atrac3: Fix crash in tonal component decoding.

Fixes Ticket780 Bug Found by: cosminamironesei Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 9af6abdc17) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
h264: check chroma_format_idc range.
2012-01-12 22:10:33 +01:00 · 2012-01-12 22:09:56 +01:00 · 2012-01-12 22:06:50 +01:00 · 2012-01-10 21:17:30 +01:00 · 2012-01-10 21:02:32 +01:00 · 2012-01-08 09:29:16 +01:00
66 changed files with 1181 additions and 516 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1,45 @@
+.config
+.version
+*.o
+*.d
+*.exe
+*.ho
+*-example
+*-test
+*_g
+config.*
+doc/*.1
+doc/*.html
+doc/*.pod
+doxy
+ffmpeg
+ffplay
+ffprobe
+ffserver
+libavcodec/libavcodec*
+libavcore/libavcore*
+libavdevice/libavdevice*
+libavfilter/libavfilter*
+libavformat/libavformat*
+libavutil/avconfig.h
+libavutil/libavutil*
+libpostproc/libpostproc*
+libswscale/libswscale*
+tests/audiogen
+tests/base64
+tests/data
+tests/rotozoom
+tests/seek_test
+tests/tiny_psnr
+tests/videogen
+tests/vsynth1
+tests/vsynth2
+tools/cws2fws
+tools/graph2dot
+tools/lavfi-showfiltfmts
+tools/pktdumper
+tools/probetest
+tools/qt-faststart
+tools/trasher
+tools/trasher*.d
+version.h
--- a/109
+++ b/109
@@ -1,13 +1,112 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.

+version 0.6.5:
+- vorbis: An additional defense in the Vorbis codec. (CVE-2011-3895)
+- vorbisdec: Fix decoding bug with channel handling.
+- matroskadec: Fix a bug where a pointer was cached to an array that might
+  later move due to a realloc(). (CVE-2011-3893)
+- vorbis: Avoid some out-of-bounds reads. (CVE-2011-3893)
+- vp3: fix oob read for negative tokens and memleaks on error, (CVE-2011-3892)
+- vp3: fix streams with non-zero last coefficient.
+
+
+version 0.6.4:
+- 4xm: Add a check in decode_i_frame to prevent buffer overreads
+- wma: initialize prev_block_len_bits, next_block_len_bits, and block_len_bits.
+- swscale: #include "libavutil/mathematics.h"
+- vp3dec: Check coefficient index in vp3_dequant() (CVE-2011-4352)
+- svq1dec: call avcodec_set_dimensions() after dimensions changed. (CVE-2011-4579)
+- commits related to CVE-2011-4353:
+  - vp6: Fix illegal read.
+  - vp6: Reset the internal state when aborting key frames header parsing
+  - vp6: Check for huffman tree build errors
+  - vp6: partially propagate huffman tree building errors during coeff model parsing and fix misspelling
+- commits related to CVE-2011-4351:
+  - qdm2: check output buffer size before decoding
+  - Fix qdm2 decoder packet handling to match the api
+  - Fix out of bound reads in the QDM2 decoder.
+  - Check for out of bound writes in the QDM2 decoder.
+- vmd: fix segfaults on corruped streams (CVE-2011-4364)
+- rv34: Check for invalid slice offsets
+- rv34: Fix potential overreads
+- rv34: Avoid NULL dereference on corrupted bitstream
+- rv10: Reject slices that does not have the same type as the first one
+- oggdec: fix out of bound write in the ogg demuxer
+- smacker: fix a few off by 1 errors
+- Check for invalid VLC value in smacker decoder.
+- Check and propagate errors when VLC trees cannot be built in smacker decoder.
+- Fixed off by one packet size allocation in the smacker demuxer.
+- Check for invalid packet size in the smacker demuxer.
+- ape demuxer: fix segfault on memory allocation failure.
+- Fixed size given to init_get_bits() in xan decoder.
+- smacker demuxer: handle possible av_realloc() failure.
+- Fixed segfault with wavpack decoder on corrupted decorrelation terms sub-blocks.
+- indeo2: fail if input buffer too small
+- indeo2: init_get_bits size in bits instead of bytes
+- wavpack: Check error codes rather than working around error conditions.
+- Fixed invalid writes and reads in wavpack decoder on corrupted bitstreams.
+- cpu detection: avoid a signed overflow
+- h264: correct implicit weight table computation for long ref pics
+- h264: correct the check for invalid long term frame index in MMCO decode
+- rv10/20: tell decoder to use edge emulation
+- flvenc: use int64_t to store offsets
+- VC-1: fix reading of custom PAR.
+- h264: notice memory allocation failure
+- libx264: do not set pic quality if no frame is output
+- mxfdec: Include FF_INPUT_BUFFER_PADDING_SIZE when allocating extradata.
+- rv30: return AVERROR(EINVAL) instead of EINVAL
+- Do not decode RV30 files if the extradata is too small
+- aacps: skip some memcpy() if src and dst would be equal
+- mpegts: fix Continuity Counter error detection
+- alsa: fallback to buffer_size/4 for period_size.
+- mxfenc: fix ignored drop flag in binary timecode representation.
+- dca: set AVCodecContext frame_size for DTS audio
+- H.264: fix overreads of qscale_table
+- postprocess.c: filter name needs to be double 0 terminated
+- Replace strncpy() with av_strlcpy() in libpostproc.
+- jpegdec: actually search for and parse RSTn
+- riff: Add mpgv MPEG-2 fourcc
+- Added M701 codec_tag for mpeg2video
+
+
+version 0.6.3:
+
+- fix compilation with --enable-hardcoded-tables
+- mjpeg: Detect overreads in mjpeg_decode_scan() and error out.
+- aac: add headers needed for log2f()
+- lavf: inspect more frames for fps when container time base is coarse
+- AMV: disable DR1 and don't override EMU_EDGE
+  (addresses http://seclists.org/bugtraq/2011/Apr/257)
+- Fix memory (re)allocation in matroskadec.c (MSVR11-011/CVE-2011-3504)
+- Fix some crashes with invalid bitstreams in the CAVS decoder
+  (CVE-2011-3362, CVE-2011-3973, CVE-2011-3974)
+- Compilation fixes for gcc-4.6, testsuite now passes again
+- Fix a heap corruption issue in the OGG decoder
+- Backported the Android VisualOn AAC encoder wrapper from 0.7.2
+
+
+version 0.6.3:
+
+- AMV: Fix possibly exploitable crash.
+- Fix apparently exploitable race condition.
+  (addresses http://seclists.org/bugtraq/2011/Apr/257)
+
+version 0.6.2:
+
+- fix compilation with --enable-hardcoded-tables
+- Fix invalid reads in VC-1 decoding (related to CVE-2011-0723)
+- Do not attempt to decode APE file with no frames
+  (adresses http://packetstorm.linuxsecurity.com/1103-exploits/vlc105-dos.txt)
+
+
 version 0.6.1:

 - fix autodetection of E-AC-3 substream samples
- performance fix for seekable http
- Backport AAC-HE v2 from trunk
- Add missing VP80 fourcc code for the VP8 codec
- smaller documentation fixes
+- performance fix for seekable HTTP
+- backport AAC-HE v2 from trunk
+- add missing VP80 fourcc code for the VP8 codec
+- small documentation fixes
 - fix several potentially exploitable issues in the FLIC decoder
  (addresses CVE-2010-3429)

@@ -18,7 +117,7 @@ version 0.6:
 - deprecated vhook subsystem removed
 - deprecated old scaler removed
 - VQF demuxer
- Alpha channel scaler
+- alpha channel scaler
 - PCX encoder
 - RTP packetization of H.263
 - RTP packetization of AMR
--- a/93
+++ b/93
@@ -6,7 +6,7 @@ Release Notes
 General notes
 -------------

-This release features a lot of improvements that are relevant for HTML5 video.
+This release focuses on improvements for the new multimedia elements in HTML5.
 The H.264 and Theora decoders are now significantly faster, the Vorbis decoder
 has seen important updates and this release supports Google's newly released
 libvpx library for the VP8 codec and WebM container.
@@ -101,19 +101,17 @@ Notable license related changes
 General notes
 -------------

-This point release includes some minor updates to make the 0.6 release series
-usable for users that need to retain the existing behavior as closely as
-possible. The changes follow below:
+This point release includes some updates to make the 0.6 release series usable
+for users that need to retain the existing behavior as closely as possible.
+The changes follow below:

-General Bugfixes
----------------
-
-Included are some general, minor bugfixes:
+Bugfixes
+--------

 - fix autodetection of E-AC-3 substream samples
- performance fix for seekable http
- Add missing VP80 fourcc code for the VP8 codec
- smaller documentation fixes
+- performance fix for seekable HTTP
+- add missing VP80 fourcc code for the VP8 codec
+- small documentation fixes
 - fix several potentially exploitable issues in the FLIC decoder
  (addresses CVE-2010-3429)

@@ -121,5 +119,76 @@ Included are some general, minor bugfixes:
 HE-AAC v2 backport
 ------------------

-This release includes a backport of the AAC decoder from trunk. This
+This release includes a backport of the AAC decoder from trunk, which
 enables proper playback of HE-AAC v2 media.
+
+
+* 0.6.2
+
+General notes
+-------------
+
+This is a maintenance-only release that addresses a small number of security
+and portability issues. Distributors and system integrators are encouraged
+to update and share their patches against this branch.
+
+Security fixes
+--------------
+
+Programming errors in container and codec implementations may lead to
+denial of service or the execution of arbitrary code if the user is
+tricked into opening a malformed media file or stream.
+
+Affected and updated have been the implementations of the following
+codecs and container formats:
+
+ - VC1 decoder (Change related to CVE-2011-0723)
+ - APE decoder (cf. http://packetstorm.linuxsecurity.com/1103-exploits/vlc105-dos.txt)
+
+
+* 0.6.3
+
+General notes
+-------------
+
+This is a mostly maintenance-only release that addresses a small number
+of bugs such as security and compilation issues. Moreover, this release
+has been updated to work with gcc-4.6 and the VisualOn AAC encoder has
+been backported from the Libav 0.7.2 release. Distributors and system
+integrators are encouraged to update and share their patches against
+this branch.
+For a full list of changes please see the Changelog file.
+
+
+* 0.6.4
+
+General notes
+-------------
+
+This mostly maintenance-only release that addresses a number a number of
+bugs such as security and compilation issues that have been brought to
+our attention. Among other (rather minor) fixes, this release features
+fixes for the QDM2 decoder (CVE-2011-4351), vp3 decoder (CVE-2011-4352),
+DoS in the VP5/VP6 decoders (CVE-2011-4353), a buffer overflow in the
+Sierra VMD decoder CVE-2011-4364, and a safety fix in the svq1 decoder
+(CVE-2011-4579).
+
+Distributors and system integrators are encouraged
+to update and share their patches against this branch.  For a full list
+of changes please see the Changelog file.
+
+
+* 0.6.5
+
+General notes
+-------------
+
+This mostly maintenance-only release that addresses a number a number of
+bugs such as security and compilation issues that have been brought to
+our attention. Among other (rather minor) fixes, this release features
+fixes for the VP3 decoder (CVE-2011-3892), vorbis decoder, and matroska
+demuxer (CVE-2011-3893 and CVE-2011-3895).
+
+Distributors and system integrators are encouraged
+to update and share their patches against this branch.  For a full list
+of changes please see the Changelog file.
--- a/2
+++ b/2
@@ -1 +1 @@
-0.6.1
+0.6.5
--- a/12
+++ b/12
@@ -181,6 +181,7 @@ External library support:
  --enable-libschroedinger enable Dirac support via libschroedinger [no]
  --enable-libspeex        enable Speex decoding via libspeex [no]
  --enable-libtheora       enable Theora encoding via libtheora [no]
+  --enable-libvo-aacenc    enable AAC encoding via libvo-aacenc [no]
  --enable-libvorbis       enable Vorbis encoding via libvorbis,
                           native implementation exists [no]
  --enable-libvpx          enable VP8 support via libvpx [no]
@@ -929,6 +930,7 @@ CONFIG_LIST="
    libschroedinger
    libspeex
    libtheora
+    libvo_aacenc
    libvorbis
    libvpx
    libx264
@@ -1357,6 +1359,7 @@ libschroedinger_decoder_deps="libschroedinger"
 libschroedinger_encoder_deps="libschroedinger"
 libspeex_decoder_deps="libspeex"
 libtheora_encoder_deps="libtheora"
+libvo_aacenc_encoder_deps="libvo_aacenc"
 libvorbis_encoder_deps="libvorbis"
 libvpx_decoder_deps="libvpx"
 libvpx_encoder_deps="libvpx"
@@ -2206,7 +2209,7 @@ case $target_os in
        LIBTARGET=i386
        if enabled x86_64; then
            enable malloc_aligned
-            LIBTARGET=x64
+            LIBTARGET="i386:x86-64"
        elif enabled arm; then
            LIBTARGET=arm
        fi
@@ -2216,7 +2219,7 @@ case $target_os in
        SLIBSUF=".dll"
        SLIBNAME_WITH_VERSION='$(SLIBPREF)$(FULLNAME)-$(LIBVERSION)$(SLIBSUF)'
        SLIBNAME_WITH_MAJOR='$(SLIBPREF)$(FULLNAME)-$(LIBMAJOR)$(SLIBSUF)'
-        SLIB_EXTRA_CMD='-lib.exe /machine:$(LIBTARGET) /def:$$(@:$(SLIBSUF)=.def) /out:$(SUBDIR)$(SLIBNAME_WITH_MAJOR:$(SLIBSUF)=.lib)'
+        SLIB_EXTRA_CMD=-'$(DLLTOOL) -m $(LIBTARGET) -d $$(@:$(SLIBSUF)=.def) -l $(SUBDIR)$(SLIBNAME_WITH_MAJOR:$(SLIBSUF)=.lib) -D $(SLIBNAME_WITH_MAJOR)'
        SLIB_INSTALL_EXTRA_CMD='-install -m 644 $(SUBDIR)$(SLIBNAME_WITH_MAJOR:$(SLIBSUF)=.lib) "$(SHLIBDIR)/$(SLIBNAME:$(SLIBSUF)=.lib)"; \
            install -m 644 $(SUBDIR)$(SLIBNAME_WITH_MAJOR:$(SLIBSUF)=.lib) "$(SHLIBDIR)/$(SLIBNAME_WITH_MAJOR:$(SLIBSUF)=.lib)"; \
            install -d "$(LIBDIR)"; \
@@ -2224,6 +2227,7 @@ case $target_os in
        SLIB_UNINSTALL_EXTRA_CMD='rm -f "$(SHLIBDIR)/$(SLIBNAME:$(SLIBSUF)=.lib)"'
        SHFLAGS='-shared -Wl,--output-def,$$(@:$(SLIBSUF)=.def) -Wl,--out-implib,$(SUBDIR)lib$(SLIBNAME:$(SLIBSUF)=.dll.a) -Wl,--enable-runtime-pseudo-reloc -Wl,--enable-auto-image-base'
        objformat="win32"
+        dlltool="${cross_prefix}dlltool"
        enable dos_paths
        check_cflags -fno-common
        if ! enabled x86_64; then
@@ -2346,6 +2350,7 @@ die_license_disabled nonfree libfaac

 die_license_disabled version3 libopencore_amrnb
 die_license_disabled version3 libopencore_amrwb
+die_license_disabled version3 libvo_aacenc

 enabled version3 && { enabled gpl && enable gplv3 || enable lgplv3; }

@@ -2622,6 +2627,7 @@ enabled libschroedinger && add_cflags $(pkg-config --cflags schroedinger-1.0) &&
                           require libschroedinger schroedinger/schro.h schro_init $(pkg-config --libs schroedinger-1.0)
 enabled libspeex   && require  libspeex speex/speex.h speex_decoder_init -lspeex
 enabled libtheora  && require  libtheora theora/theoraenc.h th_info_init -ltheoraenc -ltheoradec -logg
+enabled libvo_aacenc && require libvo_aacenc vo-aacenc/voAAC.h voGetAACEncAPI -lvo-aacenc
 enabled libvorbis  && require  libvorbis vorbis/vorbisenc.h vorbis_info_init -lvorbisenc -lvorbis -logg
 enabled libvpx     && require2 libvpx "vpx/vpx_decoder.h vpx/vp8dx.h" "vpx_codec_dec_init_ver" -lvpx &&
                      require2 libvpx "vpx/vpx_encoder.h vpx/vp8cx.h" "vpx_codec_enc_init_ver" -lvpx
@@ -2902,6 +2908,7 @@ echo "librtmp enabled           ${librtmp-no}"
 echo "libschroedinger enabled   ${libschroedinger-no}"
 echo "libspeex enabled          ${libspeex-no}"
 echo "libtheora enabled         ${libtheora-no}"
+echo "libvo-aacenc support      ${libvo_aacenc-no}"
 echo "libvorbis enabled         ${libvorbis-no}"
 echo "libvpx enabled            ${libvpx-no}"
 echo "libx264 enabled           ${libx264-no}"
@@ -3002,6 +3009,7 @@ CPPFLAGS=$CPPFLAGS
 CFLAGS=$CFLAGS
 ASFLAGS=$ASFLAGS
 CC_O=$CC_O
+DLLTOOL=$dlltool
 LDFLAGS=$LDFLAGS
 FFSERVERLDFLAGS=$FFSERVERLDFLAGS
 SHFLAGS=$SHFLAGS
--- a/doc/general.texi
+++ b/doc/general.texi
@@ -511,7 +511,7 @@ following image formats are supported:
@item Name @tab Encoding @tab Decoding @tab Comments
@item 8SVX audio             @tab     @tab  X
@item AAC                    @tab  E  @tab  X
-    @tab encoding supported through external library libfaac
+    @tab encoding supported through external library libfaac and libvo-aacenc
@item AC-3                   @tab IX  @tab  X
@item ADPCM 4X Movie         @tab     @tab  X
@item ADPCM CDROM XA         @tab     @tab  X
--- a/libavcodec/4xm.c
+++ b/libavcodec/4xm.c
@@ -641,9 +641,18 @@ static int decode_i_frame(FourXContext *f, const uint8_t *buf, int length){
    uint16_t *dst= (uint16_t*)f->current_picture.data[0];
    const int stride= f->current_picture.linesize[0]>>1;
    const unsigned int bitstream_size= AV_RL32(buf);
-    const int token_count av_unused = AV_RL32(buf + bitstream_size + 8);
-    unsigned int prestream_size= 4*AV_RL32(buf + bitstream_size + 4);
-    const uint8_t *prestream= buf + bitstream_size + 12;
+    int token_count av_unused;
+    unsigned int prestream_size;
+    const uint8_t *prestream;
+
+    if (length < bitstream_size + 12) {
+        av_log(f->avctx, AV_LOG_ERROR, "packet size too small\n");
+        return AVERROR_INVALIDDATA;
+    }
+
+    token_count    = AV_RL32(buf + bitstream_size + 8);
+    prestream_size = 4 * AV_RL32(buf + bitstream_size + 4);
+    prestream      = buf + bitstream_size + 12;

    if(prestream_size + bitstream_size + 12 != length
       || bitstream_size > (1<<26)
--- a/libavcodec/Makefile
+++ b/libavcodec/Makefile
@@ -527,6 +527,7 @@ OBJS-$(CONFIG_LIBSCHROEDINGER_ENCODER)    += libschroedingerenc.o \
 OBJS-$(CONFIG_LIBSPEEX_DECODER)           += libspeexdec.o
 OBJS-$(CONFIG_LIBTHEORA_ENCODER)          += libtheoraenc.o
 OBJS-$(CONFIG_LIBVORBIS_ENCODER)          += libvorbis.o
+OBJS-$(CONFIG_LIBVO_AACENC_ENCODER)       += libvo-aacenc.o mpeg4audio.o
 OBJS-$(CONFIG_LIBVPX_DECODER)             += libvpxdec.o
 OBJS-$(CONFIG_LIBVPX_ENCODER)             += libvpxenc.o
 OBJS-$(CONFIG_LIBX264_ENCODER)            += libx264.o
@@ -645,7 +646,9 @@ $(SUBDIR)%_tables.h: $(SUBDIR)%_tablegen$(HOSTEXESUF)
 	$(M)./$< > $@

 ifdef CONFIG_HARDCODED_TABLES
-$(SUBDIR)aac.o: $(SUBDIR)cbrt_tables.h
+$(SUBDIR)aacdec.o: $(SUBDIR)cbrt_tables.h
+$(SUBDIR)aacps.o: $(SUBDIR)aacps_tables.h
+$(SUBDIR)aactab.o: $(SUBDIR)aac_tables.h
 $(SUBDIR)dv.o: $(SUBDIR)dv_tables.h
 $(SUBDIR)mdct.o: $(SUBDIR)mdct_tables.h
 $(SUBDIR)mpegaudiodec.o: $(SUBDIR)mpegaudio_tables.h
--- a/libavcodec/aaccoder.c
+++ b/libavcodec/aaccoder.c
@@ -35,6 +35,7 @@
 #include "aac.h"
 #include "aacenc.h"
 #include "aactab.h"
+#include "libavutil/libm.h"

 /** bits needed to code codebook run value for long windows */
 static const uint8_t run_value_bits_long[64] = {
--- a/libavcodec/aacps.c
+++ b/libavcodec/aacps.c
@@ -813,14 +813,17 @@ static void stereo_processing(PSContext *ps, float (*l)[32][2], float (*r)[32][2
    const float (*H_LUT)[8][4] = (PS_BASELINE || ps->icc_mode < 3) ? HA : HB;

    //Remapping
-    memcpy(H11[0][0], H11[0][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H11[0][0][0]));
-    memcpy(H11[1][0], H11[1][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H11[1][0][0]));
-    memcpy(H12[0][0], H12[0][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H12[0][0][0]));
-    memcpy(H12[1][0], H12[1][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H12[1][0][0]));
-    memcpy(H21[0][0], H21[0][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H21[0][0][0]));
-    memcpy(H21[1][0], H21[1][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H21[1][0][0]));
-    memcpy(H22[0][0], H22[0][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H22[0][0][0]));
-    memcpy(H22[1][0], H22[1][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H22[1][0][0]));
+    if (ps->num_env_old) {
+        memcpy(H11[0][0], H11[0][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H11[0][0][0]));
+        memcpy(H11[1][0], H11[1][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H11[1][0][0]));
+        memcpy(H12[0][0], H12[0][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H12[0][0][0]));
+        memcpy(H12[1][0], H12[1][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H12[1][0][0]));
+        memcpy(H21[0][0], H21[0][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H21[0][0][0]));
+        memcpy(H21[1][0], H21[1][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H21[1][0][0]));
+        memcpy(H22[0][0], H22[0][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H22[0][0][0]));
+        memcpy(H22[1][0], H22[1][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H22[1][0][0]));
+    }
+
    if (is34) {
        remap34(&iid_mapped, ps->iid_par, ps->nr_iid_par, ps->num_env, 1);
        remap34(&icc_mapped, ps->icc_par, ps->nr_icc_par, ps->num_env, 1);
--- a/libavcodec/aacsbr.c
+++ b/libavcodec/aacsbr.c
@@ -32,6 +32,7 @@
 #include "aacsbrdata.h"
 #include "fft.h"
 #include "aacps.h"
+#include "libavutil/libm.h"

 #include <stdint.h>
 #include <float.h>
--- a/libavcodec/allcodecs.c
+++ b/libavcodec/allcodecs.c
@@ -343,6 +343,7 @@ void avcodec_register_all(void)
    REGISTER_ENCDEC  (LIBSCHROEDINGER, libschroedinger);
    REGISTER_DECODER (LIBSPEEX, libspeex);
    REGISTER_ENCODER (LIBTHEORA, libtheora);
+    REGISTER_ENCODER (LIBVO_AACENC, libvo_aacenc);
    REGISTER_ENCODER (LIBVORBIS, libvorbis);
    REGISTER_ENCDEC  (LIBVPX, libvpx);
    REGISTER_ENCODER (LIBX264, libx264);
--- a/libavcodec/atrac3.c
+++ b/libavcodec/atrac3.c
@@ -393,6 +393,8 @@ static int decodeTonalComponents (GetBitContext *gb, tonal_component *pComponent

            for (k=0; k<coded_components; k++) {
                sfIndx = get_bits(gb,6);
+                if(component_count>=64)
+                    return AVERROR_INVALIDDATA;
                pComponent[component_count].pos = j * 64 + (get_bits(gb,6));
                max_coded_values = 1024 - pComponent[component_count].pos;
                coded_values = coded_values_per_component + 1;
--- a/libavcodec/cavsdec.c
+++ b/libavcodec/cavsdec.c
@@ -130,12 +130,14 @@ static int decode_residual_block(AVSContext *h, GetBitContext *gb,
                r++;
            mask = -(level_code & 1);
            level = (level^mask) - mask;
-        } else {
+        } else if (level_code >= 0) {
            level = r->rltab[level_code][0];
            if(!level) //end of block signal
                break;
            run   = r->rltab[level_code][1];
            r += r->rltab[level_code][2];
+        } else {
+            break;
        }
        level_buf[i] = level;
        run_buf[i] = run;
@@ -189,7 +191,8 @@ static inline int decode_residual_inter(AVSContext *h) {

 static int decode_mb_i(AVSContext *h, int cbp_code) {
    GetBitContext *gb = &h->s.gb;
-    int block, pred_mode_uv;
+    unsigned pred_mode_uv;
+    int block;
    uint8_t top[18];
    uint8_t *left = NULL;
    uint8_t *d;
@@ -445,6 +448,8 @@ static inline int check_for_slice(AVSContext *h) {
    if((show_bits_long(gb,24+align) & 0xFFFFFF) == 0x000001) {
        skip_bits_long(gb,24+align);
        h->stc = get_bits(gb,8);
+        if (h->stc >= h->mb_height)
+            return 0;
        decode_slice_header(h,gb);
        return 1;
    }
@@ -659,7 +664,7 @@ static int cavs_decode_frame(AVCodecContext * avctx,void *data, int *data_size,
    buf_end = buf + buf_size;
    for(;;) {
        buf_ptr = ff_find_start_code(buf_ptr,buf_end, &stc);
-        if(stc & 0xFFFFFE00)
+        if((stc & 0xFFFFFE00) || buf_ptr == buf_end)
            return FFMAX(0, buf_ptr - buf - s->parse_context.last_index);
        input_size = (buf_end - buf_ptr)*8;
        switch(stc) {
--- a/libavcodec/dca.c
+++ b/libavcodec/dca.c
@@ -1224,6 +1224,7 @@ static int dca_decode_frame(AVCodecContext * avctx,
    //set AVCodec values with parsed data
    avctx->sample_rate = s->sample_rate;
    avctx->bit_rate = s->bit_rate;
+    avctx->frame_size = s->sample_blocks * 32;

    channels = s->prim_channels + !!s->lfe;

--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -1448,15 +1448,17 @@ static void implicit_weight_table(H264Context *h, int field){
    for(ref0=ref_start; ref0 < ref_count0; ref0++){
        int poc0 = h->ref_list[0][ref0].poc;
        for(ref1=ref_start; ref1 < ref_count1; ref1++){
-            int poc1 = h->ref_list[1][ref1].poc;
-            int td = av_clip(poc1 - poc0, -128, 127);
-            int w= 32;
-            if(td){
-                int tb = av_clip(cur_poc - poc0, -128, 127);
-                int tx = (16384 + (FFABS(td) >> 1)) / td;
-                int dist_scale_factor = (tb*tx + 32) >> 8;
-                if(dist_scale_factor >= -64 && dist_scale_factor <= 128)
-                    w = 64 - dist_scale_factor;
+            int w = 32;
+            if (!h->ref_list[0][ref0].long_ref && !h->ref_list[1][ref1].long_ref) {
+                int poc1 = h->ref_list[1][ref1].poc;
+                int td = av_clip(poc1 - poc0, -128, 127);
+                if(td){
+                    int tb = av_clip(cur_poc - poc0, -128, 127);
+                    int tx = (16384 + (FFABS(td) >> 1)) / td;
+                    int dist_scale_factor = (tb*tx + 32) >> 8;
+                    if(dist_scale_factor >= -64 && dist_scale_factor <= 128)
+                        w = 64 - dist_scale_factor;
+                }
            }
            if(field<0){
                h->implicit_weight[ref0][ref1][0]=
@@ -1840,7 +1842,10 @@ static int decode_slice_header(H264Context *h, H264Context *h0){
        h->prev_interlaced_frame = 1;

        init_scan_tables(h);
-        ff_h264_alloc_tables(h);
+        if (ff_h264_alloc_tables(h) < 0) {
+            av_log(h->s.avctx, AV_LOG_ERROR, "Could not allocate memory for h264\n");
+            return AVERROR(ENOMEM);
+        }

        for(i = 1; i < s->avctx->thread_count; i++) {
            H264Context *c;
--- a/libavcodec/h264.h
+++ b/libavcodec/h264.h
@@ -1048,7 +1048,7 @@ static void fill_decode_caches(H264Context *h, int mb_type){
                AV_ZERO32(h->mv_cache [list][scan8[0] + 4 - 1*8]);
                h->ref_cache[list][scan8[0] + 4 - 1*8]= topright_type ? LIST_NOT_USED : PART_NOT_AVAILABLE;
            }
-            if(h->ref_cache[list][scan8[0] + 4 - 1*8] < 0){
+            if(h->ref_cache[list][scan8[0] + 2 - 1*8] < 0 || h->ref_cache[list][scan8[0] + 4 - 1*8] < 0){
                if(USES_LIST(topleft_type, list)){
                    const int b_xy = h->mb2b_xy [topleft_xy] + 3 + h->b_stride + (h->topleft_partition & 2*h->b_stride);
                    const int b8_xy= 4*topleft_xy + 1 + (h->topleft_partition & 2);
--- a/libavcodec/h264_ps.c
+++ b/libavcodec/h264_ps.c
@@ -297,6 +297,10 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){

    if(sps->profile_idc >= 100){ //high profile
        sps->chroma_format_idc= get_ue_golomb_31(&s->gb);
+        if (sps->chroma_format_idc > 3U) {
+            av_log(h->s.avctx, AV_LOG_ERROR, "chroma_format_idc %d is illegal\n", sps->chroma_format_idc);
+            goto fail;
+        }
        if(sps->chroma_format_idc == 3)
            sps->residual_color_transform_flag = get_bits1(&s->gb);
        sps->bit_depth_luma   = get_ue_golomb(&s->gb) + 8;
--- a/libavcodec/h264_refs.c
+++ b/libavcodec/h264_refs.c
@@ -657,7 +657,7 @@ int ff_h264_decode_ref_pic_marking(H264Context *h, GetBitContext *gb){
                }
                if(opcode==MMCO_SHORT2LONG || opcode==MMCO_LONG2UNUSED || opcode==MMCO_LONG || opcode==MMCO_SET_MAX_LONG){
                    unsigned int long_arg= get_ue_golomb_31(gb);
-                    if(long_arg >= 32 || (long_arg >= 16 && !(opcode == MMCO_LONG2UNUSED && FIELD_PICTURE))){
+                    if(long_arg >= 32 || (long_arg >= 16 && !(opcode == MMCO_SET_MAX_LONG && long_arg == 16) && !(opcode == MMCO_LONG2UNUSED && FIELD_PICTURE))){
                        av_log(h->s.avctx, AV_LOG_ERROR, "illegal long ref in memory management control operation %d\n", opcode);
                        return -1;
                    }
--- a/libavcodec/indeo2.c
+++ b/libavcodec/indeo2.c
@@ -156,6 +156,13 @@ static int ir2_decode_frame(AVCodecContext *avctx,
        return -1;
    }

+    start = 48; /* hardcoded for now */
+
+    if (start >= buf_size) {
+        av_log(s->avctx, AV_LOG_ERROR, "input buffer size too small (%d)\n", buf_size);
+        return AVERROR_INVALIDDATA;
+    }
+
    s->decode_delta = buf[18];

    /* decide whether frame uses deltas or not */
@@ -163,9 +170,8 @@ static int ir2_decode_frame(AVCodecContext *avctx,
    for (i = 0; i < buf_size; i++)
        buf[i] = av_reverse[buf[i]];
 #endif
-    start = 48; /* hardcoded for now */

-    init_get_bits(&s->gb, buf + start, buf_size - start);
+    init_get_bits(&s->gb, buf + start, (buf_size - start) * 8);

    if (s->decode_delta) { /* intraframe */
        ir2_decode_plane(s, avctx->width, avctx->height,
--- a/libavcodec/libvo-aacenc.c
+++ b/libavcodec/libvo-aacenc.c
@@ -0,0 +1,130 @@
+/*
+ * AAC encoder wrapper
+ * Copyright (c) 2010 Martin Storsjo
+ *
+ * This file is part of Libav.
+ *
+ * Libav is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * Libav is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with Libav; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include <vo-aacenc/voAAC.h>
+#include <vo-aacenc/cmnMemory.h>
+
+#include "avcodec.h"
+#include "mpeg4audio.h"
+
+typedef struct AACContext {
+    VO_AUDIO_CODECAPI codec_api;
+    VO_HANDLE handle;
+    VO_MEM_OPERATOR mem_operator;
+    VO_CODEC_INIT_USERDATA user_data;
+} AACContext;
+
+static av_cold int aac_encode_init(AVCodecContext *avctx)
+{
+    AACContext *s = avctx->priv_data;
+    AACENC_PARAM params = { 0 };
+    int index;
+
+    avctx->coded_frame = avcodec_alloc_frame();
+    avctx->frame_size = 1024;
+
+    voGetAACEncAPI(&s->codec_api);
+
+    s->mem_operator.Alloc = cmnMemAlloc;
+    s->mem_operator.Copy = cmnMemCopy;
+    s->mem_operator.Free = cmnMemFree;
+    s->mem_operator.Set = cmnMemSet;
+    s->mem_operator.Check = cmnMemCheck;
+    s->user_data.memflag = VO_IMF_USERMEMOPERATOR;
+    s->user_data.memData = &s->mem_operator;
+    s->codec_api.Init(&s->handle, VO_AUDIO_CodingAAC, &s->user_data);
+
+    params.sampleRate = avctx->sample_rate;
+    params.bitRate    = avctx->bit_rate;
+    params.nChannels  = avctx->channels;
+    params.adtsUsed   = !(avctx->flags & CODEC_FLAG_GLOBAL_HEADER);
+    if (s->codec_api.SetParam(s->handle, VO_PID_AAC_ENCPARAM, &params)
+        != VO_ERR_NONE) {
+        av_log(avctx, AV_LOG_ERROR, "Unable to set encoding parameters\n");
+        return AVERROR(EINVAL);
+    }
+
+    for (index = 0; index < 16; index++)
+        if (avctx->sample_rate == ff_mpeg4audio_sample_rates[index])
+            break;
+    if (index == 16) {
+        av_log(avctx, AV_LOG_ERROR, "Unsupported sample rate %d\n",
+                                    avctx->sample_rate);
+        return AVERROR(ENOSYS);
+    }
+    if (avctx->flags & CODEC_FLAG_GLOBAL_HEADER) {
+        avctx->extradata_size = 2;
+        avctx->extradata      = av_mallocz(avctx->extradata_size +
+                                           FF_INPUT_BUFFER_PADDING_SIZE);
+        if (!avctx->extradata)
+            return AVERROR(ENOMEM);
+
+        avctx->extradata[0] = 0x02 << 3 | index >> 1;
+        avctx->extradata[1] = (index & 0x01) << 7 | avctx->channels << 3;
+    }
+    return 0;
+}
+
+static int aac_encode_close(AVCodecContext *avctx)
+{
+    AACContext *s = avctx->priv_data;
+
+    s->codec_api.Uninit(s->handle);
+    av_freep(&avctx->coded_frame);
+
+    return 0;
+}
+
+static int aac_encode_frame(AVCodecContext *avctx,
+                            unsigned char *frame/*out*/,
+                            int buf_size, void *data/*in*/)
+{
+    AACContext *s = avctx->priv_data;
+    VO_CODECBUFFER input = { 0 }, output = { 0 };
+    VO_AUDIO_OUTPUTINFO output_info = { { 0 } };
+
+    input.Buffer = data;
+    input.Length = 2 * avctx->channels * avctx->frame_size;
+    output.Buffer = frame;
+    output.Length = buf_size;
+
+    s->codec_api.SetInputData(s->handle, &input);
+    if (s->codec_api.GetOutputData(s->handle, &output, &output_info)
+        != VO_ERR_NONE) {
+        av_log(avctx, AV_LOG_ERROR, "Unable to encode frame\n");
+        return AVERROR(EINVAL);
+    }
+    return output.Length;
+}
+
+AVCodec libvo_aacenc_encoder = {
+    "libvo_aacenc",
+    CODEC_TYPE_AUDIO,
+    CODEC_ID_AAC,
+    sizeof(AACContext),
+    aac_encode_init,
+    aac_encode_frame,
+    aac_encode_close,
+    NULL,
+    .sample_fmts = (const enum SampleFormat[]){SAMPLE_FMT_S16,SAMPLE_FMT_NONE},
+    .long_name = NULL_IF_CONFIG_SMALL("Android VisualOn AAC"),
+};
+
--- a/libavcodec/libx264.c
+++ b/libavcodec/libx264.c
@@ -127,7 +127,8 @@ static int X264_frame(AVCodecContext *ctx, uint8_t *buf,
    }

    x4->out_pic.key_frame = pic_out.b_keyframe;
-    x4->out_pic.quality   = (pic_out.i_qpplus1 - 1) * FF_QP2LAMBDA;
+    if (bufsize)
+        x4->out_pic.quality = (pic_out.i_qpplus1 - 1) * FF_QP2LAMBDA;

    return bufsize;
 }
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -792,6 +792,10 @@ static int mjpeg_decode_scan(MJpegDecodeContext *s, int nb_components, int Ah, i
            if (s->restart_interval && !s->restart_count)
                s->restart_count = s->restart_interval;

+            if(get_bits_count(&s->gb)>s->gb.size_in_bits){
+                av_log(s->avctx, AV_LOG_ERROR, "overread %d\n", get_bits_count(&s->gb) - s->gb.size_in_bits);
+                return -1;
+            }
            for(i=0;i<nb_components;i++) {
                uint8_t *ptr;
                int n, h, v, x, y, c, j;
@@ -835,9 +839,12 @@ static int mjpeg_decode_scan(MJpegDecodeContext *s, int nb_components, int Ah, i
                }
            }

-            if (s->restart_interval && !--s->restart_count) {
+            if (s->restart_interval && show_bits(&s->gb, 8) == 0xFF){ /* skip RSTn */
+                --s->restart_count;
                align_get_bits(&s->gb);
-                skip_bits(&s->gb, 16); /* skip RSTn */
+                while(show_bits(&s->gb, 8) == 0xFF)
+                    skip_bits(&s->gb, 8);
+                skip_bits(&s->gb, 8);
                for (i=0; i<nb_components; i++) /* reset dc */
                    s->last_dc[i] = 1024;
            }
--- a/libavcodec/mpegvideo.c
+++ b/libavcodec/mpegvideo.c
@@ -282,9 +282,10 @@ int ff_alloc_picture(MpegEncContext *s, Picture *pic, int shared){
        }

        FF_ALLOCZ_OR_GOTO(s->avctx, pic->mbskip_table , mb_array_size * sizeof(uint8_t)+2, fail) //the +2 is for the slice end check
-        FF_ALLOCZ_OR_GOTO(s->avctx, pic->qscale_table , mb_array_size * sizeof(uint8_t)  , fail)
+        FF_ALLOCZ_OR_GOTO(s->avctx, pic->qscale_table_base , (big_mb_num + s->mb_stride) * sizeof(uint8_t)  , fail)
        FF_ALLOCZ_OR_GOTO(s->avctx, pic->mb_type_base , (big_mb_num + s->mb_stride) * sizeof(uint32_t), fail)
        pic->mb_type= pic->mb_type_base + 2*s->mb_stride+1;
+        pic->qscale_table = pic->qscale_table_base + 2*s->mb_stride + 1;
        if(s->out_format == FMT_H264){
            for(i=0; i<2; i++){
                FF_ALLOCZ_OR_GOTO(s->avctx, pic->motion_val_base[i], 2 * (b4_array_size+4)  * sizeof(int16_t), fail)
@@ -335,7 +336,7 @@ static void free_picture(MpegEncContext *s, Picture *pic){
    av_freep(&pic->mc_mb_var);
    av_freep(&pic->mb_mean);
    av_freep(&pic->mbskip_table);
-    av_freep(&pic->qscale_table);
+    av_freep(&pic->qscale_table_base);
    av_freep(&pic->mb_type_base);
    av_freep(&pic->dct_coeff);
    av_freep(&pic->pan_scan);
--- a/libavcodec/mpegvideo.h
+++ b/libavcodec/mpegvideo.h
@@ -86,6 +86,7 @@ typedef struct Picture{
     * halfpel luma planes.
     */
    uint8_t *interpolated[3];
+    int8_t *qscale_table_base;
    int16_t (*motion_val_base[2])[2];
    uint32_t *mb_type_base;
 #define MB_TYPE_INTRA MB_TYPE_INTRA4x4 //default mb_type if there is just one type
--- a/libavcodec/qdm2.c
+++ b/libavcodec/qdm2.c
@@ -75,6 +75,7 @@ do { \
 #define SAMPLES_NEEDED_2(why) \
     av_log (NULL,AV_LOG_INFO,"This file triggers some missing code. Please contact the developers.\nPosition: %s\n",why);

+#define QDM2_MAX_FRAME_SIZE 512

 typedef int8_t sb_int8_array[2][30][64];

@@ -167,7 +168,7 @@ typedef struct {
    /// I/O data
    const uint8_t *compressed_data;
    int compressed_size;
-    float output_buffer[1024];
+    float output_buffer[QDM2_MAX_FRAME_SIZE * 2];

    /// Synthesis filter
    DECLARE_ALIGNED(16, MPA_INT, synth_buf)[MPA_MAX_CHANNELS][512*2];
@@ -1355,6 +1356,8 @@ static void qdm2_fft_decode_tones (QDM2Context *q, int duration, GetBitContext *
            return;

        local_int_14 = (offset >> local_int_8);
+        if (local_int_14 >= FF_ARRAY_ELEMS(fft_level_index_table))
+            return;

        if (q->nb_channels > 1) {
            channel = get_bits1(gb);
@@ -1799,6 +1802,8 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx)

    avctx->channels = s->nb_channels = s->channels = AV_RB32(extradata);
    extradata += 4;
+    if (s->channels > MPA_MAX_CHANNELS)
+        return AVERROR_INVALIDDATA;

    avctx->sample_rate = AV_RB32(extradata);
    extradata += 4;
@@ -1820,6 +1825,8 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx)
    // something like max decodable tones
    s->group_order = av_log2(s->group_size) + 1;
    s->frame_size = s->group_size / 16; // 16 iterations per super block
+    if (s->frame_size > QDM2_MAX_FRAME_SIZE)
+        return AVERROR_INVALIDDATA;

    s->sub_sampling = s->fft_order - 7;
    s->frequency_range = 255 / (1 << (2 - s->sub_sampling));
@@ -1883,7 +1890,7 @@ static av_cold int qdm2_decode_close(AVCodecContext *avctx)
 }


-static void qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out)
+static int qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out)
 {
    int ch, i;
    const int frame_size = (q->frame_size * q->channels);
@@ -1919,7 +1926,7 @@ static void qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out)

        if (!q->has_errors && q->sub_packet_list_C[0].packet != NULL) {
            SAMPLES_NEEDED_2("has errors, and C list is not empty")
-            return;
+            return -1;
        }
    }

@@ -1940,6 +1947,8 @@ static void qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out)

        out[i] = value;
    }
+
+    return 0;
 }


@@ -1950,25 +1959,33 @@ static int qdm2_decode_frame(AVCodecContext *avctx,
    const uint8_t *buf = avpkt->data;
    int buf_size = avpkt->size;
    QDM2Context *s = avctx->priv_data;
+    int16_t *out = data;
+    int i, out_size;

    if(!buf)
        return 0;
    if(buf_size < s->checksum_size)
        return -1;

-    *data_size = s->channels * s->frame_size * sizeof(int16_t);
+    out_size = 16 * s->channels * s->frame_size *
+               av_get_bits_per_sample_format(avctx->sample_fmt)/8;
+    if (*data_size < out_size) {
+        av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\n");
+        return AVERROR(EINVAL);
+    }

    av_log(avctx, AV_LOG_DEBUG, "decode(%d): %p[%d] -> %p[%d]\n",
       buf_size, buf, s->checksum_size, data, *data_size);

-    qdm2_decode(s, buf, data);
-
-    // reading only when next superblock found
-    if (s->sub_packet == 0) {
-        return s->checksum_size;
+    for (i = 0; i < 16; i++) {
+        if (qdm2_decode(s, buf, out) < 0)
+            return -1;
+        out += s->channels * s->frame_size;
    }

-    return 0;
+    *data_size = out_size;
+
+    return buf_size;
 }

 AVCodec qdm2_decoder =
--- a/libavcodec/rv10.c
+++ b/libavcodec/rv10.c
@@ -454,6 +454,7 @@ static av_cold int rv10_decode_init(AVCodecContext *avctx)
    s->avctx= avctx;
    s->out_format = FMT_H263;
    s->codec_id= avctx->codec_id;
+    avctx->flags |= CODEC_FLAG_EMU_EDGE;

    s->orig_width = s->width  = avctx->coded_width;
    s->orig_height= s->height = avctx->coded_height;
@@ -558,6 +559,11 @@ static int rv10_decode_packet(AVCodecContext *avctx,
        if(MPV_frame_start(s, avctx) < 0)
            return -1;
        ff_er_frame_start(s);
+    } else {
+        if (s->current_picture_ptr->pict_type != s->pict_type) {
+            av_log(s->avctx, AV_LOG_ERROR, "Slice type mismatch\n");
+            return -1;
+        }
    }

    dprintf(avctx, "qscale=%d\n", s->qscale);
--- a/libavcodec/rv30.c
+++ b/libavcodec/rv30.c
@@ -256,6 +256,7 @@ static av_cold int rv30_decode_init(AVCodecContext *avctx)
    if(avctx->extradata_size - 8 < (r->rpr - 1) * 2){
        av_log(avctx, AV_LOG_ERROR, "Insufficient extradata - need at least %d bytes, got %d\n",
               6 + r->rpr * 2, avctx->extradata_size);
+        return AVERROR(EINVAL);
    }
    r->parse_slice_header = rv30_parse_slice_header;
    r->decode_intra_types = rv30_decode_intra_types;
--- a/libavcodec/rv34.c
+++ b/libavcodec/rv34.c
@@ -1439,12 +1439,14 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
        slice_count = (*buf++) + 1;
        slices_hdr = buf + 4;
        buf += 8 * slice_count;
+        buf_size -= 1 + 8 * slice_count;
    }else
        slice_count = avctx->slice_count;

    //parse first slice header to check whether this frame can be decoded
-    if(get_slice_offset(avctx, slices_hdr, 0) > buf_size){
-        av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n");
+    if(get_slice_offset(avctx, slices_hdr, 0) < 0 ||
+       get_slice_offset(avctx, slices_hdr, 0) > buf_size){
+        av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n");
        return -1;
    }
    init_get_bits(&s->gb, buf+get_slice_offset(avctx, slices_hdr, 0), buf_size-get_slice_offset(avctx, slices_hdr, 0));
@@ -1459,7 +1461,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
    if(   (avctx->skip_frame >= AVDISCARD_NONREF && si.type==FF_B_TYPE)
       || (avctx->skip_frame >= AVDISCARD_NONKEY && si.type!=FF_I_TYPE)
       ||  avctx->skip_frame >= AVDISCARD_ALL)
-        return buf_size;
+        return avpkt->size;
    /* skip everything if we are in a hurry>=5 */
    if(avctx->hurry_up>=5)
        return buf_size;
@@ -1472,8 +1474,8 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
        else
            size= get_slice_offset(avctx, slices_hdr, i+1) - offset;

-        if(offset > buf_size){
-            av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n");
+        if(offset < 0 || offset > buf_size || size < 0){
+            av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n");
            break;
        }

@@ -1494,7 +1496,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
            break;
    }

-    if(last){
+    if(last && s->current_picture_ptr){
        if(r->loop_filter)
            r->loop_filter(r, s->mb_height - 1);
        ff_er_frame_end(s);
@@ -1511,7 +1513,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
        }
        s->current_picture_ptr= NULL; //so we can detect if frame_end wasnt called (find some nicer solution...)
    }
-    return buf_size;
+    return avpkt->size;
 }

 av_cold int ff_rv34_decode_end(AVCodecContext *avctx)
--- a/libavcodec/smacker.c
+++ b/libavcodec/smacker.c
@@ -133,11 +133,13 @@ static int smacker_decode_bigtree(GetBitContext *gb, HuffContext *hc, DBCtx *ctx
            return -1;
        }
        b1 = get_bits_count(gb);
-        i1 = get_vlc2(gb, ctx->v1->table, SMKTREE_BITS, 3);
+        i1 = ctx->v1->table ? get_vlc2(gb, ctx->v1->table, SMKTREE_BITS, 3) : 0;
        b1 = get_bits_count(gb) - b1;
        b2 = get_bits_count(gb);
-        i2 = get_vlc2(gb, ctx->v2->table, SMKTREE_BITS, 3);
+        i2 = ctx->v2->table ? get_vlc2(gb, ctx->v2->table, SMKTREE_BITS, 3) : 0;
        b2 = get_bits_count(gb) - b2;
+        if (i1 < 0 || i2 < 0)
+            return -1;
        val = ctx->recode1[i1] | (ctx->recode2[i2] << 8);
        if(val == ctx->escapes[0]) {
            ctx->last[0] = hc->current;
@@ -289,7 +291,8 @@ static int decode_header_trees(SmackVContext *smk) {
        smk->mmap_tbl[0] = 0;
        smk->mmap_last[0] = smk->mmap_last[1] = smk->mmap_last[2] = 1;
    } else {
-        smacker_decode_header_tree(smk, &gb, &smk->mmap_tbl, smk->mmap_last, mmap_size);
+        if (smacker_decode_header_tree(smk, &gb, &smk->mmap_tbl, smk->mmap_last, mmap_size))
+            return -1;
    }
    if(!get_bits1(&gb)) {
        av_log(smk->avctx, AV_LOG_INFO, "Skipping MCLR tree\n");
@@ -297,7 +300,8 @@ static int decode_header_trees(SmackVContext *smk) {
        smk->mclr_tbl[0] = 0;
        smk->mclr_last[0] = smk->mclr_last[1] = smk->mclr_last[2] = 1;
    } else {
-        smacker_decode_header_tree(smk, &gb, &smk->mclr_tbl, smk->mclr_last, mclr_size);
+        if (smacker_decode_header_tree(smk, &gb, &smk->mclr_tbl, smk->mclr_last, mclr_size))
+            return -1;
    }
    if(!get_bits1(&gb)) {
        av_log(smk->avctx, AV_LOG_INFO, "Skipping FULL tree\n");
@@ -305,7 +309,8 @@ static int decode_header_trees(SmackVContext *smk) {
        smk->full_tbl[0] = 0;
        smk->full_last[0] = smk->full_last[1] = smk->full_last[2] = 1;
    } else {
-        smacker_decode_header_tree(smk, &gb, &smk->full_tbl, smk->full_last, full_size);
+        if (smacker_decode_header_tree(smk, &gb, &smk->full_tbl, smk->full_last, full_size))
+            return -1;
    }
    if(!get_bits1(&gb)) {
        av_log(smk->avctx, AV_LOG_INFO, "Skipping TYPE tree\n");
@@ -313,7 +318,8 @@ static int decode_header_trees(SmackVContext *smk) {
        smk->type_tbl[0] = 0;
        smk->type_last[0] = smk->type_last[1] = smk->type_last[2] = 1;
    } else {
-        smacker_decode_header_tree(smk, &gb, &smk->type_tbl, smk->type_last, type_size);
+        if (smacker_decode_header_tree(smk, &gb, &smk->type_tbl, smk->type_last, type_size))
+            return -1;
    }

    return 0;
@@ -523,8 +529,8 @@ static av_cold int decode_init(AVCodecContext *avctx)
        return -1;
    }

-    decode_header_trees(c);
-
+    if (decode_header_trees(c))
+        return -1;

    return 0;
 }
@@ -619,9 +625,9 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
    if(bits) { //decode 16-bit data
        for(i = stereo; i >= 0; i--)
            pred[i] = bswap_16(get_bits(&gb, 16));
-        for(i = 0; i < stereo; i++)
+        for(i = 0; i <= stereo; i++)
            *samples++ = pred[i];
-        for(i = 0; i < unp_size / 2; i++) {
+        for(; i < unp_size / 2; i++) {
            if(i & stereo) {
                if(vlc[2].table)
                    res = get_vlc2(&gb, vlc[2].table, SMKTREE_BITS, 3);
@@ -653,9 +659,9 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
    } else { //8-bit data
        for(i = stereo; i >= 0; i--)
            pred[i] = get_bits(&gb, 8);
-        for(i = 0; i < stereo; i++)
+        for(i = 0; i <= stereo; i++)
            *samples8++ = pred[i];
-        for(i = 0; i < unp_size; i++) {
+        for(; i < unp_size; i++) {
            if(i & stereo){
                if(vlc[1].table)
                    res = get_vlc2(&gb, vlc[1].table, SMKTREE_BITS, 3);
--- a/libavcodec/sp5xdec.c
+++ b/libavcodec/sp5xdec.c
@@ -90,7 +90,6 @@ static int sp5x_decode_frame(AVCodecContext *avctx,
    recoded[j++] = 0xFF;
    recoded[j++] = 0xD9;

-    avctx->flags &= ~CODEC_FLAG_EMU_EDGE;
    av_init_packet(&avpkt_recoded);
    avpkt_recoded.data = recoded;
    avpkt_recoded.size = j;
@@ -216,6 +215,6 @@ AVCodec amv_decoder = {
    NULL,
    ff_mjpeg_decode_end,
    sp5x_decode_frame,
-    CODEC_CAP_DR1,
+    0,
    .long_name = NULL_IF_CONFIG_SMALL("AMV Video"),
 };
--- a/libavcodec/svq1dec.c
+++ b/libavcodec/svq1dec.c
@@ -678,6 +678,7 @@ static int svq1_decode_frame(AVCodecContext *avctx,
 #endif
    return result;
  }
+  avcodec_set_dimensions(avctx, s->width, s->height);

  //FIXME this avoids some confusion for "B frames" without 2 references
  //this should be removed after libavcodec can handle more flexible picture types & ordering
--- a/libavcodec/tableprint.c
+++ b/libavcodec/tableprint.c
@@ -33,6 +33,7 @@ WRITE_1D_FUNC(float,  float,    "%.18e", 3)
 WRITE_2D_FUNC(int8,   int8_t)
 WRITE_2D_FUNC(uint8,  uint8_t)
 WRITE_2D_FUNC(uint32, uint32_t)
+WRITE_2D_FUNC(float,  float)

 void write_fileheader(void) {
    printf("/* This file was generated by libavcodec/tableprint */\n");
--- a/libavcodec/tableprint.h
+++ b/libavcodec/tableprint.h
@@ -66,6 +66,7 @@ void write_float_array    (const float    *, int);
 void write_int8_2d_array  (const void *, int, int);
 void write_uint8_2d_array (const void *, int, int);
 void write_uint32_2d_array(const void *, int, int);
+void write_float_2d_array (const void *, int, int);
 /** \} */ // end of printfuncs group

 /** Write a standard file header */
--- a/libavcodec/vc1.c
+++ b/libavcodec/vc1.c
@@ -467,8 +467,8 @@ static int decode_sequence_header_adv(VC1Context *v, GetBitContext *gb)
        if(ar && ar < 14){
            v->s.avctx->sample_aspect_ratio = ff_vc1_pixel_aspect[ar];
        }else if(ar == 15){
-            w = get_bits(gb, 8);
-            h = get_bits(gb, 8);
+            w = get_bits(gb, 8) + 1;
+            h = get_bits(gb, 8) + 1;
            v->s.avctx->sample_aspect_ratio = (AVRational){w, h};
        }
        av_log(v->s.avctx, AV_LOG_DEBUG, "Aspect: %i:%i\n", v->s.avctx->sample_aspect_ratio.num, v->s.avctx->sample_aspect_ratio.den);
--- a/libavcodec/vc1dec.c
+++ b/libavcodec/vc1dec.c
@@ -1365,7 +1365,7 @@ static void vc1_decode_ac_coeff(VC1Context *v, int *last, int *skip, int *value,
    if (index != vc1_ac_sizes[codingset] - 1) {
        run = vc1_index_decode_table[codingset][index][0];
        level = vc1_index_decode_table[codingset][index][1];
-        lst = index >= vc1_last_decode_table[codingset];
+        lst = index >= vc1_last_decode_table[codingset] || get_bits_left(gb) < 0;
        if(get_bits1(gb))
            level = -level;
    } else {
--- a/libavcodec/vmdav.c
+++ b/libavcodec/vmdav.c
@@ -72,9 +72,11 @@ typedef struct VmdVideoContext {
 #define QUEUE_SIZE 0x1000
 #define QUEUE_MASK 0x0FFF

-static void lz_unpack(const unsigned char *src, unsigned char *dest, int dest_len)
+static void lz_unpack(const unsigned char *src, int src_len,
+                      unsigned char *dest, int dest_len)
 {
    const unsigned char *s;
+    unsigned int s_len;
    unsigned char *d;
    unsigned char *d_end;
    unsigned char queue[QUEUE_SIZE];
@@ -87,13 +89,16 @@ static void lz_unpack(const unsigned char *src, unsigned char *dest, int dest_le
    unsigned int i, j;

    s = src;
+    s_len = src_len;
    d = dest;
    d_end = d + dest_len;
    dataleft = AV_RL32(s);
-    s += 4;
+    s += 4; s_len -= 4;
    memset(queue, 0x20, QUEUE_SIZE);
+    if (s_len < 4)
+        return;
    if (AV_RL32(s) == 0x56781234) {
-        s += 4;
+        s += 4; s_len -= 4;
        qpos = 0x111;
        speclen = 0xF + 3;
    } else {
@@ -101,32 +106,41 @@ static void lz_unpack(const unsigned char *src, unsigned char *dest, int dest_le
        speclen = 100;  /* no speclen */
    }

-    while (dataleft > 0) {
-        tag = *s++;
+    while (dataleft > 0 && s_len > 0) {
+        tag = *s++; s_len--;
        if ((tag == 0xFF) && (dataleft > 8)) {
-            if (d + 8 > d_end)
+            if (d + 8 > d_end || s_len < 8)
                return;
            for (i = 0; i < 8; i++) {
                queue[qpos++] = *d++ = *s++;
                qpos &= QUEUE_MASK;
            }
+            s_len -= 8;
            dataleft -= 8;
        } else {
            for (i = 0; i < 8; i++) {
                if (dataleft == 0)
                    break;
                if (tag & 0x01) {
-                    if (d + 1 > d_end)
+                    if (d + 1 > d_end || s_len < 1)
                        return;
                    queue[qpos++] = *d++ = *s++;
                    qpos &= QUEUE_MASK;
                    dataleft--;
+                    s_len--;
                } else {
+                    if (s_len < 2)
+                        return;
                    chainofs = *s++;
                    chainofs |= ((*s & 0xF0) << 4);
                    chainlen = (*s++ & 0x0F) + 3;
-                    if (chainlen == speclen)
+                    s_len -= 2;
+                    if (chainlen == speclen) {
+                        if (s_len < 1)
+                            return;
                        chainlen = *s++ + 0xF + 3;
+                        s_len--;
+                    }
                    if (d + chainlen > d_end)
                        return;
                    for (j = 0; j < chainlen; j++) {
@@ -143,7 +157,7 @@ static void lz_unpack(const unsigned char *src, unsigned char *dest, int dest_le
 }

 static int rle_unpack(const unsigned char *src, unsigned char *dest,
-    int src_len, int dest_len)
+    int src_count, int src_size, int dest_len)
 {
    const unsigned char *ps;
    unsigned char *pd;
@@ -152,31 +166,40 @@ static int rle_unpack(const unsigned char *src, unsigned char *dest,

    ps = src;
    pd = dest;
-    if (src_len & 1)
+    if (src_count & 1) {
+        if (src_size < 1)
+            return 0;
        *pd++ = *ps++;
+        src_size--;
+    }

-    src_len >>= 1;
+    src_count >>= 1;
    i = 0;
    do {
+        if (src_size < 1)
+            break;
        l = *ps++;
+        src_size--;
        if (l & 0x80) {
            l = (l & 0x7F) * 2;
-            if (pd + l > dest_end)
+            if (pd + l > dest_end || src_size < l)
                return ps - src;
            memcpy(pd, ps, l);
            ps += l;
+            src_size -= l;
            pd += l;
        } else {
-            if (pd + i > dest_end)
+            if (pd + i > dest_end || src_size < 2)
                return ps - src;
            for (i = 0; i < l; i++) {
                *pd++ = ps[0];
                *pd++ = ps[1];
            }
            ps += 2;
+            src_size -= 2;
        }
        i += l;
-    } while (i < src_len);
+    } while (i < src_count);

    return ps - src;
 }
@@ -191,6 +214,7 @@ static void vmd_decode(VmdVideoContext *s)
    const unsigned char *p = s->buf + 16;

    const unsigned char *pb;
+    unsigned int pb_size;
    unsigned char meth;
    unsigned char *dp;   /* pointer to current frame */
    unsigned char *pp;   /* pointer to previous frame */
@@ -205,6 +229,16 @@ static void vmd_decode(VmdVideoContext *s)
    frame_y = AV_RL16(&s->buf[8]);
    frame_width = AV_RL16(&s->buf[10]) - frame_x + 1;
    frame_height = AV_RL16(&s->buf[12]) - frame_y + 1;
+    if (frame_x < 0 || frame_width < 0 ||
+        frame_x >= s->avctx->width ||
+        frame_width > s->avctx->width ||
+        frame_x + frame_width > s->avctx->width)
+        return;
+    if (frame_y < 0 || frame_height < 0 ||
+        frame_y >= s->avctx->height ||
+        frame_height > s->avctx->height ||
+        frame_y + frame_height > s->avctx->height)
+        return;

    if ((frame_width == s->avctx->width && frame_height == s->avctx->height) &&
        (frame_x || frame_y)) {
@@ -217,8 +251,9 @@ static void vmd_decode(VmdVideoContext *s)

    /* if only a certain region will be updated, copy the entire previous
     * frame before the decode */
-    if (frame_x || frame_y || (frame_width != s->avctx->width) ||
-        (frame_height != s->avctx->height)) {
+    if (s->prev_frame.data[0] &&
+        (frame_x || frame_y || (frame_width != s->avctx->width) ||
+        (frame_height != s->avctx->height))) {

        memcpy(s->frame.data[0], s->prev_frame.data[0],
            s->avctx->height * s->frame.linesize[0]);
@@ -236,14 +271,19 @@ static void vmd_decode(VmdVideoContext *s)
        }
        s->size -= (256 * 3 + 2);
    }
-    if (s->size >= 0) {
+    if (s->size > 0) {
        /* originally UnpackFrame in VAG's code */
        pb = p;
-        meth = *pb++;
+        pb_size = s->buf + s->size - pb;
+        if (pb_size < 1)
+            return;
+        meth = *pb++; pb_size--;
        if (meth & 0x80) {
-            lz_unpack(pb, s->unpack_buffer, s->unpack_buffer_size);
+            lz_unpack(pb, pb_size,
+                      s->unpack_buffer, s->unpack_buffer_size);
            meth &= 0x7F;
            pb = s->unpack_buffer;
+            pb_size = s->unpack_buffer_size;
        }

        dp = &s->frame.data[0][frame_y * s->frame.linesize[0] + frame_x];
@@ -254,17 +294,21 @@ static void vmd_decode(VmdVideoContext *s)
            for (i = 0; i < frame_height; i++) {
                ofs = 0;
                do {
+                    if (pb_size < 1)
+                        return;
                    len = *pb++;
+                    pb_size--;
                    if (len & 0x80) {
                        len = (len & 0x7F) + 1;
-                        if (ofs + len > frame_width)
+                        if (ofs + len > frame_width || pb_size < len)
                            return;
                        memcpy(&dp[ofs], pb, len);
                        pb += len;
+                        pb_size -= len;
                        ofs += len;
                    } else {
                        /* interframe pixel copy */
-                        if (ofs + len + 1 > frame_width)
+                        if (ofs + len + 1 > frame_width || !s->prev_frame.data[0])
                            return;
                        memcpy(&dp[ofs], &pp[ofs], len + 1);
                        ofs += len + 1;
@@ -282,8 +326,11 @@ static void vmd_decode(VmdVideoContext *s)

        case 2:
            for (i = 0; i < frame_height; i++) {
+                if (pb_size < frame_width)
+                    return;
                memcpy(dp, pb, frame_width);
                pb += frame_width;
+                pb_size -= frame_width;
                dp += s->frame.linesize[0];
                pp += s->prev_frame.linesize[0];
            }
@@ -293,18 +340,27 @@ static void vmd_decode(VmdVideoContext *s)
            for (i = 0; i < frame_height; i++) {
                ofs = 0;
                do {
+                    if (pb_size < 1)
+                        return;
                    len = *pb++;
+                    pb_size--;
                    if (len & 0x80) {
                        len = (len & 0x7F) + 1;
+                        if (pb_size < 1)
+                            return;
                        if (*pb++ == 0xFF)
-                            len = rle_unpack(pb, &dp[ofs], len, frame_width - ofs);
-                        else
+                            len = rle_unpack(pb, &dp[ofs], len, pb_size, frame_width - ofs);
+                        else {
+                            if (pb_size < len)
+                                return;
                            memcpy(&dp[ofs], pb, len);
+                        }
                        pb += len;
+                        pb_size -= 1 + len;
                        ofs += len;
                    } else {
                        /* interframe pixel copy */
-                        if (ofs + len + 1 > frame_width)
+                        if (ofs + len + 1 > frame_width || !s->prev_frame.data[0])
                            return;
                        memcpy(&dp[ofs], &pp[ofs], len + 1);
                        ofs += len + 1;
--- a/libavcodec/vorbis.c
+++ b/libavcodec/vorbis.c
@@ -156,7 +156,7 @@ void ff_vorbis_ready_floor1_list(vorbis_floor1_entry * list, int values)
    }
 }

-static inline void render_line_unrolled(intptr_t x, intptr_t y, int x1,
+static inline void render_line_unrolled(intptr_t x, uint8_t y, int x1,
                                        intptr_t sy, int ady, int adx,
                                        float *buf)
 {
@@ -179,7 +179,7 @@ static inline void render_line_unrolled(intptr_t x, intptr_t y, int x1,
    }
 }

-static void render_line(int x0, int y0, int x1, int y1, float *buf)
+static void render_line(int x0, uint8_t y0, int x1, int y1, float *buf)
 {
    int dy  = y1 - y0;
    int adx = x1 - x0;
@@ -189,10 +189,10 @@ static void render_line(int x0, int y0, int x1, int y1, float *buf)
    if (ady*2 <= adx) { // optimized common case
        render_line_unrolled(x0, y0, x1, sy, ady, adx, buf);
    } else {
-        int base = dy / adx;
-        int x    = x0;
-        int y    = y0;
-        int err  = -adx;
+        int base  = dy / adx;
+        int x     = x0;
+        uint8_t y = y0;
+        int err   = -adx;
        ady -= FFABS(base) * adx;
        while (++x < x1) {
            y += base;
@@ -210,7 +210,8 @@ void ff_vorbis_floor1_render_list(vorbis_floor1_entry * list, int values,
                                  uint_fast16_t *y_list, int *flag,
                                  int multiplier, float *out, int samples)
 {
-    int lx, ly, i;
+    int lx, i;
+    uint8_t ly;
    lx = 0;
    ly = y_list[0] * multiplier;
    for (i = 1; i < values; i++) {
--- a/libavcodec/vorbis_dec.c
+++ b/libavcodec/vorbis_dec.c
@@ -61,8 +61,8 @@ typedef struct vorbis_floor0_s vorbis_floor0;
 typedef struct vorbis_floor1_s vorbis_floor1;
 struct vorbis_context_s;
 typedef
-uint_fast8_t (* vorbis_floor_decode_func)
-             (struct vorbis_context_s *, vorbis_floor_data *, float *);
+int (* vorbis_floor_decode_func)
+    (struct vorbis_context_s *, vorbis_floor_data *, float *);
 typedef struct {
    uint_fast8_t floor_type;
    vorbis_floor_decode_func decode;
@@ -453,11 +453,11 @@ static int vorbis_parse_setup_hdr_tdtransforms(vorbis_context *vc)

 // Process floors part

-static uint_fast8_t vorbis_floor0_decode(vorbis_context *vc,
-                                         vorbis_floor_data *vfu, float *vec);
+static int vorbis_floor0_decode(vorbis_context *vc,
+                                vorbis_floor_data *vfu, float *vec);
 static void create_map(vorbis_context *vc, uint_fast8_t floor_number);
-static uint_fast8_t vorbis_floor1_decode(vorbis_context *vc,
-                                         vorbis_floor_data *vfu, float *vec);
+static int vorbis_floor1_decode(vorbis_context *vc,
+                                vorbis_floor_data *vfu, float *vec);
 static int vorbis_parse_setup_hdr_floors(vorbis_context *vc)
 {
    GetBitContext *gb = &vc->gb;
@@ -477,6 +477,7 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context *vc)
        if (floor_setup->floor_type == 1) {
            uint_fast8_t  maximum_class = 0;
            uint_fast8_t  rangebits;
+            uint_fast32_t rangemax;
            uint_fast16_t floor1_values = 2;

            floor_setup->decode = vorbis_floor1_decode;
@@ -530,8 +531,15 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context *vc)


            rangebits = get_bits(gb, 4);
+            rangemax = (1 << rangebits);
+            if (rangemax > vc->blocksize[1] / 2) {
+                av_log(vc->avccontext, AV_LOG_ERROR,
+                       "Floor value is too large for blocksize: %d (%d)\n",
+                       rangemax, vc->blocksize[1] / 2);
+                return -1;
+            }
            floor_setup->data.t1.list[0].x = 0;
-            floor_setup->data.t1.list[1].x = (1 << rangebits);
+            floor_setup->data.t1.list[1].x = rangemax;

            for (j = 0; j < floor_setup->data.t1.partitions; ++j) {
                for (k = 0; k < floor_setup->data.t1.class_dimensions[floor_setup->data.t1.partition_class[j]]; ++k, ++floor1_values) {
@@ -648,7 +656,7 @@ static int vorbis_parse_setup_hdr_residues(vorbis_context *vc)
        res_setup->partition_size = get_bits(gb, 24) + 1;
        /* Validations to prevent a buffer overflow later. */
        if (res_setup->begin>res_setup->end ||
-            res_setup->end>vc->blocksize[1] / (res_setup->type == 2 ? 1 : 2) ||
+            res_setup->end > (res_setup->type == 2 ? vc->avccontext->channels : 1) * vc->blocksize[1] / 2 ||
            (res_setup->end-res_setup->begin) / res_setup->partition_size > V_MAX_PARTITIONS) {
            av_log(vc->avccontext, AV_LOG_ERROR, "partition out of bounds: type, begin, end, size, blocksize: %"PRIdFAST16", %"PRIdFAST32", %"PRIdFAST32", %"PRIdFAST32", %"PRIdFAST32"\n", res_setup->type, res_setup->begin, res_setup->end, res_setup->partition_size, vc->blocksize[1] / 2);
            return -1;
@@ -1002,8 +1010,8 @@ static av_cold int vorbis_decode_init(AVCodecContext *avccontext)

 // Read and decode floor

-static uint_fast8_t vorbis_floor0_decode(vorbis_context *vc,
-                                         vorbis_floor_data *vfu, float *vec)
+static int vorbis_floor0_decode(vorbis_context *vc,
+                                vorbis_floor_data *vfu, float *vec)
 {
    vorbis_floor0 *vf = &vfu->t0;
    float *lsp = vf->lsp;
@@ -1027,6 +1035,9 @@ static uint_fast8_t vorbis_floor0_decode(vorbis_context *vc,
        }
        AV_DEBUG("floor0 dec: booknumber: %u\n", book_idx);
        codebook = vc->codebooks[vf->book_list[book_idx]];
+        /* Invalid codebook! */
+        if (!codebook.codevectors)
+            return -1;

        while (lsp_len<vf->order) {
            int vec_off;
@@ -1112,8 +1123,8 @@ static uint_fast8_t vorbis_floor0_decode(vorbis_context *vc,
    return 0;
 }

-static uint_fast8_t vorbis_floor1_decode(vorbis_context *vc,
-                                         vorbis_floor_data *vfu, float *vec)
+static int vorbis_floor1_decode(vorbis_context *vc,
+                                vorbis_floor_data *vfu, float *vec)
 {
    vorbis_floor1 *vf = &vfu->t1;
    GetBitContext *gb = &vc->gb;
@@ -1251,6 +1262,7 @@ static av_always_inline int vorbis_residue_decode_internal(vorbis_context *vc,
                                                           uint_fast8_t *do_not_decode,
                                                           float *vec,
                                                           uint_fast16_t vlen,
+                                                           unsigned ch_left,
                                                           int vr_type)
 {
    GetBitContext *gb = &vc->gb;
@@ -1262,6 +1274,7 @@ static av_always_inline int vorbis_residue_decode_internal(vorbis_context *vc,
    uint_fast8_t ch_used;
    uint_fast8_t i,j,l;
    uint_fast16_t k;
+    unsigned max_output = (ch - 1) * vlen;

    if (vr_type == 2) {
        for (j = 1; j < ch; ++j)
@@ -1269,8 +1282,15 @@ static av_always_inline int vorbis_residue_decode_internal(vorbis_context *vc,
        if (do_not_decode[0])
            return 0;
        ch_used = 1;
+        max_output += vr->end / ch;
    } else {
        ch_used = ch;
+        max_output += vr->end;
+    }
+
+    if (max_output > ch_left * vlen) {
+        av_log(vc->avccontext, AV_LOG_ERROR, "Insufficient output buffer\n");
+        return -1;
    }

    AV_DEBUG(" residue type 0/1/2 decode begin, ch: %d  cpc %d  \n", ch, c_p_c);
@@ -1392,14 +1412,16 @@ static av_always_inline int vorbis_residue_decode_internal(vorbis_context *vc,
 static inline int vorbis_residue_decode(vorbis_context *vc, vorbis_residue *vr,
                                        uint_fast8_t ch,
                                        uint_fast8_t *do_not_decode,
-                                        float *vec, uint_fast16_t vlen)
+                                        float *vec, uint_fast16_t vlen,
+                                        unsigned ch_left)
+
 {
    if (vr->type == 2)
-        return vorbis_residue_decode_internal(vc, vr, ch, do_not_decode, vec, vlen, 2);
+        return vorbis_residue_decode_internal(vc, vr, ch, do_not_decode, vec, vlen, ch_left, 2);
    else if (vr->type == 1)
-        return vorbis_residue_decode_internal(vc, vr, ch, do_not_decode, vec, vlen, 1);
+        return vorbis_residue_decode_internal(vc, vr, ch, do_not_decode, vec, vlen, ch_left, 1);
    else if (vr->type == 0)
-        return vorbis_residue_decode_internal(vc, vr, ch, do_not_decode, vec, vlen, 0);
+        return vorbis_residue_decode_internal(vc, vr, ch, do_not_decode, vec, vlen, ch_left, 0);
    else {
        av_log(vc->avccontext, AV_LOG_ERROR, " Invalid residue type while residue decode?! \n");
        return -1;
@@ -1462,6 +1484,8 @@ static int vorbis_parse_audio_packet(vorbis_context *vc)
    uint_fast8_t res_num = 0;
    int_fast16_t retlen  = 0;
    float fadd_bias = vc->add_bias;
+    unsigned ch_left = vc->audio_channels;
+    unsigned vlen;

    if (get_bits1(gb)) {
        av_log(vc->avccontext, AV_LOG_ERROR, "Not a Vorbis I audio packet.\n");
@@ -1480,24 +1504,32 @@ static int vorbis_parse_audio_packet(vorbis_context *vc)

    blockflag = vc->modes[mode_number].blockflag;
    blocksize = vc->blocksize[blockflag];
+    vlen = blocksize / 2;
    if (blockflag)
        skip_bits(gb, 2); // previous_window, next_window

-    memset(ch_res_ptr,   0, sizeof(float) * vc->audio_channels * blocksize / 2); //FIXME can this be removed ?
-    memset(ch_floor_ptr, 0, sizeof(float) * vc->audio_channels * blocksize / 2); //FIXME can this be removed ?
+    memset(ch_res_ptr,   0, sizeof(float) * vc->audio_channels * vlen); //FIXME can this be removed ?
+    memset(ch_floor_ptr, 0, sizeof(float) * vc->audio_channels * vlen); //FIXME can this be removed ?

 // Decode floor

    for (i = 0; i < vc->audio_channels; ++i) {
        vorbis_floor *floor;
+        int ret;
        if (mapping->submaps > 1) {
            floor = &vc->floors[mapping->submap_floor[mapping->mux[i]]];
        } else {
            floor = &vc->floors[mapping->submap_floor[0]];
        }

-        no_residue[i] = floor->decode(vc, &floor->data, ch_floor_ptr);
-        ch_floor_ptr += blocksize / 2;
+        ret = floor->decode(vc, &floor->data, ch_floor_ptr);
+
+        if (ret < 0) {
+            av_log(vc->avccontext, AV_LOG_ERROR, "Invalid codebook in vorbis_floor_decode.\n");
+            return -1;
+        }
+        no_residue[i] = ret;
+        ch_floor_ptr += vlen;
    }

 // Nonzero vector propagate
@@ -1514,6 +1546,7 @@ static int vorbis_parse_audio_packet(vorbis_context *vc)
    for (i = 0; i < mapping->submaps; ++i) {
        vorbis_residue *residue;
        uint_fast8_t ch = 0;
+        int ret;

        for (j = 0; j < vc->audio_channels; ++j) {
            if ((mapping->submaps == 1) || (i == mapping->mux[j])) {
@@ -1528,9 +1561,18 @@ static int vorbis_parse_audio_packet(vorbis_context *vc)
            }
        }
        residue = &vc->residues[mapping->submap_residue[i]];
-        vorbis_residue_decode(vc, residue, ch, do_not_decode, ch_res_ptr, blocksize/2);
+        if (ch_left < ch) {
+            av_log(vc->avccontext, AV_LOG_ERROR, "Too many channels in vorbis_floor_decode.\n");
+            return -1;
+        }
+        if (ch) {
+            ret = vorbis_residue_decode(vc, residue, ch, do_not_decode, ch_res_ptr, vlen, ch_left);
+            if (ret < 0)
+                return ret;
+        }

-        ch_res_ptr += ch * blocksize / 2;
+        ch_res_ptr += ch * vlen;
+        ch_left -= ch;
    }

 // Inverse coupling
--- a/libavcodec/vp3.c
+++ b/libavcodec/vp3.c
@@ -884,7 +884,7 @@ static int unpack_vlcs(Vp3DecodeContext *s, GetBitContext *gb,
            /* decode a VLC into a token */
            token = get_vlc2(gb, vlc_table, 11, 3);
            /* use the token to get a zero run, a coefficient, and an eob run */
-            if (token <= 6) {
+            if ((unsigned) token <= 6U) {
                eob_run = eob_run_base[token];
                if (eob_run_get_bits[token])
                    eob_run += get_bits(gb, eob_run_get_bits[token]);
@@ -902,7 +902,7 @@ static int unpack_vlcs(Vp3DecodeContext *s, GetBitContext *gb,
                    coeff_i        += eob_run;
                    eob_run = 0;
                }
-            } else {
+            } else if (token >= 0) {
                bits_to_get = coeff_get_bits[token];
                if (bits_to_get)
                    bits_to_get = get_bits(gb, bits_to_get);
@@ -936,6 +936,10 @@ static int unpack_vlcs(Vp3DecodeContext *s, GetBitContext *gb,
                for (i = coeff_index+1; i <= coeff_index+zero_run; i++)
                    s->num_coded_frags[plane][i]--;
                coeff_i++;
+            } else {
+                av_log(s->avctx, AV_LOG_ERROR,
+                       "Invalid token %d\n", token);
+                return -1;
            }
    }

@@ -985,6 +989,8 @@ static int unpack_dct_coeffs(Vp3DecodeContext *s, GetBitContext *gb)
    /* unpack the Y plane DC coefficients */
    residual_eob_run = unpack_vlcs(s, gb, &s->dc_vlc[dc_y_table], 0,
        0, residual_eob_run);
+    if (residual_eob_run < 0)
+        return residual_eob_run;

    /* reverse prediction of the Y-plane DC coefficients */
    reverse_dc_prediction(s, 0, s->fragment_width[0], s->fragment_height[0]);
@@ -992,8 +998,12 @@ static int unpack_dct_coeffs(Vp3DecodeContext *s, GetBitContext *gb)
    /* unpack the C plane DC coefficients */
    residual_eob_run = unpack_vlcs(s, gb, &s->dc_vlc[dc_c_table], 0,
        1, residual_eob_run);
+    if (residual_eob_run < 0)
+        return residual_eob_run;
    residual_eob_run = unpack_vlcs(s, gb, &s->dc_vlc[dc_c_table], 0,
        2, residual_eob_run);
+    if (residual_eob_run < 0)
+        return residual_eob_run;

    /* reverse prediction of the C-plane DC coefficients */
    if (!(s->avctx->flags & CODEC_FLAG_GRAY))
@@ -1030,11 +1040,17 @@ static int unpack_dct_coeffs(Vp3DecodeContext *s, GetBitContext *gb)
    for (i = 1; i <= 63; i++) {
            residual_eob_run = unpack_vlcs(s, gb, y_tables[i], i,
                0, residual_eob_run);
+            if (residual_eob_run < 0)
+                return residual_eob_run;

            residual_eob_run = unpack_vlcs(s, gb, c_tables[i], i,
                1, residual_eob_run);
+            if (residual_eob_run < 0)
+                return residual_eob_run;
            residual_eob_run = unpack_vlcs(s, gb, c_tables[i], i,
                2, residual_eob_run);
+            if (residual_eob_run < 0)
+                return residual_eob_run;
    }

    return 0;
@@ -1285,6 +1301,10 @@ static inline int vp3_dequant(Vp3DecodeContext *s, Vp3Fragment *frag,
        case 1: // zero run
            s->dct_tokens[plane][i]++;
            i += (token >> 2) & 0x7f;
+            if (i > 63) {
+                av_log(s->avctx, AV_LOG_ERROR, "Coefficient index overflow\n");
+                return i;
+            }
            block[perm[i]] = (token >> 9) * dequantizer[perm[i]];
            i++;
            break;
@@ -1296,6 +1316,8 @@ static inline int vp3_dequant(Vp3DecodeContext *s, Vp3Fragment *frag,
            return i;
        }
    } while (i < 64);
+    // return value is expected to be a valid level
+    i--;
 end:
    // the actual DC+prediction is in the fragment structure
    block[0] = frag->dc * s->qmat[0][inter][plane][0];
--- a/libavcodec/vp5.c
+++ b/libavcodec/vp5.c
@@ -116,7 +116,7 @@ static void vp5_parse_vector_models(VP56Context *s)
                model->vector_pdv[comp][node] = vp56_rac_gets_nn(c, 7);
 }

-static void vp5_parse_coeff_models(VP56Context *s)
+static int vp5_parse_coeff_models(VP56Context *s)
 {
    VP56RangeCoder *c = &s->c;
    VP56Model *model = s->modelp;
@@ -160,6 +160,7 @@ static void vp5_parse_coeff_models(VP56Context *s)
                for (ctx=0; ctx<6; ctx++)
                    for (node=0; node<5; node++)
                        model->coeff_acct[pt][ct][cg][ctx][node] = av_clip(((model->coeff_ract[pt][ct][cg][node] * vp5_ract_lc[ct][cg][node][ctx][0] + 128) >> 8) + vp5_ract_lc[ct][cg][node][ctx][1], 1, 254);
+    return 0;
 }

 static void vp5_parse_coeff(VP56Context *s)
--- a/libavcodec/vp56.c
+++ b/libavcodec/vp56.c
@@ -537,7 +537,8 @@ int vp56_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
            s->mb_type = VP56_MB_INTER_NOVEC_PF;
        }

-        s->parse_coeff_models(s);
+        if (s->parse_coeff_models(s))
+            goto next;

        memset(s->prev_dc, 0, sizeof(s->prev_dc));
        s->prev_dc[1][VP56_FRAME_CURRENT] = 128;
@@ -601,6 +602,7 @@ int vp56_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
            }
        }

+    next:
        if (p->key_frame || golden_frame) {
            if (s->framep[VP56_FRAME_GOLDEN]->data[0] &&
                s->framep[VP56_FRAME_GOLDEN] != s->framep[VP56_FRAME_GOLDEN2])
--- a/libavcodec/vp56.h
+++ b/libavcodec/vp56.h
@@ -41,7 +41,7 @@ typedef void (*VP56Filter)(VP56Context *s, uint8_t *dst, uint8_t *src,
 typedef void (*VP56ParseCoeff)(VP56Context *s);
 typedef void (*VP56DefaultModelsInit)(VP56Context *s);
 typedef void (*VP56ParseVectorModels)(VP56Context *s);
-typedef void (*VP56ParseCoeffModels)(VP56Context *s);
+typedef int  (*VP56ParseCoeffModels)(VP56Context *s);
 typedef int  (*VP56ParseHeader)(VP56Context *s, const uint8_t *buf,
                                int buf_size, int *golden_frame);

--- a/libavcodec/vp6.c
+++ b/libavcodec/vp6.c
@@ -136,8 +136,11 @@ static int vp6_parse_header(VP56Context *s, const uint8_t *buf, int buf_size,
    if (coeff_offset) {
        buf      += coeff_offset;
        buf_size -= coeff_offset;
-        if (buf_size < 0)
+        if (buf_size < 0) {
+            if (s->framep[VP56_FRAME_CURRENT]->key_frame)
+                avcodec_set_dimensions(s->avctx, 0, 0);
            return 0;
+        }
        if (s->use_huffman) {
            s->parse_coeff = vp6_parse_coeff_huffman;
            init_get_bits(&s->gb, buf, buf_size<<3);
@@ -212,8 +215,8 @@ static int vp6_huff_cmp(const void *va, const void *vb)
    return (a->count - b->count)*16 + (b->sym - a->sym);
 }

-static void vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
-                                const uint8_t *map, unsigned size, VLC *vlc)
+static int vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
+                               const uint8_t *map, unsigned size, VLC *vlc)
 {
    Node nodes[2*size], *tmp = &nodes[size];
    int a, b, i;
@@ -228,12 +231,12 @@ static void vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
    }

    free_vlc(vlc);
-    /* then build the huffman tree accodring to probabilities */
-    ff_huff_build_tree(s->avctx, vlc, size, nodes, vp6_huff_cmp,
-                       FF_HUFFMAN_FLAG_HNODE_FIRST);
+    /* then build the huffman tree according to probabilities */
+    return ff_huff_build_tree(s->avctx, vlc, size, nodes, vp6_huff_cmp,
+                              FF_HUFFMAN_FLAG_HNODE_FIRST);
 }

-static void vp6_parse_coeff_models(VP56Context *s)
+static int vp6_parse_coeff_models(VP56Context *s)
 {
    VP56RangeCoder *c = &s->c;
    VP56Model *model = s->modelp;
@@ -278,15 +281,18 @@ static void vp6_parse_coeff_models(VP56Context *s)

    if (s->use_huffman) {
        for (pt=0; pt<2; pt++) {
-            vp6_build_huff_tree(s, model->coeff_dccv[pt],
-                                vp6_huff_coeff_map, 12, &s->dccv_vlc[pt]);
-            vp6_build_huff_tree(s, model->coeff_runv[pt],
-                                vp6_huff_run_map, 9, &s->runv_vlc[pt]);
+            if (vp6_build_huff_tree(s, model->coeff_dccv[pt],
+                                    vp6_huff_coeff_map, 12, &s->dccv_vlc[pt]))
+                return -1;
+            if (vp6_build_huff_tree(s, model->coeff_runv[pt],
+                                    vp6_huff_run_map, 9, &s->runv_vlc[pt]))
+                return -1;
            for (ct=0; ct<3; ct++)
                for (cg = 0; cg < 6; cg++)
-                    vp6_build_huff_tree(s, model->coeff_ract[pt][ct][cg],
-                                        vp6_huff_coeff_map, 12,
-                                        &s->ract_vlc[pt][ct][cg]);
+                    if (vp6_build_huff_tree(s, model->coeff_ract[pt][ct][cg],
+                                            vp6_huff_coeff_map, 12,
+                                            &s->ract_vlc[pt][ct][cg]))
+                        return -1;
        }
        memset(s->nb_null, 0, sizeof(s->nb_null));
    } else {
@@ -296,6 +302,7 @@ static void vp6_parse_coeff_models(VP56Context *s)
            for (node=0; node<5; node++)
                model->coeff_dcct[pt][ctx][node] = av_clip(((model->coeff_dccv[pt][node] * vp6_dccv_lc[ctx][node][0] + 128) >> 8) + vp6_dccv_lc[ctx][node][1], 1, 255);
    }
+    return 0;
 }

 static void vp6_parse_vector_adjustment(VP56Context *s, VP56mv *vect)
@@ -366,7 +373,7 @@ static void vp6_parse_coeff_huffman(VP56Context *s)
        if (b > 3) pt = 1;
        vlc_coeff = &s->dccv_vlc[pt];

-        for (coeff_idx=0; coeff_idx<64; ) {
+        for (coeff_idx = 0;;) {
            int run = 1;
            if (coeff_idx<2 && s->nb_null[coeff_idx][pt]) {
                s->nb_null[coeff_idx][pt]--;
@@ -403,6 +410,8 @@ static void vp6_parse_coeff_huffman(VP56Context *s)
                }
            }
            coeff_idx+=run;
+            if (coeff_idx >= 64)
+                break;
            cg = FFMIN(vp6_coeff_groups[coeff_idx], 3);
            vlc_coeff = &s->ract_vlc[pt][ct][cg];
        }
@@ -430,7 +439,8 @@ static void vp6_parse_coeff(VP56Context *s)
        model1 = model->coeff_dccv[pt];
        model2 = model->coeff_dcct[pt][ctx];

-        for (coeff_idx=0; coeff_idx<64; ) {
+        coeff_idx = 0;
+        for (;;) {
            if ((coeff_idx>1 && ct==0) || vp56_rac_get_prob(c, model2[0])) {
                /* parse a coeff */
                if (vp56_rac_get_prob(c, model2[2])) {
@@ -471,8 +481,10 @@ static void vp6_parse_coeff(VP56Context *s)
                            run += vp56_rac_get_prob(c, model3[i+8]) << i;
                }
            }
-
-            cg = vp6_coeff_groups[coeff_idx+=run];
+            coeff_idx += run;
+            if (coeff_idx >= 64)
+                break;
+            cg = vp6_coeff_groups[coeff_idx];
            model1 = model2 = model->coeff_ract[pt][ct][cg];
        }

--- a/libavcodec/wavpack.c
+++ b/libavcodec/wavpack.c
@@ -275,7 +275,14 @@ static int wv_get_value(WavpackContext *ctx, GetBitContext *gb, int channel, int
            }
        }else{
            t = get_unary_0_33(gb);
-            if(t >= 2) t = get_bits(gb, t - 1) | (1 << (t-1));
+            if(t >= 2){
+                if(get_bits_left(gb) < t-1)
+                    goto error;
+                t = get_bits(gb, t - 1) | (1 << (t-1));
+            }else{
+                if(get_bits_left(gb) < 0)
+                    goto error;
+            }
            ctx->zeroes = t;
            if(ctx->zeroes){
                memset(ctx->ch[0].median, 0, sizeof(ctx->ch[0].median));
@@ -286,24 +293,24 @@ static int wv_get_value(WavpackContext *ctx, GetBitContext *gb, int channel, int
        }
    }

-    if(get_bits_count(gb) >= ctx->data_size){
-        *last = 1;
-        return 0;
-    }
-
    if(ctx->zero){
        t = 0;
        ctx->zero = 0;
    }else{
        t = get_unary_0_33(gb);
-        if(get_bits_count(gb) >= ctx->data_size){
-            *last = 1;
-            return 0;
-        }
+        if(get_bits_left(gb) < 0)
+            goto error;
        if(t == 16) {
            t2 = get_unary_0_33(gb);
-            if(t2 < 2) t += t2;
-            else t += get_bits(gb, t2 - 1) | (1 << (t2 - 1));
+            if(t2 < 2){
+                if(get_bits_left(gb) < 0)
+                    goto error;
+                t += t2;
+            }else{
+                if(get_bits_left(gb) < t2 - 1)
+                    goto error;
+                t += get_bits(gb, t2 - 1) | (1 << (t2 - 1));
+            }
        }

        if(ctx->one){
@@ -343,9 +350,13 @@ static int wv_get_value(WavpackContext *ctx, GetBitContext *gb, int channel, int
    }
    if(!c->error_limit){
        ret = base + get_tail(gb, add);
+        if (get_bits_left(gb) <= 0)
+            goto error;
    }else{
        int mid = (base*2 + add + 1) >> 1;
        while(add > c->error_limit){
+            if(get_bits_left(gb) <= 0)
+                goto error;
            if(get_bits1(gb)){
                add -= (mid - base);
                base = mid;
@@ -359,6 +370,10 @@ static int wv_get_value(WavpackContext *ctx, GetBitContext *gb, int channel, int
    if(ctx->hybrid_bitrate)
        c->slow_level += wp_log2(ret) - LEVEL_DECAY(c->slow_level);
    return sign ? ~ret : ret;
+
+error:
+    *last = 1;
+    return 0;
 }

 static inline int wv_get_value_integer(WavpackContext *s, uint32_t *crc, int S)
@@ -368,7 +383,7 @@ static inline int wv_get_value_integer(WavpackContext *s, uint32_t *crc, int S)
    if(s->extra_bits){
        S <<= s->extra_bits;

-        if(s->got_extra_bits){
+        if(s->got_extra_bits && get_bits_left(&s->gb_extra_bits) >= s->extra_bits){
            S |= get_bits(&s->gb_extra_bits, s->extra_bits);
            *crc = *crc * 9 + (S&0xffff) * 3 + ((unsigned)S>>16);
        }
@@ -559,7 +574,10 @@ static inline int wv_unpack_stereo(WavpackContext *s, GetBitContext *gb, void *d
        count++;
    }while(!last && count < s->max_samples);

-    s->samples_left -= count;
+    if (last)
+        s->samples_left = 0;
+    else
+        s->samples_left -= count;
    if(!s->samples_left){
        if(crc != s->CRC){
            av_log(s->avctx, AV_LOG_ERROR, "CRC error\n");
@@ -632,7 +650,10 @@ static inline int wv_unpack_mono(WavpackContext *s, GetBitContext *gb, void *dst
        count++;
    }while(!last && count < s->samples);

-    s->samples_left -= count;
+    if (last)
+        s->samples_left = 0;
+    else
+        s->samples_left -= count;
    if(!s->samples_left){
        if(crc != s->CRC){
            av_log(s->avctx, AV_LOG_ERROR, "CRC error\n");
@@ -755,12 +776,13 @@ static int wavpack_decode_frame(AVCodecContext *avctx,
        }
        switch(id & WP_IDF_MASK){
        case WP_ID_DECTERMS:
-            s->terms = size;
-            if(s->terms > MAX_TERMS){
+            if(size > MAX_TERMS){
                av_log(avctx, AV_LOG_ERROR, "Too many decorrelation terms\n");
+                s->terms = 0;
                buf += ssize;
                continue;
            }
+            s->terms = size;
            for(i = 0; i < s->terms; i++) {
                s->decorr[s->terms - i - 1].value = (*buf & 0x1F) - 5;
                s->decorr[s->terms - i - 1].delta = *buf >> 5;
@@ -976,6 +998,9 @@ static int wavpack_decode_frame(AVCodecContext *avctx,
        else
            samplecount = wv_unpack_stereo(s, &s->gb, samples, SAMPLE_FMT_FLT);

+        if (samplecount < 0)
+            return -1;
+
    }else{
        if(avctx->sample_fmt == SAMPLE_FMT_S16)
            samplecount = wv_unpack_mono(s, &s->gb, samples, SAMPLE_FMT_S16);
@@ -984,11 +1009,14 @@ static int wavpack_decode_frame(AVCodecContext *avctx,
        else
            samplecount = wv_unpack_mono(s, &s->gb, samples, SAMPLE_FMT_FLT);

+        if (samplecount < 0)
+            return -1;
+
        if(s->stereo && avctx->sample_fmt == SAMPLE_FMT_S16){
            int16_t *dst = (int16_t*)samples + samplecount * 2;
            int16_t *src = (int16_t*)samples + samplecount;
            int cnt = samplecount;
-            while(cnt--){
+            while(cnt-- > 0){
                *--dst = *--src;
                *--dst = *src;
            }
@@ -997,7 +1025,7 @@ static int wavpack_decode_frame(AVCodecContext *avctx,
            int32_t *dst = (int32_t*)samples + samplecount * 2;
            int32_t *src = (int32_t*)samples + samplecount;
            int cnt = samplecount;
-            while(cnt--){
+            while(cnt-- > 0){
                *--dst = *--src;
                *--dst = *src;
            }
@@ -1006,7 +1034,7 @@ static int wavpack_decode_frame(AVCodecContext *avctx,
            float *dst = (float*)samples + samplecount * 2;
            float *src = (float*)samples + samplecount;
            int cnt = samplecount;
-            while(cnt--){
+            while(cnt-- > 0){
                *--dst = *--src;
                *--dst = *src;
            }
--- a/libavcodec/wma.c
+++ b/libavcodec/wma.c
@@ -135,6 +135,9 @@ int ff_wma_init(AVCodecContext *avctx, int flags2)

    /* compute MDCT block size */
    s->frame_len_bits = ff_wma_get_frame_len_bits(s->sample_rate, s->version, 0);
+    s->next_block_len_bits = s->frame_len_bits;
+    s->prev_block_len_bits = s->frame_len_bits;
+    s->block_len_bits      = s->frame_len_bits;

    s->frame_len = 1 << s->frame_len_bits;
    if (s->use_variable_block_len) {
--- a/libavcodec/x86/cpuid.c
+++ b/libavcodec/x86/cpuid.c
@@ -98,7 +98,7 @@ int mm_support(void)

    if(max_ext_level >= 0x80000001){
        cpuid(0x80000001, eax, ebx, ecx, ext_caps);
-        if (ext_caps & (1<<31))
+        if (ext_caps & (1U<<31))
            rval |= FF_MM_3DNOW;
        if (ext_caps & (1<<30))
            rval |= FF_MM_3DNOWEXT;
--- a/libavcodec/x86/fft_sse.c
+++ b/libavcodec/x86/fft_sse.c
@@ -23,7 +23,7 @@
 #include "libavcodec/dsputil.h"
 #include "fft.h"

-DECLARE_ALIGNED(16, static const int, m1m1m1m1)[4] =
+DECLARE_ASM_CONST(16, int, ff_m1m1m1m1)[4] =
    { 1 << 31, 1 << 31, 1 << 31, 1 << 31 };

 void ff_fft_dispatch_sse(FFTComplex *z, int nbits);
@@ -183,7 +183,7 @@ void ff_imdct_calc_sse(FFTContext *s, FFTSample *output, const FFTSample *input)
    j = -n;
    k = n-16;
    __asm__ volatile(
-        "movaps %4, %%xmm7 \n"
+        "movaps "MANGLE(ff_m1m1m1m1)", %%xmm7 \n"
        "1: \n"
        "movaps       (%2,%1), %%xmm0 \n"
        "movaps       (%3,%0), %%xmm1 \n"
@@ -196,8 +196,7 @@ void ff_imdct_calc_sse(FFTContext *s, FFTSample *output, const FFTSample *input)
        "add $16, %0 \n"
        "jl 1b \n"
        :"+r"(j), "+r"(k)
-        :"r"(output+n4), "r"(output+n4*3),
-         "m"(*m1m1m1m1)
+        :"r"(output+n4), "r"(output+n4*3)
    );
 }

--- a/libavcodec/xan.c
+++ b/libavcodec/xan.c
@@ -88,17 +88,18 @@ static av_cold int xan_decode_init(AVCodecContext *avctx)
    return 0;
 }

-static int xan_huffman_decode(unsigned char *dest, const unsigned char *src,
-    int dest_len)
+static int xan_huffman_decode(unsigned char *dest, int dest_len,
+                              const unsigned char *src, int src_len)
 {
    unsigned char byte = *src++;
    unsigned char ival = byte + 0x16;
    const unsigned char * ptr = src + byte*2;
+    int ptr_len = src_len - 1 - byte*2;
    unsigned char val = ival;
    unsigned char *dest_end = dest + dest_len;
    GetBitContext gb;

-    init_get_bits(&gb, ptr, 0); // FIXME: no src size available
+    init_get_bits(&gb, ptr, ptr_len * 8);

    while ( val != 0x16 ) {
        val = src[val - 0x17 + get_bits1(&gb) * byte];
@@ -263,7 +264,8 @@ static void xan_wc3_decode_frame(XanContext *s) {
    vector_segment =    s->buf + AV_RL16(&s->buf[4]);
    imagedata_segment = s->buf + AV_RL16(&s->buf[6]);

-    xan_huffman_decode(opcode_buffer, huffman_segment, opcode_buffer_size);
+    xan_huffman_decode(opcode_buffer, opcode_buffer_size,
+                       huffman_segment, s->size - (huffman_segment - s->buf) );

    if (imagedata_segment[0] == 2)
        xan_unpack(s->buffer2, &imagedata_segment[1], s->buffer2_size);
--- a/libavdevice/alsa-audio-common.c
+++ b/libavdevice/alsa-audio-common.c
@@ -129,6 +129,8 @@ av_cold int ff_alsa_open(AVFormatContext *ctx, snd_pcm_stream_t mode,
    }

    snd_pcm_hw_params_get_period_size_min(hw_params, &period_size, NULL);
+    if (!period_size)
+        period_size = buffer_size / 4;
    res = snd_pcm_hw_params_set_period_size_near(h, hw_params, &period_size, NULL);
    if (res < 0) {
        av_log(ctx, AV_LOG_ERROR, "cannot set ALSA period size (%s)\n",
--- a/libavformat/ape.c
+++ b/libavformat/ape.c
@@ -242,6 +242,10 @@ static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap)
            url_fskip(pb, ape->wavheaderlength);
    }

+    if(!ape->totalframes){
+        av_log(s, AV_LOG_ERROR, "No frames in the file!\n");
+        return AVERROR(EINVAL);
+    }
    if(ape->totalframes > UINT_MAX / sizeof(APEFrame)){
        av_log(s, AV_LOG_ERROR, "Too many frames: %d\n", ape->totalframes);
        return -1;
@@ -259,6 +263,8 @@ static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap)

    if (ape->seektablelength > 0) {
        ape->seektable = av_malloc(ape->seektablelength);
+        if (!ape->seektable)
+            return AVERROR(ENOMEM);
        for (i = 0; i < ape->seektablelength / sizeof(uint32_t); i++)
            ape->seektable[i] = get_le32(pb);
    }
--- a/libavformat/flvenc.c
+++ b/libavformat/flvenc.c
@@ -162,7 +162,7 @@ static int flv_write_header(AVFormatContext *s)
    AVCodecContext *audio_enc = NULL, *video_enc = NULL;
    int i;
    double framerate = 0.0;
-    int metadata_size_pos, data_size;
+    int64_t metadata_size_pos, data_size;

    for(i=0; i<s->nb_streams; i++){
        AVCodecContext *enc = s->streams[i]->codec;
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -759,11 +759,15 @@ static int ebml_parse_elem(MatroskaDemuxContext *matroska,
    uint32_t id = syntax->id;
    uint64_t length;
    int res;
+    void *newelem;

    data = (char *)data + syntax->data_offset;
    if (syntax->list_elem_size) {
        EbmlList *list = data;
-        list->elem = av_realloc(list->elem, (list->nb_elem+1)*syntax->list_elem_size);
+        newelem = av_realloc(list->elem, (list->nb_elem+1)*syntax->list_elem_size);
+        if (!newelem)
+            return AVERROR(ENOMEM);
+        list->elem = newelem;
        data = (char*)list->elem + list->nb_elem*syntax->list_elem_size;
        memset(data, 0, syntax->list_elem_size);
        list->nb_elem++;
@@ -883,6 +887,7 @@ static int matroska_decode_buffer(uint8_t** buf, int* buf_size,
    uint8_t* data = *buf;
    int isize = *buf_size;
    uint8_t* pkt_data = NULL;
+    uint8_t* newpktdata;
    int pkt_size = isize;
    int result = 0;
    int olen;
@@ -909,7 +914,12 @@ static int matroska_decode_buffer(uint8_t** buf, int* buf_size,
        zstream.avail_in = isize;
        do {
            pkt_size *= 3;
-            pkt_data = av_realloc(pkt_data, pkt_size);
+            newpktdata = av_realloc(pkt_data, pkt_size);
+            if (!newpktdata) {
+                inflateEnd(&zstream);
+                goto failed;
+            }
+            pkt_data = newpktdata;
            zstream.avail_out = pkt_size - zstream.total_out;
            zstream.next_out = pkt_data + zstream.total_out;
            result = inflate(&zstream, Z_NO_FLUSH);
@@ -930,7 +940,12 @@ static int matroska_decode_buffer(uint8_t** buf, int* buf_size,
        bzstream.avail_in = isize;
        do {
            pkt_size *= 3;
-            pkt_data = av_realloc(pkt_data, pkt_size);
+            newpktdata = av_realloc(pkt_data, pkt_size);
+            if (!newpktdata) {
+                BZ2_bzDecompressEnd(&bzstream);
+                goto failed;
+            }
+            pkt_data = newpktdata;
            bzstream.avail_out = pkt_size - bzstream.total_out_lo32;
            bzstream.next_out = pkt_data + bzstream.total_out_lo32;
            result = BZ2_bzDecompress(&bzstream);
@@ -985,13 +1000,17 @@ static void matroska_fix_ass_packet(MatroskaDemuxContext *matroska,
    }
 }

-static void matroska_merge_packets(AVPacket *out, AVPacket *in)
+static int matroska_merge_packets(AVPacket *out, AVPacket *in)
 {
-    out->data = av_realloc(out->data, out->size+in->size);
+    void *newdata = av_realloc(out->data, out->size+in->size);
+    if (!newdata)
+        return AVERROR(ENOMEM);
+    out->data = newdata;
    memcpy(out->data+out->size, in->data, in->size);
    out->size += in->size;
    av_destruct_packet(in);
    av_free(in);
+    return 0;
 }

 static void matroska_convert_tag(AVFormatContext *s, EbmlList *list,
@@ -1055,13 +1074,13 @@ static void matroska_convert_tags(AVFormatContext *s)
 static void matroska_execute_seekhead(MatroskaDemuxContext *matroska)
 {
    EbmlList *seekhead_list = &matroska->seekhead;
-    MatroskaSeekhead *seekhead = seekhead_list->elem;
    uint32_t level_up = matroska->level_up;
    int64_t before_pos = url_ftell(matroska->ctx->pb);
    MatroskaLevel level;
    int i;

    for (i=0; i<seekhead_list->nb_elem; i++) {
+        MatroskaSeekhead *seekhead = seekhead_list->elem;
        int64_t offset = seekhead[i].pos + matroska->segment_start;

        if (seekhead[i].pos <= before_pos
@@ -1494,11 +1513,13 @@ static int matroska_deliver_packet(MatroskaDemuxContext *matroska,
        memcpy(pkt, matroska->packets[0], sizeof(AVPacket));
        av_free(matroska->packets[0]);
        if (matroska->num_packets > 1) {
+            void *newpackets;
            memmove(&matroska->packets[0], &matroska->packets[1],
                    (matroska->num_packets - 1) * sizeof(AVPacket *));
-            matroska->packets =
-                av_realloc(matroska->packets, (matroska->num_packets - 1) *
-                           sizeof(AVPacket *));
+            newpackets = av_realloc(matroska->packets,
+                            (matroska->num_packets - 1) * sizeof(AVPacket *));
+            if (newpackets)
+                matroska->packets = newpackets;
        } else {
            av_freep(&matroska->packets);
        }
--- a/libavformat/mpegts.c
+++ b/libavformat/mpegts.c
@@ -1140,7 +1140,7 @@ static int handle_packet(MpegTSContext *ts, const uint8_t *packet)
 {
    AVFormatContext *s = ts->stream;
    MpegTSFilter *tss;
-    int len, pid, cc, cc_ok, afc, is_start;
+    int len, pid, cc, expected_cc, cc_ok, afc, is_start;
    const uint8_t *p, *p_end;
    int64_t pos;

@@ -1158,7 +1158,8 @@ static int handle_packet(MpegTSContext *ts, const uint8_t *packet)

    /* continuity check (currently not used) */
    cc = (packet[3] & 0xf);
-    cc_ok = (tss->last_cc < 0) || ((((tss->last_cc + 1) & 0x0f) == cc));
+    expected_cc = (packet[3] & 0x10) ? (tss->last_cc + 1) & 0x0f : tss->last_cc;
+    cc_ok = (tss->last_cc < 0) || (expected_cc == cc);
    tss->last_cc = cc;

    /* skip adaptation field */
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -592,7 +592,7 @@ static int mxf_read_generic_descriptor(MXFDescriptor *descriptor, ByteIOContext
    default:
        /* Private uid used by SONY C0023S01.mxf */
        if (IS_KLV_KEY(uid, mxf_sony_mpeg4_extradata)) {
-            descriptor->extradata = av_malloc(size);
+            descriptor->extradata = av_malloc(size + FF_INPUT_BUFFER_PADDING_SIZE);
            if (!descriptor->extradata)
                return -1;
            descriptor->extradata_size = size;
--- a/libavformat/mxfenc.c
+++ b/libavformat/mxfenc.c
@@ -1536,7 +1536,7 @@ static const uint8_t system_metadata_package_set_key[] = { 0x06,0x0E,0x2B,0x34,0
 static uint32_t ff_framenum_to_12m_time_code(unsigned frame, int drop, int fps)
 {
    return (0                                    << 31) | // color frame flag
-           (0                                    << 30) | // drop  frame flag
+           (drop                                 << 30) | // drop  frame flag
           ( ((frame % fps) / 10)                << 28) | // tens  of frames
           ( ((frame % fps) % 10)                << 24) | // units of frames
           (0                                    << 23) | // field phase (NTSC), b0 (PAL)
--- a/libavformat/oggdec.c
+++ b/libavformat/oggdec.c
@@ -94,14 +94,24 @@ ogg_restore (AVFormatContext * s, int discard)
    ogg->state = ost->next;

    if (!discard){
+        struct ogg_stream *old_streams = ogg->streams;
+
        for (i = 0; i < ogg->nstreams; i++)
            av_free (ogg->streams[i].buf);

        url_fseek (bc, ost->pos, SEEK_SET);
        ogg->curidx = ost->curidx;
        ogg->nstreams = ost->nstreams;
-        memcpy(ogg->streams, ost->streams,
-               ost->nstreams * sizeof(*ogg->streams));
+        ogg->streams = av_realloc (ogg->streams,
+                                   ogg->nstreams * sizeof (*ogg->streams));
+
+        if (ogg->streams) {
+            memcpy(ogg->streams, ost->streams,
+                   ost->nstreams * sizeof(*ogg->streams));
+        } else {
+            av_free(old_streams);
+            ogg->nstreams = 0;
+        }
    }

    av_free (ost);
@@ -577,20 +587,19 @@ ogg_read_close (AVFormatContext * s)
 }


-static int64_t
-ogg_read_timestamp (AVFormatContext * s, int stream_index, int64_t * pos_arg,
-                    int64_t pos_limit)
+static int64_t ogg_read_timestamp (AVFormatContext * s, int stream_index,
+                                   int64_t * pos_arg, int64_t pos_limit)
 {
    struct ogg *ogg = s->priv_data;
-    struct ogg_stream *os = ogg->streams + stream_index;
    ByteIOContext *bc = s->pb;
    int64_t pts = AV_NOPTS_VALUE;
-    int i;
+    int i = -1;
    url_fseek(bc, *pos_arg, SEEK_SET);
    ogg_reset(ogg);

    while (url_ftell(bc) < pos_limit && !ogg_packet(s, &i, NULL, NULL, pos_arg)) {
        if (i == stream_index) {
+            struct ogg_stream *os = ogg->streams + stream_index;
            pts = ogg_calc_pts(s, i, NULL);
            if (os->keyframe_seek && !(os->pflags & AV_PKT_FLAG_KEY))
                pts = AV_NOPTS_VALUE;
@@ -615,6 +624,7 @@ static int ogg_read_seek(AVFormatContext *s, int stream_index, int64_t timestamp
        os->keyframe_seek = 1;

    ret = av_seek_frame_binary(s, stream_index, timestamp, flags);
+    os = ogg->streams + stream_index;
    if (ret < 0)
        os->keyframe_seek = 0;
    return ret;
--- a/libavformat/riff.c
+++ b/libavformat/riff.c
@@ -123,6 +123,8 @@ const AVCodecTag ff_codec_bmp_tags[] = {
    { CODEC_ID_MPEG2VIDEO,   MKTAG('L', 'M', 'P', '2') }, /* Lead MPEG2 in avi */
    { CODEC_ID_MPEG2VIDEO,   MKTAG('s', 'l', 'i', 'f') },
    { CODEC_ID_MPEG2VIDEO,   MKTAG('E', 'M', '2', 'V') },
+    { CODEC_ID_MPEG2VIDEO,   MKTAG('M', '7', '0', '1') }, /* Matrox MPEG2 intra-only */
+    { CODEC_ID_MPEG2VIDEO,   MKTAG('m', 'p', 'g', 'v') },
    { CODEC_ID_MJPEG,        MKTAG('M', 'J', 'P', 'G') },
    { CODEC_ID_MJPEG,        MKTAG('L', 'J', 'P', 'G') },
    { CODEC_ID_MJPEG,        MKTAG('d', 'm', 'b', '1') },
--- a/libavformat/smacker.c
+++ b/libavformat/smacker.c
@@ -289,10 +289,15 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
            if(flags & 1) {
                int size;
                size = get_le32(s->pb) - 4;
+                uint8_t *tmpbuf;
+
                frame_size -= size;
                frame_size -= 4;
                smk->curstream++;
-                smk->bufs[smk->curstream] = av_realloc(smk->bufs[smk->curstream], size);
+                tmpbuf = av_realloc(smk->bufs[smk->curstream], size);
+                if (!tmpbuf)
+                    return AVERROR(ENOMEM);
+                smk->bufs[smk->curstream] = tmpbuf;
                smk->buf_sizes[smk->curstream] = size;
                ret = get_buffer(s->pb, smk->bufs[smk->curstream], size);
                if(ret != size)
@@ -301,7 +306,9 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
            }
            flags >>= 1;
        }
-        if (av_new_packet(pkt, frame_size + 768))
+        if (frame_size < 0)
+            return AVERROR_INVALIDDATA;
+        if (av_new_packet(pkt, frame_size + 769))
            return AVERROR(ENOMEM);
        if(smk->frm_size[smk->cur_frame] & 1)
            palchange |= 2;
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -2205,12 +2205,20 @@ int av_find_stream_info(AVFormatContext *ic)

        /* check if one codec still needs to be handled */
        for(i=0;i<ic->nb_streams;i++) {
+            int fps_analyze_framecount = 20;
+
            st = ic->streams[i];
            if (!has_codec_parameters(st->codec))
                break;
+            /* if the timebase is coarse (like the usual millisecond precision
+               of mkv), we need to analyze more frames to reliably arrive at
+               the correct fps */
+            if (av_q2d(st->time_base) > 0.0005)
+                fps_analyze_framecount *= 2;
            /* variable fps and no guess at the real fps */
            if(   tb_unreliable(st->codec) && !(st->r_frame_rate.num && st->avg_frame_rate.num)
-               && duration_count[i]<20 && st->codec->codec_type == AVMEDIA_TYPE_VIDEO)
+               && duration_count[i] < fps_analyze_framecount
+               && st->codec->codec_type == AVMEDIA_TYPE_VIDEO)
                break;
            if(st->parser && st->parser->parser->split && !st->codec->extradata)
                break;
--- a/libavutil/log.c
+++ b/libavutil/log.c
@@ -59,7 +59,8 @@ void av_log_default_callback(void* ptr, int level, const char* fmt, va_list vl)
 {
    static int print_prefix=1;
    static int count;
-    static char line[1024], prev[1024];
+    static char prev[1024];
+    char line[1024];
    static const uint8_t color[]={0x41,0x41,0x11,0x03,9,9,9};
    AVClass* avc= ptr ? *(AVClass**)ptr : NULL;
    if(level>av_log_level)
--- a/libpostproc/postprocess.c
+++ b/libpostproc/postprocess.c
@@ -86,6 +86,7 @@ try to unroll inner for(x=0 ... loop to avoid these damn if(x ... checks
 //#define DEBUG_BRIGHTNESS
 #include "postprocess.h"
 #include "postprocess_internal.h"
+#include "libavutil/avstring.h"

 unsigned postproc_version(void)
 {
@@ -766,7 +767,8 @@ pp_mode *pp_get_mode_by_name_and_quality(const char *name, int quality)
    ppMode->maxClippedThreshold= 0.01;
    ppMode->error=0;

-    strncpy(temp, name, GET_MODE_BUFFER_SIZE);
+    memset(temp, 0, GET_MODE_BUFFER_SIZE);
+    av_strlcpy(temp, name, GET_MODE_BUFFER_SIZE - 1);

    av_log(NULL, AV_LOG_DEBUG, "pp: %s\n", name);

@@ -822,7 +824,7 @@ pp_mode *pp_get_mode_by_name_and_quality(const char *name, int quality)

                plen= strlen(p);
                spaceLeft= p - temp + plen;
-                if(spaceLeft + newlen  >= GET_MODE_BUFFER_SIZE){
+                if(spaceLeft + newlen  >= GET_MODE_BUFFER_SIZE - 1){
                    ppMode->error++;
                    break;
                }
--- a/libswscale/swscale_template.c
+++ b/libswscale/swscale_template.c
@@ -1882,7 +1882,7 @@ static inline void RENAME(bgr24ToY_mmx)(uint8_t *dst, const uint8_t *src, long w
 static inline void RENAME(bgr24ToUV_mmx)(uint8_t *dstU, uint8_t *dstV, const uint8_t *src, long width, enum PixelFormat srcFormat)
 {
    __asm__ volatile(
-        "movq                    24+%4, %%mm6       \n\t"
+        "movq                   24(%4), %%mm6       \n\t"
        "mov                        %3, %%"REG_a"   \n\t"
        "pxor                    %%mm7, %%mm7       \n\t"
        "1:                                         \n\t"
@@ -1893,9 +1893,9 @@ static inline void RENAME(bgr24ToUV_mmx)(uint8_t *dstU, uint8_t *dstV, const uin
        "punpcklbw               %%mm7, %%mm1       \n\t"
        "movq                    %%mm0, %%mm2       \n\t"
        "movq                    %%mm1, %%mm3       \n\t"
-        "pmaddwd                    %4, %%mm0       \n\t"
-        "pmaddwd                  8+%4, %%mm1       \n\t"
-        "pmaddwd                 16+%4, %%mm2       \n\t"
+        "pmaddwd                  (%4), %%mm0       \n\t"
+        "pmaddwd                 8(%4), %%mm1       \n\t"
+        "pmaddwd                16(%4), %%mm2       \n\t"
        "pmaddwd                 %%mm6, %%mm3       \n\t"
        "paddd                   %%mm1, %%mm0       \n\t"
        "paddd                   %%mm3, %%mm2       \n\t"
@@ -1907,9 +1907,9 @@ static inline void RENAME(bgr24ToUV_mmx)(uint8_t *dstU, uint8_t *dstV, const uin
        "punpcklbw               %%mm7, %%mm3       \n\t"
        "movq                    %%mm1, %%mm4       \n\t"
        "movq                    %%mm3, %%mm5       \n\t"
-        "pmaddwd                    %4, %%mm1       \n\t"
-        "pmaddwd                  8+%4, %%mm3       \n\t"
-        "pmaddwd                 16+%4, %%mm4       \n\t"
+        "pmaddwd                  (%4), %%mm1       \n\t"
+        "pmaddwd                 8(%4), %%mm3       \n\t"
+        "pmaddwd                16(%4), %%mm4       \n\t"
        "pmaddwd                 %%mm6, %%mm5       \n\t"
        "paddd                   %%mm3, %%mm1       \n\t"
        "paddd                   %%mm5, %%mm4       \n\t"
@@ -1932,7 +1932,7 @@ static inline void RENAME(bgr24ToUV_mmx)(uint8_t *dstU, uint8_t *dstV, const uin
        "add                        $4, %%"REG_a"   \n\t"
        " js                        1b              \n\t"
    : "+r" (src)
-    : "r" (dstU+width), "r" (dstV+width), "g" ((x86_reg)-width), "m"(ff_bgr24toUV[srcFormat == PIX_FMT_RGB24][0])
+    : "r" (dstU+width), "r" (dstV+width), "g" ((x86_reg)-width), "r"(ff_bgr24toUV[srcFormat == PIX_FMT_RGB24])
    : "%"REG_a
    );
 }
--- a/libswscale/utils.c
+++ b/libswscale/utils.c
@@ -42,6 +42,7 @@
 #include "libavutil/x86_cpu.h"
 #include "libavutil/avutil.h"
 #include "libavutil/bswap.h"
+#include "libavutil/mathematics.h"
 #include "libavutil/pixdesc.h"

 unsigned swscale_version(void)
--- a/tests/ref/fate/cscd
+++ b/tests/ref/fate/cscd
@@ -1,208 +1,208 @@
 0, 0, 270000, 0xf90015d8
-0, 2880, 270000, 0xf90015d8
-0, 5760, 270000, 0xf90015d8
-0, 8640, 270000, 0xf90015d8
-0, 11520, 270000, 0xf90015d8
-0, 14400, 270000, 0xf90015d8
-0, 17280, 270000, 0xf90015d8
-0, 20160, 270000, 0xf90015d8
-0, 23040, 270000, 0xf90015d8
-0, 25920, 270000, 0xf90015d8
-0, 28800, 270000, 0xf90015d8
-0, 31680, 270000, 0xf90015d8
-0, 34560, 270000, 0xf90015d8
-0, 37440, 270000, 0xf90015d8
-0, 40320, 270000, 0xf90015d8
-0, 43200, 270000, 0xf90015d8
-0, 46080, 270000, 0xf90015d8
-0, 48960, 270000, 0xf90015d8
-0, 51840, 270000, 0xf90015d8
-0, 54720, 270000, 0xf90015d8
-0, 57600, 270000, 0xf90015d8
-0, 60480, 270000, 0xf90015d8
-0, 63360, 270000, 0xf90015d8
-0, 66240, 270000, 0xf90015d8
-0, 69120, 270000, 0xf90015d8
-0, 72000, 270000, 0xf90015d8
-0, 74880, 270000, 0xf90015d8
-0, 77760, 270000, 0xf90015d8
-0, 80640, 270000, 0xf90015d8
-0, 83520, 270000, 0xf90015d8
-0, 86400, 270000, 0xf90015d8
-0, 89280, 270000, 0xf90015d8
-0, 92160, 270000, 0xf90015d8
-0, 95040, 270000, 0xf90015d8
-0, 97920, 270000, 0xf90015d8
-0, 100800, 270000, 0xf90015d8
-0, 103680, 270000, 0xf90015d8
-0, 106560, 270000, 0xf90015d8
-0, 109440, 270000, 0xf90015d8
-0, 112320, 270000, 0x1f9c15d8
-0, 115200, 270000, 0x436f15d8
-0, 118080, 270000, 0xe90115d8
-0, 120960, 270000, 0xe90115d8
-0, 123840, 270000, 0x8ea215d8
-0, 126720, 270000, 0x424015d8
-0, 129600, 270000, 0x0ce315d8
-0, 132480, 270000, 0x14bc15d8
-0, 135360, 270000, 0x2a9215d8
-0, 138240, 270000, 0x233f15d8
-0, 141120, 270000, 0x764b15d8
-0, 144000, 270000, 0xf76115d8
-0, 146880, 270000, 0xbbe015d8
-0, 149760, 270000, 0x95af15d8
-0, 152640, 270000, 0x324815d8
-0, 155520, 270000, 0x311915d8
-0, 158400, 270000, 0x090ef191
-0, 161280, 270000, 0xd88974dc
-0, 164160, 270000, 0xfa7f58df
-0, 167040, 270000, 0x78f849c3
-0, 169920, 270000, 0xae174892
-0, 172800, 270000, 0x9d4e2332
-0, 175680, 270000, 0x874b09b4
-0, 178560, 270000, 0x4069fed6
-0, 181440, 270000, 0x4069fed6
-0, 184320, 270000, 0x4069fed6
-0, 187200, 270000, 0x4069fed6
-0, 190080, 270000, 0x4069fed6
-0, 192960, 270000, 0x4069fed6
-0, 195840, 270000, 0x4069fed6
-0, 198720, 270000, 0x4069fed6
-0, 201600, 270000, 0x4069fed6
-0, 204480, 270000, 0x4069fed6
-0, 207360, 270000, 0x4069fed6
-0, 210240, 270000, 0x773db046
-0, 213120, 270000, 0x773db046
-0, 216000, 270000, 0x773db046
-0, 218880, 270000, 0x773db046
-0, 221760, 270000, 0x773db046
-0, 224640, 270000, 0x773db046
-0, 227520, 270000, 0x773db046
-0, 230400, 270000, 0x773db046
-0, 233280, 270000, 0x773db046
-0, 236160, 270000, 0x773db046
-0, 239040, 270000, 0x773db046
-0, 241920, 270000, 0x773db046
-0, 244800, 270000, 0x773db046
-0, 247680, 270000, 0x773db046
-0, 250560, 270000, 0x773db046
-0, 253440, 270000, 0x773db046
-0, 256320, 270000, 0x773db046
-0, 259200, 270000, 0x17b9aec9
-0, 262080, 270000, 0x622fad4c
-0, 264960, 270000, 0xdaea3aef
-0, 267840, 270000, 0x61bb10e3
-0, 270720, 270000, 0xfc37ee0c
-0, 273600, 270000, 0x50dbd01e
-0, 276480, 270000, 0xcd66c27c
-0, 279360, 270000, 0xd13f1e4f
-0, 282240, 270000, 0xa4a2dbf5
-0, 285120, 270000, 0xf302c9ab
-0, 288000, 270000, 0x4479f7fe
-0, 290880, 270000, 0x1afe92c8
-0, 293760, 270000, 0x3007f4c3
-0, 296640, 270000, 0x5834c096
-0, 299520, 270000, 0x40109126
-0, 302400, 270000, 0x0a7b8882
-0, 305280, 270000, 0x15b8635d
-0, 308160, 270000, 0xeaa5598e
-0, 311040, 270000, 0x0b7b5489
-0, 313920, 270000, 0x0b7b5489
-0, 316800, 270000, 0x0b7b5489
-0, 319680, 270000, 0x0b7b5489
-0, 322560, 270000, 0x8f0e6eaa
-0, 325440, 270000, 0xc46fc0f2
-0, 328320, 270000, 0xadd7e605
-0, 331200, 270000, 0x9d23a056
-0, 334080, 270000, 0x365afa63
-0, 336960, 270000, 0x6ac3bda2
-0, 339840, 270000, 0x14f5daf2
-0, 342720, 270000, 0x4b3afb6a
-0, 345600, 270000, 0x1a3302e3
-0, 348480, 270000, 0x1a3302e3
-0, 351360, 270000, 0x1a3302e3
-0, 354240, 270000, 0x1a3302e3
-0, 357120, 270000, 0xc15526e2
-0, 360000, 270000, 0x3dd73006
-0, 362880, 270000, 0x60abb5bc
-0, 365760, 270000, 0xb960c27c
-0, 368640, 270000, 0x8fa4c01c
-0, 371520, 270000, 0x8fa4c01c
-0, 374400, 270000, 0x8fa4c01c
-0, 377280, 270000, 0xb20dcc38
-0, 380160, 270000, 0x03c6ad3c
-0, 383040, 270000, 0xe550b194
-0, 385920, 270000, 0xe550b194
-0, 388800, 270000, 0xe550b194
-0, 391680, 270000, 0xe550b194
-0, 394560, 270000, 0xe550b194
-0, 397440, 270000, 0xe550b194
-0, 400320, 270000, 0xe550b194
-0, 403200, 270000, 0xe550b194
-0, 406080, 270000, 0xe550b194
-0, 408960, 270000, 0xe550b194
-0, 411840, 270000, 0xe550b194
-0, 414720, 270000, 0xe550b194
-0, 417600, 270000, 0xe550b194
-0, 420480, 270000, 0xe550b194
-0, 423360, 270000, 0x4550a014
-0, 426240, 270000, 0xaf639da8
-0, 429120, 270000, 0xe4229da8
-0, 432000, 270000, 0x315d9da8
-0, 434880, 270000, 0x7e899da8
-0, 437760, 270000, 0x99b9a8a0
-0, 440640, 270000, 0x4588ac2a
-0, 443520, 270000, 0x1e79ae6e
-0, 446400, 270000, 0xa003cb14
-0, 449280, 270000, 0x03ef1bb8
-0, 452160, 270000, 0x3b3f30fc
-0, 455040, 270000, 0x4dad3525
-0, 457920, 270000, 0x5b600c12
-0, 460800, 270000, 0x75a1fab3
-0, 463680, 270000, 0xc9f7d9ad
-0, 466560, 270000, 0x9eaec58d
-0, 469440, 270000, 0xb91bc3e8
-0, 472320, 270000, 0x77bdbbfb
-0, 475200, 270000, 0x77bdbbfb
-0, 478080, 270000, 0x77bdbbfb
-0, 480960, 270000, 0x77bdbbfb
-0, 483840, 270000, 0x77bdbbfb
-0, 486720, 270000, 0x77bdbbfb
-0, 489600, 270000, 0x3d54eac2
-0, 492480, 270000, 0x3d54eac2
-0, 495360, 270000, 0x3d54eac2
-0, 498240, 270000, 0x3d54eac2
-0, 501120, 270000, 0x3d54eac2
-0, 504000, 270000, 0x3d54eac2
-0, 506880, 270000, 0x3d54eac2
-0, 509760, 270000, 0x3d54eac2
-0, 512640, 270000, 0x3d54eac2
-0, 515520, 270000, 0x3d54eac2
-0, 518400, 270000, 0x3d54eac2
-0, 521280, 270000, 0x3d54eac2
-0, 524160, 270000, 0x3d54eac2
-0, 527040, 270000, 0x3d54eac2
-0, 529920, 270000, 0x3d54eac2
-0, 532800, 270000, 0x3d54eac2
-0, 535680, 270000, 0x3d54eac2
-0, 538560, 270000, 0x3d54eac2
-0, 541440, 270000, 0x3d54eac2
-0, 544320, 270000, 0x5f3609ba
-0, 547200, 270000, 0x80921b0c
-0, 550080, 270000, 0x80921b0c
-0, 552960, 270000, 0x80921b0c
-0, 555840, 270000, 0x80921b0c
-0, 558720, 270000, 0x80921b0c
-0, 561600, 270000, 0x80921b0c
-0, 564480, 270000, 0x80921b0c
-0, 567360, 270000, 0x80921b0c
-0, 570240, 270000, 0x80921b0c
-0, 573120, 270000, 0x80921b0c
-0, 576000, 270000, 0x80921b0c
-0, 578880, 270000, 0x80921b0c
-0, 581760, 270000, 0x80921b0c
-0, 584640, 270000, 0x80921b0c
-0, 587520, 270000, 0x80921b0c
-0, 590400, 270000, 0x80921b0c
-0, 593280, 270000, 0xf0e626a8
-0, 596160, 270000, 0xf0e626a8
+0, 2865, 270000, 0xf90015d8
+0, 5729, 270000, 0xf90015d8
+0, 8594, 270000, 0xf90015d8
+0, 11459, 270000, 0xf90015d8
+0, 14324, 270000, 0xf90015d8
+0, 17188, 270000, 0xf90015d8
+0, 20053, 270000, 0xf90015d8
+0, 22918, 270000, 0xf90015d8
+0, 25782, 270000, 0xf90015d8
+0, 28647, 270000, 0xf90015d8
+0, 31512, 270000, 0xf90015d8
+0, 34377, 270000, 0xf90015d8
+0, 37241, 270000, 0xf90015d8
+0, 40106, 270000, 0xf90015d8
+0, 42971, 270000, 0xf90015d8
+0, 45836, 270000, 0xf90015d8
+0, 48700, 270000, 0xf90015d8
+0, 51565, 270000, 0xf90015d8
+0, 54430, 270000, 0xf90015d8
+0, 57294, 270000, 0xf90015d8
+0, 60159, 270000, 0xf90015d8
+0, 63024, 270000, 0xf90015d8
+0, 65889, 270000, 0xf90015d8
+0, 68753, 270000, 0xf90015d8
+0, 71618, 270000, 0xf90015d8
+0, 74483, 270000, 0xf90015d8
+0, 77347, 270000, 0xf90015d8
+0, 80212, 270000, 0xf90015d8
+0, 83077, 270000, 0xf90015d8
+0, 85942, 270000, 0xf90015d8
+0, 88806, 270000, 0xf90015d8
+0, 91671, 270000, 0xf90015d8
+0, 94536, 270000, 0xf90015d8
+0, 97401, 270000, 0xf90015d8
+0, 100265, 270000, 0xf90015d8
+0, 103130, 270000, 0xf90015d8
+0, 105995, 270000, 0xf90015d8
+0, 108859, 270000, 0xf90015d8
+0, 111724, 270000, 0x1f9c15d8
+0, 114589, 270000, 0x436f15d8
+0, 117454, 270000, 0xe90115d8
+0, 120318, 270000, 0xe90115d8
+0, 123183, 270000, 0x8ea215d8
+0, 126048, 270000, 0x424015d8
+0, 128912, 270000, 0x0ce315d8
+0, 131777, 270000, 0x14bc15d8
+0, 134642, 270000, 0x2a9215d8
+0, 137507, 270000, 0x233f15d8
+0, 140371, 270000, 0x764b15d8
+0, 143236, 270000, 0xf76115d8
+0, 146101, 270000, 0xbbe015d8
+0, 148966, 270000, 0x95af15d8
+0, 151830, 270000, 0x324815d8
+0, 154695, 270000, 0x311915d8
+0, 157560, 270000, 0x090ef191
+0, 160424, 270000, 0xd88974dc
+0, 163289, 270000, 0xfa7f58df
+0, 166154, 270000, 0x78f849c3
+0, 169019, 270000, 0xae174892
+0, 171883, 270000, 0x9d4e2332
+0, 174748, 270000, 0x874b09b4
+0, 177613, 270000, 0x4069fed6
+0, 180477, 270000, 0x4069fed6
+0, 183342, 270000, 0x4069fed6
+0, 186207, 270000, 0x4069fed6
+0, 189072, 270000, 0x4069fed6
+0, 191936, 270000, 0x4069fed6
+0, 194801, 270000, 0x4069fed6
+0, 197666, 270000, 0x4069fed6
+0, 200531, 270000, 0x4069fed6
+0, 203395, 270000, 0x4069fed6
+0, 206260, 270000, 0x4069fed6
+0, 209125, 270000, 0x773db046
+0, 211989, 270000, 0x773db046
+0, 214854, 270000, 0x773db046
+0, 217719, 270000, 0x773db046
+0, 220584, 270000, 0x773db046
+0, 223448, 270000, 0x773db046
+0, 226313, 270000, 0x773db046
+0, 229178, 270000, 0x773db046
+0, 232042, 270000, 0x773db046
+0, 234907, 270000, 0x773db046
+0, 237772, 270000, 0x773db046
+0, 240637, 270000, 0x773db046
+0, 243501, 270000, 0x773db046
+0, 246366, 270000, 0x773db046
+0, 249231, 270000, 0x773db046
+0, 252095, 270000, 0x773db046
+0, 254960, 270000, 0x773db046
+0, 257825, 270000, 0x17b9aec9
+0, 260690, 270000, 0x622fad4c
+0, 263554, 270000, 0xdaea3aef
+0, 266419, 270000, 0x61bb10e3
+0, 269284, 270000, 0xfc37ee0c
+0, 272149, 270000, 0x50dbd01e
+0, 275013, 270000, 0xcd66c27c
+0, 277878, 270000, 0xd13f1e4f
+0, 280743, 270000, 0xa4a2dbf5
+0, 283607, 270000, 0xf302c9ab
+0, 286472, 270000, 0x4479f7fe
+0, 289337, 270000, 0x1afe92c8
+0, 292202, 270000, 0x3007f4c3
+0, 295066, 270000, 0x5834c096
+0, 297931, 270000, 0x40109126
+0, 300796, 270000, 0x0a7b8882
+0, 303660, 270000, 0x15b8635d
+0, 306525, 270000, 0xeaa5598e
+0, 309390, 270000, 0x0b7b5489
+0, 312255, 270000, 0x0b7b5489
+0, 315119, 270000, 0x0b7b5489
+0, 317984, 270000, 0x0b7b5489
+0, 320849, 270000, 0x8f0e6eaa
+0, 323714, 270000, 0xc46fc0f2
+0, 326578, 270000, 0xadd7e605
+0, 329443, 270000, 0x9d23a056
+0, 332308, 270000, 0x365afa63
+0, 335172, 270000, 0x6ac3bda2
+0, 338037, 270000, 0x14f5daf2
+0, 340902, 270000, 0x4b3afb6a
+0, 343767, 270000, 0x1a3302e3
+0, 346631, 270000, 0x1a3302e3
+0, 349496, 270000, 0x1a3302e3
+0, 352361, 270000, 0x1a3302e3
+0, 355225, 270000, 0xc15526e2
+0, 358090, 270000, 0x3dd73006
+0, 360955, 270000, 0x60abb5bc
+0, 363820, 270000, 0xb960c27c
+0, 366684, 270000, 0x8fa4c01c
+0, 369549, 270000, 0x8fa4c01c
+0, 372414, 270000, 0x8fa4c01c
+0, 375279, 270000, 0xb20dcc38
+0, 378143, 270000, 0x03c6ad3c
+0, 381008, 270000, 0xe550b194
+0, 383873, 270000, 0xe550b194
+0, 386737, 270000, 0xe550b194
+0, 389602, 270000, 0xe550b194
+0, 392467, 270000, 0xe550b194
+0, 395332, 270000, 0xe550b194
+0, 398196, 270000, 0xe550b194
+0, 401061, 270000, 0xe550b194
+0, 403926, 270000, 0xe550b194
+0, 406790, 270000, 0xe550b194
+0, 409655, 270000, 0xe550b194
+0, 412520, 270000, 0xe550b194
+0, 415385, 270000, 0xe550b194
+0, 418249, 270000, 0xe550b194
+0, 421114, 270000, 0x4550a014
+0, 423979, 270000, 0xaf639da8
+0, 426844, 270000, 0xe4229da8
+0, 429708, 270000, 0x315d9da8
+0, 432573, 270000, 0x7e899da8
+0, 435438, 270000, 0x99b9a8a0
+0, 438302, 270000, 0x4588ac2a
+0, 441167, 270000, 0x1e79ae6e
+0, 444032, 270000, 0xa003cb14
+0, 446897, 270000, 0x03ef1bb8
+0, 449761, 270000, 0x3b3f30fc
+0, 452626, 270000, 0x4dad3525
+0, 455491, 270000, 0x5b600c12
+0, 458355, 270000, 0x75a1fab3
+0, 461220, 270000, 0xc9f7d9ad
+0, 464085, 270000, 0x9eaec58d
+0, 466950, 270000, 0xb91bc3e8
+0, 469814, 270000, 0x77bdbbfb
+0, 472679, 270000, 0x77bdbbfb
+0, 475544, 270000, 0x77bdbbfb
+0, 478408, 270000, 0x77bdbbfb
+0, 481273, 270000, 0x77bdbbfb
+0, 484138, 270000, 0x77bdbbfb
+0, 487003, 270000, 0x3d54eac2
+0, 489867, 270000, 0x3d54eac2
+0, 492732, 270000, 0x3d54eac2
+0, 495597, 270000, 0x3d54eac2
+0, 498462, 270000, 0x3d54eac2
+0, 501326, 270000, 0x3d54eac2
+0, 504191, 270000, 0x3d54eac2
+0, 507056, 270000, 0x3d54eac2
+0, 509920, 270000, 0x3d54eac2
+0, 512785, 270000, 0x3d54eac2
+0, 515650, 270000, 0x3d54eac2
+0, 518515, 270000, 0x3d54eac2
+0, 521379, 270000, 0x3d54eac2
+0, 524244, 270000, 0x3d54eac2
+0, 527109, 270000, 0x3d54eac2
+0, 529973, 270000, 0x3d54eac2
+0, 532838, 270000, 0x3d54eac2
+0, 535703, 270000, 0x3d54eac2
+0, 538568, 270000, 0x3d54eac2
+0, 541432, 270000, 0x5f3609ba
+0, 544297, 270000, 0x80921b0c
+0, 547162, 270000, 0x80921b0c
+0, 550027, 270000, 0x80921b0c
+0, 552891, 270000, 0x80921b0c
+0, 555756, 270000, 0x80921b0c
+0, 558621, 270000, 0x80921b0c
+0, 561485, 270000, 0x80921b0c
+0, 564350, 270000, 0x80921b0c
+0, 567215, 270000, 0x80921b0c
+0, 570080, 270000, 0x80921b0c
+0, 572944, 270000, 0x80921b0c
+0, 575809, 270000, 0x80921b0c
+0, 578674, 270000, 0x80921b0c
+0, 581538, 270000, 0x80921b0c
+0, 584403, 270000, 0x80921b0c
+0, 587268, 270000, 0x80921b0c
+0, 590133, 270000, 0xf0e626a8
+0, 592997, 270000, 0xf0e626a8
--- a/tests/ref/fate/smacker
+++ b/tests/ref/fate/smacker
@@ -1,5 +1,5 @@
 0, 0, 192000, 0x8926d7fc
-1, 0, 47240, 0xad778a78
+1, 0, 47240, 0x9974897c
 0, 6390, 192000, 0x2506d384
 0, 12780, 192000, 0x9a8dc93a
 0, 19170, 192000, 0x4badb7f2
@@ -15,163 +15,163 @@
 0, 83070, 192000, 0x1a3d7971
 0, 89460, 192000, 0xa1a65bd5
 0, 95850, 192000, 0x344957b9
-1, 96408, 3128, 0x4c1564ae
+1, 96408, 3128, 0x7e4064b4
 0, 102240, 192000, 0xe23b5f4e
-1, 102792, 3128, 0x34553309
+1, 102792, 3128, 0x80883301
 0, 108630, 192000, 0xb5c2710b
-1, 109176, 3136, 0xb474d246
+1, 109176, 3136, 0x2ad2d341
 0, 115020, 192000, 0x7a25938f
-1, 115576, 3128, 0x87b868ea
+1, 115576, 3128, 0xda8468e3
 0, 121410, 192000, 0x0a84e4c9
-1, 121959, 3136, 0xf1516dc3
+1, 121959, 3136, 0x9d6f6cdf
 0, 127800, 192000, 0x94209b0d
-1, 128359, 3128, 0x867563cb
+1, 128359, 3128, 0x1aaa64b5
 0, 134190, 192000, 0xf940e51f
-1, 134743, 3128, 0x5200728c
+1, 134743, 3128, 0x9182728b
 0, 140580, 192000, 0xb9fdec42
-1, 141127, 3136, 0xeda118a0
+1, 141127, 3136, 0xfa8e17b3
 0, 146970, 192000, 0x7b04a376
-1, 147527, 3128, 0x03e2c1d6
+1, 147527, 3128, 0x0dc3c1cf
 0, 153360, 192000, 0x5fe0026b
-1, 153910, 3136, 0xc3e862b6
+1, 153910, 3136, 0x0109639d
 0, 159750, 192000, 0x775aca39
-1, 160310, 3128, 0x937a13be
+1, 160310, 3128, 0x6d8a12d9
 0, 166140, 192000, 0xae14fb32
-1, 166694, 3128, 0x7b1b9577
+1, 166694, 3128, 0x4b9a9597
 0, 172530, 192000, 0x661106e5
-1, 173078, 3136, 0x042c7113
+1, 173078, 3136, 0x9112710e
 0, 178920, 192000, 0xe8658dbf
-1, 179478, 3128, 0xac48f451
+1, 179478, 3128, 0x8cccf522
 0, 185310, 192000, 0x5359f0f9
-1, 185861, 3128, 0x018fbbe9
+1, 185861, 3128, 0x6594bbf3
 0, 191700, 192000, 0xc1ec80f4
-1, 192245, 3136, 0xc62aa7ce
+1, 192245, 3136, 0xd878a7d5
 0, 198090, 192000, 0xca53806b
-1, 198645, 3128, 0x106e3924
+1, 198645, 3128, 0xaa6e3905
 0, 204480, 192000, 0xf0766b2e
-1, 205029, 3136, 0xfeb82ecc
+1, 205029, 3136, 0x2a062e04
 0, 210870, 192000, 0x39962da8
-1, 211429, 3128, 0x7e7c005b
+1, 211429, 3128, 0x84e4006a
 0, 217260, 192000, 0x4171c37f
-1, 217812, 3128, 0x949d3560
+1, 217812, 3128, 0x85183633
 0, 223650, 192000, 0x3abf3b46
-1, 224196, 3136, 0x02bd4aff
+1, 224196, 3136, 0xb62d4b02
 0, 230040, 192000, 0xecc68313
-1, 230596, 3128, 0x4aaf4715
+1, 230596, 3128, 0xe209462a
 0, 236430, 192000, 0xea339baf
-1, 236980, 3136, 0x2958825f
+1, 236980, 3136, 0x57c4824b
 0, 242820, 192000, 0x616b8f16
-1, 243380, 3128, 0x99a5914d
+1, 243380, 3128, 0x664a9163
 0, 249210, 192000, 0xf77a8581
-1, 249763, 3128, 0xe67277a4
+1, 249763, 3128, 0xb4287874
 0, 255600, 192000, 0xb315678b
-1, 256147, 3136, 0x11296973
+1, 256147, 3136, 0xde626885
 0, 261990, 192000, 0x0a4a5218
-1, 262547, 3128, 0x5cc362f7
+1, 262547, 3128, 0x919763c2
 0, 268380, 192000, 0x98802be4
-1, 268931, 3128, 0x0c5e6586
+1, 268931, 3128, 0xa4f664e1
 0, 274770, 192000, 0xa2f0fd94
-1, 275314, 3136, 0xe940b0f9
+1, 275314, 3136, 0xa0bab0d4
 0, 281160, 192000, 0x6671c84f
-1, 281714, 3128, 0x2c9292cc
+1, 281714, 3128, 0xe938939c
 0, 287550, 192000, 0x38327e31
-1, 288098, 3136, 0xa807c096
+1, 288098, 3136, 0x3679bfc7
 0, 293940, 192000, 0xb85d3e08
-1, 294498, 3128, 0x9d2254d8
+1, 294498, 3128, 0xc96c55c3
 0, 300330, 192000, 0xdc69eba9
-1, 300882, 3128, 0xe68015b0
+1, 300882, 3128, 0x119114d6
 0, 306720, 192000, 0x8955a0b3
-1, 307265, 3136, 0x65d58029
+1, 307265, 3136, 0x42f3800f
 0, 313110, 192000, 0x714a548b
-1, 313665, 3128, 0xcffcc48c
+1, 313665, 3128, 0x4250c4ad
 0, 319500, 192000, 0xc0471de9
-1, 320049, 3136, 0x8c704944
+1, 320049, 3136, 0x5cdd4925
 0, 325890, 192000, 0x2e16e039
-1, 326449, 3128, 0x1459231d
+1, 326449, 3128, 0xa4c12360
 0, 332280, 192000, 0x9fa4b033
-1, 332833, 3128, 0x7dde4839
+1, 332833, 3128, 0x849f48de
 0, 338670, 192000, 0x4a0f9402
-1, 339216, 3136, 0xbb6890e2
+1, 339216, 3136, 0x6acd8ff9
 0, 345060, 192000, 0x1f3e6843
-1, 345616, 3128, 0xcd9a8524
+1, 345616, 3128, 0xb2758556
 0, 351450, 192000, 0x31774850
-1, 352000, 3128, 0xa244fc31
+1, 352000, 3128, 0x10f2fcb1
 0, 357840, 192000, 0x9d5336a2
-1, 358384, 3136, 0x504e2bd9
+1, 358384, 3136, 0xf0f02b23
 0, 364230, 192000, 0xf7de27a2
-1, 364784, 3128, 0x655858d8
+1, 364784, 3128, 0x64f759c6
 0, 370620, 192000, 0x98c717ce
-1, 371167, 3136, 0x46027610
+1, 371167, 3136, 0x7ec075e3
 0, 377010, 192000, 0x615b10b8
-1, 377567, 3128, 0x4192d5e3
+1, 377567, 3128, 0xf981d51e
 0, 383400, 192000, 0xd5bc0e7e
-1, 383951, 3128, 0x21d2e7fe
+1, 383951, 3128, 0xc622e8b9
 0, 389790, 192000, 0xd5bc0e7e
-1, 390335, 3136, 0x7c93e329
+1, 390335, 3136, 0xf632e2f8
 0, 396180, 192000, 0xd5bc0e7e
-1, 396735, 3128, 0xa67718c0
+1, 396735, 3128, 0xda561864
 0, 402570, 192000, 0xd5bc0e7e
-1, 403118, 3136, 0x9bb6e8a3
+1, 403118, 3136, 0x14d2e888
 0, 408960, 192000, 0xd5bc0e7e
-1, 409518, 3128, 0x0933b7a6
+1, 409518, 3128, 0x015bb869
 0, 415350, 192000, 0xd5bc0e7e
-1, 415902, 3128, 0x07f1fb57
+1, 415902, 3128, 0xedb1fb62
 0, 421740, 192000, 0xd5bc0e7e
-1, 422286, 3136, 0x8a050cfd
+1, 422286, 3136, 0xe0560c41
 0, 428130, 192000, 0xd5bc0e7e
-1, 428686, 3128, 0xdb773c0b
+1, 428686, 3128, 0x14773c9a
 0, 434520, 192000, 0xd5bc0e7e
-1, 435069, 3136, 0xd1281c53
+1, 435069, 3136, 0x850f1c82
 0, 440910, 192000, 0xd5bc0e7e
-1, 441469, 3128, 0x9f395324
+1, 441469, 3128, 0xb0bd5347
 0, 447300, 192000, 0xd5bc0e7e
-1, 447853, 3128, 0x5f13edec
+1, 447853, 3128, 0x8f82edbf
 0, 453690, 192000, 0xd5bc0e7e
-1, 454237, 3136, 0x871cbecf
+1, 454237, 3136, 0x493abee2
 0, 460080, 192000, 0xd5bc0e7e
-1, 460637, 3128, 0x799eff3e
+1, 460637, 3128, 0xf5daff3f
 0, 466470, 192000, 0xd5bc0e7e
-1, 467020, 3128, 0x3f902762
+1, 467020, 3128, 0x78ad2690
 0, 472860, 192000, 0xd5bc0e7e
-1, 473404, 3136, 0x29f8bb04
+1, 473404, 3136, 0x490ebafc
 0, 479250, 192000, 0xd5bc0e7e
-1, 479804, 3128, 0xf3523ee9
+1, 479804, 3128, 0x70333fd2
 0, 485640, 192000, 0xd5bc0e7e
-1, 486188, 3136, 0x4405c435
+1, 486188, 3136, 0x8cb1c350
 0, 492030, 192000, 0xd5bc0e7e
-1, 492588, 3128, 0x892957cb
+1, 492588, 3128, 0x8bd057cb
 0, 498420, 192000, 0xd5bc0e7e
-1, 498971, 3128, 0xdf483dbd
+1, 498971, 3128, 0x161b3dbc
 0, 504810, 192000, 0xd5bc0e7e
-1, 505355, 3136, 0x5e8ab797
+1, 505355, 3136, 0xb47fb88a
 0, 511200, 192000, 0xd5bc0e7e
-1, 511755, 3128, 0x92e13820
+1, 511755, 3128, 0x474b381e
 0, 517590, 192000, 0xd5bc0e7e
-1, 518139, 3136, 0xfde719b6
+1, 518139, 3136, 0x07c519bb
 0, 523980, 192000, 0xd5bc0e7e
-1, 524539, 3128, 0x442f17ae
+1, 524539, 3128, 0x15b916c8
 0, 530370, 192000, 0xd5bc0e7e
-1, 530922, 3128, 0x011af61f
+1, 530922, 3128, 0x0ed7f6fb
 0, 536760, 192000, 0xd5bc0e7e
-1, 537306, 3136, 0x4e3e3a6d
+1, 537306, 3136, 0x54d6397b
 0, 543150, 192000, 0xd5bc0e7e
-1, 543706, 3128, 0xc11242b9
+1, 543706, 3128, 0x437242bb
 0, 549540, 192000, 0xd5bc0e7e
-1, 550090, 3128, 0x01415b59
+1, 550090, 3128, 0x38f05c4d
 0, 555930, 192000, 0xd5bc0e7e
-1, 556473, 3136, 0x302e0e55
+1, 556473, 3136, 0x5d000e59
 0, 562320, 192000, 0xd5bc0e7e
-1, 562873, 3128, 0x20522d04
+1, 562873, 3128, 0xdeab2d04
 0, 568710, 192000, 0xd5bc0e7e
-1, 569257, 3136, 0x316a697d
+1, 569257, 3136, 0x77de6880
 0, 575100, 192000, 0xd5bc0e7e
-1, 575657, 3128, 0x6d75ee27
+1, 575657, 3128, 0xbc87ef25
 0, 581490, 192000, 0xd5bc0e7e
-1, 582041, 3128, 0xcb008ae8
+1, 582041, 3128, 0xc1638ade
 0, 587880, 192000, 0xd5bc0e7e
-1, 588424, 3136, 0xd2664b51
+1, 588424, 3136, 0xcfb64a5f
 0, 594270, 192000, 0xd5bc0e7e
-1, 594824, 3128, 0xdfcab728
+1, 594824, 3128, 0x90b1b826
 0, 600660, 192000, 0xd5bc0e7e
 1, 601208, 3136, 0x00000000
 0, 607050, 192000, 0xd5bc0e7e
@@ -1 +1 @@
 .6.1
 .6.5