update for 2.1.4

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

RELEASE

@@ -1 +1 @@
-2.1.3
+2.1.4

VERSION

@@ -1 +1 @@
-2.1.3
+2.1.4

cmdutils.c

@@ -68,7 +68,7 @@ struct SwsContext *sws_opts;
 AVDictionary *swr_opts;
 AVDictionary *format_opts, *codec_opts, *resample_opts;
 
-const int this_year = 2013;
+const int this_year = 2014;
 
 static FILE *report_file;
 

configure

@@ -2036,6 +2036,7 @@ wmv3_vdpau_hwaccel_select="vc1_vdpau_hwaccel"
 
 # parsers
 h264_parser_select="golomb h264chroma h264dsp h264pred h264qpel videodsp"
+hevc_parser_select="hevc_decoder"
 mpeg4video_parser_select="error_resilience mpegvideo"
 mpegvideo_parser_select="error_resilience mpegvideo"
 vc1_parser_select="mpegvideo"

doc/Doxyfile

@@ -31,7 +31,7 @@ PROJECT_NAME           = FFmpeg
 # This could be handy for archiving the generated documentation or
 # if some version control system is used.
 
-PROJECT_NUMBER         = 2.1.3
+PROJECT_NUMBER         = 2.1.4
 
 # With the PROJECT_LOGO tag one can specify a logo or icon that is included
 # in the documentation. The maximum height of the logo should not exceed 55

libavcodec/aacdec.c

@@ -194,6 +194,9 @@ static int frame_configure_elements(AVCodecContext *avctx)
 
     /* get output buffer */
     av_frame_unref(ac->frame);
+    if (!avctx->channels)
+        return 1;
+
     ac->frame->nb_samples = 2048;
     if ((ret = ff_get_buffer(avctx, ac->frame, 0)) < 0)
         return ret;
@@ -1402,12 +1405,12 @@ static int decode_pulses(Pulse *pulse, GetBitContext *gb,
         return -1;
     pulse->pos[0]    = swb_offset[pulse_swb];
     pulse->pos[0]   += get_bits(gb, 5);
-    if (pulse->pos[0] > 1023)
+    if (pulse->pos[0] >= swb_offset[num_swb])
         return -1;
     pulse->amp[0]    = get_bits(gb, 4);
     for (i = 1; i < pulse->num_pulse; i++) {
         pulse->pos[i] = get_bits(gb, 5) + pulse->pos[i - 1];
-        if (pulse->pos[i] > 1023)
+        if (pulse->pos[i] >= swb_offset[num_swb])
             return -1;
         pulse->amp[i] = get_bits(gb, 4);
     }

libavcodec/alsdec.c

@@ -688,7 +688,11 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
         } else {
             *bd->opt_order = sconf->max_order;
         }
-
+        if (*bd->opt_order > bd->block_length) {
+            *bd->opt_order = bd->block_length;
+            av_log(avctx, AV_LOG_ERROR, "Predictor order too large.\n");
+            return AVERROR_INVALIDDATA;
+        }
         opt_order = *bd->opt_order;
 
         if (opt_order) {

libavcodec/ansi.c

@@ -417,7 +417,7 @@ static int decode_frame(AVCodecContext *avctx,
             switch(buf[0]) {
             case '0': case '1': case '2': case '3': case '4':
             case '5': case '6': case '7': case '8': case '9':
-                if (s->nb_args < MAX_NB_ARGS)
+                if (s->nb_args < MAX_NB_ARGS && s->args[s->nb_args] < 6553)
                     s->args[s->nb_args] = FFMAX(s->args[s->nb_args], 0) * 10 + buf[0] - '0';
                 break;
             case ';':

libavcodec/apedec.c

@@ -603,10 +603,14 @@ static void decode_array_0000(APEContext *ctx, GetBitContext *gb,
         rice->ksum += out[i];
     }
     rice->k = av_log2(rice->ksum / 10) + 1;
+    if (rice->k >= 24)
+        return;
     for (; i < 64; i++) {
         out[i] = get_rice_ook(&ctx->gb, rice->k);
         rice->ksum += out[i];
         rice->k = av_log2(rice->ksum / ((i + 1) * 2)) + 1;
+        if (rice->k >= 24)
+            return;
     }
     ksummax = 1 << rice->k + 7;
     ksummin = rice->k ? (1 << rice->k + 6) : 0;

libavcodec/dnxhdenc.c

@@ -235,7 +235,7 @@ static av_cold int dnxhd_init_qmat(DNXHDEncContext *ctx, int lbias, int cbias)
 
 static av_cold int dnxhd_init_rc(DNXHDEncContext *ctx)
 {
-    FF_ALLOCZ_OR_GOTO(ctx->m.avctx, ctx->mb_rc, 8160*ctx->m.avctx->qmax*sizeof(RCEntry), fail);
+    FF_ALLOCZ_OR_GOTO(ctx->m.avctx, ctx->mb_rc, 8160*(ctx->m.avctx->qmax + 1)*sizeof(RCEntry), fail);
     if (ctx->m.avctx->mb_decision != FF_MB_DECISION_RD)
         FF_ALLOCZ_OR_GOTO(ctx->m.avctx, ctx->mb_cmp, ctx->m.mb_num*sizeof(RCCMPEntry), fail);
 

libavcodec/h264.c

@@ -3430,6 +3430,12 @@ static int decode_slice_header(H264Context *h, H264Context *h0)
                pps_id);
         return AVERROR_INVALIDDATA;
     }
+    if (h0->au_pps_id >= 0 && pps_id != h0->au_pps_id) {
+        av_log(h->avctx, AV_LOG_ERROR,
+               "PPS change from %d to %d forbidden\n",
+               h0->au_pps_id, pps_id);
+        return AVERROR_INVALIDDATA;
+    }
     h->pps = *h0->pps_buffers[pps_id];
 
     if (!h0->sps_buffers[h->pps.sps_id]) {
@@ -3441,9 +3447,7 @@ static int decode_slice_header(H264Context *h, H264Context *h0)
 
     if (h->pps.sps_id != h->current_sps_id ||
         h0->sps_buffers[h->pps.sps_id]->new) {
-        h0->sps_buffers[h->pps.sps_id]->new = 0;
 
-        h->current_sps_id = h->pps.sps_id;
         h->sps            = *h0->sps_buffers[h->pps.sps_id];
 
         if (h->mb_width  != h->sps.mb_width ||
@@ -3928,8 +3932,8 @@ static int decode_slice_header(H264Context *h, H264Context *h0)
         if (h->deblocking_filter) {
             h->slice_alpha_c0_offset += get_se_golomb(&h->gb) << 1;
             h->slice_beta_offset     += get_se_golomb(&h->gb) << 1;
-            if (h->slice_alpha_c0_offset > 104U ||
-                h->slice_beta_offset     > 104U) {
+            if (h->slice_alpha_c0_offset < 52 - 12 || h->slice_alpha_c0_offset > 52 + 12 ||
+                h->slice_beta_offset     < 52 - 12 || h->slice_beta_offset     > 52 + 12) {
                 av_log(h->avctx, AV_LOG_ERROR,
                        "deblocking filter parameters %d %d out of range\n",
                        h->slice_alpha_c0_offset, h->slice_beta_offset);
@@ -4022,6 +4026,10 @@ static int decode_slice_header(H264Context *h, H264Context *h0)
     if (h->ref_count[0]) h->er.last_pic = &h->ref_list[0][0];
     if (h->ref_count[1]) h->er.next_pic = &h->ref_list[1][0];
     h->er.ref_count = h->ref_count[0];
+    h0->au_pps_id = pps_id;
+    h->sps.new =
+    h0->sps_buffers[h->pps.sps_id]->new = 0;
+    h->current_sps_id = h->pps.sps_id;
 
     if (h->avctx->debug & FF_DEBUG_PICT_INFO) {
         av_log(h->avctx, AV_LOG_DEBUG,
@@ -4605,6 +4613,8 @@ static int execute_decode_slices(H264Context *h, int context_count)
     H264Context *hx;
     int i;
 
+    av_assert0(h->mb_y < h->mb_height);
+
     if (h->avctx->hwaccel ||
         h->avctx->codec->capabilities & CODEC_CAP_HWACCEL_VDPAU)
         return 0;
@@ -4786,6 +4796,9 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size,
                 continue;
 
 again:
+            if (   !(avctx->active_thread_type & FF_THREAD_FRAME)
+                || nals_needed >= nal_index)
+                h->au_pps_id = -1;
             /* Ignore per frame NAL unit type during extradata
              * parsing. Decoding slices is not possible in codec init
              * with frame-mt */
@@ -5008,6 +5021,7 @@ static int get_consumed_bytes(int pos, int buf_size)
 static int output_frame(H264Context *h, AVFrame *dst, Picture *srcp)
 {
     AVFrame *src = &srcp->f;
+    const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(src->format);
     int i;
     int ret = av_frame_ref(dst, src);
     if (ret < 0)
@@ -5018,9 +5032,9 @@ static int output_frame(H264Context *h, AVFrame *dst, Picture *srcp)
     if (!srcp->crop)
         return 0;
 
-    for (i = 0; i < 3; i++) {
-        int hshift = (i > 0) ? h->chroma_x_shift : 0;
-        int vshift = (i > 0) ? h->chroma_y_shift : 0;
+    for (i = 0; i < desc->nb_components; i++) {
+        int hshift = (i > 0) ? desc->log2_chroma_w : 0;
+        int vshift = (i > 0) ? desc->log2_chroma_h : 0;
         int off    = ((srcp->crop_left >> hshift) << h->pixel_shift) +
                       (srcp->crop_top  >> vshift) * dst->linesize[i];
         dst->data[i] += off;

libavcodec/h264.h

@@ -390,6 +390,8 @@ typedef struct H264Context {
      */
     PPS pps; // FIXME move to Picture perhaps? (->no) do we need that?
 
+    int au_pps_id; ///< pps_id of current access unit
+
     uint32_t dequant4_buffer[6][QP_MAX_NUM + 1][16]; // FIXME should these be moved down?
     uint32_t dequant8_buffer[6][QP_MAX_NUM + 1][64];
     uint32_t(*dequant4_coeff[6])[16];

libavcodec/hevc.c

@@ -743,11 +743,10 @@ static void hls_sao_param(HEVCContext *s, int rx, int ry)
 #undef SET_SAO
 #undef CTB
 
-
-static void hls_transform_unit(HEVCContext *s, int x0, int y0,
-                               int xBase, int yBase, int cb_xBase, int cb_yBase,
-                               int log2_cb_size, int log2_trafo_size,
-                               int trafo_depth, int blk_idx)
+static int hls_transform_unit(HEVCContext *s, int x0, int y0,
+                              int xBase, int yBase, int cb_xBase, int cb_yBase,
+                              int log2_cb_size, int log2_trafo_size,
+                              int trafo_depth, int blk_idx)
 {
     HEVCLocalContext *lc = s->HEVClc;
 
@@ -781,6 +780,18 @@ static void hls_transform_unit(HEVCContext *s, int x0, int y0,
                 if (ff_hevc_cu_qp_delta_sign_flag(s) == 1)
                     lc->tu.cu_qp_delta = -lc->tu.cu_qp_delta;
             lc->tu.is_cu_qp_delta_coded = 1;
+
+            if (lc->tu.cu_qp_delta < -(26 + s->sps->qp_bd_offset / 2) ||
+                lc->tu.cu_qp_delta >  (25 + s->sps->qp_bd_offset / 2)) {
+                av_log(s->avctx, AV_LOG_ERROR,
+                       "The cu_qp_delta %d is outside the valid range "
+                       "[%d, %d].\n",
+                       lc->tu.cu_qp_delta,
+                       -(26 + s->sps->qp_bd_offset / 2),
+                        (25 + s->sps->qp_bd_offset / 2));
+                return AVERROR_INVALIDDATA;
+            }
+
             ff_hevc_set_qPy(s, x0, y0, cb_xBase, cb_yBase, log2_cb_size);
         }
 
@@ -816,6 +827,7 @@ static void hls_transform_unit(HEVCContext *s, int x0, int y0,
                 ff_hevc_hls_residual_coding(s, xBase, yBase, log2_trafo_size, scan_idx_c, 2);
         }
     }
+    return 0;
 }
 
 static void set_deblocking_bypass(HEVCContext *s, int x0, int y0, int log2_cb_size)
@@ -833,13 +845,14 @@ static void set_deblocking_bypass(HEVCContext *s, int x0, int y0, int log2_cb_si
             s->is_pcm[i + j * min_pu_width] = 2;
 }
 
-static void hls_transform_tree(HEVCContext *s, int x0, int y0,
-                               int xBase, int yBase, int cb_xBase, int cb_yBase,
-                               int log2_cb_size, int log2_trafo_size,
-                               int trafo_depth, int blk_idx)
+static int hls_transform_tree(HEVCContext *s, int x0, int y0,
+                              int xBase, int yBase, int cb_xBase, int cb_yBase,
+                              int log2_cb_size, int log2_trafo_size,
+                              int trafo_depth, int blk_idx)
 {
     HEVCLocalContext *lc = s->HEVClc;
     uint8_t split_transform_flag;
+    int ret;
 
     if (trafo_depth > 0 && log2_trafo_size == 2) {
         SAMPLE_CBF(lc->tt.cbf_cb[trafo_depth], x0, y0) =
@@ -892,14 +905,26 @@ static void hls_transform_tree(HEVCContext *s, int x0, int y0,
         int x1 = x0 + ((1 << log2_trafo_size) >> 1);
         int y1 = y0 + ((1 << log2_trafo_size) >> 1);
 
-        hls_transform_tree(s, x0, y0, x0, y0, cb_xBase, cb_yBase, log2_cb_size,
-                           log2_trafo_size - 1, trafo_depth + 1, 0);
-        hls_transform_tree(s, x1, y0, x0, y0, cb_xBase, cb_yBase, log2_cb_size,
-                           log2_trafo_size - 1, trafo_depth + 1, 1);
-        hls_transform_tree(s, x0, y1, x0, y0, cb_xBase, cb_yBase, log2_cb_size,
-                           log2_trafo_size - 1, trafo_depth + 1, 2);
-        hls_transform_tree(s, x1, y1, x0, y0, cb_xBase, cb_yBase, log2_cb_size,
-                           log2_trafo_size - 1, trafo_depth + 1, 3);
+        ret = hls_transform_tree(s, x0, y0, x0, y0, cb_xBase, cb_yBase,
+                                 log2_cb_size, log2_trafo_size - 1,
+                                 trafo_depth + 1, 0);
+        if (ret < 0)
+            return ret;
+        ret = hls_transform_tree(s, x1, y0, x0, y0, cb_xBase, cb_yBase,
+                                 log2_cb_size, log2_trafo_size - 1,
+                                 trafo_depth + 1, 1);
+        if (ret < 0)
+            return ret;
+        ret = hls_transform_tree(s, x0, y1, x0, y0, cb_xBase, cb_yBase,
+                                 log2_cb_size, log2_trafo_size - 1,
+                                 trafo_depth + 1, 2);
+        if (ret < 0)
+            return ret;
+        ret = hls_transform_tree(s, x1, y1, x0, y0, cb_xBase, cb_yBase,
+                                 log2_cb_size, log2_trafo_size - 1,
+                                 trafo_depth + 1, 3);
+        if (ret < 0)
+            return ret;
     } else {
         int min_tu_size      = 1 << s->sps->log2_min_tb_size;
         int log2_min_tu_size = s->sps->log2_min_tb_size;
@@ -911,9 +936,11 @@ static void hls_transform_tree(HEVCContext *s, int x0, int y0,
             lc->tt.cbf_luma = ff_hevc_cbf_luma_decode(s, trafo_depth);
         }
 
-        hls_transform_unit(s, x0, y0, xBase, yBase, cb_xBase, cb_yBase,
-                           log2_cb_size, log2_trafo_size, trafo_depth, blk_idx);
-
+        ret = hls_transform_unit(s, x0, y0, xBase, yBase, cb_xBase, cb_yBase,
+                                 log2_cb_size, log2_trafo_size, trafo_depth,
+                                 blk_idx);
+        if (ret < 0)
+            return ret;
         // TODO: store cbf_luma somewhere else
         if (lc->tt.cbf_luma) {
             int i, j;
@@ -932,6 +959,7 @@ static void hls_transform_tree(HEVCContext *s, int x0, int y0,
                 set_deblocking_bypass(s, x0, y0, log2_trafo_size);
         }
     }
+    return 0;
 }
 
 static int hls_pcm_sample(HEVCContext *s, int x0, int y0, int log2_cb_size)
@@ -1520,7 +1548,8 @@ static int hls_coding_unit(HEVCContext *s, int x0, int y0, int log2_cb_size)
     int min_cb_width     = s->sps->min_cb_width;
     int x_cb             = x0 >> log2_min_cb_size;
     int y_cb             = y0 >> log2_min_cb_size;
-    int x, y;
+    int x, y, ret;
+    int qp_block_mask = (1<<(s->sps->log2_ctb_size - s->pps->diff_cu_qp_delta_depth)) - 1;
 
     lc->cu.x            = x0;
     lc->cu.y            = y0;
@@ -1577,7 +1606,6 @@ static int hls_coding_unit(HEVCContext *s, int x0, int y0, int log2_cb_size)
                 lc->cu.pcm_flag = ff_hevc_pcm_flag_decode(s);
             }
             if (lc->cu.pcm_flag) {
-                int ret;
                 intra_prediction_unit_default_value(s, x0, y0, log2_cb_size);
                 ret = hls_pcm_sample(s, x0, y0, log2_cb_size);
                 if (s->sps->pcm.loop_filter_disable_flag)
@@ -1636,8 +1664,11 @@ static int hls_coding_unit(HEVCContext *s, int x0, int y0, int log2_cb_size)
                 lc->cu.max_trafo_depth = lc->cu.pred_mode == MODE_INTRA ?
                                          s->sps->max_transform_hierarchy_depth_intra + lc->cu.intra_split_flag :
                                          s->sps->max_transform_hierarchy_depth_inter;
-                hls_transform_tree(s, x0, y0, x0, y0, x0, y0, log2_cb_size,
-                                   log2_cb_size, 0, 0);
+                ret = hls_transform_tree(s, x0, y0, x0, y0, x0, y0,
+                                         log2_cb_size,
+                                         log2_cb_size, 0, 0);
+                if (ret < 0)
+                    return ret;
             } else {
                 if (!s->sh.disable_deblocking_filter_flag)
                     ff_hevc_deblocking_boundary_strengths(s, x0, y0, log2_cb_size,
@@ -1656,6 +1687,11 @@ static int hls_coding_unit(HEVCContext *s, int x0, int y0, int log2_cb_size)
         x += min_cb_width;
     }
 
+    if(((x0 + (1<<log2_cb_size)) & qp_block_mask) == 0 &&
+       ((y0 + (1<<log2_cb_size)) & qp_block_mask) == 0) {
+        lc->qPy_pred = lc->qp_y;
+    }
+
     set_ct_depth(s, x0, y0, log2_cb_size, lc->ct.depth);
 
     return 0;
@@ -1667,6 +1703,7 @@ static int hls_coding_quadtree(HEVCContext *s, int x0, int y0,
     HEVCLocalContext *lc = s->HEVClc;
     const int cb_size    = 1 << log2_cb_size;
     int ret;
+    int qp_block_mask = (1<<(s->sps->log2_ctb_size - s->pps->diff_cu_qp_delta_depth)) - 1;
 
     lc->ct.depth = cb_depth;
     if ((x0 + cb_size <= s->sps->width) &&
@@ -1694,14 +1731,27 @@ static int hls_coding_quadtree(HEVCContext *s, int x0, int y0,
         if (more_data < 0)
             return more_data;
 
-        if (more_data && x1 < s->sps->width)
+        if (more_data && x1 < s->sps->width) {
             more_data = hls_coding_quadtree(s, x1, y0, log2_cb_size - 1, cb_depth + 1);
-        if (more_data && y1 < s->sps->height)
+            if (more_data < 0)
+                return more_data;
+        }
+        if (more_data && y1 < s->sps->height) {
             more_data = hls_coding_quadtree(s, x0, y1, log2_cb_size - 1, cb_depth + 1);
+            if (more_data < 0)
+                return more_data;
+        }
         if (more_data && x1 < s->sps->width &&
             y1 < s->sps->height) {
-            return hls_coding_quadtree(s, x1, y1, log2_cb_size - 1, cb_depth + 1);
+            more_data = hls_coding_quadtree(s, x1, y1, log2_cb_size - 1, cb_depth + 1);
+            if (more_data < 0)
+                return more_data;
         }
+
+        if(((x0 + (1<<log2_cb_size)) & qp_block_mask) == 0 &&
+            ((y0 + (1<<log2_cb_size)) & qp_block_mask) == 0)
+            lc->qPy_pred = lc->qp_y;
+
         if (more_data)
             return ((x1 + cb_size_split) < s->sps->width ||
                     (y1 + cb_size_split) < s->sps->height);
@@ -1795,6 +1845,14 @@ static int hls_decode_entry(AVCodecContext *avctxt, void *isFilterThread)
         return AVERROR_INVALIDDATA;
     }
 
+    if (s->sh.dependent_slice_segment_flag) {
+        int prev_rs = s->pps->ctb_addr_ts_to_rs[ctb_addr_ts - 1];
+        if (s->tab_slice_address[prev_rs] != s->sh.slice_addr) {
+            av_log(s->avctx, AV_LOG_ERROR, "Previous slice segment missing\n");
+            return AVERROR_INVALIDDATA;
+        }
+    }
+
     while (more_data && ctb_addr_ts < s->sps->ctb_size) {
         int ctb_addr_rs = s->pps->ctb_addr_ts_to_rs[ctb_addr_ts];
 
@@ -1811,8 +1869,11 @@ static int hls_decode_entry(AVCodecContext *avctxt, void *isFilterThread)
         s->filter_slice_edges[ctb_addr_rs]  = s->sh.slice_loop_filter_across_slices_enabled_flag;
 
         more_data = hls_coding_quadtree(s, x_ctb, y_ctb, s->sps->log2_ctb_size, 0);
-        if (more_data < 0)
+        if (more_data < 0) {
+            s->tab_slice_address[ctb_addr_rs] = -1;
             return more_data;
+        }
+
 
         ctb_addr_ts++;
         ff_hevc_save_states(s, ctb_addr_ts);
@@ -1878,8 +1939,10 @@ static int hls_decode_entry_wpp(AVCodecContext *avctxt, void *input_ctb_row, int
         hls_sao_param(s, x_ctb >> s->sps->log2_ctb_size, y_ctb >> s->sps->log2_ctb_size);
         more_data = hls_coding_quadtree(s, x_ctb, y_ctb, s->sps->log2_ctb_size, 0);
 
-        if (more_data < 0)
+        if (more_data < 0) {
+            s->tab_slice_address[ctb_addr_rs] = -1;
             return more_data;
+        }
 
         ctb_addr_ts++;
 
@@ -2043,13 +2106,16 @@ static void restore_tqb_pixels(HEVCContext *s)
 
 static int hevc_frame_start(HEVCContext *s)
 {
-    HEVCLocalContext *lc     = s->HEVClc;
+    HEVCLocalContext *lc = s->HEVClc;
+    int pic_size_in_ctb  = ((s->sps->width  >> s->sps->log2_min_cb_size) + 1) *
+                           ((s->sps->height >> s->sps->log2_min_cb_size) + 1);
     int ret;
 
     memset(s->horizontal_bs, 0, 2 * s->bs_width * (s->bs_height + 1));
     memset(s->vertical_bs,   0, 2 * s->bs_width * (s->bs_height + 1));
     memset(s->cbf_luma,      0, s->sps->min_tb_width * s->sps->min_tb_height);
     memset(s->is_pcm,        0, s->sps->min_pu_width * s->sps->min_pu_height);
+    memset(s->tab_slice_address, -1, pic_size_in_ctb * sizeof(*s->tab_slice_address));
 
     lc->start_of_tiles_x = 0;
     s->is_decoded        = 0;

libavcodec/hevc.h

@@ -373,7 +373,7 @@ typedef struct ScalingList {
 } ScalingList;
 
 typedef struct HEVCSPS {
-    int vps_id;
+    unsigned vps_id;
     int chroma_format_idc;
     uint8_t separate_colour_plane_flag;
 
@@ -454,7 +454,7 @@ typedef struct HEVCSPS {
 } HEVCSPS;
 
 typedef struct HEVCPPS {
-    int sps_id; ///< seq_parameter_set_id
+    unsigned sps_id; ///< seq_parameter_set_id
 
     uint8_t sign_data_hiding_flag;
 
@@ -733,6 +733,8 @@ typedef struct HEVCLocalContext {
     int8_t qp_y;
     int8_t curr_qp_y;
 
+    int qPy_pred;
+
     TransformUnit tu;
 
     uint8_t ctb_left_flag;

libavcodec/hevc_filter.c

@@ -93,45 +93,7 @@ static int get_qPy_pred(HEVCContext *s, int xC, int yC, int xBase, int yBase, in
         lc->first_qp_group = !lc->tu.is_cu_qp_delta_coded;
         qPy_pred = s->sh.slice_qp;
     } else {
-        qPy_pred = lc->qp_y;
-        if (log2_cb_size < s->sps->log2_ctb_size - s->pps->diff_cu_qp_delta_depth) {
-            static const int offsetX[8][8] = {
-                    {-1, 1, 3, 1, 7, 1, 3, 1},
-                    { 0, 0, 0, 0, 0, 0, 0, 0},
-                    { 1, 3, 1, 3, 1, 3, 1, 3},
-                    { 2, 2, 2, 2, 2, 2, 2, 2},
-                    { 3, 5, 7, 5, 3, 5, 7, 5},
-                    { 4, 4, 4, 4, 4, 4, 4, 4},
-                    { 5, 7, 5, 7, 5, 7, 5, 7},
-                    { 6, 6, 6, 6, 6, 6, 6, 6}
-            };
-            static const int offsetY[8][8] = {
-                    { 7, 0, 1, 2, 3, 4, 5, 6},
-                    { 0, 1, 2, 3, 4, 5, 6, 7},
-                    { 1, 0, 3, 2, 5, 4, 7, 6},
-                    { 0, 1, 2, 3, 4, 5, 6, 7},
-                    { 3, 0, 1, 2, 7, 4, 5, 6},
-                    { 0, 1, 2, 3, 4, 5, 6, 7},
-                    { 1, 0, 3, 2, 5, 4, 7, 6},
-                    { 0, 1, 2, 3, 4, 5, 6, 7}
-            };
-            int xC0b = (xC - (xC & ctb_size_mask)) >> s->sps->log2_min_cb_size;
-            int yC0b = (yC - (yC & ctb_size_mask)) >> s->sps->log2_min_cb_size;
-            int idxX = (xQgBase & ctb_size_mask)   >> s->sps->log2_min_cb_size;
-            int idxY = (yQgBase & ctb_size_mask)   >> s->sps->log2_min_cb_size;
-            int idx_mask = ctb_size_mask >> s->sps->log2_min_cb_size;
-            int x, y;
-
-            x = FFMIN(xC0b +  offsetX[idxX][idxY],             min_cb_width  - 1);
-            y = FFMIN(yC0b + (offsetY[idxX][idxY] & idx_mask), min_cb_height - 1);
-
-            if (xC0b == (lc->start_of_tiles_x >> s->sps->log2_min_cb_size) &&
-                offsetX[idxX][idxY] == -1) {
-                x = (lc->end_of_tiles_x >> s->sps->log2_min_cb_size) - 1;
-                y = yC0b - 1;
-            }
-            qPy_pred = s->qp_y_tab[y * min_cb_width + x];
-        }
+        qPy_pred = lc->qPy_pred;
     }
 
     // qPy_a

libavcodec/hevc_ps.c

@@ -489,8 +489,8 @@ static void decode_vui(HEVCContext *s, HEVCSPS *sps)
 
     vui->vui_timing_info_present_flag = get_bits1(gb);
     if (vui->vui_timing_info_present_flag) {
-        vui->vui_num_units_in_tick               = get_bits(gb, 32);
-        vui->vui_time_scale                      = get_bits(gb, 32);
+        vui->vui_num_units_in_tick               = get_bits_long(gb, 32);
+        vui->vui_time_scale                      = get_bits_long(gb, 32);
         vui->vui_poc_proportional_to_timing_flag = get_bits1(gb);
         if (vui->vui_poc_proportional_to_timing_flag)
             vui->vui_num_ticks_poc_diff_one_minus1 = get_ue_golomb_long(gb);

libavcodec/jpeg2000dec.c

@@ -344,7 +344,7 @@ static int get_siz(Jpeg2000DecoderContext *s)
             break;
         }
     }
-    if (s->avctx->pix_fmt == AV_PIX_FMT_NONE) {
+    if (i == possible_fmts_nb) {
         av_log(s->avctx, AV_LOG_ERROR,
                "Unknown pix_fmt, profile: %d, colour_space: %d, "
                "components: %d, precision: %d, "
@@ -354,6 +354,7 @@ static int get_siz(Jpeg2000DecoderContext *s)
                ncomponents > 2 ? s->cdy[1] : 0,
                ncomponents > 2 ? s->cdx[2] : 0,
                ncomponents > 2 ? s->cdy[2] : 0);
+        return AVERROR_PATCHWELCOME;
     }
     s->avctx->bits_per_raw_sample = s->precision;
     return 0;

libavcodec/libxvid.c

@@ -48,6 +48,7 @@
  * This stores all the private context for the codec.
  */
 struct xvid_context {
+    AVClass *class;
     void *encoder_handle;          /**< Handle for Xvid encoder */
     int xsize;                     /**< Frame x size */
     int ysize;                     /**< Frame y size */

libavcodec/mjpegbdec.c

@@ -119,7 +119,7 @@ read_header:
                       8 * FFMIN(field_size, buf_end - buf_ptr - sos_offs));
         s->mjpb_skiptosod = (sod_offs - sos_offs - show_bits(&s->gb, 16));
         s->start_code = SOS;
-        if (ff_mjpeg_decode_sos(s, NULL, NULL) < 0 &&
+        if (ff_mjpeg_decode_sos(s, NULL, 0, NULL) < 0 &&
             (avctx->err_recognition & AV_EF_EXPLODE))
           return AVERROR_INVALIDDATA;
     }

libavcodec/mjpegdec.c

@@ -334,7 +334,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
         s->first_picture = 0;
     }
 
-    if (s->interlaced && (s->bottom_field == !s->interlace_polarity)) {
+    if (s->got_picture && s->interlaced && (s->bottom_field == !s->interlace_polarity)) {
         if (s->progressive) {
             avpriv_request_sample(s->avctx, "progressively coded interlaced picture");
             return AVERROR_INVALIDDATA;
@@ -1092,6 +1092,7 @@ static void shift_output(MJpegDecodeContext *s, uint8_t *ptr, int linesize)
 
 static int mjpeg_decode_scan(MJpegDecodeContext *s, int nb_components, int Ah,
                              int Al, const uint8_t *mb_bitmask,
+                             int mb_bitmask_size,
                              const AVFrame *reference)
 {
     int i, mb_x, mb_y;
@@ -1101,8 +1102,13 @@ static int mjpeg_decode_scan(MJpegDecodeContext *s, int nb_components, int Ah,
     GetBitContext mb_bitmask_gb;
     int bytes_per_pixel = 1 + (s->bits > 8);
 
-    if (mb_bitmask)
+    if (mb_bitmask) {
+        if (mb_bitmask_size != (s->mb_width * s->mb_height + 7)>>3) {
+            av_log(s->avctx, AV_LOG_ERROR, "mb_bitmask_size mismatches\n");
+            return AVERROR_INVALIDDATA;
+        }
         init_get_bits(&mb_bitmask_gb, mb_bitmask, s->mb_width * s->mb_height);
+    }
 
     if (s->flipped && s->avctx->lowres) {
         av_log(s->avctx, AV_LOG_ERROR, "Can not flip image with lowres\n");
@@ -1268,7 +1274,7 @@ static int mjpeg_decode_scan_progressive_ac(MJpegDecodeContext *s, int ss,
 }
 
 int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
-                        const AVFrame *reference)
+                        int mb_bitmask_size, const AVFrame *reference)
 {
     int len, nb_components, i, h, v, predictor, point_transform;
     int index, id, ret;
@@ -1400,7 +1406,7 @@ next_field:
         } else {
             if ((ret = mjpeg_decode_scan(s, nb_components,
                                          prev_shift, point_transform,
-                                         mb_bitmask, reference)) < 0)
+                                         mb_bitmask, mb_bitmask_size, reference)) < 0)
                 return ret;
         }
     }
@@ -1735,8 +1741,6 @@ int ff_mjpeg_find_marker(MJpegDecodeContext *s,
         int t = 0, b = 0;
         PutBitContext pb;
 
-        s->cur_scan++;
-
         /* find marker */
         while (src + t < buf_end) {
             uint8_t x = src[t++];
@@ -1801,7 +1805,7 @@ int ff_mjpeg_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
                                           &unescaped_buf_size);
         /* EOF */
         if (start_code < 0) {
-            goto the_end;
+            break;
         } else if (unescaped_buf_size > INT_MAX / 8) {
             av_log(avctx, AV_LOG_ERROR,
                    "MJPEG packet 0x%x too big (%d/%d), corrupt data?\n",
@@ -1926,7 +1930,8 @@ eoi_parser:
 
             goto the_end;
         case SOS:
-            if ((ret = ff_mjpeg_decode_sos(s, NULL, NULL)) < 0 &&
+            s->cur_scan++;
+            if ((ret = ff_mjpeg_decode_sos(s, NULL, 0, NULL)) < 0 &&
                 (avctx->err_recognition & AV_EF_EXPLODE))
                 goto fail;
             break;
@@ -1954,7 +1959,7 @@ eoi_parser:
                "marker parser used %d bytes (%d bits)\n",
                (get_bits_count(&s->gb) + 7) / 8, get_bits_count(&s->gb));
     }
-    if (s->got_picture) {
+    if (s->got_picture && s->cur_scan) {
         av_log(avctx, AV_LOG_WARNING, "EOI missing, emulating\n");
         goto eoi_parser;
     }

libavcodec/mjpegdec.h

@@ -131,7 +131,8 @@ int ff_mjpeg_decode_dqt(MJpegDecodeContext *s);
 int ff_mjpeg_decode_dht(MJpegDecodeContext *s);
 int ff_mjpeg_decode_sof(MJpegDecodeContext *s);
 int ff_mjpeg_decode_sos(MJpegDecodeContext *s,
-                        const uint8_t *mb_bitmask, const AVFrame *reference);
+                        const uint8_t *mb_bitmask,int mb_bitmask_size,
+                        const AVFrame *reference);
 int ff_mjpeg_find_marker(MJpegDecodeContext *s,
                          const uint8_t **buf_ptr, const uint8_t *buf_end,
                          const uint8_t **unescaped_buf_ptr, int *unescaped_buf_size);

libavcodec/mpeg4videodec.c

@@ -1766,6 +1766,11 @@ static int decode_vol_header(MpegEncContext *s, GetBitContext *gb){
              s->quarter_sample= get_bits1(gb);
         else s->quarter_sample=0;
 
+        if (get_bits_left(gb) < 4) {
+            av_log(s->avctx, AV_LOG_ERROR, "VOL Header truncated\n");
+            return AVERROR_INVALIDDATA;
+        }
+
         if(!get_bits1(gb)){
             int pos= get_bits_count(gb);
             int estimation_method= get_bits(gb, 2);

libavcodec/msrle.c

@@ -35,6 +35,7 @@
 #include "avcodec.h"
 #include "internal.h"
 #include "msrledec.h"
+#include "libavutil/imgutils.h"
 
 typedef struct MsrleContext {
     AVCodecContext *avctx;
@@ -110,7 +111,7 @@ static int msrle_decode_frame(AVCodecContext *avctx,
 
     /* FIXME how to correctly detect RLE ??? */
     if (avctx->height * istride == avpkt->size) { /* assume uncompressed */
-        int linesize = (avctx->width * avctx->bits_per_coded_sample + 7) / 8;
+        int linesize = av_image_get_linesize(avctx->pix_fmt, avctx->width, 0);
         uint8_t *ptr = s->frame->data[0];
         uint8_t *buf = avpkt->data + (avctx->height-1)*istride;
         int i, j;

libavcodec/mxpegdec.c

@@ -295,11 +295,11 @@ static int mxpeg_decode_frame(AVCodecContext *avctx,
                                              AV_GET_BUFFER_FLAG_REF)) < 0)
                         return ret;
 
-                    ret = ff_mjpeg_decode_sos(jpg, s->mxm_bitmask, reference_ptr);
+                    ret = ff_mjpeg_decode_sos(jpg, s->mxm_bitmask, s->bitmask_size, reference_ptr);
                     if (ret < 0 && (avctx->err_recognition & AV_EF_EXPLODE))
                         return ret;
                 } else {
-                    ret = ff_mjpeg_decode_sos(jpg, NULL, NULL);
+                    ret = ff_mjpeg_decode_sos(jpg, NULL, 0, NULL);
                     if (ret < 0 && (avctx->err_recognition & AV_EF_EXPLODE))
                         return ret;
                 }

libavcodec/snow.h

@@ -318,7 +318,8 @@ static av_always_inline void add_yblock(SnowContext *s, int sliced, slice_buffer
         if(!sliced && !offset_dst)
             dst -= src_x;
         src_x=0;
-    }else if(src_x + b_w > w){
+    }
+    if(src_x + b_w > w){
         b_w = w - src_x;
     }
     if(src_y<0){
@@ -327,7 +328,8 @@ static av_always_inline void add_yblock(SnowContext *s, int sliced, slice_buffer
         if(!sliced && !offset_dst)
             dst -= src_y*dst_stride;
         src_y=0;
-    }else if(src_y + b_h> h){
+    }
+    if(src_y + b_h> h){
         b_h = h - src_y;
     }
 

libavcodec/takdec.c

@@ -720,11 +720,9 @@ static int tak_decode_frame(AVCodecContext *avctx, void *data,
         return AVERROR_INVALIDDATA;
     }
 
-    if (s->ti.bps != avctx->bits_per_raw_sample) {
-        avctx->bits_per_raw_sample = s->ti.bps;
-        if ((ret = set_bps_params(avctx)) < 0)
-            return ret;
-    }
+    avctx->bits_per_raw_sample = s->ti.bps;
+    if ((ret = set_bps_params(avctx)) < 0)
+        return ret;
     if (s->ti.sample_rate != avctx->sample_rate) {
         avctx->sample_rate = s->ti.sample_rate;
         set_sample_rate_params(avctx);

libavcodec/tiff.c

@@ -79,6 +79,7 @@ static void free_geotags(TiffContext *const s)
             av_freep(&s->geotags[i].val);
     }
     av_freep(&s->geotags);
+    s->geotag_count = 0;
 }
 
 #define RET_GEOKEY(TYPE, array, element)\

libavcodec/utils.c

@@ -733,8 +733,7 @@ int ff_init_buffer_info(AVCodecContext *avctx, AVFrame *frame)
     case AVMEDIA_TYPE_VIDEO:
         frame->width  = FFMAX(avctx->width,  FF_CEIL_RSHIFT(avctx->coded_width,  avctx->lowres));
         frame->height = FFMAX(avctx->height, FF_CEIL_RSHIFT(avctx->coded_height, avctx->lowres));
-        if (frame->format < 0)
-            frame->format              = avctx->pix_fmt;
+        frame->format              = avctx->pix_fmt;
         if (!frame->sample_aspect_ratio.num)
             frame->sample_aspect_ratio = avctx->sample_aspect_ratio;
         if (av_frame_get_colorspace(frame) == AVCOL_SPC_UNSPECIFIED)

libavcodec/vc1.c

@@ -627,10 +627,24 @@ static void rotate_luts(VC1Context *v)
     }
 }
 
+static int read_bfraction(VC1Context *v, GetBitContext* gb) {
+    int bfraction_lut_index = get_vlc2(gb, ff_vc1_bfraction_vlc.table, VC1_BFRACTION_VLC_BITS, 1);
+
+    if (bfraction_lut_index == 21 || bfraction_lut_index < 0) {
+        av_log(v->s.avctx, AV_LOG_ERROR, "bfraction invalid\n");
+        return AVERROR_INVALIDDATA;
+    }
+    v->bfraction_lut_index = bfraction_lut_index;
+    v->bfraction           = ff_vc1_bfraction_lut[v->bfraction_lut_index];
+    return 0;
+}
+
 int ff_vc1_parse_frame_header(VC1Context *v, GetBitContext* gb)
 {
     int pqindex, lowquant, status;
 
+    v->field_mode = 0;
+    v->fcm = 0;
     if (v->finterpflag)
         v->interpfrm = get_bits1(gb);
     if (!v->s.avctx->codec)
@@ -658,8 +672,8 @@ int ff_vc1_parse_frame_header(VC1Context *v, GetBitContext* gb)
 
     v->bi_type = 0;
     if (v->s.pict_type == AV_PICTURE_TYPE_B) {
-        v->bfraction_lut_index = get_vlc2(gb, ff_vc1_bfraction_vlc.table, VC1_BFRACTION_VLC_BITS, 1);
-        v->bfraction           = ff_vc1_bfraction_lut[v->bfraction_lut_index];
+        if (read_bfraction(v, gb) < 0)
+            return AVERROR_INVALIDDATA;
         if (v->bfraction == 0) {
             v->s.pict_type = AV_PICTURE_TYPE_BI;
         }
@@ -937,8 +951,8 @@ int ff_vc1_parse_frame_header_adv(VC1Context *v, GetBitContext* gb)
                 v->refdist += get_unary(gb, 0, 16);
         }
         if ((v->s.pict_type == AV_PICTURE_TYPE_B) || (v->s.pict_type == AV_PICTURE_TYPE_BI)) {
-            v->bfraction_lut_index = get_vlc2(gb, ff_vc1_bfraction_vlc.table, VC1_BFRACTION_VLC_BITS, 1);
-            v->bfraction           = ff_vc1_bfraction_lut[v->bfraction_lut_index];
+            if (read_bfraction(v, gb) < 0)
+                return AVERROR_INVALIDDATA;
             v->frfd = (v->bfraction * v->refdist) >> 8;
             v->brfd = v->refdist - v->frfd - 1;
             if (v->brfd < 0)
@@ -950,8 +964,8 @@ int ff_vc1_parse_frame_header_adv(VC1Context *v, GetBitContext* gb)
         if (v->finterpflag)
             v->interpfrm = get_bits1(gb);
         if (v->s.pict_type == AV_PICTURE_TYPE_B) {
-            v->bfraction_lut_index = get_vlc2(gb, ff_vc1_bfraction_vlc.table, VC1_BFRACTION_VLC_BITS, 1);
-            v->bfraction           = ff_vc1_bfraction_lut[v->bfraction_lut_index];
+            if (read_bfraction(v, gb) < 0)
+                return AVERROR_INVALIDDATA;
             if (v->bfraction == 0) {
                 v->s.pict_type = AV_PICTURE_TYPE_BI; /* XXX: should not happen here */
             }
@@ -1195,8 +1209,8 @@ int ff_vc1_parse_frame_header_adv(VC1Context *v, GetBitContext* gb)
         break;
     case AV_PICTURE_TYPE_B:
         if (v->fcm == ILACE_FRAME) {
-            v->bfraction_lut_index = get_vlc2(gb, ff_vc1_bfraction_vlc.table, VC1_BFRACTION_VLC_BITS, 1);
-            v->bfraction           = ff_vc1_bfraction_lut[v->bfraction_lut_index];
+            if (read_bfraction(v, gb) < 0)
+                return AVERROR_INVALIDDATA;
             if (v->bfraction == 0) {
                 return -1;
             }

libavcodec/vc1dec.c

@@ -4342,6 +4342,10 @@ static void vc1_decode_b_mb_intfi(VC1Context *v)
             if (bmvtype == BMV_TYPE_DIRECT) {
                 dmv_x[0] = dmv_y[0] = pred_flag[0] = 0;
                 dmv_x[1] = dmv_y[1] = pred_flag[0] = 0;
+                if (!s->next_picture_ptr->field_picture) {
+                    av_log(s->avctx, AV_LOG_ERROR, "Mixed field/frame direct mode not supported\n");
+                    return;
+                }
             }
             vc1_pred_b_mv_intfi(v, 0, dmv_x, dmv_y, 1, pred_flag);
             vc1_b_mc(v, dmv_x, dmv_y, (bmvtype == BMV_TYPE_DIRECT), bmvtype);
@@ -6028,6 +6032,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data,
         goto err;
     }
 
+    v->s.current_picture_ptr->field_picture = v->field_mode;
     v->s.current_picture_ptr->f.interlaced_frame = (v->fcm != PROGRESSIVE);
     v->s.current_picture_ptr->f.top_field_first  = v->tff;
 

libavcodec/vmnc.c

@@ -291,6 +291,11 @@ static int decode_hextile(VmncContext *c, uint8_t* dst, GetByteContext *gb,
                         fg = vmnc_get_pixel(gb, bpp, c->bigendian);
                     xy = bytestream2_get_byte(gb);
                     wh = bytestream2_get_byte(gb);
+                    if (   (xy >> 4) + (wh >> 4) + 1 > w - i
+                        || (xy & 0xF) + (wh & 0xF)+1 > h - j) {
+                        av_log(c->avctx, AV_LOG_ERROR, "Rectangle outside picture\n");
+                        return AVERROR_INVALIDDATA;
+                    }
                     paint_rect(dst2, xy >> 4, xy & 0xF,
                                (wh>>4)+1, (wh & 0xF)+1, fg, bpp, stride);
                 }

libavcodec/wmalosslessdec.c

@@ -127,8 +127,8 @@ typedef struct WmallDecodeCtx {
 
     int8_t  mclms_order;
     int8_t  mclms_scaling;
-    int16_t mclms_coeffs[128];
-    int16_t mclms_coeffs_cur[4];
+    int16_t mclms_coeffs[WMALL_MAX_CHANNELS * WMALL_MAX_CHANNELS * 32];
+    int16_t mclms_coeffs_cur[WMALL_MAX_CHANNELS * WMALL_MAX_CHANNELS];
     int16_t mclms_prevvalues[WMALL_MAX_CHANNELS * 2 * 32];
     int16_t mclms_updates[WMALL_MAX_CHANNELS * 2 * 32];
     int     mclms_recent;

libavfilter/dualinput.c

@@ -57,7 +57,7 @@ int ff_dualinput_init(AVFilterContext *ctx, FFDualInputContext *s)
     in[1].after  = EXT_INFINITY;
 
     if (s->shortest)
-        in[1].after = EXT_STOP;
+        in[0].after = in[1].after = EXT_STOP;
     if (!s->repeatlast) {
         in[0].after = EXT_STOP;
         in[1].sync  = 0;

libavformat/ape.c

@@ -411,8 +411,10 @@ static int ape_read_packet(AVFormatContext * s, AVPacket * pkt)
     AV_WL32(pkt->data    , nblocks);
     AV_WL32(pkt->data + 4, ape->frames[ape->currentframe].skip);
     ret = avio_read(s->pb, pkt->data + extra_size, ape->frames[ape->currentframe].size);
-    if (ret < 0)
+    if (ret < 0) {
+        av_free_packet(pkt);
         return ret;
+    }
 
     pkt->pts = ape->frames[ape->currentframe].pts;
     pkt->stream_index = 0;

libavformat/avidec.c

@@ -348,6 +348,7 @@ static void avi_read_nikon(AVFormatContext *s, uint64_t end)
                 uint16_t size    = avio_rl16(s->pb);
                 const char *name = NULL;
                 char buffer[64]  = { 0 };
+                size = FFMIN(size, tag_end - avio_tell(s->pb));
                 size -= avio_read(s->pb, buffer,
                                   FFMIN(size, sizeof(buffer) - 1));
                 switch (tag) {

libavformat/bink.c

@@ -79,6 +79,7 @@ static int read_header(AVFormatContext *s)
     uint32_t pos, next_pos;
     uint16_t flags;
     int keyframe;
+    int ret;
 
     vst = avformat_new_stream(s, NULL);
     if (!vst)
@@ -177,8 +178,9 @@ static int read_header(AVFormatContext *s)
             av_log(s, AV_LOG_ERROR, "invalid frame index table\n");
             return AVERROR(EIO);
         }
-        av_add_index_entry(vst, pos, i, next_pos - pos, 0,
-                           keyframe ? AVINDEX_KEYFRAME : 0);
+        if ((ret = av_add_index_entry(vst, pos, i, next_pos - pos, 0,
+                                      keyframe ? AVINDEX_KEYFRAME : 0)) < 0)
+            return ret;
     }
 
     avio_skip(pb, 4);

libavformat/flac_picture.c

@@ -107,9 +107,10 @@ int ff_flac_parse_picture(AVFormatContext *s, uint8_t *buf, int buf_size)
             ret = AVERROR_INVALIDDATA;
         goto fail;
     }
-    if (!(data = av_buffer_alloc(len))) {
+    if (!(data = av_buffer_alloc(len + FF_INPUT_BUFFER_PADDING_SIZE))) {
         RETURN_ERROR(AVERROR(ENOMEM));
     }
+    memset(data->data + len, 0, FF_INPUT_BUFFER_PADDING_SIZE);
     if (avio_read(pb, data->data, len) != len) {
         av_log(s, AV_LOG_ERROR, "Error reading attached picture data.\n");
         if (s->error_recognition & AV_EF_EXPLODE)

libavformat/libssh.c

@@ -159,7 +159,7 @@ static int64_t libssh_seek(URLContext *h, int64_t pos, int whence)
         newpos = pos;
         break;
     case SEEK_CUR:
-        newpos = sftp_tell64(s->file);
+        newpos = sftp_tell64(s->file) + pos;
         break;
     case SEEK_END:
         newpos = s->filesize + pos;

libavformat/matroskadec.c

@@ -1834,7 +1834,7 @@ static int matroska_read_header(AVFormatContext *s)
         avpriv_set_pts_info(st, 64, matroska->time_scale*track->time_scale, 1000*1000*1000); /* 64 bit pts in ns */
 
         st->codec->codec_id = codec_id;
-        st->start_time = 0;
+
         if (strcmp(track->language, "und"))
             av_dict_set(&st->metadata, "language", track->language, 0);
         av_dict_set(&st->metadata, "title", track->name, 0);
@@ -1906,6 +1906,7 @@ static int matroska_read_header(AVFormatContext *s)
             st->codec->codec_type = AVMEDIA_TYPE_AUDIO;
             st->codec->sample_rate = track->audio.out_samplerate;
             st->codec->channels = track->audio.channels;
+            if (!st->codec->bits_per_coded_sample)
             st->codec->bits_per_coded_sample = track->audio.bitdepth;
             if (st->codec->codec_id != AV_CODEC_ID_AAC)
             st->need_parsing = AVSTREAM_PARSE_HEADERS;

libavformat/matroskaenc.c

@@ -612,7 +612,7 @@ static int mkv_write_tracks(AVFormatContext *s)
             continue;
         }
 
-        if (!bit_depth)
+        if (!bit_depth && codec->codec_id != AV_CODEC_ID_ADPCM_G726)
             bit_depth = av_get_bytes_per_sample(codec->sample_fmt) << 3;
         if (!bit_depth)
             bit_depth = codec->bits_per_coded_sample;

libavformat/mpegts.c

@@ -1222,6 +1222,11 @@ static int parse_MP4SLDescrTag(MP4DescrParseContext *d, int64_t off, int len)
         descr->sl.timestamp_res      = avio_rb32(&d->pb);
                                        avio_rb32(&d->pb);
         descr->sl.timestamp_len      = avio_r8(&d->pb);
+        if (descr->sl.timestamp_len > 64) {
+            avpriv_request_sample(NULL, "timestamp_len > 64");
+            descr->sl.timestamp_len = 64;
+            return AVERROR_PATCHWELCOME;
+        }
         descr->sl.ocr_len            = avio_r8(&d->pb);
         descr->sl.au_len             = avio_r8(&d->pb);
         descr->sl.inst_bitrate_len   = avio_r8(&d->pb);

libavformat/mpegtsenc.c

@@ -259,7 +259,7 @@ static void mpegts_write_pat(AVFormatContext *s)
                           data, q - data);
 }
 
-static void mpegts_write_pmt(AVFormatContext *s, MpegTSService *service)
+static int mpegts_write_pmt(AVFormatContext *s, MpegTSService *service)
 {
     MpegTSWrite *ts = s->priv_data;
     uint8_t data[1012], *q, *desc_length_ptr, *program_info_length_ptr;
@@ -315,6 +315,10 @@ static void mpegts_write_pmt(AVFormatContext *s, MpegTSService *service)
             stream_type = STREAM_TYPE_PRIVATE_DATA;
             break;
         }
+
+        if (q - data > sizeof(data) - 32)
+            return AVERROR(EINVAL);
+
         *q++ = stream_type;
         put16(&q, 0xe000 | ts_st->pid);
         desc_length_ptr = q;
@@ -346,7 +350,7 @@ static void mpegts_write_pmt(AVFormatContext *s, MpegTSService *service)
                 len_ptr = q++;
                 *len_ptr = 0;
 
-                for (p = lang->value; next && *len_ptr < 255 / 4 * 4; p = next + 1) {
+                for (p = lang->value; next && *len_ptr < 255 / 4 * 4 && q - data < sizeof(data) - 4; p = next + 1) {
                     next = strchr(p, ',');
                     if (strlen(p) != 3 && (!next || next != p + 3))
                         continue; /* not a 3-letter code */
@@ -418,6 +422,7 @@ static void mpegts_write_pmt(AVFormatContext *s, MpegTSService *service)
     }
     mpegts_write_section1(&service->pmt, PMT_TID, service->sid, ts->tables_version, 0, 0,
                           data, q - data);
+    return 0;
 }
 
 /* NOTE: str == NULL is accepted for an empty string */

libavformat/rmdec.c

@@ -257,16 +257,6 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb,
         default:
             av_strlcpy(st->codec->codec_name, buf, sizeof(st->codec->codec_name));
         }
-        if (ast->deint_id == DEINT_ID_INT4 ||
-            ast->deint_id == DEINT_ID_GENR ||
-            ast->deint_id == DEINT_ID_SIPR) {
-            if (st->codec->block_align <= 0 ||
-                ast->audio_framesize * sub_packet_h > (unsigned)INT_MAX ||
-                ast->audio_framesize * sub_packet_h < st->codec->block_align)
-                return AVERROR_INVALIDDATA;
-            if (av_new_packet(&ast->pkt, ast->audio_framesize * sub_packet_h) < 0)
-                return AVERROR(ENOMEM);
-        }
         switch (ast->deint_id) {
         case DEINT_ID_INT4:
             if (ast->coded_framesize > ast->audio_framesize ||
@@ -288,6 +278,16 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb,
             av_log(s, AV_LOG_ERROR, "Unknown interleaver %X\n", ast->deint_id);
             return AVERROR_INVALIDDATA;
         }
+        if (ast->deint_id == DEINT_ID_INT4 ||
+            ast->deint_id == DEINT_ID_GENR ||
+            ast->deint_id == DEINT_ID_SIPR) {
+            if (st->codec->block_align <= 0 ||
+                ast->audio_framesize * sub_packet_h > (unsigned)INT_MAX ||
+                ast->audio_framesize * sub_packet_h < st->codec->block_align)
+                return AVERROR_INVALIDDATA;
+            if (av_new_packet(&ast->pkt, ast->audio_framesize * sub_packet_h) < 0)
+                return AVERROR(ENOMEM);
+        }
 
         if (read_all) {
             avio_r8(pb);

libavformat/rtpdec_asf.c

@@ -144,6 +144,8 @@ static int asfrtp_parse_sdp_line(AVFormatContext *s, int stream_index,
                 if (s->streams[stream_index]->id == rt->asf_ctx->streams[i]->id) {
                     *s->streams[stream_index]->codec =
                         *rt->asf_ctx->streams[i]->codec;
+                    s->streams[stream_index]->need_parsing =
+                        rt->asf_ctx->streams[i]->need_parsing;
                     rt->asf_ctx->streams[i]->codec->extradata_size = 0;
                     rt->asf_ctx->streams[i]->codec->extradata = NULL;
                     avpriv_set_pts_info(s->streams[stream_index], 32, 1, 1000);

libavformat/segafilm.c

@@ -72,13 +72,22 @@ static int film_probe(AVProbeData *p)
     return AVPROBE_SCORE_MAX;
 }
 
+static int film_read_close(AVFormatContext *s)
+{
+    FilmDemuxContext *film = s->priv_data;
+
+    av_freep(&film->sample_table);
+
+    return 0;
+}
+
 static int film_read_header(AVFormatContext *s)
 {
     FilmDemuxContext *film = s->priv_data;
     AVIOContext *pb = s->pb;
     AVStream *st;
     unsigned char scratch[256];
-    int i;
+    int i, ret;
     unsigned int data_offset;
     unsigned int audio_frame_counter;
 
@@ -203,14 +212,16 @@ static int film_read_header(AVFormatContext *s)
     for (i = 0; i < film->sample_count; i++) {
         /* load the next sample record and transfer it to an internal struct */
         if (avio_read(pb, scratch, 16) != 16) {
-            av_freep(&film->sample_table);
-            return AVERROR(EIO);
+            ret = AVERROR(EIO);
+            goto fail;
         }
         film->sample_table[i].sample_offset =
             data_offset + AV_RB32(&scratch[0]);
         film->sample_table[i].sample_size = AV_RB32(&scratch[4]);
-        if (film->sample_table[i].sample_size > INT_MAX / 4)
-            return AVERROR_INVALIDDATA;
+        if (film->sample_table[i].sample_size > INT_MAX / 4) {
+            ret = AVERROR_INVALIDDATA;
+            goto fail;
+        }
         if (AV_RB32(&scratch[8]) == 0xFFFFFFFF) {
             film->sample_table[i].stream = film->audio_stream_index;
             film->sample_table[i].pts = audio_frame_counter;
@@ -231,6 +242,9 @@ static int film_read_header(AVFormatContext *s)
     film->current_sample = 0;
 
     return 0;
+fail:
+    film_read_close(s);
+    return ret;
 }
 
 static int film_read_packet(AVFormatContext *s,
@@ -270,15 +284,6 @@ static int film_read_packet(AVFormatContext *s,
     return ret;
 }
 
-static int film_read_close(AVFormatContext *s)
-{
-    FilmDemuxContext *film = s->priv_data;
-
-    av_freep(&film->sample_table);
-
-    return 0;
-}
-
 AVInputFormat ff_segafilm_demuxer = {
     .name           = "film_cpk",
     .long_name      = NULL_IF_CONFIG_SMALL("Sega FILM / CPK"),

libavutil/samplefmt.c

@@ -135,6 +135,8 @@ int av_samples_get_buffer_size(int *linesize, int nb_channels, int nb_samples,
 
     /* auto-select alignment if not specified */
     if (!align) {
+        if (nb_samples > INT_MAX - 31)
+            return AVERROR(EINVAL);
         align = 1;
         nb_samples = FFALIGN(nb_samples, 32);
     }

tests/ref/fate/vp8-alpha

@@ -1,121 +1,121 @@
 #tb 0: 1/1000
-0,          1,          1,        0,     2108, 0x59b92a34, S=1,     1900, 0x8fb3adc5
-0,         33,         33,        0,      142, 0x2f2a3fed, F=0x0, S=1,      160, 0xa13346af
-0,         66,         66,        0,      157, 0x17804767, F=0x0, S=1,      209, 0x64115f15
-0,        100,        100,        0,      206, 0x537262ca, F=0x0, S=1,      317, 0x44a09dd0
-0,        133,        133,        0,      259, 0x73ff74b6, F=0x0, S=1,      384, 0x2ee2c588
-0,        166,        166,        0,      320, 0x0fcf8ce4, F=0x0, S=1,      415, 0xff68c953
-0,        200,        200,        0,      377, 0x8fffb5f5, F=0x0, S=1,      475, 0x4166f3eb
-0,        233,        233,        0,      407, 0xe476c19e, F=0x0, S=1,      193, 0x3ff75489
-0,        266,        266,        0,      539, 0x90202334, F=0x0, S=1,      681, 0x776656b0
-0,        300,        300,        0,      560, 0xc6e2168d, F=0x0, S=1,      585, 0xddc81b8a
-0,        333,        333,        0,      597, 0x201a32a7, F=0x0, S=1,      574, 0x8baa1d65
-0,        366,        366,        0,      770, 0xab2b8891, F=0x0, S=1,      666, 0xcd8e51eb
-0,        400,        400,        0,      708, 0xc2386711, F=0x0, S=1,      706, 0x046b6444
-0,        433,        433,        0,      905, 0x7211c52d, F=0x0, S=1,      814, 0x5e288def
-0,        466,        466,        0,      770, 0xda4f8574, F=0x0, S=1,      829, 0xa0e8a949
-0,        500,        500,        0,      955, 0xf9a1d77a, F=0x0, S=1,      857, 0x9b63b955
-0,        533,        533,        0,      970, 0xff4de39a, F=0x0, S=1,      153, 0x3b00416c
-0,        566,        566,        0,      978, 0x12bcf81f, F=0x0, S=1,     1181, 0xce175555
-0,        600,        600,        0,     1233, 0x2903744a, F=0x0, S=1,      860, 0x737eb566
-0,        633,        633,        0,     1118, 0x7f274f50, F=0x0, S=1,      933, 0xb669c6b6
-0,        666,        666,        0,      941, 0x6bffd4b1, F=0x0, S=1,     1058, 0x07581cee
-0,        700,        700,        0,     1598, 0xc007219f, F=0x0, S=1,      939, 0x2c0bdc45
-0,        733,        733,        0,     1218, 0x25d962b6, F=0x0, S=1,     1090, 0x96482341
-0,        766,        766,        0,     1200, 0x86b85be3, F=0x0, S=1,      189, 0x3f085309
-0,        800,        800,        0,     1329, 0x298a848a, F=0x0, S=1,     1426, 0x6ea3df12
-0,        833,        833,        0,     1500, 0xe437edec, F=0x0, S=1,     1244, 0x32836b8d
-0,        866,        866,        0,     1288, 0xc4447dd5, F=0x0, S=1,     1289, 0x06a57b0f
-0,        900,        900,        0,     1281, 0xb5bf7e9f, F=0x0, S=1,     1227, 0xd96d5697
-0,        933,        933,        0,     1372, 0x09be9014, F=0x0, S=1,     1556, 0x2630fbff
-0,        966,        966,        0,     1238, 0x42ce6316, F=0x0, S=1,     1287, 0x1d3084f6
-0,       1000,       1000,        0,     1655, 0xb94b45c2, F=0x0, S=1,     1494, 0x34dbd1a4
-0,       1033,       1033,        0,     1164, 0xf6b93ad0, F=0x0, S=1,     1337, 0xba6d9673
-0,       1066,       1066,        0,     1084, 0x58c50fb5, F=0x0, S=1,     1384, 0x3fabb82b
-0,       1100,       1100,        0,     1151, 0x0b3f3359, F=0x0, S=1,     1353, 0x08e2a1d7
-0,       1133,       1133,        0,     1277, 0xa3ae77e1, F=0x0, S=1,     1409, 0xf65cb9f7
-0,       1166,       1166,        0,      782, 0xdcf671ff, F=0x0, S=1,     1408, 0x01e2ac53
-0,       1200,       1200,        0,      926, 0xe913c286, F=0x0, S=1,     1320, 0x32e38e42
-0,       1233,       1233,        0,      970, 0x3d86e5ae, F=0x0, S=1,     1608, 0x40b52618
-0,       1266,       1266,        0,     1353, 0xe4f197b2, F=0x0, S=1,     1272, 0xf1d272a5
-0,       1300,       1300,        0,      685, 0x629b4ce4, F=0x0, S=1,     1257, 0x14845de9
-0,       1333,       1333,        0,      743, 0x6f1172a3, F=0x0, S=1,     1260, 0xa6c66fda
-0,       1366,       1366,        0,      789, 0x94fc84cd, F=0x0, S=1,     1009, 0x7daaf2b0
-0,       1400,       1400,        0,     1460, 0x668adb82, F=0x0, S=1,      944, 0x44b6ccf5
-0,       1433,       1433,        0,      766, 0x49c884ef, F=0x0, S=1,      996, 0x8646e6dd
-0,       1466,       1466,        0,     1037, 0x24831498, F=0x0, S=1,      983, 0x14a9e7a6
-0,       1500,       1500,        0,      943, 0x1f53d180, F=0x0, S=1,     1107, 0x02f72acb
-0,       1533,       1533,        0,     1152, 0xbf6a35ae, F=0x0, S=1,     1026, 0xd57afda0
-0,       1566,       1566,        0,      730, 0x42806abf, F=0x0, S=1,     1029, 0xfb0402d5
-0,       1600,       1600,        0,      975, 0xa5ffec57, F=0x0, S=1,     1081, 0xe2890cea
-0,       1633,       1633,        0,      970, 0xbe8ee224, F=0x0, S=1,     1151, 0x7b0d3b20
-0,       1666,       1666,        0,     1012, 0x20c6f0d8, F=0x0, S=1,      979, 0xc25cd69c
-0,       1700,       1700,        0,      874, 0x1a2fb4da, F=0x0, S=1,      943, 0xdb2dc9f8
-0,       1733,       1733,        0,      869, 0xab0caf3d, F=0x0, S=1,      934, 0x48b9bfcc
-0,       1766,       1766,        0,      863, 0xd8caa2e5, F=0x0, S=1,      874, 0x0b34b026
-0,       1800,       1800,        0,     1246, 0x47866cdc, F=0x0, S=1,      818, 0x0c908eeb
-0,       1833,       1833,        0,      742, 0xa6296ac1, F=0x0, S=1,      921, 0x97b6b053
-0,       1866,       1866,        0,      828, 0x0b568d7a, F=0x0, S=1,      969, 0x3314dbfa
-0,       1900,       1900,        0,      825, 0x6d329394, F=0x0, S=1,      982, 0x5f66e68c
-0,       1933,       1933,        0,      836, 0x8ace8dfb, F=0x0, S=1,      929, 0x9ffdc2fd
-0,       1966,       1966,        0,     1774, 0xd4686726, F=0x0, S=1,      909, 0x11a9c07a
-0,       2000,       2000,        0,     1803, 0x08c879ce, F=0x0, S=1,     1525, 0x1e11f02f
-0,       2033,       2033,        0,      518, 0x7c32fc72, F=0x0, S=1,      785, 0xfc1f792a
-0,       2066,       2066,        0,      790, 0x3dac8aa0, F=0x0, S=1,      876, 0x0918c88d
-0,       2100,       2100,        0,      927, 0x4feccb24, F=0x0, S=1,     1059, 0xbcaa05c7
-0,       2133,       2133,        0,      835, 0x29d39266, F=0x0, S=1,      980, 0x4913e409
-0,       2166,       2166,        0,      951, 0xc1dddd12, F=0x0, S=1,     1041, 0x0541047e
-0,       2200,       2200,        0,      876, 0x2f6eb89d, F=0x0, S=1,      949, 0x2d56c53b
-0,       2233,       2233,        0,      959, 0xf0dedabd, F=0x0, S=1,     1022, 0x8d33f5fa
-0,       2266,       2266,        0,      860, 0x9274ab39, F=0x0, S=1,     1061, 0x289c0132
-0,       2300,       2300,        0,      863, 0x7058ba30, F=0x0, S=1,      940, 0x1f32d4a3
-0,       2333,       2333,        0,     1021, 0xcabdf84f, F=0x0, S=1,      887, 0xda8ab95e
-0,       2366,       2366,        0,      897, 0x9867c8e8, F=0x0, S=1,      840, 0xd93eaaf5
-0,       2400,       2400,        0,      897, 0x6a16b5db, F=0x0, S=1,      977, 0x7b77dc9b
-0,       2433,       2433,        0,      953, 0xe9b4cf1f, F=0x0, S=1,      921, 0x75a8ca45
-0,       2466,       2466,        0,      847, 0x0335ad37, F=0x0, S=1,     1000, 0x2691f3bd
-0,       2500,       2500,        0,      902, 0x3360b315, F=0x0, S=1,     1008, 0xd5e1deb6
-0,       2533,       2533,        0,      881, 0xf5309d59, F=0x0, S=1,     1113, 0xdbef3065
-0,       2566,       2566,        0,      974, 0x7c2de3ce, F=0x0, S=1,     1086, 0x365626bb
-0,       2600,       2600,        0,      974, 0xf42bd9f5, F=0x0, S=1,     1039, 0xa7e9060d
-0,       2633,       2633,        0,     1029, 0x7c33f4d0, F=0x0, S=1,     1041, 0xf4affa59
-0,       2666,       2666,        0,      881, 0x9021a565, F=0x0, S=1,     1039, 0xc1e00521
-0,       2700,       2700,        0,     1157, 0xe1c136f7, F=0x0, S=1,      917, 0x357ac7d3
-0,       2733,       2733,        0,      649, 0xdffb3cb7, F=0x0, S=1,      976, 0xa386e05e
-0,       2766,       2766,        0,      758, 0xb67875f3, F=0x0, S=1,     1041, 0xae4e0a63
-0,       2800,       2800,        0,     1105, 0x8ffb1a26, F=0x0, S=1,      962, 0x211ddc5e
-0,       2833,       2833,        0,      866, 0xa60eb2d9, F=0x0, S=1,      929, 0xe9e4c84b
-0,       2866,       2866,        0,      912, 0xcd34bf9b, F=0x0, S=1,      946, 0xfce9d359
-0,       2900,       2900,        0,      868, 0x5651a343, F=0x0, S=1,      809, 0x624a8ef9
-0,       2933,       2933,        0,      997, 0xfa66eaeb, F=0x0, S=1,      992, 0xc913e5e2
-0,       2966,       2966,        0,     1111, 0x3f272497, F=0x0, S=1,     1007, 0xf78ee6a7
-0,       3000,       3000,        0,      842, 0xe442999f, F=0x0, S=1,      972, 0x25a0d25c
-0,       3033,       3033,        0,     1030, 0x6f97ffad, F=0x0, S=1,      993, 0x4059fd6b
-0,       3066,       3066,        0,     1176, 0x66e64926, F=0x0, S=1,      951, 0x2762cdf1
-0,       3100,       3100,        0,      803, 0xfd1699cb, F=0x0, S=1,      959, 0x5cf9d56c
-0,       3133,       3133,        0,      972, 0x1cdff00e, F=0x0, S=1,     1023, 0xeaf20900
-0,       3166,       3166,        0,      907, 0x17f8acca, F=0x0, S=1,     1054, 0xeb010c4d
-0,       3200,       3200,        0,      915, 0x3569b545, F=0x0, S=1,      987, 0x73b2e159
-0,       3233,       3233,        0,     1021, 0x14c5076a, F=0x0, S=1,     1007, 0x6c4bf7f0
-0,       3266,       3266,        0,      837, 0xbf86b0ef, F=0x0, S=1,      963, 0xf472d31a
-0,       3300,       3300,        0,      885, 0x1caac123, F=0x0, S=1,     1052, 0x2b7bfd20
-0,       3333,       3333,        0,     1355, 0x299e8d3c, F=0x0, S=1,      858, 0x2bbca3f0
-0,       3366,       3366,        0,      784, 0xb0bd7e9d, F=0x0, S=1,      969, 0xc865dc00
-0,       3400,       3400,        0,      991, 0xbc7ddda9, F=0x0, S=1,     1028, 0x801b00a6
-0,       3433,       3433,        0,      986, 0xb356f6b1, F=0x0, S=1,     1056, 0x8b840add
-0,       3466,       3466,        0,      978, 0x94a3e87e, F=0x0, S=1,     1018, 0xe766fa52
-0,       3500,       3500,        0,      976, 0x55ddd14a, F=0x0, S=1,      992, 0x58a9ddfe
-0,       3533,       3533,        0,     1241, 0x1ec867f7, F=0x0, S=1,      966, 0xa329e84f
-0,       3566,       3566,        0,      975, 0xecf5dbb3, F=0x0, S=1,      899, 0xa7539f4d
-0,       3600,       3600,        0,     1129, 0xb7243037, F=0x0, S=1,     1057, 0xbd0d10bd
-0,       3633,       3633,        0,      913, 0xe5f1d03d, F=0x0, S=1,     1092, 0xeb9621f8
-0,       3666,       3666,        0,      943, 0x87d0ed78, F=0x0, S=1,     1057, 0x079c1054
-0,       3700,       3700,        0,      917, 0x536cc3fd, F=0x0, S=1,      946, 0xd2b9d0e2
-0,       3733,       3733,        0,      892, 0x4dffb1e2, F=0x0, S=1,      930, 0x70c9cc40
-0,       3766,       3766,        0,      957, 0x1a98e71c, F=0x0, S=1,      719, 0x6fec614a
-0,       3800,       3800,        0,      893, 0xf405b2c3, F=0x0, S=1,      821, 0x63529cab
-0,       3833,       3833,        0,      978, 0xa0a8d5f6, F=0x0, S=1,      745, 0x3c616219
-0,       3866,       3866,        0,      887, 0xfa7cb65d, F=0x0, S=1,      768, 0xb8f07885
-0,       3900,       3900,        0,      867, 0xd808ade7, F=0x0, S=1,      783, 0xf82b6b9a
-0,       3933,       3933,        0,     1068, 0x6f8b135a, F=0x0, S=1,      807, 0x52028d50
-0,       3966,       3966,        0,     2010, 0x536fe0b6, F=0x0, S=1,     1512, 0x690aeb55
+0,          0,          0,        0,     2108, 0x59b92a34, S=1,     1900, 0x8fb3adc5
+0,         32,         32,        0,      142, 0x2f2a3fed, F=0x0, S=1,      160, 0xa13346af
+0,         65,         65,        0,      157, 0x17804767, F=0x0, S=1,      209, 0x64115f15
+0,         99,         99,        0,      206, 0x537262ca, F=0x0, S=1,      317, 0x44a09dd0
+0,        132,        132,        0,      259, 0x73ff74b6, F=0x0, S=1,      384, 0x2ee2c588
+0,        165,        165,        0,      320, 0x0fcf8ce4, F=0x0, S=1,      415, 0xff68c953
+0,        199,        199,        0,      377, 0x8fffb5f5, F=0x0, S=1,      475, 0x4166f3eb
+0,        232,        232,        0,      407, 0xe476c19e, F=0x0, S=1,      193, 0x3ff75489
+0,        265,        265,        0,      539, 0x90202334, F=0x0, S=1,      681, 0x776656b0
+0,        299,        299,        0,      560, 0xc6e2168d, F=0x0, S=1,      585, 0xddc81b8a
+0,        332,        332,        0,      597, 0x201a32a7, F=0x0, S=1,      574, 0x8baa1d65
+0,        365,        365,        0,      770, 0xab2b8891, F=0x0, S=1,      666, 0xcd8e51eb
+0,        399,        399,        0,      708, 0xc2386711, F=0x0, S=1,      706, 0x046b6444
+0,        432,        432,        0,      905, 0x7211c52d, F=0x0, S=1,      814, 0x5e288def
+0,        465,        465,        0,      770, 0xda4f8574, F=0x0, S=1,      829, 0xa0e8a949
+0,        499,        499,        0,      955, 0xf9a1d77a, F=0x0, S=1,      857, 0x9b63b955
+0,        532,        532,        0,      970, 0xff4de39a, F=0x0, S=1,      153, 0x3b00416c
+0,        565,        565,        0,      978, 0x12bcf81f, F=0x0, S=1,     1181, 0xce175555
+0,        599,        599,        0,     1233, 0x2903744a, F=0x0, S=1,      860, 0x737eb566
+0,        632,        632,        0,     1118, 0x7f274f50, F=0x0, S=1,      933, 0xb669c6b6
+0,        665,        665,        0,      941, 0x6bffd4b1, F=0x0, S=1,     1058, 0x07581cee
+0,        699,        699,        0,     1598, 0xc007219f, F=0x0, S=1,      939, 0x2c0bdc45
+0,        732,        732,        0,     1218, 0x25d962b6, F=0x0, S=1,     1090, 0x96482341
+0,        765,        765,        0,     1200, 0x86b85be3, F=0x0, S=1,      189, 0x3f085309
+0,        799,        799,        0,     1329, 0x298a848a, F=0x0, S=1,     1426, 0x6ea3df12
+0,        832,        832,        0,     1500, 0xe437edec, F=0x0, S=1,     1244, 0x32836b8d
+0,        865,        865,        0,     1288, 0xc4447dd5, F=0x0, S=1,     1289, 0x06a57b0f
+0,        899,        899,        0,     1281, 0xb5bf7e9f, F=0x0, S=1,     1227, 0xd96d5697
+0,        932,        932,        0,     1372, 0x09be9014, F=0x0, S=1,     1556, 0x2630fbff
+0,        965,        965,        0,     1238, 0x42ce6316, F=0x0, S=1,     1287, 0x1d3084f6
+0,        999,        999,        0,     1655, 0xb94b45c2, F=0x0, S=1,     1494, 0x34dbd1a4
+0,       1032,       1032,        0,     1164, 0xf6b93ad0, F=0x0, S=1,     1337, 0xba6d9673
+0,       1065,       1065,        0,     1084, 0x58c50fb5, F=0x0, S=1,     1384, 0x3fabb82b
+0,       1099,       1099,        0,     1151, 0x0b3f3359, F=0x0, S=1,     1353, 0x08e2a1d7
+0,       1132,       1132,        0,     1277, 0xa3ae77e1, F=0x0, S=1,     1409, 0xf65cb9f7
+0,       1165,       1165,        0,      782, 0xdcf671ff, F=0x0, S=1,     1408, 0x01e2ac53
+0,       1199,       1199,        0,      926, 0xe913c286, F=0x0, S=1,     1320, 0x32e38e42
+0,       1232,       1232,        0,      970, 0x3d86e5ae, F=0x0, S=1,     1608, 0x40b52618
+0,       1265,       1265,        0,     1353, 0xe4f197b2, F=0x0, S=1,     1272, 0xf1d272a5
+0,       1299,       1299,        0,      685, 0x629b4ce4, F=0x0, S=1,     1257, 0x14845de9
+0,       1332,       1332,        0,      743, 0x6f1172a3, F=0x0, S=1,     1260, 0xa6c66fda
+0,       1365,       1365,        0,      789, 0x94fc84cd, F=0x0, S=1,     1009, 0x7daaf2b0
+0,       1399,       1399,        0,     1460, 0x668adb82, F=0x0, S=1,      944, 0x44b6ccf5
+0,       1432,       1432,        0,      766, 0x49c884ef, F=0x0, S=1,      996, 0x8646e6dd
+0,       1465,       1465,        0,     1037, 0x24831498, F=0x0, S=1,      983, 0x14a9e7a6
+0,       1499,       1499,        0,      943, 0x1f53d180, F=0x0, S=1,     1107, 0x02f72acb
+0,       1532,       1532,        0,     1152, 0xbf6a35ae, F=0x0, S=1,     1026, 0xd57afda0
+0,       1565,       1565,        0,      730, 0x42806abf, F=0x0, S=1,     1029, 0xfb0402d5
+0,       1599,       1599,        0,      975, 0xa5ffec57, F=0x0, S=1,     1081, 0xe2890cea
+0,       1632,       1632,        0,      970, 0xbe8ee224, F=0x0, S=1,     1151, 0x7b0d3b20
+0,       1665,       1665,        0,     1012, 0x20c6f0d8, F=0x0, S=1,      979, 0xc25cd69c
+0,       1699,       1699,        0,      874, 0x1a2fb4da, F=0x0, S=1,      943, 0xdb2dc9f8
+0,       1732,       1732,        0,      869, 0xab0caf3d, F=0x0, S=1,      934, 0x48b9bfcc
+0,       1765,       1765,        0,      863, 0xd8caa2e5, F=0x0, S=1,      874, 0x0b34b026
+0,       1799,       1799,        0,     1246, 0x47866cdc, F=0x0, S=1,      818, 0x0c908eeb
+0,       1832,       1832,        0,      742, 0xa6296ac1, F=0x0, S=1,      921, 0x97b6b053
+0,       1865,       1865,        0,      828, 0x0b568d7a, F=0x0, S=1,      969, 0x3314dbfa
+0,       1899,       1899,        0,      825, 0x6d329394, F=0x0, S=1,      982, 0x5f66e68c
+0,       1932,       1932,        0,      836, 0x8ace8dfb, F=0x0, S=1,      929, 0x9ffdc2fd
+0,       1965,       1965,        0,     1774, 0xd4686726, F=0x0, S=1,      909, 0x11a9c07a
+0,       1999,       1999,        0,     1803, 0x08c879ce, F=0x0, S=1,     1525, 0x1e11f02f
+0,       2032,       2032,        0,      518, 0x7c32fc72, F=0x0, S=1,      785, 0xfc1f792a
+0,       2065,       2065,        0,      790, 0x3dac8aa0, F=0x0, S=1,      876, 0x0918c88d
+0,       2099,       2099,        0,      927, 0x4feccb24, F=0x0, S=1,     1059, 0xbcaa05c7
+0,       2132,       2132,        0,      835, 0x29d39266, F=0x0, S=1,      980, 0x4913e409
+0,       2165,       2165,        0,      951, 0xc1dddd12, F=0x0, S=1,     1041, 0x0541047e
+0,       2199,       2199,        0,      876, 0x2f6eb89d, F=0x0, S=1,      949, 0x2d56c53b
+0,       2232,       2232,        0,      959, 0xf0dedabd, F=0x0, S=1,     1022, 0x8d33f5fa
+0,       2265,       2265,        0,      860, 0x9274ab39, F=0x0, S=1,     1061, 0x289c0132
+0,       2299,       2299,        0,      863, 0x7058ba30, F=0x0, S=1,      940, 0x1f32d4a3
+0,       2332,       2332,        0,     1021, 0xcabdf84f, F=0x0, S=1,      887, 0xda8ab95e
+0,       2365,       2365,        0,      897, 0x9867c8e8, F=0x0, S=1,      840, 0xd93eaaf5
+0,       2399,       2399,        0,      897, 0x6a16b5db, F=0x0, S=1,      977, 0x7b77dc9b
+0,       2432,       2432,        0,      953, 0xe9b4cf1f, F=0x0, S=1,      921, 0x75a8ca45
+0,       2465,       2465,        0,      847, 0x0335ad37, F=0x0, S=1,     1000, 0x2691f3bd
+0,       2499,       2499,        0,      902, 0x3360b315, F=0x0, S=1,     1008, 0xd5e1deb6
+0,       2532,       2532,        0,      881, 0xf5309d59, F=0x0, S=1,     1113, 0xdbef3065
+0,       2565,       2565,        0,      974, 0x7c2de3ce, F=0x0, S=1,     1086, 0x365626bb
+0,       2599,       2599,        0,      974, 0xf42bd9f5, F=0x0, S=1,     1039, 0xa7e9060d
+0,       2632,       2632,        0,     1029, 0x7c33f4d0, F=0x0, S=1,     1041, 0xf4affa59
+0,       2665,       2665,        0,      881, 0x9021a565, F=0x0, S=1,     1039, 0xc1e00521
+0,       2699,       2699,        0,     1157, 0xe1c136f7, F=0x0, S=1,      917, 0x357ac7d3
+0,       2732,       2732,        0,      649, 0xdffb3cb7, F=0x0, S=1,      976, 0xa386e05e
+0,       2765,       2765,        0,      758, 0xb67875f3, F=0x0, S=1,     1041, 0xae4e0a63
+0,       2799,       2799,        0,     1105, 0x8ffb1a26, F=0x0, S=1,      962, 0x211ddc5e
+0,       2832,       2832,        0,      866, 0xa60eb2d9, F=0x0, S=1,      929, 0xe9e4c84b
+0,       2865,       2865,        0,      912, 0xcd34bf9b, F=0x0, S=1,      946, 0xfce9d359
+0,       2899,       2899,        0,      868, 0x5651a343, F=0x0, S=1,      809, 0x624a8ef9
+0,       2932,       2932,        0,      997, 0xfa66eaeb, F=0x0, S=1,      992, 0xc913e5e2
+0,       2965,       2965,        0,     1111, 0x3f272497, F=0x0, S=1,     1007, 0xf78ee6a7
+0,       2999,       2999,        0,      842, 0xe442999f, F=0x0, S=1,      972, 0x25a0d25c
+0,       3032,       3032,        0,     1030, 0x6f97ffad, F=0x0, S=1,      993, 0x4059fd6b
+0,       3065,       3065,        0,     1176, 0x66e64926, F=0x0, S=1,      951, 0x2762cdf1
+0,       3099,       3099,        0,      803, 0xfd1699cb, F=0x0, S=1,      959, 0x5cf9d56c
+0,       3132,       3132,        0,      972, 0x1cdff00e, F=0x0, S=1,     1023, 0xeaf20900
+0,       3165,       3165,        0,      907, 0x17f8acca, F=0x0, S=1,     1054, 0xeb010c4d
+0,       3199,       3199,        0,      915, 0x3569b545, F=0x0, S=1,      987, 0x73b2e159
+0,       3232,       3232,        0,     1021, 0x14c5076a, F=0x0, S=1,     1007, 0x6c4bf7f0
+0,       3265,       3265,        0,      837, 0xbf86b0ef, F=0x0, S=1,      963, 0xf472d31a
+0,       3299,       3299,        0,      885, 0x1caac123, F=0x0, S=1,     1052, 0x2b7bfd20
+0,       3332,       3332,        0,     1355, 0x299e8d3c, F=0x0, S=1,      858, 0x2bbca3f0
+0,       3365,       3365,        0,      784, 0xb0bd7e9d, F=0x0, S=1,      969, 0xc865dc00
+0,       3399,       3399,        0,      991, 0xbc7ddda9, F=0x0, S=1,     1028, 0x801b00a6
+0,       3432,       3432,        0,      986, 0xb356f6b1, F=0x0, S=1,     1056, 0x8b840add
+0,       3465,       3465,        0,      978, 0x94a3e87e, F=0x0, S=1,     1018, 0xe766fa52
+0,       3499,       3499,        0,      976, 0x55ddd14a, F=0x0, S=1,      992, 0x58a9ddfe
+0,       3532,       3532,        0,     1241, 0x1ec867f7, F=0x0, S=1,      966, 0xa329e84f
+0,       3565,       3565,        0,      975, 0xecf5dbb3, F=0x0, S=1,      899, 0xa7539f4d
+0,       3599,       3599,        0,     1129, 0xb7243037, F=0x0, S=1,     1057, 0xbd0d10bd
+0,       3632,       3632,        0,      913, 0xe5f1d03d, F=0x0, S=1,     1092, 0xeb9621f8
+0,       3665,       3665,        0,      943, 0x87d0ed78, F=0x0, S=1,     1057, 0x079c1054
+0,       3699,       3699,        0,      917, 0x536cc3fd, F=0x0, S=1,      946, 0xd2b9d0e2
+0,       3732,       3732,        0,      892, 0x4dffb1e2, F=0x0, S=1,      930, 0x70c9cc40
+0,       3765,       3765,        0,      957, 0x1a98e71c, F=0x0, S=1,      719, 0x6fec614a
+0,       3799,       3799,        0,      893, 0xf405b2c3, F=0x0, S=1,      821, 0x63529cab
+0,       3832,       3832,        0,      978, 0xa0a8d5f6, F=0x0, S=1,      745, 0x3c616219
+0,       3865,       3865,        0,      887, 0xfa7cb65d, F=0x0, S=1,      768, 0xb8f07885
+0,       3899,       3899,        0,      867, 0xd808ade7, F=0x0, S=1,      783, 0xf82b6b9a
+0,       3932,       3932,        0,     1068, 0x6f8b135a, F=0x0, S=1,      807, 0x52028d50
+0,       3965,       3965,        0,     2010, 0x536fe0b6, F=0x0, S=1,     1512, 0x690aeb55