ffmpeg: do not call exit from exit_program()

This should fix  Ticket2116

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 127ff88639)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Changelog

@@ -2,6 +2,9 @@ Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.
 
 version <next>:
+- Fix a crash on windows platforms related to automatic stack alignment
+  in libavresample
+- Fix memleaks in the ogg demuxer. Related to CVE-2012-2882
 
 
 version 1.1:
@@ -60,7 +63,9 @@ version 1.1:
 - support building on the Plan 9 operating system
 - kerndeint filter ported from MPlayer
 - histeq filter ported from VirtualDub
+- Megalux Frame demuxer
 - 012v decoder
+- Improved AVC Intra decoding support
 
 
 version 1.0:
@@ -349,7 +354,6 @@ easier to use. The changes are:
 - Simple segmenting muxer
 - Indeo 4 decoder
 - SMJPEG demuxer
-- Megalux Frame demuxer
 
 
 version 0.8:

RELEASE

@@ -1 +1 @@
-1.1.git
+1.1.2

VERSION

@@ -0,0 +1 @@
+1.1.2

configure

@@ -789,8 +789,8 @@ check_ld(){
     log check_ld "$@"
     type=$1
     shift 1
-    flags=$(filter_out '-l*' $@)
-    libs=$(filter '-l*' $@)
+    flags=$(filter_out '-l*|*.so' $@)
+    libs=$(filter '-l*|*.so' $@)
     check_$type $($cflags_filter $flags) || return
     flags=$($ldflags_filter $flags)
     libs=$($ldflags_filter $libs)
@@ -1343,6 +1343,8 @@ HAVE_LIST="
     asm_types_h
     attribute_may_alias
     attribute_packed
+    cdio_paranoia_h
+    cdio_paranoia_paranoia_h
     clock_gettime
     closesocket
     cmov
@@ -3076,7 +3078,7 @@ check_64bit(){
 }
 
 case "$arch" in
-    alpha|ia64)
+    aarch64|alpha|ia64)
         spic=$shared
     ;;
     mips)
@@ -3817,7 +3819,6 @@ enabled libiec61883 && require libiec61883 libiec61883/iec61883.h iec61883_cmp_c
 enabled libaacplus && require  "libaacplus >= 2.0.0" aacplus.h aacplusEncOpen -laacplus
 enabled libass     && require_pkg_config libass ass/ass.h ass_library_init
 enabled libbluray  && require libbluray libbluray/bluray.h bd_open -lbluray
-enabled libcdio    && require2 libcdio "cdio/cdda.h cdio/paranoia.h" cdio_cddap_open -lcdio_paranoia -lcdio_cdda -lcdio
 enabled libcelt    && require libcelt celt/celt.h celt_decode -lcelt0 &&
                       { check_lib celt/celt.h celt_decoder_create_custom -lcelt0 ||
                         die "ERROR: libcelt must be installed and version must be >= 0.11.0."; }
@@ -3916,7 +3917,7 @@ rsync --help 2> /dev/null | grep -q 'contimeout' && enable rsync_contimeout || d
 check_header linux/fb.h
 check_header linux/videodev.h
 check_header linux/videodev2.h
-check_struct linux/videodev2.h "struct v4l2_frmivalenum" discrete
+check_code cc linux/videodev2.h "struct v4l2_frmsizeenum vfse; vfse.discrete.width = 0;" && enable_safe struct_v4l2_frmivalenum_discrete
 
 check_header sys/videoio.h
 
@@ -3954,6 +3955,9 @@ enabled jack_indev && check_lib2 jack/jack.h jack_client_open -ljack && check_fu
 
 enabled_any sndio_indev sndio_outdev && check_lib2 sndio.h sio_open -lsndio
 
+if enabled libcdio; then
+    check_lib2 "cdio/cdda.h cdio/paranoia.h" cdio_cddap_open -lcdio_paranoia -lcdio_cdda -lcdio || check_lib2 "cdio/paranoia/cdda.h cdio/paranoia/paranoia.h" cdio_cddap_open -lcdio_paranoia -lcdio_cdda -lcdio
+fi
 
 enabled x11grab                                           &&
 require X11 X11/Xlib.h XOpenDisplay -lX11                 &&

doc/APIchanges

@@ -132,30 +132,30 @@ API changes, most recent first:
 2012-03-26 - a67d9cf - lavfi 2.66.100
   Add avfilter_fill_frame_from_{audio_,}buffer_ref() functions.
 
-2012-xx-xx - xxxxxxx - lavu 52.2.1 - avstring.h
+2012-12-29 - d8fd06c - lavu 52.3.0 - avstring.h
   Add av_basename() and av_dirname().
 
-2012-11-10 - 5980f5dd - lavu 52.2.0 - audioconvert.h
+2012-11-11 - 5980f5d - lavu 52.2.0 - audioconvert.h
   Rename audioconvert.h to channel_layout.h. audioconvert.h is now deprecated.
 
-2012-10-26 - dfde8a34 - lavu 52.1.0 - intmath.h
-  Add av_ctz() for trailing zero bit count.
+2012-11-05 - dfde8a3 - lavu 52.1.0 - intmath.h
+  Add av_ctz() for trailing zero bit count
 
-2012-10-18 - a893655b - lavu 51.45.0 - error.h
-  Add AVERROR_EXPERIMENTAL.
+2012-10-21 - a893655 - lavu 51.45.0 - error.h
+  Add AVERROR_EXPERIMENTAL
 
-2012-10-12 - d2fcb356 - lavu 51.44.0 - pixdesc.h
+2012-10-12 - d2fcb35 - lavu 51.44.0 - pixdesc.h
   Add functions for accessing pixel format descriptors.
   Accessing the av_pix_fmt_descriptors array directly is now
   deprecated.
 
-2012-10-11 - 9a92aea2 - lavu 51.43.0 - aes.h, md5.h, sha.h, tree.h
+2012-10-11 - 9a92aea - lavu 51.43.0 - aes.h, md5.h, sha.h, tree.h
   Add functions for allocating the opaque contexts for the algorithms,
 
-2012-10-10 - b522000e - lavf 54.18.0 - avio.h
+2012-10-10 - b522000 - lavf 54.18.0 - avio.h
   Add avio_closep to complement avio_close.
 
-2012-10-06 - 78071a14 - lavu 51.42.0 - pixfmt.h
+2012-10-08 - 78071a1 - lavu 51.42.0 - pixfmt.h
   Rename PixelFormat to AVPixelFormat and all PIX_FMT_* to AV_PIX_FMT_*.
   To provide backwards compatibility, PixelFormat is now #defined as
   AVPixelFormat.

doc/Doxyfile

@@ -31,7 +31,7 @@ PROJECT_NAME           = FFmpeg
 # This could be handy for archiving the generated documentation or
 # if some version control system is used.
 
-PROJECT_NUMBER         =
+PROJECT_NUMBER         = 1.1.2
 
 # With the PROJECT_LOGO tag one can specify an logo or icon that is included
 # in the documentation. The maximum height of the logo should not exceed 55

doc/RELEASE_NOTES

@@ -1,7 +1,7 @@
 Release Notes
 =============
 
-* 0.10 "Freedom"  January, 2012
+* 1.1 "Fire Flower"  January, 2013
 
 
 General notes
@@ -20,3 +20,6 @@ compiler. Since MSVC does not support C99 features used extensively by FFmpeg,
 this has been accomplished using a converter that turns C99 code to C89. See the
 platform-specific documentation for more detailed documentation on building
 FFmpeg with MSVC.
+
+The used output sample format for several audio decoders has changed, make
+sure you always check/use AVCodecContext.sample_fmt or AVFrame.format.

doc/examples/demuxing.c

@@ -314,7 +314,7 @@ int main (int argc, char **argv)
     if (audio_stream) {
         const char *fmt;
 
-        if ((ret = get_format_from_sample_fmt(&fmt, audio_dec_ctx->sample_fmt) < 0))
+        if ((ret = get_format_from_sample_fmt(&fmt, audio_dec_ctx->sample_fmt)) < 0)
             goto end;
         printf("Play the output audio file with the command:\n"
                "ffplay -f %s -ac %d -ar %d %s\n",

doc/examples/resampling_audio.c

@@ -200,7 +200,7 @@ int main(int argc, char **argv)
         fwrite(dst_data[0], 1, dst_bufsize, dst_file);
     } while (t < 10);
 
-    if ((ret = get_format_from_sample_fmt(&fmt, dst_sample_fmt) < 0))
+    if ((ret = get_format_from_sample_fmt(&fmt, dst_sample_fmt)) < 0)
         goto end;
     fprintf(stderr, "Resampling succeeded. Play the output file with the command:\n"
             "ffplay -f %s -channel_layout %"PRId64" -channels %d -ar %d %s\n",

doc/muxers.texi

@@ -711,10 +711,11 @@ Write an mp3 with an ID3v2.3 header and an ID3v1 footer:
 ffmpeg -i INPUT -id3v2_version 3 -write_id3v1 1 out.mp3
 @end example
 
-Attach a picture to an mp3:
+To attach a picture to an mp3 file select both the audio and the picture stream
+with @code{map}:
 @example
-ffmpeg -i input.mp3 -i cover.png -c copy -metadata:s:v title="Album cover"
--metadata:s:v comment="Cover (Front)" out.mp3
+ffmpeg -i input.mp3 -i cover.png -c copy -map 0 -map 1
+-metadata:s:v title="Album cover" -metadata:s:v comment="Cover (Front)" out.mp3
 @end example
 
 @c man end MUXERS

doc/platform.texi

@@ -114,7 +114,7 @@ wrapper.
 You will need the following prerequisites:
 
 @itemize
-@item @uref{https://github.com/libav/c99-to-c89/, C99-to-C89 Converter & Wrapper}
+@item @uref{http://download.videolan.org/pub/contrib/c99-to-c89/, C99-to-C89 Converter & Wrapper}
 @item @uref{http://code.google.com/p/msinttypes/, msinttypes}
 @item @uref{http://www.mingw.org/, MSYS}
 @item @uref{http://yasm.tortall.net/, YASM}

ffmpeg.c

@@ -471,7 +471,6 @@ static void exit_program(void)
     if (received_sigterm) {
         av_log(NULL, AV_LOG_INFO, "Received signal %d: terminating.\n",
                (int) received_sigterm);
-        exit (255);
     }
 }
 
@@ -2100,6 +2099,12 @@ static int transcode_init(void)
                     codec->time_base.num *= icodec->ticks_per_frame;
                 }
             }
+            if (   codec->codec_tag == AV_RL32("tmcd")
+                && icodec->time_base.num < icodec->time_base.den
+                && icodec->time_base.num > 0
+                && 121LL*icodec->time_base.num > icodec->time_base.den) {
+                codec->time_base = icodec->time_base;
+            }
 
             if(ost->frame_rate.num)
                 codec->time_base = av_inv_q(ost->frame_rate);
@@ -3214,6 +3219,6 @@ int main(int argc, char **argv)
         printf("bench: utime=%0.3fs maxrss=%ikB\n", ti / 1000000.0, maxrss);
     }
 
-    exit(0);
+    exit(received_nb_signals ? 255 : 0);
     return 0;
 }

ffmpeg_opt.c

@@ -1143,8 +1143,6 @@ static OutputStream *new_video_stream(OptionsContext *o, AVFormatContext *oc, in
             if (p) p++;
         }
         video_enc->rc_override_count = i;
-        if (!video_enc->rc_initial_buffer_occupancy)
-            video_enc->rc_initial_buffer_occupancy = video_enc->rc_buffer_size * 3 / 4;
         video_enc->intra_dc_precision = intra_dc_precision - 8;
 
         if (do_psnr)
@@ -1155,9 +1153,11 @@ static OutputStream *new_video_stream(OptionsContext *o, AVFormatContext *oc, in
         if (do_pass) {
             if (do_pass & 1) {
                 video_enc->flags |= CODEC_FLAG_PASS1;
+                av_dict_set(&ost->opts, "flags", "+pass1", AV_DICT_APPEND);
             }
             if (do_pass & 2) {
                 video_enc->flags |= CODEC_FLAG_PASS2;
+                av_dict_set(&ost->opts, "flags", "+pass2", AV_DICT_APPEND);
             }
         }
 
@@ -2150,7 +2150,7 @@ static int opt_channel_layout(void *optctx, const char *opt, const char *arg)
         return AVERROR(EINVAL);
     }
     snprintf(layout_str, sizeof(layout_str), "%"PRIu64, layout);
-    ret = opt_default(NULL, opt, layout_str);
+    ret = opt_default_new(o, opt, layout_str);
     if (ret < 0)
         return ret;
 

libavcodec/012v.c

@@ -44,7 +44,7 @@ static av_cold int zero12v_decode_init(AVCodecContext *avctx)
 static int zero12v_decode_frame(AVCodecContext *avctx, void *data,
                                 int *got_frame, AVPacket *avpkt)
 {
-    int line = 0;
+    int line = 0, ret;
     const int width = avctx->width;
     AVFrame *pic = avctx->coded_frame;
     uint16_t *y, *u, *v;
@@ -65,8 +65,8 @@ static int zero12v_decode_frame(AVCodecContext *avctx, void *data,
     }
 
     pic->reference = 0;
-    if (ff_get_buffer(avctx, pic) < 0)
-        return AVERROR_INVALIDDATA;;
+    if ((ret = ff_get_buffer(avctx, pic)) < 0)
+        return ret;
 
     y = (uint16_t *)pic->data[0];
     u = (uint16_t *)pic->data[1];

libavcodec/aacdec.c

@@ -914,6 +914,11 @@ static av_cold int aac_decode_init(AVCodecContext *avctx)
         }
     }
 
+    if (avctx->channels > MAX_CHANNELS) {
+        av_log(avctx, AV_LOG_ERROR, "Too many channels\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     AAC_INIT_VLC_STATIC( 0, 304);
     AAC_INIT_VLC_STATIC( 1, 270);
     AAC_INIT_VLC_STATIC( 2, 550);

libavcodec/aacenc.c

@@ -517,7 +517,7 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
 
     /* add current frame to queue */
     if (frame) {
-        if ((ret = ff_af_queue_add(&s->afq, frame) < 0))
+        if ((ret = ff_af_queue_add(&s->afq, frame)) < 0)
             return ret;
     }
 

libavcodec/aasc.c

@@ -60,7 +60,7 @@ static av_cold int aasc_decode_init(AVCodecContext *avctx)
         }
         break;
     case 16:
-        avctx->pix_fmt = AV_PIX_FMT_RGB555;
+        avctx->pix_fmt = AV_PIX_FMT_RGB555LE;
         break;
     case 24:
         avctx->pix_fmt = AV_PIX_FMT_BGR24;

libavcodec/arm/videodsp_armv5te.S

@@ -22,7 +22,6 @@
 #include "config.h"
 #include "libavutil/arm/asm.S"
 
-#if HAVE_ARMV5TE_EXTERNAL
 function ff_prefetch_arm, export=1
         subs            r2,  r2,  #1
         pld             [r0]
@@ -30,4 +29,3 @@ function ff_prefetch_arm, export=1
         bne             ff_prefetch_arm
         bx              lr
 endfunc
-#endif

libavcodec/arm/videodsp_init_armv5te.c

@@ -19,7 +19,7 @@
  */
 
 #include "libavutil/arm/cpu.h"
-#include <libavcodec/videodsp.h>
+#include "libavcodec/videodsp.h"
 #include "videodsp_arm.h"
 
 void ff_prefetch_arm(uint8_t *mem, ptrdiff_t stride, int h);

libavcodec/arm/vp8dsp_armv6.S

@@ -124,14 +124,14 @@ function ff_vp8_luma_dc_wht_armv6, export=1
         sbfx            r1,  r9,  #3,  #13
         sbfx            r10, r4,  #3,  #13
 #else
-        sxth            r8,  r8
-        sxth            r7,  r7
-        sxth            r9,  r9
-        sxth            r4,  r4
-        asr             r8,  #3                 @ block[0][0]
-        asr             r7,  #3                 @ block[0][1]
-        asr             r9,  #3                 @ block[0][2]
-        asr             r4,  #3                 @ block[0][3]
+        sxth            r6,  r8
+        sxth            r12, r7
+        sxth            r1,  r9
+        sxth            r10, r4
+        asr             r6,  #3                 @ block[0][0]
+        asr             r12, #3                 @ block[0][1]
+        asr             r1,  #3                 @ block[0][2]
+        asr             r10, #3                 @ block[0][3]
 #endif
 
         strh            r6,  [r0], #32

libavcodec/atrac3.c

@@ -518,7 +518,7 @@ static int add_tonal_components(float *spectrum, int num_components,
         output   = &spectrum[components[i].pos];
 
         for (j = 0; j < components[i].num_coefs; j++)
-            output[i] += input[i];
+            output[j] += input[j];
     }
 
     return last_pos;

libavcodec/dirac.c

@@ -237,7 +237,7 @@ static int parse_source_parameters(AVCodecContext *avctx, GetBitContext *gb,
 
     avctx->pix_fmt = dirac_pix_fmt[!luma_offset][source->chroma_format];
     avcodec_get_chroma_sub_sample(avctx->pix_fmt, &chroma_x_shift, &chroma_y_shift);
-    if (!(source->width % (1<<chroma_x_shift)) || !(source->height % (1<<chroma_y_shift))) {
+    if ((source->width % (1<<chroma_x_shift)) || (source->height % (1<<chroma_y_shift))) {
         av_log(avctx, AV_LOG_ERROR, "Dimensions must be a integer multiply of the chroma subsampling\n");
         return AVERROR_INVALIDDATA;
     }

libavcodec/error_resilience.c

@@ -924,6 +924,12 @@ void ff_er_frame_end(MpegEncContext *s)
         return;
     };
 
+    if (   s->picture_structure == PICT_FRAME
+        && s->current_picture.f.linesize[0] != s->current_picture_ptr->f.linesize[0]) {
+        av_log(s->avctx, AV_LOG_ERROR, "Error concealment not possible, frame not fully initialized\n");
+        return;
+    }
+
     if (s->current_picture.f.motion_val[0] == NULL) {
         av_log(s->avctx, AV_LOG_ERROR, "Warning MVs not available\n");
 

libavcodec/get_bits.h

@@ -366,25 +366,49 @@ static inline int check_marker(GetBitContext *s, const char *msg)
 }
 
 /**
- * Inititalize GetBitContext.
- * @param buffer bitstream buffer, must be FF_INPUT_BUFFER_PADDING_SIZE bytes larger than the actual read bits
- * because some optimized bitstream readers read 32 or 64 bit at once and could read over the end
+ * Initialize GetBitContext.
+ * @param buffer bitstream buffer, must be FF_INPUT_BUFFER_PADDING_SIZE bytes
+ *        larger than the actual read bits because some optimized bitstream
+ *        readers read 32 or 64 bit at once and could read over the end
  * @param bit_size the size of the buffer in bits
+ * @return 0 on success, AVERROR_INVALIDDATA if the buffer_size would overflow.
  */
-static inline void init_get_bits(GetBitContext *s, const uint8_t *buffer,
-                                 int bit_size)
+static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,
+                                int bit_size)
 {
-    int buffer_size = (bit_size+7)>>3;
-    if (buffer_size < 0 || bit_size < 0) {
+    int buffer_size;
+    int ret = 0;
+
+    if (bit_size >= INT_MAX - 7 || bit_size < 0 || !buffer) {
         buffer_size = bit_size = 0;
         buffer = NULL;
+        ret = AVERROR_INVALIDDATA;
     }
 
+    buffer_size = (bit_size + 7) >> 3;
+
     s->buffer       = buffer;
     s->size_in_bits = bit_size;
     s->size_in_bits_plus8 = bit_size + 8;
     s->buffer_end   = buffer + buffer_size;
     s->index        = 0;
+    return ret;
+}
+
+/**
+ * Initialize GetBitContext.
+ * @param buffer bitstream buffer, must be FF_INPUT_BUFFER_PADDING_SIZE bytes
+ *        larger than the actual read bits because some optimized bitstream
+ *        readers read 32 or 64 bit at once and could read over the end
+ * @param byte_size the size of the buffer in bytes
+ * @return 0 on success, AVERROR_INVALIDDATA if the buffer_size would overflow.
+ */
+static inline int init_get_bits8(GetBitContext *s, const uint8_t *buffer,
+                                 int byte_size)
+{
+    if (byte_size > INT_MAX / 8 || byte_size < 0)
+        byte_size = -1;
+    return init_get_bits(s, buffer, byte_size * 8);
 }
 
 static inline void align_get_bits(GetBitContext *s)

libavcodec/gifdec.c

@@ -118,7 +118,7 @@ static void gif_copy_img_rect(const uint32_t *src, uint32_t *dst,
     const uint32_t *src_px, *src_pr,
                    *src_py = src + y_start,
                    *dst_py = dst + y_start;
-    const uint32_t *src_pb = src_py + t * linesize;
+    const uint32_t *src_pb = src_py + h * linesize;
     uint32_t *dst_px;
 
     for (; src_py < src_pb; src_py += linesize, dst_py += linesize) {

libavcodec/h264.c

@@ -309,10 +309,11 @@ static inline int get_lowest_part_list_y(H264Context *h, Picture *pic, int n,
                                          int height, int y_offset, int list)
 {
     int raw_my        = h->mv_cache[list][scan8[n]][1];
-    int filter_height = (raw_my & 3) ? 2 : 0;
+    int filter_height_up   = (raw_my & 3) ? 2 : 0;
+    int filter_height_down = (raw_my & 3) ? 3 : 0;
     int full_my       = (raw_my >> 2) + y_offset;
-    int top           = full_my - filter_height;
-    int bottom        = full_my + filter_height + height;
+    int top           = full_my - filter_height_up;
+    int bottom        = full_my + filter_height_down + height;
 
     return FFMAX(abs(top), bottom);
 }
@@ -2350,7 +2351,7 @@ static int field_end(H264Context *h, int in_setup)
      * past end by one (callers fault) and resync_mb_y != 0
      * causes problems for the first MB line, too.
      */
-    if (!FIELD_PICTURE)
+    if (!FIELD_PICTURE && h->current_slice && !h->sps.new)
         ff_er_frame_end(s);
 
     ff_MPV_frame_end(s);
@@ -2589,7 +2590,7 @@ static int h264_slice_header_init(H264Context *h, int reinit)
             return ret;
         }
     } else {
-        if ((ret = ff_MPV_common_init(s) < 0)) {
+        if ((ret = ff_MPV_common_init(s)) < 0) {
             av_log(h->s.avctx, AV_LOG_ERROR, "ff_MPV_common_init() failed.\n");
             return ret;
         }
@@ -2764,7 +2765,8 @@ static int decode_slice_header(H264Context *h, H264Context *h0)
                      || s->avctx->bits_per_raw_sample != h->sps.bit_depth_luma
                      || h->cur_chroma_format_idc != h->sps.chroma_format_idc
                      || av_cmp_q(h->sps.sar, s->avctx->sample_aspect_ratio)));
-
+    if (h0->s.avctx->pix_fmt != get_pixel_format(h0))
+        must_reinit = 1;
 
     s->mb_width  = h->sps.mb_width;
     s->mb_height = h->sps.mb_height * (2 - h->sps.frame_mbs_only_flag);
@@ -2973,7 +2975,9 @@ static int decode_slice_header(H264Context *h, H264Context *h0)
             s->current_picture_ptr->frame_num = h->prev_frame_num;
             ff_thread_report_progress(&s->current_picture_ptr->f, INT_MAX, 0);
             ff_thread_report_progress(&s->current_picture_ptr->f, INT_MAX, 1);
-            ff_generate_sliding_window_mmcos(h);
+            if ((ret = ff_generate_sliding_window_mmcos(h, 1)) < 0 &&
+                s->avctx->err_recognition & AV_EF_EXPLODE)
+                return ret;
             if (ff_h264_execute_ref_pic_marking(h, h->mmco, h->mmco_index) < 0 &&
                 (s->avctx->err_recognition & AV_EF_EXPLODE))
                 return AVERROR_INVALIDDATA;
@@ -3152,7 +3156,15 @@ static int decode_slice_header(H264Context *h, H264Context *h0)
         }
     }
 
-    if (h->nal_ref_idc && ff_h264_decode_ref_pic_marking(h0, &s->gb) < 0 &&
+    // If frame-mt is enabled, only update mmco tables for the first slice
+    // in a field. Subsequent slices can temporarily clobber h->mmco_index
+    // or h->mmco, which will cause ref list mix-ups and decoding errors
+    // further down the line. This may break decoding if the first slice is
+    // corrupt, thus we only do this if frame-mt is enabled.
+    if (h->nal_ref_idc &&
+        ff_h264_decode_ref_pic_marking(h0, &s->gb,
+                            !(s->avctx->active_thread_type & FF_THREAD_FRAME) ||
+                            h0->current_slice == 0) < 0 &&
         (s->avctx->err_recognition & AV_EF_EXPLODE))
         return AVERROR_INVALIDDATA;
 

libavcodec/h264.h

@@ -669,9 +669,10 @@ void ff_h264_remove_all_refs(H264Context *h);
  */
 int ff_h264_execute_ref_pic_marking(H264Context *h, MMCO *mmco, int mmco_count);
 
-int ff_h264_decode_ref_pic_marking(H264Context *h, GetBitContext *gb);
+int ff_h264_decode_ref_pic_marking(H264Context *h, GetBitContext *gb,
+                                   int first_slice);
 
-void ff_generate_sliding_window_mmcos(H264Context *h);
+int ff_generate_sliding_window_mmcos(H264Context *h, int first_slice);
 
 /**
  * Check if the top & left blocks are available if needed & change the

libavcodec/h264_refs.c

@@ -480,22 +480,50 @@ static void print_long_term(H264Context *h) {
     }
 }
 
-void ff_generate_sliding_window_mmcos(H264Context *h) {
-    MpegEncContext * const s = &h->s;
+static int check_opcodes(MMCO *mmco1, MMCO *mmco2, int n_mmcos)
+{
+    int i;
 
-    h->mmco_index= 0;
-    if(h->short_ref_count && h->long_ref_count + h->short_ref_count >= h->sps.ref_frame_count &&
-            !(FIELD_PICTURE && !s->first_field && s->current_picture_ptr->f.reference)) {
-        h->mmco[0].opcode= MMCO_SHORT2UNUSED;
-        h->mmco[0].short_pic_num= h->short_ref[ h->short_ref_count - 1 ]->frame_num;
-        h->mmco_index= 1;
+    for (i = 0; i < n_mmcos; i++) {
+        if (mmco1[i].opcode != mmco2[i].opcode)
+            return -1;
+    }
+
+    return 0;
+}
+
+int ff_generate_sliding_window_mmcos(H264Context *h, int first_slice)
+{
+    MpegEncContext * const s = &h->s;
+    MMCO mmco_temp[MAX_MMCO_COUNT], *mmco = first_slice ? h->mmco : mmco_temp;
+    int mmco_index = 0, i;
+
+    if (h->short_ref_count &&
+        h->long_ref_count + h->short_ref_count >= h->sps.ref_frame_count &&
+        !(FIELD_PICTURE && !s->first_field &&
+          s->current_picture_ptr->f.reference)) {
+        mmco[0].opcode = MMCO_SHORT2UNUSED;
+        mmco[0].short_pic_num = h->short_ref[h->short_ref_count - 1]->frame_num;
+        mmco_index = 1;
         if (FIELD_PICTURE) {
-            h->mmco[0].short_pic_num *= 2;
-            h->mmco[1].opcode= MMCO_SHORT2UNUSED;
-            h->mmco[1].short_pic_num= h->mmco[0].short_pic_num + 1;
-            h->mmco_index= 2;
+            mmco[0].short_pic_num *= 2;
+            mmco[1].opcode = MMCO_SHORT2UNUSED;
+            mmco[1].short_pic_num = mmco[0].short_pic_num + 1;
+            mmco_index = 2;
         }
     }
+
+    if (first_slice) {
+        h->mmco_index = mmco_index;
+    } else if (!first_slice && mmco_index >= 0 &&
+               (mmco_index != h->mmco_index ||
+                (i = check_opcodes(h->mmco, mmco_temp, mmco_index)))) {
+        av_log(h->s.avctx, AV_LOG_ERROR,
+               "Inconsistent MMCO state between slices [%d, %d, %d]\n",
+               mmco_index, h->mmco_index, i);
+        return AVERROR_INVALIDDATA;
+    }
+    return 0;
 }
 
 int ff_h264_execute_ref_pic_marking(H264Context *h, MMCO *mmco, int mmco_count){
@@ -665,52 +693,86 @@ int ff_h264_execute_ref_pic_marking(H264Context *h, MMCO *mmco, int mmco_count){
     return (h->s.avctx->err_recognition & AV_EF_EXPLODE) ? err : 0;
 }
 
-int ff_h264_decode_ref_pic_marking(H264Context *h, GetBitContext *gb){
+int ff_h264_decode_ref_pic_marking(H264Context *h, GetBitContext *gb,
+                                   int first_slice)
+{
     MpegEncContext * const s = &h->s;
-    int i;
+    int i, ret;
+    MMCO mmco_temp[MAX_MMCO_COUNT], *mmco = first_slice ? h->mmco : mmco_temp;
+    int mmco_index = 0;
 
-    h->mmco_index= 0;
-    if(h->nal_unit_type == NAL_IDR_SLICE){ //FIXME fields
-        s->broken_link= get_bits1(gb) -1;
-        if(get_bits1(gb)){
-            h->mmco[0].opcode= MMCO_LONG;
-            h->mmco[0].long_arg= 0;
-            h->mmco_index= 1;
+    if (h->nal_unit_type == NAL_IDR_SLICE){ // FIXME fields
+        s->broken_link = get_bits1(gb) - 1;
+        if (get_bits1(gb)){
+            mmco[0].opcode = MMCO_LONG;
+            mmco[0].long_arg = 0;
+            mmco_index = 1;
         }
-    }else{
-        if(get_bits1(gb)){ // adaptive_ref_pic_marking_mode_flag
-            for(i= 0; i<MAX_MMCO_COUNT; i++) {
-                MMCOOpcode opcode= get_ue_golomb_31(gb);
+    } else {
+        if (get_bits1(gb)) { // adaptive_ref_pic_marking_mode_flag
+            for (i = 0; i < MAX_MMCO_COUNT; i++) {
+                MMCOOpcode opcode = get_ue_golomb_31(gb);
 
-                h->mmco[i].opcode= opcode;
-                if(opcode==MMCO_SHORT2UNUSED || opcode==MMCO_SHORT2LONG){
-                    h->mmco[i].short_pic_num= (h->curr_pic_num - get_ue_golomb(gb) - 1) & (h->max_pic_num - 1);
-/*                    if(h->mmco[i].short_pic_num >= h->short_ref_count || h->short_ref[ h->mmco[i].short_pic_num ] == NULL){
-                        av_log(s->avctx, AV_LOG_ERROR, "illegal short ref in memory management control operation %d\n", mmco);
-                        return -1;
-                    }*/
-                }
-                if(opcode==MMCO_SHORT2LONG || opcode==MMCO_LONG2UNUSED || opcode==MMCO_LONG || opcode==MMCO_SET_MAX_LONG){
-                    unsigned int long_arg= get_ue_golomb_31(gb);
-                    if(long_arg >= 32 || (long_arg >= 16 && !(opcode == MMCO_SET_MAX_LONG && long_arg == 16) && !(opcode == MMCO_LONG2UNUSED && FIELD_PICTURE))){
-                        av_log(h->s.avctx, AV_LOG_ERROR, "illegal long ref in memory management control operation %d\n", opcode);
+                mmco[i].opcode = opcode;
+                if (opcode == MMCO_SHORT2UNUSED || opcode == MMCO_SHORT2LONG){
+                    mmco[i].short_pic_num =
+                        (h->curr_pic_num - get_ue_golomb(gb) - 1) &
+                            (h->max_pic_num - 1);
+#if 0
+                    if (mmco[i].short_pic_num >= h->short_ref_count ||
+                        h->short_ref[ mmco[i].short_pic_num ] == NULL){
+                        av_log(s->avctx, AV_LOG_ERROR,
+                               "illegal short ref in memory management control "
+                               "operation %d\n", mmco);
                         return -1;
                     }
-                    h->mmco[i].long_arg= long_arg;
+#endif
+                }
+                if (opcode == MMCO_SHORT2LONG || opcode == MMCO_LONG2UNUSED ||
+                    opcode == MMCO_LONG || opcode == MMCO_SET_MAX_LONG) {
+                    unsigned int long_arg = get_ue_golomb_31(gb);
+                    if (long_arg >= 32 ||
+                        (long_arg >= 16 && !(opcode == MMCO_SET_MAX_LONG &&
+                                             long_arg == 16) &&
+                         !(opcode == MMCO_LONG2UNUSED && FIELD_PICTURE))){
+                        av_log(h->s.avctx, AV_LOG_ERROR,
+                               "illegal long ref in memory management control "
+                               "operation %d\n", opcode);
+                        return -1;
+                    }
+                    mmco[i].long_arg = long_arg;
                 }
 
-                if(opcode > (unsigned)MMCO_LONG){
-                    av_log(h->s.avctx, AV_LOG_ERROR, "illegal memory management control operation %d\n", opcode);
+                if (opcode > (unsigned) MMCO_LONG){
+                    av_log(h->s.avctx, AV_LOG_ERROR,
+                           "illegal memory management control operation %d\n",
+                           opcode);
                     return -1;
                 }
-                if(opcode == MMCO_END)
+                if (opcode == MMCO_END)
                     break;
             }
-            h->mmco_index= i;
-        }else{
-            ff_generate_sliding_window_mmcos(h);
+            mmco_index = i;
+        } else {
+            if (first_slice) {
+                ret = ff_generate_sliding_window_mmcos(h, first_slice);
+                if (ret < 0 && s->avctx->err_recognition & AV_EF_EXPLODE)
+                    return ret;
+            }
+            mmco_index = -1;
         }
     }
 
+    if (first_slice && mmco_index != -1) {
+        h->mmco_index = mmco_index;
+    } else if (!first_slice && mmco_index >= 0 &&
+               (mmco_index != h->mmco_index ||
+                (i = check_opcodes(h->mmco, mmco_temp, mmco_index)))) {
+        av_log(h->s.avctx, AV_LOG_ERROR,
+               "Inconsistent MMCO state between slices [%d, %d, %d]\n",
+               mmco_index, h->mmco_index, i);
+        return AVERROR_INVALIDDATA;
+    }
+
     return 0;
 }

libavcodec/huffyuvdec.c

@@ -118,12 +118,13 @@ static void generate_joint_tables(HYuvContext *s)
             for (i = y = 0; y < 256; y++) {
                 int len0 = s->len[0][y];
                 int limit = VLC_BITS - len0;
-                if(limit <= 0)
+                if(limit <= 0 || !len0)
                     continue;
                 for (u = 0; u < 256; u++) {
                     int len1 = s->len[p][u];
-                    if (len1 > limit)
+                    if (len1 > limit || !len1)
                         continue;
+                    av_assert0(i < (1 << VLC_BITS));
                     len[i] = len0 + len1;
                     bits[i] = (s->bits[0][y] << len1) + s->bits[p][u];
                     symbols[i] = (y << 8) + u;
@@ -146,18 +147,19 @@ static void generate_joint_tables(HYuvContext *s)
         for (i = 0, g = -16; g < 16; g++) {
             int len0 = s->len[p0][g & 255];
             int limit0 = VLC_BITS - len0;
-            if (limit0 < 2)
+            if (limit0 < 2 || !len0)
                 continue;
             for (b = -16; b < 16; b++) {
                 int len1 = s->len[p1][b & 255];
                 int limit1 = limit0 - len1;
-                if (limit1 < 1)
+                if (limit1 < 1 || !len1)
                     continue;
                 code = (s->bits[p0][g & 255] << len1) + s->bits[p1][b & 255];
                 for (r = -16; r < 16; r++) {
                     int len2 = s->len[2][r & 255];
-                    if (len2 > limit1)
+                    if (len2 > limit1 || !len2)
                         continue;
+                    av_assert0(i < (1 << VLC_BITS));
                     len[i] = len0 + len1 + len2;
                     bits[i] = (code << len2) + s->bits[2][r & 255];
                     if (s->decorrelate) {
@@ -182,6 +184,7 @@ static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length)
 {
     GetBitContext gb;
     int i;
+    int ret;
 
     init_get_bits(&gb, src, length * 8);
 
@@ -192,8 +195,9 @@ static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length)
             return -1;
         }
         ff_free_vlc(&s->vlc[i]);
-        init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1,
-                 s->bits[i], 4, 4, 0);
+        if ((ret = init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1,
+                           s->bits[i], 4, 4, 0)) < 0)
+            return ret;
     }
 
     generate_joint_tables(s);
@@ -205,6 +209,7 @@ static int read_old_huffman_tables(HYuvContext *s)
 {
     GetBitContext gb;
     int i;
+    int ret;
 
     init_get_bits(&gb, classic_shift_luma,
                   classic_shift_luma_table_size * 8);
@@ -228,8 +233,9 @@ static int read_old_huffman_tables(HYuvContext *s)
 
     for (i = 0; i < 3; i++) {
         ff_free_vlc(&s->vlc[i]);
-        init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1,
-                 s->bits[i], 4, 4, 0);
+        if ((ret = init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1,
+                            s->bits[i], 4, 4, 0)) < 0)
+            return ret;
     }
 
     generate_joint_tables(s);

libavcodec/iff.c

@@ -341,7 +341,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
             avctx->pix_fmt = AV_PIX_FMT_RGB444;
         } else if (avctx->codec_tag != MKTAG('D','E','E','P')) {
             if (avctx->bits_per_coded_sample == 24) {
-                avctx->pix_fmt = AV_PIX_FMT_RGB0;
+                avctx->pix_fmt = AV_PIX_FMT_0BGR32;
             } else if (avctx->bits_per_coded_sample == 32) {
                 avctx->pix_fmt = AV_PIX_FMT_BGR32;
             } else {

libavcodec/kbdwin.c

@@ -16,9 +16,8 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
-
-#include <libavutil/avassert.h>
-#include <libavutil/mathematics.h>
+#include "libavutil/avassert.h"
+#include "libavutil/mathematics.h"
 #include "libavutil/attributes.h"
 #include "kbdwin.h"
 

libavcodec/libfaac.c

@@ -199,7 +199,7 @@ static int Faac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
 
     /* add current frame to the queue */
     if (frame) {
-        if ((ret = ff_af_queue_add(&s->afq, frame) < 0))
+        if ((ret = ff_af_queue_add(&s->afq, frame)) < 0)
             return ret;
     }
 

libavcodec/libfdk-aacenc.c

@@ -334,7 +334,7 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
         in_buf.bufElSizes        = &in_buffer_element_size;
 
         /* add current frame to the queue */
-        if ((ret = ff_af_queue_add(&s->afq, frame) < 0))
+        if ((ret = ff_af_queue_add(&s->afq, frame)) < 0)
             return ret;
     }
 

libavcodec/libmp3lame.c

@@ -237,7 +237,7 @@ static int mp3lame_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
 
     /* add current frame to the queue */
     if (frame) {
-        if ((ret = ff_af_queue_add(&s->afq, frame) < 0))
+        if ((ret = ff_af_queue_add(&s->afq, frame)) < 0)
             return ret;
     }
 

libavcodec/libopencore-amr.c

@@ -261,7 +261,7 @@ static int amr_nb_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
             if (frame->nb_samples < avctx->frame_size - avctx->delay)
                 s->enc_last_frame = -1;
         }
-        if ((ret = ff_af_queue_add(&s->afq, frame) < 0)) {
+        if ((ret = ff_af_queue_add(&s->afq, frame)) < 0) {
             av_freep(&flush_buf);
             return ret;
         }

libavcodec/libspeexenc.c

@@ -288,7 +288,7 @@ static int encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
             speex_encode_stereo_int(samples, s->header.frame_size, &s->bits);
         speex_encode_int(s->enc_state, samples, &s->bits);
         s->pkt_frame_count++;
-        if ((ret = ff_af_queue_add(&s->afq, frame) < 0))
+        if ((ret = ff_af_queue_add(&s->afq, frame)) < 0)
             return ret;
     } else {
         /* handle end-of-stream */

libavcodec/libvo-aacenc.c

@@ -157,7 +157,7 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
             samples = (VO_PBYTE)frame->data[0];
         }
         /* add current frame to the queue */
-        if ((ret = ff_af_queue_add(&s->afq, frame) < 0))
+        if ((ret = ff_af_queue_add(&s->afq, frame)) < 0)
             return ret;
     }
 

libavcodec/libvorbisenc.c

@@ -305,7 +305,7 @@ static int oggvorbis_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
             av_log(avctx, AV_LOG_ERROR, "error in vorbis_analysis_wrote()\n");
             return vorbis_error_to_averror(ret);
         }
-        if ((ret = ff_af_queue_add(&s->afq, frame) < 0))
+        if ((ret = ff_af_queue_add(&s->afq, frame)) < 0)
             return ret;
     } else {
         if (!s->eof)

libavcodec/libx264.c

@@ -335,7 +335,7 @@ static av_cold int X264_init(AVCodecContext *avctx)
             x4->params.rc.f_rf_constant_max = x4->crf_max;
     }
 
-    if (avctx->rc_buffer_size && avctx->rc_initial_buffer_occupancy &&
+    if (avctx->rc_buffer_size && avctx->rc_initial_buffer_occupancy > 0 &&
         (avctx->rc_initial_buffer_occupancy <= avctx->rc_buffer_size)) {
         x4->params.rc.f_vbv_buffer_init =
             (float)avctx->rc_initial_buffer_occupancy / avctx->rc_buffer_size;
@@ -695,6 +695,7 @@ static const AVCodecDefault x264_defaults[] = {
     { "threads",          AV_STRINGIFY(X264_THREADS_AUTO) },
     { "thread_type",      "0" },
     { "flags",            "+cgop" },
+    { "rc_init_occupancy","-1" },
     { NULL },
 };
 

libavcodec/ljpegenc.c

@@ -57,6 +57,13 @@ static int encode_picture_lossless(AVCodecContext *avctx, AVPacket *pkt,
         max_pkt_size += mb_width * mb_height * 3 * 4
                         * s->mjpeg_hsample[0] * s->mjpeg_vsample[0];
     }
+
+    if (!s->edge_emu_buffer &&
+        (ret = ff_mpv_frame_size_alloc(s, pict->linesize[0])) < 0) {
+        av_log(avctx, AV_LOG_ERROR, "failed to allocate context scratch buffers.\n");
+        return ret;
+    }
+
     if ((ret = ff_alloc_packet2(avctx, pkt, max_pkt_size)) < 0)
         return ret;
 

libavcodec/movtextenc.c

@@ -21,6 +21,7 @@
 
 #include <stdarg.h>
 #include "avcodec.h"
+#include "libavutil/avassert.h"
 #include "libavutil/avstring.h"
 #include "libavutil/intreadwrite.h"
 #include "ass_split.h"
@@ -87,15 +88,18 @@ static av_cold int mov_text_encode_init(AVCodecContext *avctx)
 static void mov_text_text_cb(void *priv, const char *text, int len)
 {
     MovTextContext *s = priv;
+    av_assert0(s->end >= s->ptr);
     av_strlcpy(s->ptr, text, FFMIN(s->end - s->ptr, len + 1));
-    s->ptr += len;
+    s->ptr += FFMIN(s->end - s->ptr, len);
 }
 
 static void mov_text_new_line_cb(void *priv, int forced)
 {
     MovTextContext *s = priv;
+    av_assert0(s->end >= s->ptr);
     av_strlcpy(s->ptr, "\n", FFMIN(s->end - s->ptr, 2));
-    s->ptr++;
+    if (s->end > s->ptr)
+        s->ptr++;
 }
 
 static const ASSCodesCallbacks mov_text_callbacks = {

libavcodec/mpeg12.c

@@ -2001,8 +2001,6 @@ static int mpeg1_decode_sequence(AVCodecContext *avctx,
 
     width  = get_bits(&s->gb, 12);
     height = get_bits(&s->gb, 12);
-    if (width <= 0 || height <= 0)
-        return -1;
     s->aspect_ratio_info = get_bits(&s->gb, 4);
     if (s->aspect_ratio_info == 0) {
         av_log(avctx, AV_LOG_ERROR, "aspect ratio has forbidden 0 value\n");
@@ -2312,6 +2310,11 @@ static int decode_chunks(AVCodecContext *avctx,
             break;
 
         case PICTURE_START_CODE:
+            if (s2->width <= 0 || s2->height <= 0) {
+                av_log(avctx, AV_LOG_ERROR, "%dx%d is invalid\n", s2->width, s2->height);
+                return AVERROR_INVALIDDATA;
+            }
+
             if(s->tmpgexs){
                 s2->intra_dc_precision= 3;
                 s2->intra_matrix[0]= 1;

libavcodec/mpeg12enc.c

@@ -145,6 +145,9 @@ static av_cold int encode_init(AVCodecContext *avctx)
 {
     MpegEncContext *s = avctx->priv_data;
 
+    if (avctx->codec_id == AV_CODEC_ID_MPEG1VIDEO && avctx->height > 2800)
+        avctx->thread_count = 1;
+
     if(ff_MPV_encode_init(avctx) < 0)
         return -1;
 
@@ -180,6 +183,19 @@ static av_cold int encode_init(AVCodecContext *avctx)
         }
     }
 
+    if ((avctx->width & 0xFFF) == 0 && (avctx->height & 0xFFF) == 1) {
+        av_log(avctx, AV_LOG_ERROR, "Width / Height is invalid for MPEG2\n");
+        return AVERROR(EINVAL);
+    }
+
+    if (s->strict_std_compliance > FF_COMPLIANCE_UNOFFICIAL) {
+        if ((avctx->width & 0xFFF) == 0 || (avctx->height & 0xFFF) == 0) {
+            av_log(avctx, AV_LOG_ERROR, "Width or Height are not allowed to be multiplies of 4096\n"
+                                        "add '-strict %d' if you want to use them anyway.\n", FF_COMPLIANCE_UNOFFICIAL);
+            return AVERROR(EINVAL);
+        }
+    }
+
     s->drop_frame_timecode = s->drop_frame_timecode || !!(avctx->flags2 & CODEC_FLAG2_DROP_FRAME_TIMECODE);
     if (s->drop_frame_timecode)
         s->tc.flags |= AV_TIMECODE_FLAG_DROPFRAME;
@@ -227,8 +243,8 @@ static void mpeg1_encode_sequence_header(MpegEncContext *s)
             /* mpeg1 header repeated every gop */
             put_header(s, SEQ_START_CODE);
 
-            put_sbits(&s->pb, 12, s->width );
-            put_sbits(&s->pb, 12, s->height);
+            put_sbits(&s->pb, 12, s->width  & 0xFFF);
+            put_sbits(&s->pb, 12, s->height & 0xFFF);
 
             for(i=1; i<15; i++){
                 float error= aspect_ratio;

libavcodec/mpegvideo.c

@@ -1653,7 +1653,7 @@ static void draw_line(uint8_t *buf, int sx, int sy, int ex, int ey,
         buf += sx + sy * stride;
         ex  -= sx;
         f    = ((ey - sy) << 16) / ex;
-        for(x= 0; x <= ex; x++){
+        for (x = 0; x <= ex; x++) {
             y  = (x * f) >> 16;
             fr = (x * f) & 0xFFFF;
             buf[y * stride + x]       += (color * (0x10000 - fr)) >> 16;

libavcodec/nellymoserenc.c

@@ -397,7 +397,7 @@ static int encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
             if (frame->nb_samples >= NELLY_BUF_LEN)
                 s->last_frame = 1;
         }
-        if ((ret = ff_af_queue_add(&s->afq, frame) < 0))
+        if ((ret = ff_af_queue_add(&s->afq, frame)) < 0)
             return ret;
     } else {
         memset(s->buf + NELLY_BUF_LEN, 0, NELLY_SAMPLES * sizeof(*s->buf));

libavcodec/ra144enc.c

@@ -536,7 +536,7 @@ static int ra144_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
         for (; i < frame->nb_samples; i++)
             ractx->curr_block[i] = samples[i] >> 2;
 
-        if ((ret = ff_af_queue_add(&ractx->afq, frame) < 0))
+        if ((ret = ff_af_queue_add(&ractx->afq, frame)) < 0)
             return ret;
     } else
         ractx->last_frame = 1;

libavcodec/rv30.c

@@ -187,7 +187,7 @@ static void rv30_loop_filter(RV34DecContext *r, int row)
                 for(i = !mb_x; i < 2; i++, C += 4){
                     int ij = i + (j >> 1);
                     loc_lim = 0;
-                    if(cur_cbp && (1 << ij))
+                    if (cur_cbp & (1 << ij))
                         loc_lim = cur_lim;
                     else if(!i && left_cbp & (1 << (ij + 1)))
                         loc_lim = left_lim;
@@ -229,7 +229,7 @@ static void rv30_loop_filter(RV34DecContext *r, int row)
                 for(i = 0; i < 2; i++, C += 4){
                     int ij = i + (j >> 1);
                     loc_lim = 0;
-                    if(r->cbp_chroma[mb_pos] && (1 << ij))
+                    if (r->cbp_chroma[mb_pos] & (1 << ij))
                         loc_lim = cur_lim;
                     else if(!j && top_cbp & (1 << (ij + 2)))
                         loc_lim = top_lim;

libavcodec/sanm.c

@@ -26,6 +26,7 @@
 #include "bytestream.h"
 #include "internal.h"
 #include "libavutil/bswap.h"
+#include "libavutil/imgutils.h"
 #include "libavcodec/dsputil.h"
 #include "sanm_data.h"
 
@@ -638,6 +639,11 @@ static int old_codec47(SANMVideoContext *ctx, int top,
     decoded_size = bytestream2_get_le32(&ctx->gb);
     bytestream2_skip(&ctx->gb, 8);
 
+    if (decoded_size > height * stride - left - top * stride) {
+        decoded_size = height * stride - left - top * stride;
+        av_log(ctx->avctx, AV_LOG_WARNING, "decoded size is too large\n");
+    }
+
     if (skip & 1)
         bytestream2_skip(&ctx->gb, 0x8080);
     if (!seq) {
@@ -716,8 +722,11 @@ static int process_frame_obj(SANMVideoContext *ctx)
     h     = bytestream2_get_le16u(&ctx->gb);
 
     if (ctx->width < left + w || ctx->height < top + h) {
-        ctx->avctx->width  = FFMAX(left + w, ctx->width);
-        ctx->avctx->height = FFMAX(top + h, ctx->height);
+        if (av_image_check_size(FFMAX(left + w, ctx->width),
+                                FFMAX(top  + h, ctx->height), 0, ctx->avctx) < 0)
+            return AVERROR_INVALIDDATA;
+        avcodec_set_dimensions(ctx->avctx, FFMAX(left + w, ctx->width),
+                                           FFMAX(top  + h, ctx->height));
         init_sizes(ctx, left + w, top + h);
         if (init_buffers(ctx)) {
             av_log(ctx->avctx, AV_LOG_ERROR, "error resizing buffers\n");

libavcodec/svq1enc.c

@@ -538,7 +538,7 @@ static int svq1_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
     int i, ret;
 
     if ((ret = ff_alloc_packet2(avctx, pkt, s->y_block_width * s->y_block_height *
-                             MAX_MB_BYTES*3 + FF_MIN_BUFFER_SIZE) < 0))
+                             MAX_MB_BYTES*3 + FF_MIN_BUFFER_SIZE)) < 0)
         return ret;
 
     if (avctx->pix_fmt != AV_PIX_FMT_YUV410P) {
@@ -547,7 +547,7 @@ static int svq1_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
     }
 
     if (!s->current_picture.data[0]) {
-        if ((ret = ff_get_buffer(avctx, &s->current_picture) < 0) ||
+        if ((ret = ff_get_buffer(avctx, &s->current_picture))< 0 ||
             (ret = ff_get_buffer(avctx, &s->last_picture))   < 0) {
             return ret;
         }

libavcodec/tiff.c

@@ -878,7 +878,7 @@ static int tiff_decode_tag(TiffContext *s)
             s->fax_opts = value;
         break;
 #define ADD_METADATA(count, name, sep)\
-    if (ret = add_metadata(count, type, name, sep, s) < 0) {\
+    if ((ret = add_metadata(count, type, name, sep, s)) < 0) {\
         av_log(s->avctx, AV_LOG_ERROR, "Error allocating temporary buffer\n");\
         return ret;\
     }

libavcodec/utils.c

@@ -1018,6 +1018,9 @@ int attribute_align_arg avcodec_open2(AVCodecContext *avctx, const AVCodec *code
             && avctx->bit_rate>0 && avctx->bit_rate<1000) {
             av_log(avctx, AV_LOG_WARNING, "Bitrate %d is extreemly low, did you mean %dk\n", avctx->bit_rate, avctx->bit_rate);
         }
+
+        if (!avctx->rc_initial_buffer_occupancy)
+            avctx->rc_initial_buffer_occupancy = avctx->rc_buffer_size * 3 / 4;
     }
 
     avctx->pts_correction_num_faulty_pts =
@@ -1806,7 +1809,7 @@ int attribute_align_arg avcodec_decode_audio4(AVCodecContext *avctx,
      * extended_data are doing it correctly */
     if (*got_frame_ptr) {
         planar   = av_sample_fmt_is_planar(frame->format);
-        channels = av_get_channel_layout_nb_channels(frame->channel_layout);
+        channels = frame->channels;
         if (!(planar && channels > AV_NUM_DATA_POINTERS))
             frame->extended_data = frame->data;
     } else {

libavcodec/vc1dec.c

@@ -1149,8 +1149,12 @@ static av_always_inline void get_mvdata_interlaced(VC1Context *v, int *dmv_x,
         *dmv_x = get_bits(gb, v->k_x);
         *dmv_y = get_bits(gb, v->k_y);
         if (v->numref) {
-            *pred_flag = *dmv_y & 1;
-            *dmv_y     = (*dmv_y + *pred_flag) >> 1;
+            if (pred_flag) {
+                *pred_flag = *dmv_y & 1;
+                *dmv_y     = (*dmv_y + *pred_flag) >> 1;
+            } else {
+                *dmv_y     = (*dmv_y + (*dmv_y & 1)) >> 1;
+            }
         }
     }
     else {
@@ -1177,7 +1181,7 @@ static av_always_inline void get_mvdata_interlaced(VC1Context *v, int *dmv_x,
             *dmv_y = (sign ^ ((val >> 1) + offs_tab[index1 >> v->numref])) - sign;
         } else
             *dmv_y = 0;
-        if (v->numref)
+        if (v->numref && pred_flag)
             *pred_flag = index1 & 1;
     }
 }

libavcodec/vorbisdec.c

@@ -195,37 +195,41 @@ static void vorbis_free(vorbis_context *vc)
     av_freep(&vc->channel_residues);
     av_freep(&vc->saved);
 
-    for (i = 0; i < vc->residue_count; i++)
-        av_free(vc->residues[i].classifs);
+    if (vc->residues)
+        for (i = 0; i < vc->residue_count; i++)
+            av_free(vc->residues[i].classifs);
     av_freep(&vc->residues);
     av_freep(&vc->modes);
 
     ff_mdct_end(&vc->mdct[0]);
     ff_mdct_end(&vc->mdct[1]);
 
-    for (i = 0; i < vc->codebook_count; ++i) {
-        av_free(vc->codebooks[i].codevectors);
-        ff_free_vlc(&vc->codebooks[i].vlc);
-    }
+    if (vc->codebooks)
+        for (i = 0; i < vc->codebook_count; ++i) {
+            av_free(vc->codebooks[i].codevectors);
+            ff_free_vlc(&vc->codebooks[i].vlc);
+        }
     av_freep(&vc->codebooks);
 
-    for (i = 0; i < vc->floor_count; ++i) {
-        if (vc->floors[i].floor_type == 0) {
-            av_free(vc->floors[i].data.t0.map[0]);
-            av_free(vc->floors[i].data.t0.map[1]);
-            av_free(vc->floors[i].data.t0.book_list);
-            av_free(vc->floors[i].data.t0.lsp);
-        } else {
-            av_free(vc->floors[i].data.t1.list);
+    if (vc->floors)
+        for (i = 0; i < vc->floor_count; ++i) {
+            if (vc->floors[i].floor_type == 0) {
+                av_free(vc->floors[i].data.t0.map[0]);
+                av_free(vc->floors[i].data.t0.map[1]);
+                av_free(vc->floors[i].data.t0.book_list);
+                av_free(vc->floors[i].data.t0.lsp);
+            } else {
+                av_free(vc->floors[i].data.t1.list);
+            }
         }
-    }
     av_freep(&vc->floors);
 
-    for (i = 0; i < vc->mapping_count; ++i) {
-        av_free(vc->mappings[i].magnitude);
-        av_free(vc->mappings[i].angle);
-        av_free(vc->mappings[i].mux);
-    }
+    if (vc->mappings)
+        for (i = 0; i < vc->mapping_count; ++i) {
+            av_free(vc->mappings[i].magnitude);
+            av_free(vc->mappings[i].angle);
+            av_free(vc->mappings[i].mux);
+        }
     av_freep(&vc->mappings);
 }
 
@@ -1651,6 +1655,45 @@ static int vorbis_decode_frame(AVCodecContext *avccontext, void *data,
 
     av_dlog(NULL, "packet length %d \n", buf_size);
 
+    if (*buf == 1 && buf_size > 7) {
+        init_get_bits(gb, buf+1, buf_size*8 - 8);
+        vorbis_free(vc);
+        if ((ret = vorbis_parse_id_hdr(vc))) {
+            av_log(avccontext, AV_LOG_ERROR, "Id header corrupt.\n");
+            vorbis_free(vc);
+            return ret;
+        }
+
+        if (vc->audio_channels > 8)
+            avccontext->channel_layout = 0;
+        else
+            avccontext->channel_layout = ff_vorbis_channel_layouts[vc->audio_channels - 1];
+
+        avccontext->channels    = vc->audio_channels;
+        avccontext->sample_rate = vc->audio_samplerate;
+        return buf_size;
+    }
+
+    if (*buf == 3 && buf_size > 7) {
+        av_log(avccontext, AV_LOG_DEBUG, "Ignoring comment header\n");
+        return buf_size;
+    }
+
+    if (*buf == 5 && buf_size > 7 && vc->channel_residues && !vc->modes) {
+        init_get_bits(gb, buf+1, buf_size*8 - 8);
+        if ((ret = vorbis_parse_setup_hdr(vc))) {
+            av_log(avccontext, AV_LOG_ERROR, "Setup header corrupt.\n");
+            vorbis_free(vc);
+            return ret;
+        }
+        return buf_size;
+    }
+
+    if (!vc->channel_residues || !vc->modes) {
+        av_log(avccontext, AV_LOG_ERROR, "Data packet before valid headers\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     /* get output buffer */
     vc->frame.nb_samples = vc->blocksize[1] / 2;
     if ((ret = ff_get_buffer(avccontext, &vc->frame)) < 0) {

libavcodec/vp3.c

@@ -281,15 +281,15 @@ static av_cold int vp3_decode_end(AVCodecContext *avctx)
     Vp3DecodeContext *s = avctx->priv_data;
     int i;
 
-    av_free(s->superblock_coding);
-    av_free(s->all_fragments);
-    av_free(s->coded_fragment_list[0]);
-    av_free(s->dct_tokens_base);
-    av_free(s->superblock_fragments);
-    av_free(s->macroblock_coding);
-    av_free(s->motion_val[0]);
-    av_free(s->motion_val[1]);
-    av_free(s->edge_emu_buffer);
+    av_freep(&s->superblock_coding);
+    av_freep(&s->all_fragments);
+    av_freep(&s->coded_fragment_list[0]);
+    av_freep(&s->dct_tokens_base);
+    av_freep(&s->superblock_fragments);
+    av_freep(&s->macroblock_coding);
+    av_freep(&s->motion_val[0]);
+    av_freep(&s->motion_val[1]);
+    av_freep(&s->edge_emu_buffer);
 
     if (avctx->internal->is_copy)
         return 0;
@@ -2339,6 +2339,8 @@ static av_cold int theora_decode_init(AVCodecContext *avctx)
     }
 
   for(i=0;i<3;i++) {
+    if (header_len[i] <= 0)
+        continue;
     init_get_bits(&gb, header_start[i], header_len[i] * 8);
 
     ptype = get_bits(&gb, 8);

libavcodec/vqavideo.c

@@ -537,6 +537,11 @@ static int vqa_decode_chunk(VqaContext *s)
         bytestream2_seek(&s->gb, cbp0_chunk, SEEK_SET);
         chunk_size = bytestream2_get_be32(&s->gb);
 
+        if (chunk_size > MAX_CODEBOOK_SIZE - s->next_codebook_buffer_index) {
+            av_log(s->avctx, AV_LOG_ERROR, "cbp0 chunk too large (0x%X bytes)\n", chunk_size);
+            return AVERROR_INVALIDDATA;
+        }
+
         /* accumulate partial codebook */
         bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index],
                                chunk_size);
@@ -560,6 +565,11 @@ static int vqa_decode_chunk(VqaContext *s)
         bytestream2_seek(&s->gb, cbpz_chunk, SEEK_SET);
         chunk_size = bytestream2_get_be32(&s->gb);
 
+        if (chunk_size > MAX_CODEBOOK_SIZE - s->next_codebook_buffer_index) {
+            av_log(s->avctx, AV_LOG_ERROR, "cbpz chunk too large (0x%X bytes)\n", chunk_size);
+            return AVERROR_INVALIDDATA;
+        }
+
         /* accumulate partial codebook */
         bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index],
                                chunk_size);

libavcodec/x86/dsputil_mmx.c

@@ -1785,6 +1785,7 @@ static av_always_inline void gmc(uint8_t *dst, uint8_t *src,
     }
 }
 
+#if CONFIG_VIDEODSP
 #if HAVE_YASM
 #if ARCH_X86_32
 static void gmc_mmx(uint8_t *dst, uint8_t *src,
@@ -1814,6 +1815,7 @@ static void gmc_mmx(uint8_t *dst, uint8_t *src,
         width, height, &ff_emulated_edge_mc_8);
 }
 #endif
+#endif
 
 #endif /* HAVE_INLINE_ASM */
 
@@ -2518,7 +2520,7 @@ static void dsputil_init_sse(DSPContext *c, AVCodecContext *avctx, int mm_flags)
     c->scalarproduct_float          = ff_scalarproduct_float_sse;
     c->butterflies_float_interleave = ff_butterflies_float_interleave_sse;
 
-#if HAVE_INLINE_ASM
+#if HAVE_INLINE_ASM && CONFIG_VIDEODSP
     c->gmc = gmc_sse;
 #endif
 #endif /* HAVE_YASM */

libavcodec/zmbv.c

@@ -429,6 +429,8 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac
         c->fmt = buf[3];
         c->bw = buf[4];
         c->bh = buf[5];
+        c->decode_intra = NULL;
+        c->decode_xor = NULL;
 
         buf += 6;
         len -= 6;

libavdevice/libcdio.c

@@ -23,8 +23,15 @@
  * libcdio CD grabbing
  */
 
+#include "config.h"
+
+#if HAVE_CDIO_PARANOIA_H
 #include <cdio/cdda.h>
 #include <cdio/paranoia.h>
+#elif HAVE_CDIO_PARANOIA_PARANOIA_H
+#include <cdio/paranoia/cdda.h>
+#include <cdio/paranoia/paranoia.h>
+#endif
 
 #include "libavutil/log.h"
 #include "libavutil/mem.h"

libavfilter/vf_yadif.c

@@ -369,7 +369,7 @@ static int query_formats(AVFilterContext *ctx)
 static av_cold int init(AVFilterContext *ctx, const char *args)
 {
     YADIFContext *yadif = ctx->priv;
-    static const char *shorthand[] = { "mode", "parity", "enable", NULL };
+    static const char *shorthand[] = { "mode", "parity", "deint", NULL };
     int ret;
 
     yadif->csp = NULL;

libavfilter/vsrc_testsrc.c

@@ -248,7 +248,7 @@ static int color_config_props(AVFilterLink *inlink)
     if (av_image_check_size(test->w, test->h, 0, ctx) < 0)
         return AVERROR(EINVAL);
 
-    if (ret = config_props(inlink) < 0)
+    if ((ret = config_props(inlink)) < 0)
         return ret;
 
     av_log(ctx, AV_LOG_VERBOSE, "color:0x%02x%02x%02x%02x\n",

libavformat/dvenc.c

@@ -376,8 +376,8 @@ static int dv_write_header(AVFormatContext *s)
                 break;
         }
     }
-    if (tcr)
-        return av_timecode_init_from_string(&dvc->tc, rate, tcr->value, s);
+    if (tcr && av_timecode_init_from_string(&dvc->tc, rate, tcr->value, s) >= 0)
+        return 0;
     return av_timecode_init(&dvc->tc, rate, 0, 0, s);
 }
 

libavformat/flvdec.c

@@ -713,13 +713,13 @@ static int flv_read_packet(AVFormatContext *s, AVPacket *pkt)
         st = s->streams[i];
         if (stream_type == FLV_STREAM_TYPE_AUDIO) {
             if (st->codec->codec_type == AVMEDIA_TYPE_AUDIO &&
-                flv_same_audio_codec(st->codec, flags)) {
+                (s->audio_codec_id || flv_same_audio_codec(st->codec, flags))) {
                 break;
             }
         } else
         if (stream_type == FLV_STREAM_TYPE_VIDEO) {
             if (st->codec->codec_type == AVMEDIA_TYPE_VIDEO &&
-                flv_same_video_codec(st->codec, flags)) {
+                (s->video_codec_id || flv_same_video_codec(st->codec, flags))) {
                 break;
             }
         } else if (stream_type == FLV_STREAM_TYPE_DATA) {

libavformat/matroska.c

@@ -21,6 +21,9 @@
 
 #include "matroska.h"
 
+/* If you add a tag here that is not in ff_codec_bmp_tags[]
+   or ff_codec_wav_tags[], add it also to additional_audio_tags[]
+   or additional_video_tags[] in matroskaenc.c */
 const CodecTags ff_mkv_codec_tags[]={
     {"A_AAC"            , AV_CODEC_ID_AAC},
     {"A_AC3"            , AV_CODEC_ID_AC3},

libavformat/matroskadec.c

@@ -1881,6 +1881,7 @@ static int matroska_deliver_packet(MatroskaDemuxContext *matroska,
  */
 static void matroska_clear_queue(MatroskaDemuxContext *matroska)
 {
+    matroska->prev_pkt = NULL;
     if (matroska->packets) {
         int n;
         for (n = 0; n < matroska->num_packets; n++) {
@@ -2388,7 +2389,6 @@ static int matroska_read_seek(AVFormatContext *s, int stream_index,
         avio_seek(s->pb, st->index_entries[st->nb_index_entries-1].pos, SEEK_SET);
         matroska->current_id = 0;
         while ((index = av_index_search_timestamp(st, timestamp, flags)) < 0) {
-            matroska->prev_pkt = NULL;
             matroska_clear_queue(matroska);
             if (matroska_parse_cluster(matroska) < 0)
                 break;

libavformat/matroskaenc.c

@@ -1353,6 +1353,33 @@ static int mkv_query_codec(enum AVCodecID codec_id, int std_compliance)
     return 0;
 }
 
+const AVCodecTag additional_audio_tags[] = {
+    { AV_CODEC_ID_ALAC,      0XFFFFFFFF },
+    { AV_CODEC_ID_EAC3,      0XFFFFFFFF },
+    { AV_CODEC_ID_MLP,       0xFFFFFFFF },
+    { AV_CODEC_ID_OPUS,      0xFFFFFFFF },
+    { AV_CODEC_ID_PCM_S16BE, 0xFFFFFFFF },
+    { AV_CODEC_ID_PCM_S24BE, 0xFFFFFFFF },
+    { AV_CODEC_ID_PCM_S32BE, 0xFFFFFFFF },
+    { AV_CODEC_ID_QDM2,      0xFFFFFFFF },
+    { AV_CODEC_ID_RA_144,    0xFFFFFFFF },
+    { AV_CODEC_ID_RA_288,    0xFFFFFFFF },
+    { AV_CODEC_ID_COOK,      0xFFFFFFFF },
+    { AV_CODEC_ID_TRUEHD,    0xFFFFFFFF },
+    { AV_CODEC_ID_TTA,       0xFFFFFFFF },
+    { AV_CODEC_ID_WAVPACK,   0xFFFFFFFF },
+    { AV_CODEC_ID_NONE,      0xFFFFFFFF }
+};
+
+const AVCodecTag additional_video_tags[] = {
+    { AV_CODEC_ID_PRORES,    0xFFFFFFFF },
+    { AV_CODEC_ID_RV10,      0xFFFFFFFF },
+    { AV_CODEC_ID_RV20,      0xFFFFFFFF },
+    { AV_CODEC_ID_RV30,      0xFFFFFFFF },
+    { AV_CODEC_ID_RV40,      0xFFFFFFFF },
+    { AV_CODEC_ID_NONE,      0xFFFFFFFF }
+};
+
 #if CONFIG_MATROSKA_MUXER
 AVOutputFormat ff_matroska_muxer = {
     .name              = "matroska",
@@ -1369,6 +1396,10 @@ AVOutputFormat ff_matroska_muxer = {
     .write_trailer     = mkv_write_trailer,
     .flags             = AVFMT_GLOBALHEADER | AVFMT_VARIABLE_FPS |
                          AVFMT_TS_NONSTRICT,
+    .codec_tag         = (const AVCodecTag* const []){
+         ff_codec_bmp_tags, ff_codec_wav_tags,
+         additional_audio_tags, additional_video_tags, 0
+    },
     .subtitle_codec    = AV_CODEC_ID_SSA,
     .query_codec       = mkv_query_codec,
 };
@@ -1405,5 +1436,8 @@ AVOutputFormat ff_matroska_audio_muxer = {
     .write_packet      = mkv_write_packet,
     .write_trailer     = mkv_write_trailer,
     .flags             = AVFMT_GLOBALHEADER | AVFMT_TS_NONSTRICT,
+    .codec_tag         = (const AVCodecTag* const []){
+        ff_codec_wav_tags, additional_audio_tags, 0
+    },
 };
 #endif

libavformat/movenc.c

@@ -1147,7 +1147,12 @@ static int mov_write_tmcd_tag(AVIOContext *pb, MOVTrack *track)
 {
     int64_t pos = avio_tell(pb);
     int frame_duration = av_rescale(track->timescale, track->enc->time_base.num, track->enc->time_base.den);
-    int nb_frames = (track->timescale + frame_duration/2) / frame_duration;
+    int nb_frames = 1.0/av_q2d(track->enc->time_base) + 0.5;
+
+    if (nb_frames > 255) {
+        av_log(NULL, AV_LOG_ERROR, "fps %d is too large\n", nb_frames);
+        return AVERROR(EINVAL);
+    }
 
     avio_wb32(pb, 0); /* size */
     ffio_wfourcc(pb, "tmcd");               /* Data format */

libavformat/mpeg.c

@@ -504,7 +504,7 @@ static int mpegps_read_packet(AVFormatContext *s,
     if(st->discard >= AVDISCARD_ALL)
         goto skip;
     if (startcode >= 0xa0 && startcode <= 0xaf) {
-      if (lpcm_header_len == 6) {
+      if (lpcm_header_len == 6 && st->codec->codec_id == AV_CODEC_ID_MLP) {
             if (len < 6)
                 goto skip;
             avio_skip(s->pb, 6);

libavformat/mux.c

@@ -395,7 +395,7 @@ int avformat_write_header(AVFormatContext *s, AVDictionary **options)
             return ret;
     }
 
-    if ((ret = init_pts(s) < 0))
+    if ((ret = init_pts(s)) < 0)
         return ret;
 
     return 0;
@@ -490,13 +490,12 @@ static int compute_pkt_fields2(AVFormatContext *s, AVStream *st, AVPacket *pkt)
  */
 static inline int split_write_packet(AVFormatContext *s, AVPacket *pkt)
 {
-    int ret;
-    AVPacket spkt = *pkt;
+    int ret, did_split;
 
-    av_packet_split_side_data(&spkt);
-    ret = s->oformat->write_packet(s, &spkt);
-    spkt.data = NULL;
-    av_destruct_packet(&spkt);
+    did_split = av_packet_split_side_data(pkt);
+    ret = s->oformat->write_packet(s, pkt);
+    if (did_split)
+        av_packet_merge_side_data(pkt);
     return ret;
 }
 

libavformat/oggdec.c

@@ -102,6 +102,7 @@ static int ogg_restore(AVFormatContext *s, int discard)
             av_free(ogg->streams[i].buf);
 
         avio_seek(bc, ost->pos, SEEK_SET);
+        ogg->page_pos = -1;
         ogg->curidx   = ost->curidx;
         ogg->nstreams = ost->nstreams;
         ogg->streams  = av_realloc(ogg->streams,
@@ -146,6 +147,7 @@ static int ogg_reset(AVFormatContext *s)
         }
     }
 
+    ogg->page_pos = -1;
     ogg->curidx = -1;
 
     return 0;
@@ -183,6 +185,9 @@ static int ogg_replace_stream(AVFormatContext *s, uint32_t serial)
 
     os = &ogg->streams[0];
 
+    os->serial  = serial;
+    return 0;
+
     buf     = os->buf;
     bufsize = os->bufsize;
     codec   = os->codec;
@@ -297,6 +302,12 @@ static int ogg_read_page(AVFormatContext *s, int *sid)
             sync[(sp + 2) & 3] == 'g' && sync[(sp + 3) & 3] == 'S')
             break;
 
+        if(!i && bc->seekable && ogg->page_pos > 0) {
+            memset(sync, 0, 4);
+            avio_seek(bc, ogg->page_pos+4, SEEK_SET);
+            ogg->page_pos = -1;
+        }
+
         c = avio_r8(bc);
 
         if (url_feof(bc))
@@ -335,6 +346,7 @@ static int ogg_read_page(AVFormatContext *s, int *sid)
     }
 
     os = ogg->streams + idx;
+    ogg->page_pos =
     os->page_pos = avio_tell(bc) - 27;
 
     if (os->psize > 0)
@@ -559,6 +571,7 @@ static int ogg_get_length(AVFormatContext *s)
 
     ogg_save(s);
     avio_seek(s->pb, end, SEEK_SET);
+    ogg->page_pos = -1;
 
     while (!ogg_read_page(s, &i)) {
         if (ogg->streams[i].granule != -1 && ogg->streams[i].granule != 0 &&
@@ -599,6 +612,23 @@ static int ogg_get_length(AVFormatContext *s)
     return 0;
 }
 
+static int ogg_read_close(AVFormatContext *s)
+{
+    struct ogg *ogg = s->priv_data;
+    int i;
+
+    for (i = 0; i < ogg->nstreams; i++) {
+        av_free(ogg->streams[i].buf);
+        if (ogg->streams[i].codec &&
+            ogg->streams[i].codec->cleanup) {
+            ogg->streams[i].codec->cleanup(s, i);
+        }
+        av_free(ogg->streams[i].private);
+    }
+    av_free(ogg->streams);
+    return 0;
+}
+
 static int ogg_read_header(AVFormatContext *s)
 {
     struct ogg *ogg = s->priv_data;
@@ -722,19 +752,6 @@ retry:
     return psize;
 }
 
-static int ogg_read_close(AVFormatContext *s)
-{
-    struct ogg *ogg = s->priv_data;
-    int i;
-
-    for (i = 0; i < ogg->nstreams; i++) {
-        av_free(ogg->streams[i].buf);
-        av_free(ogg->streams[i].private);
-    }
-    av_free(ogg->streams);
-    return 0;
-}
-
 static int64_t ogg_read_timestamp(AVFormatContext *s, int stream_index,
                                   int64_t *pos_arg, int64_t pos_limit)
 {

libavformat/oggdec.h

@@ -55,6 +55,7 @@ struct ogg_codec {
      * Number of expected headers
      */
     int nb_header;
+    void (*cleanup)(AVFormatContext *s, int idx);
 };
 
 struct ogg_stream {
@@ -99,6 +100,7 @@ struct ogg {
     int nstreams;
     int headers;
     int curidx;
+    int64_t page_pos;                   ///< file offset of the current page
     struct ogg_state *state;
 };
 

libavformat/oggparsevorbis.c

@@ -192,6 +192,16 @@ fixup_vorbis_headers(AVFormatContext * as, struct oggvorbis_private *priv,
     return offset;
 }
 
+static void vorbis_cleanup(AVFormatContext *s, int idx)
+{
+    struct ogg *ogg = s->priv_data;
+    struct ogg_stream *os = ogg->streams + idx;
+    struct oggvorbis_private *priv = os->private;
+    int i;
+    if (os->private)
+        for (i = 0; i < 3; i++)
+            av_freep(&priv->packet[i]);
+}
 
 static int
 vorbis_header (AVFormatContext * s, int idx)
@@ -373,5 +383,6 @@ const struct ogg_codec ff_vorbis_codec = {
     .magicsize = 7,
     .header = vorbis_header,
     .packet = vorbis_packet,
+    .cleanup= vorbis_cleanup,
     .nb_header = 3,
 };

libavformat/riff.c

@@ -817,7 +817,13 @@ int ff_read_riff_info(AVFormatContext *s, int64_t size)
 
         chunk_code = avio_rl32(pb);
         chunk_size = avio_rl32(pb);
-
+        if (url_feof(pb)) {
+            if (chunk_code || chunk_size) {
+                av_log(s, AV_LOG_WARNING, "INFO subchunk truncated\n");
+                return AVERROR_INVALIDDATA;
+            }
+            break;
+        }
         if (chunk_size > end || end - chunk_size < cur || chunk_size == UINT_MAX) {
             avio_seek(pb, -9, SEEK_CUR);
             chunk_code = avio_rl32(pb);

libavformat/rtmppkt.c

@@ -356,11 +356,11 @@ int ff_amf_tag_size(const uint8_t *data, const uint8_t *data_end)
                 data++;
                 break;
             }
-            if (data + size >= data_end || data + size < data)
+            if (size < 0 || size >= data_end - data)
                 return -1;
             data += size;
             t = ff_amf_tag_size(data, data_end);
-            if (t < 0 || data + t >= data_end)
+            if (t < 0 || t >= data_end - data)
                 return -1;
             data += t;
         }
@@ -389,7 +389,7 @@ int ff_amf_get_field_value(const uint8_t *data, const uint8_t *data_end,
         int size = bytestream_get_be16(&data);
         if (!size)
             break;
-        if (data + size >= data_end || data + size < data)
+        if (size < 0 || size >= data_end - data)
             return -1;
         data += size;
         if (size == namelen && !memcmp(data-size, name, namelen)) {
@@ -410,7 +410,7 @@ int ff_amf_get_field_value(const uint8_t *data, const uint8_t *data_end,
             return 0;
         }
         len = ff_amf_tag_size(data, data_end);
-        if (len < 0 || data + len >= data_end || data + len < data)
+        if (len < 0 || len >= data_end - data)
             return -1;
         data += len;
     }
@@ -440,7 +440,7 @@ static const char* rtmp_packet_type(int type)
 
 static void ff_amf_tag_contents(void *ctx, const uint8_t *data, const uint8_t *data_end)
 {
-    int size;
+    unsigned int size;
     char buf[1024];
 
     if (data >= data_end)
@@ -459,7 +459,7 @@ static void ff_amf_tag_contents(void *ctx, const uint8_t *data, const uint8_t *d
         } else {
             size = bytestream_get_be32(&data);
         }
-        size = FFMIN(size, 1023);
+        size = FFMIN(size, sizeof(buf) - 1);
         memcpy(buf, data, size);
         buf[size] = 0;
         av_log(ctx, AV_LOG_DEBUG, " string '%s'\n", buf);
@@ -472,22 +472,21 @@ static void ff_amf_tag_contents(void *ctx, const uint8_t *data, const uint8_t *d
     case AMF_DATA_TYPE_OBJECT:
         av_log(ctx, AV_LOG_DEBUG, " {\n");
         for (;;) {
-            int size = bytestream_get_be16(&data);
             int t;
-            memcpy(buf, data, size);
-            buf[size] = 0;
+            size = bytestream_get_be16(&data);
+            av_strlcpy(buf, data, FFMIN(sizeof(buf), size + 1));
             if (!size) {
                 av_log(ctx, AV_LOG_DEBUG, " }\n");
                 data++;
                 break;
             }
-            if (data + size >= data_end || data + size < data)
+            if (size >= data_end - data)
                 return;
             data += size;
             av_log(ctx, AV_LOG_DEBUG, "  %s: ", buf);
             ff_amf_tag_contents(ctx, data, data_end);
             t = ff_amf_tag_size(data, data_end);
-            if (t < 0 || data + t >= data_end)
+            if (t < 0 || t >= data_end - data)
                 return;
             data += t;
         }

libavformat/rtmpproto.c

@@ -1989,7 +1989,7 @@ static int handle_invoke(URLContext *s, RTMPPacket *pkt)
                !memcmp(pkt->data, "\002\000\007publish", 10)       ||
                !memcmp(pkt->data, "\002\000\010_checkbw", 11)      ||
                !memcmp(pkt->data, "\002\000\014createStream", 15)) {
-        if (ret = send_invoke_response(s, pkt) < 0)
+        if ((ret = send_invoke_response(s, pkt)) < 0)
             return ret;
     }
 

libavformat/rtp.c

@@ -19,7 +19,7 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
-#include <libavutil/opt.h>
+#include "libavutil/opt.h"
 #include "avformat.h"
 
 #include "rtp.h"
@@ -107,8 +107,8 @@ int ff_rtp_get_payload_type(AVFormatContext *fmt,
     /* static payload type */
     for (i = 0; AVRtpPayloadTypes[i].pt >= 0; ++i)
         if (AVRtpPayloadTypes[i].codec_id == codec->codec_id) {
-            if (codec->codec_id == AV_CODEC_ID_H263 && (!fmt ||
-                !fmt->oformat->priv_class ||
+            if (codec->codec_id == AV_CODEC_ID_H263 && (!fmt || !fmt->oformat ||
+                !fmt->oformat->priv_class || !fmt->priv_data ||
                 !av_opt_flag_is_set(fmt->priv_data, "rtpflags", "rfc2190")))
                 continue;
             /* G722 has 8000 as nominal rate even if the sample rate is 16000,

libavformat/rtpenc_chain.c

@@ -64,7 +64,7 @@ int ff_rtp_chain_mux_open(AVFormatContext **out, AVFormatContext *s,
     /* Get the payload type from the codec */
     if (st->id < RTP_PT_PRIVATE)
         rtpctx->streams[0]->id =
-            ff_rtp_get_payload_type(rtpctx, st->codec, idx);
+            ff_rtp_get_payload_type(s, st->codec, idx);
     else
         rtpctx->streams[0]->id = st->id;
 

libavformat/rtpenc_h264.c

@@ -31,14 +31,14 @@
 
 static const uint8_t *avc_mp4_find_startcode(const uint8_t *start, const uint8_t *end, int nal_length_size)
 {
-    int res = 0;
+    unsigned int res = 0;
 
     if (end - start < nal_length_size)
         return NULL;
     while (nal_length_size--)
         res = (res << 8) | *start++;
 
-    if (start + res > end || res < 0 || start + res < start)
+    if (res > end - start)
         return NULL;
 
     return start + res;

libavformat/srtdec.c

@@ -100,6 +100,8 @@ static int srt_read_header(AVFormatContext *s)
             pts = get_pts(&ptr, &duration, &x1, &y1, &x2, &y2);
             if (pts != AV_NOPTS_VALUE) {
                 int len = buf.len - (ptr - buf.str);
+                if (len <= 0)
+                    continue;
                 sub = ff_subtitles_queue_insert(&srt->q, ptr, len, 0);
                 if (!sub) {
                     res = AVERROR(ENOMEM);

libavformat/wtvdec.c

@@ -414,6 +414,7 @@ static void get_attachment(AVFormatContext *s, AVIOContext *pb, int length)
     char description[1024];
     unsigned int filesize;
     AVStream *st;
+    int ret;
     int64_t pos = avio_tell(pb);
 
     avio_get_str16le(pb, INT_MAX, mime, sizeof(mime));
@@ -430,13 +431,14 @@ static void get_attachment(AVFormatContext *s, AVIOContext *pb, int length)
     if (!st)
         goto done;
     av_dict_set(&st->metadata, "title", description, 0);
+    st->codec->codec_type = AVMEDIA_TYPE_VIDEO;
     st->codec->codec_id   = AV_CODEC_ID_MJPEG;
-    st->codec->codec_type = AVMEDIA_TYPE_ATTACHMENT;
-    st->codec->extradata  = av_mallocz(filesize);
-    if (!st->codec->extradata)
+    ret = av_get_packet(pb, &st->attached_pic, filesize);
+    if (ret < 0)
         goto done;
-    st->codec->extradata_size = filesize;
-    avio_read(pb, st->codec->extradata, filesize);
+    st->attached_pic.stream_index = st->index;
+    st->attached_pic.flags       |= AV_PKT_FLAG_KEY;
+    st->disposition              |= AV_DISPOSITION_ATTACHED_PIC;
 done:
     avio_seek(pb, pos + length, SEEK_SET);
 }

libavresample/audio_mix.c

@@ -401,10 +401,6 @@ AudioMix *ff_audio_mix_alloc(AVAudioResampleContext *avr)
         av_free(matrix_dbl);
     }
 
-    ret = mix_function_init(am);
-    if (ret < 0)
-        goto error;
-
     return am;
 
 error:
@@ -544,8 +540,5 @@ int ff_audio_mix_set_matrix(AudioMix *am, const double *matrix, int stride)
         return AVERROR(EINVAL);
     }
 
-    /* TODO: detect situations where we can just swap around pointers
-             instead of doing matrix multiplications with 0.0 and 1.0 */
-
-    return 0;
+    return mix_function_init(am);
 }

libswresample/swresample.c

@@ -826,7 +826,7 @@ int64_t swr_next_pts(struct SwrContext *s, int64_t pts){
     if(s->min_compensation >= FLT_MAX) {
         return (s->outpts = pts - swr_get_delay(s, s->in_sample_rate * (int64_t)s->out_sample_rate));
     } else {
-        int64_t delta = pts - swr_get_delay(s, s->in_sample_rate * (int64_t)s->out_sample_rate) - s->outpts;
+        int64_t delta = pts - swr_get_delay(s, s->in_sample_rate * (int64_t)s->out_sample_rate) - s->outpts + s->drop_output*(int64_t)s->in_sample_rate;
         double fdelta = delta /(double)(s->in_sample_rate * (int64_t)s->out_sample_rate);
 
         if(fabs(fdelta) > s->min_compensation) {

tests/ref/fate/filter-delogo

@@ -8,13 +8,13 @@
 0,          6,          6,        1,   126720, 0x94a0f126
 0,          7,          7,        1,   126720, 0x0250f106
 0,          8,          8,        1,   126720, 0xcf6ab4bc
-0,          9,          9,        1,   126720, 0x44aeb57c
-0,         10,         10,        1,   126720, 0x33b0b5bc
-0,         11,         11,        1,   126720, 0xc4bab591
+0,          9,          9,        1,   126720, 0x429eb57c
+0,         10,         10,        1,   126720, 0x3bf0b5bc
+0,         11,         11,        1,   126720, 0xcaedb591
 0,         12,         12,        1,   126720, 0xa492b5ec
-0,         13,         13,        1,   126720, 0x1459b85c
-0,         14,         14,        1,   126720, 0x806fb8dc
-0,         15,         15,        1,   126720, 0xd241b871
+0,         13,         13,        1,   126720, 0x2431b85c
+0,         14,         14,        1,   126720, 0x8283b8dc
+0,         15,         15,        1,   126720, 0xd71bb871
 0,         16,         16,        1,   126720, 0x698eb5cc
 0,         17,         17,        1,   126720, 0x4719aa98
 0,         18,         18,        1,   126720, 0x9ca1962c
@@ -28,83 +28,83 @@
 0,         26,         26,        1,   126720, 0x7af2ea86
 0,         27,         27,        1,   126720, 0x40d4b4eb
 0,         28,         28,        1,   126720, 0x49d00307
-0,         29,         29,        1,   126720, 0x44c8848e
-0,         30,         30,        1,   126720, 0xc6990101
-0,         31,         31,        1,   126720, 0x2e01b963
+0,         29,         29,        1,   126720, 0x0654849c
+0,         30,         30,        1,   126720, 0xe46d0107
+0,         31,         31,        1,   126720, 0xa483b963
 0,         32,         32,        1,   126720, 0xd0e903f0
-0,         33,         33,        1,   126720, 0x3457d592
-0,         34,         34,        1,   126720, 0x4f1ddb3c
-0,         35,         35,        1,   126720, 0x3980ace5
+0,         33,         33,        1,   126720, 0x964ed592
+0,         34,         34,        1,   126720, 0x23fbdb3c
+0,         35,         35,        1,   126720, 0x59fdace5
 0,         36,         36,        1,   126720, 0xb1e37954
-0,         37,         37,        1,   126720, 0x619fc554
-0,         38,         38,        1,   126720, 0x945fb39e
-0,         39,         39,        1,   126720, 0xb1d5e0ce
+0,         37,         37,        1,   126720, 0x8ed9c554
+0,         38,         38,        1,   126720, 0xe3c4b39f
+0,         39,         39,        1,   126720, 0xfd17e0ce
 0,         40,         40,        1,   126720, 0xf26e1dcc
-0,         41,         41,        1,   126720, 0x04d5783e
-0,         42,         42,        1,   126720, 0xbaa0479e
-0,         43,         43,        1,   126720, 0x20d88b01
+0,         41,         41,        1,   126720, 0x13cc783c
+0,         42,         42,        1,   126720, 0x47ad47a1
+0,         43,         43,        1,   126720, 0x427c8b0d
 0,         44,         44,        1,   126720, 0x59d99901
-0,         45,         45,        1,   126720, 0x1c6e09f6
-0,         46,         46,        1,   126720, 0xeec50fc5
-0,         47,         47,        1,   126720, 0xb3a92827
-0,         48,         48,        1,   126720, 0xf62dd2b6
-0,         49,         49,        1,   126720, 0x75b1e619
-0,         50,         50,        1,   126720, 0x6bbce2c0
-0,         51,         51,        1,   126720, 0xd93e023c
-0,         52,         52,        1,   126720, 0xbbe8e7c2
-0,         53,         53,        1,   126720, 0x2272ec17
-0,         54,         54,        1,   126720, 0xf5e4ee6e
-0,         55,         55,        1,   126720, 0x751d2607
-0,         56,         56,        1,   126720, 0x44c499c9
-0,         57,         57,        1,   126720, 0xddccd842
-0,         58,         58,        1,   126720, 0x508dd214
-0,         59,         59,        1,   126720, 0x8eb10272
-0,         60,         60,        1,   126720, 0x7224b1c6
-0,         61,         61,        1,   126720, 0x50ff456c
-0,         62,         62,        1,   126720, 0xa81e2731
-0,         63,         63,        1,   126720, 0x7e50456d
-0,         64,         64,        1,   126720, 0x44802978
-0,         65,         65,        1,   126720, 0x86e88743
-0,         66,         66,        1,   126720, 0x0b1087d6
-0,         67,         67,        1,   126720, 0xb0227d21
-0,         68,         68,        1,   126720, 0x29d10bd2
-0,         69,         69,        1,   126720, 0x04b43afa
-0,         70,         70,        1,   126720, 0xb48e9698
-0,         71,         71,        1,   126720, 0x75d760fb
-0,         72,         72,        1,   126720, 0xa2ab1fdb
-0,         73,         73,        1,   126720, 0xec30a5ee
-0,         74,         74,        1,   126720, 0xbdab7c8c
-0,         75,         75,        1,   126720, 0xac5c3f2c
-0,         76,         76,        1,   126720, 0xce6350be
-0,         77,         77,        1,   126720, 0xb109657a
-0,         78,         78,        1,   126720, 0x723865a4
-0,         79,         79,        1,   126720, 0xa9869124
-0,         80,         80,        1,   126720, 0xc41af558
-0,         81,         81,        1,   126720, 0xcbe6a402
-0,         82,         82,        1,   126720, 0xb6735ecb
-0,         83,         83,        1,   126720, 0xba3059f2
-0,         84,         84,        1,   126720, 0xe7d63b8d
-0,         85,         85,        1,   126720, 0x8f115906
-0,         86,         86,        1,   126720, 0xaf6a8dcb
-0,         87,         87,        1,   126720, 0xb73e846e
-0,         88,         88,        1,   126720, 0xedd6380f
-0,         89,         89,        1,   126720, 0xd9026acf
-0,         90,         90,        1,   126720, 0xa03a650b
-0,         91,         91,        1,   126720, 0x262765bc
-0,         92,         92,        1,   126720, 0xaaa9ded1
-0,         93,         93,        1,   126720, 0xe4f42665
-0,         94,         94,        1,   126720, 0x78daf760
-0,         95,         95,        1,   126720, 0x3b0c6ef8
-0,         96,         96,        1,   126720, 0xb745df80
-0,         97,         97,        1,   126720, 0x08e57b90
-0,         98,         98,        1,   126720, 0x6f883ab0
-0,         99,         99,        1,   126720, 0x934b4dd5
-0,        100,        100,        1,   126720, 0x762f108f
-0,        101,        101,        1,   126720, 0x91ee0f2b
-0,        102,        102,        1,   126720, 0x9af6e5e8
-0,        103,        103,        1,   126720, 0xdcd95e0a
-0,        104,        104,        1,   126720, 0x22c33a6e
-0,        105,        105,        1,   126720, 0x21c1b7f4
-0,        106,        106,        1,   126720, 0x0a66a1ed
-0,        107,        107,        1,   126720, 0x53fea81b
-0,        108,        108,        1,   126720, 0x597f5567
+0,         45,         45,        1,   126720, 0xc40707da
+0,         46,         46,        1,   126720, 0xcd060dce
+0,         47,         47,        1,   126720, 0xed4024f6
+0,         48,         48,        1,   126720, 0x7decd2b4
+0,         49,         49,        1,   126720, 0xd1d2e730
+0,         50,         50,        1,   126720, 0x77cee457
+0,         51,         51,        1,   126720, 0xe78d02c0
+0,         52,         52,        1,   126720, 0xad0beb29
+0,         53,         53,        1,   126720, 0xc414eea2
+0,         54,         54,        1,   126720, 0x6a15f17d
+0,         55,         55,        1,   126720, 0x516027f6
+0,         56,         56,        1,   126720, 0x4eda9dce
+0,         57,         57,        1,   126720, 0x7d9bdba3
+0,         58,         58,        1,   126720, 0x7aa3d5c0
+0,         59,         59,        1,   126720, 0x7c7a04f9
+0,         60,         60,        1,   126720, 0x3e8fb6cc
+0,         61,         61,        1,   126720, 0xd5474916
+0,         62,         62,        1,   126720, 0xf3f62bab
+0,         63,         63,        1,   126720, 0x2f054987
+0,         64,         64,        1,   126720, 0x974c2e81
+0,         65,         65,        1,   126720, 0xe7e28a97
+0,         66,         66,        1,   126720, 0x45e38b41
+0,         67,         67,        1,   126720, 0x169c7f19
+0,         68,         68,        1,   126720, 0x91d90ee8
+0,         69,         69,        1,   126720, 0xdd653e24
+0,         70,         70,        1,   126720, 0x0da598c4
+0,         71,         71,        1,   126720, 0x687e62cc
+0,         72,         72,        1,   126720, 0x7631232d
+0,         73,         73,        1,   126720, 0xbd1ea826
+0,         74,         74,        1,   126720, 0xb55f7f4b
+0,         75,         75,        1,   126720, 0x923f3fc9
+0,         76,         76,        1,   126720, 0x15515301
+0,         77,         77,        1,   126720, 0x9ee066e5
+0,         78,         78,        1,   126720, 0x7c21664b
+0,         79,         79,        1,   126720, 0x36849100
+0,         80,         80,        1,   126720, 0x08b1f61a
+0,         81,         81,        1,   126720, 0x5bfca6e2
+0,         82,         82,        1,   126720, 0x929f60e3
+0,         83,         83,        1,   126720, 0xa2b55c29
+0,         84,         84,        1,   126720, 0x68bd3ff3
+0,         85,         85,        1,   126720, 0x30db5b29
+0,         86,         86,        1,   126720, 0x00578f9b
+0,         87,         87,        1,   126720, 0x18368642
+0,         88,         88,        1,   126720, 0xbcb83a80
+0,         89,         89,        1,   126720, 0x90f36b72
+0,         90,         90,        1,   126720, 0x85e46522
+0,         91,         91,        1,   126720, 0x2429660a
+0,         92,         92,        1,   126720, 0xf283dfe2
+0,         93,         93,        1,   126720, 0x896b27dc
+0,         94,         94,        1,   126720, 0x5af4f961
+0,         95,         95,        1,   126720, 0x31897085
+0,         96,         96,        1,   126720, 0x441ce33e
+0,         97,         97,        1,   126720, 0x903f8009
+0,         98,         98,        1,   126720, 0xbdf33dba
+0,         99,         99,        1,   126720, 0x8a364f36
+0,        100,        100,        1,   126720, 0xda5513f6
+0,        101,        101,        1,   126720, 0xd60012b3
+0,        102,        102,        1,   126720, 0x67bce7be
+0,        103,        103,        1,   126720, 0x697e6174
+0,        104,        104,        1,   126720, 0xbe3e3e90
+0,        105,        105,        1,   126720, 0xf3e4bba6
+0,        106,        106,        1,   126720, 0x8124a679
+0,        107,        107,        1,   126720, 0x58d1acde
+0,        108,        108,        1,   126720, 0xd8a15ba3

tests/ref/fate/rv30

@@ -8,13 +8,13 @@
 0,          6,          6,        1,   126720, 0x5e6ff4d7
 0,          7,          7,        1,   126720, 0xcc10f4b7
 0,          8,          8,        1,   126720, 0x763ab817
-0,          9,          9,        1,   126720, 0xeb6fb8d7
-0,         10,         10,        1,   126720, 0xda71b917
-0,         11,         11,        1,   126720, 0x0967b8f7
+0,          9,          9,        1,   126720, 0xe95fb8d7
+0,         10,         10,        1,   126720, 0xe2b1b917
+0,         11,         11,        1,   126720, 0x11abb8f7
 0,         12,         12,        1,   126720, 0x4b62b947
-0,         13,         13,        1,   126720, 0xbb1abbb7
-0,         14,         14,        1,   126720, 0x273fbc37
-0,         15,         15,        1,   126720, 0x16eebbd7
+0,         13,         13,        1,   126720, 0xcaf2bbb7
+0,         14,         14,        1,   126720, 0x2953bc37
+0,         15,         15,        1,   126720, 0x1dd9bbd7
 0,         16,         16,        1,   126720, 0x105eb927
 0,         17,         17,        1,   126720, 0x7fa3ae27
 0,         18,         18,        1,   126720, 0x722e99f7
@@ -28,83 +28,83 @@
 0,         26,         26,        1,   126720, 0x6ddaef32
 0,         27,         27,        1,   126720, 0xde1bb900
 0,         28,         28,        1,   126720, 0xac6c071b
-0,         29,         29,        1,   126720, 0x04e7897c
-0,         30,         30,        1,   126720, 0x5eee050f
-0,         31,         31,        1,   126720, 0xe675be59
+0,         29,         29,        1,   126720, 0x4a9f897c
+0,         30,         30,        1,   126720, 0xd8fa050f
+0,         31,         31,        1,   126720, 0x5d06be59
 0,         32,         32,        1,   126720, 0xdc3e0837
-0,         33,         33,        1,   126720, 0x68cfda2b
-0,         34,         34,        1,   126720, 0xe572dfc9
-0,         35,         35,        1,   126720, 0x582fb176
+0,         33,         33,        1,   126720, 0xcac6da2b
+0,         34,         34,        1,   126720, 0x6672dfc9
+0,         35,         35,        1,   126720, 0x7491b176
 0,         36,         36,        1,   126720, 0xa9477df0
-0,         37,         37,        1,   126720, 0xbc3cc34f
-0,         38,         38,        1,   126720, 0xcf8cb0e2
-0,         39,         39,        1,   126720, 0xcff1db35
+0,         37,         37,        1,   126720, 0xe976c34f
+0,         38,         38,        1,   126720, 0xdb7ab0e2
+0,         39,         39,        1,   126720, 0x1b42db35
 0,         40,         40,        1,   126720, 0xc6e10f9f
-0,         41,         41,        1,   126720, 0x75ae61b6
-0,         42,         42,        1,   126720, 0x12af3119
-0,         43,         43,        1,   126720, 0x85597543
+0,         41,         41,        1,   126720, 0x169d61b6
+0,         42,         42,        1,   126720, 0xc7623119
+0,         43,         43,        1,   126720, 0x5b9b7543
 0,         44,         44,        1,   126720, 0x68c27aca
-0,         45,         45,        1,   126720, 0x554fe3e4
-0,         46,         46,        1,   126720, 0x72ecea95
-0,         47,         47,        1,   126720, 0xf4d003d1
-0,         48,         48,        1,   126720, 0x9bf6a605
-0,         49,         49,        1,   126720, 0x5d00b5fe
-0,         50,         50,        1,   126720, 0x93f7b040
-0,         51,         51,        1,   126720, 0x0d6ad154
-0,         52,         52,        1,   126720, 0x4be8b4ea
-0,         53,         53,        1,   126720, 0xe39bba0d
-0,         54,         54,        1,   126720, 0x9c21bad8
-0,         55,         55,        1,   126720, 0xa567f25b
-0,         56,         56,        1,   126720, 0x7a82663a
-0,         57,         57,        1,   126720, 0x72f2a47d
-0,         58,         58,        1,   126720, 0x4f639ebe
-0,         59,         59,        1,   126720, 0xab0fce83
-0,         60,         60,        1,   126720, 0x6cf87d39
-0,         61,         61,        1,   126720, 0x534a10cc
-0,         62,         62,        1,   126720, 0x6bbcf44c
-0,         63,         63,        1,   126720, 0xfdca11d3
-0,         64,         64,        1,   126720, 0x7e58f5a6
-0,         65,         65,        1,   126720, 0x5fd753d8
-0,         66,         66,        1,   126720, 0x0c735615
-0,         67,         67,        1,   126720, 0x2a034ebf
-0,         68,         68,        1,   126720, 0xeaf3dd0b
-0,         69,         69,        1,   126720, 0x0eaf0c1b
-0,         70,         70,        1,   126720, 0xce5e6794
-0,         71,         71,        1,   126720, 0xf27c31c3
-0,         72,         72,        1,   126720, 0xb64af168
-0,         73,         73,        1,   126720, 0x14cf7974
-0,         74,         74,        1,   126720, 0x1c2a513d
-0,         75,         75,        1,   126720, 0xa3f515ab
-0,         76,         76,        1,   126720, 0xcfd62765
-0,         77,         77,        1,   126720, 0xbc513f2a
-0,         78,         78,        1,   126720, 0xbc303fae
-0,         79,         79,        1,   126720, 0x2f8f69b9
-0,         80,         80,        1,   126720, 0x0a22cc69
-0,         81,         81,        1,   126720, 0xd9f67585
-0,         82,         82,        1,   126720, 0x20403001
-0,         83,         83,        1,   126720, 0xf92b2a25
-0,         84,         84,        1,   126720, 0x3c170aad
-0,         85,         85,        1,   126720, 0x3378251f
-0,         86,         86,        1,   126720, 0xb3ed5911
-0,         87,         87,        1,   126720, 0x35d24ef8
-0,         88,         88,        1,   126720, 0x8da30275
-0,         89,         89,        1,   126720, 0xc15a3577
-0,         90,         90,        1,   126720, 0xf2942f53
-0,         91,         91,        1,   126720, 0x44d8304a
-0,         92,         92,        1,   126720, 0xd688a932
-0,         93,         93,        1,   126720, 0x0a24f256
-0,         94,         94,        1,   126720, 0xfab9c45d
-0,         95,         95,        1,   126720, 0x10e939ce
-0,         96,         96,        1,   126720, 0x97fcaa3a
-0,         97,         97,        1,   126720, 0x45464610
-0,         98,         98,        1,   126720, 0xfe2e057d
-0,         99,         99,        1,   126720, 0x0b6718ae
-0,        100,        100,        1,   126720, 0x5284da7b
-0,        101,        101,        1,   126720, 0x23efdc35
-0,        102,        102,        1,   126720, 0xc387b2b3
-0,        103,        103,        1,   126720, 0xc9e92bf1
-0,        104,        104,        1,   126720, 0xfbf20a01
-0,        105,        105,        1,   126720, 0x4d888b2e
-0,        106,        106,        1,   126720, 0xdd0d74df
-0,        107,        107,        1,   126720, 0x49d07aa4
-0,        108,        108,        1,   126720, 0x08382b8e
+0,         45,         45,        1,   126720, 0xa0e4e1c9
+0,         46,         46,        1,   126720, 0xbbdae87e
+0,         47,         47,        1,   126720, 0xe67e00a1
+0,         48,         48,        1,   126720, 0x648ea605
+0,         49,         49,        1,   126720, 0x5becb718
+0,         50,         50,        1,   126720, 0xb79ab1da
+0,         51,         51,        1,   126720, 0x0d52d1dc
+0,         52,         52,        1,   126720, 0x1277b853
+0,         53,         53,        1,   126720, 0xc57cbc83
+0,         54,         54,        1,   126720, 0x2126bdc3
+0,         55,         55,        1,   126720, 0x4c1ef41f
+0,         56,         56,        1,   126720, 0x185f6a2c
+0,         57,         57,        1,   126720, 0xb2b5a7d3
+0,         58,         58,        1,   126720, 0x32d7a26d
+0,         59,         59,        1,   126720, 0x0bffd118
+0,         60,         60,        1,   126720, 0x2eed823a
+0,         61,         61,        1,   126720, 0xc4c0147c
+0,         62,         62,        1,   126720, 0x1f8bf8ac
+0,         63,         63,        1,   126720, 0xfcb715e8
+0,         64,         64,        1,   126720, 0xc3e9fa9c
+0,         65,         65,        1,   126720, 0x9ad8572c
+0,         66,         66,        1,   126720, 0x2800596d
+0,         67,         67,        1,   126720, 0x3caa5094
+0,         68,         68,        1,   126720, 0x6162e000
+0,         69,         69,        1,   126720, 0x18200f2c
+0,         70,         70,        1,   126720, 0x649e699f
+0,         71,         71,        1,   126720, 0x5f513367
+0,         72,         72,        1,   126720, 0x71fbf4a8
+0,         73,         73,        1,   126720, 0x5bff7b97
+0,         74,         74,        1,   126720, 0xbad453d4
+0,         75,         75,        1,   126720, 0x56e6161d
+0,         76,         76,        1,   126720, 0x524f2980
+0,         77,         77,        1,   126720, 0x0589405a
+0,         78,         78,        1,   126720, 0x5c264043
+0,         79,         79,        1,   126720, 0x2394696f
+0,         80,         80,        1,   126720, 0x1aa0cd15
+0,         81,         81,        1,   126720, 0xd6ec7840
+0,         82,         82,        1,   126720, 0xde5531f0
+0,         83,         83,        1,   126720, 0x03a42c3a
+0,         84,         84,        1,   126720, 0xbdee0efb
+0,         85,         85,        1,   126720, 0xa6012736
+0,         86,         86,        1,   126720, 0x448f5ae6
+0,         87,         87,        1,   126720, 0x8a2550c3
+0,         88,         88,        1,   126720, 0x143104e7
+0,         89,         89,        1,   126720, 0x75db363d
+0,         90,         90,        1,   126720, 0x906d2f9d
+0,         91,         91,        1,   126720, 0xfc7b30ab
+0,         92,         92,        1,   126720, 0xd3edaa62
+0,         93,         93,        1,   126720, 0x6267f3fc
+0,         94,         94,        1,   126720, 0x87b6c67f
+0,         95,         95,        1,   126720, 0x84da3b79
+0,         96,         96,        1,   126720, 0x72fbae15
+0,         97,         97,        1,   126720, 0xb8474a80
+0,         98,         98,        1,   126720, 0xbeae088b
+0,         99,         99,        1,   126720, 0x538b1a14
+0,        100,        100,        1,   126720, 0x07bbddcd
+0,        101,        101,        1,   126720, 0x807ddf8f
+0,        102,        102,        1,   126720, 0x325bb46d
+0,        103,        103,        1,   126720, 0xd80c2f2a
+0,        104,        104,        1,   126720, 0xfc1b0dec
+0,        105,        105,        1,   126720, 0x46068ebc
+0,        106,        106,        1,   126720, 0xcd987941
+0,        107,        107,        1,   126720, 0x52f37f2e
+0,        108,        108,        1,   126720, 0xc96931a2