update for 2.2.8

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avcodec: fix aac/ac3 parser bitstream buffer size
2014-09-21 01:18:16 +02:00 · 2014-09-20 18:40:33 +02:00 · 2014-09-20 18:40:33 +02:00 · 2014-09-20 18:40:33 +02:00 · 2014-09-20 18:40:33 +02:00 · 2014-09-20 18:40:33 +02:00
173 changed files with 1283 additions and 682 deletions
@@ -1,8 +1,24 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.

-version 2.2:
+version 2.2.7
+- snow: fix null pointer dereference
+- iff: fix out of array access
+- svq1dec: fix input data corruption
+- proresenc_ks: check buffer size

+
+version 2.2.6
+- fix infinite loop in dvbsub parser
+- fix some interlaced MPEG-2 videos
+- fix decoding issues in dv (Ticket2340, 2341)
+- fix v4l2 and v4l2enc crashes
+- fix theoretical librtmp crash
+- fix theoretical eamad crash
+- support dimension change in g2meet
+
+
+version 2.2:
 - HNM version 4 demuxer and video decoder
 - Live HDS muxer
 - setsar/setdar filters now support variables in ratio expressions
@@ -33,6 +33,7 @@ Specifically, the GPL parts of FFmpeg are
    - vf_geq.c
    - vf_histeq.c
    - vf_hqdn3d.c
+    - vf_interlace.c
    - vf_kerndeint.c
    - vf_mcdeint.c
    - vf_mp.c
@@ -1 +1 @@
-2.2
+2.2.8
@@ -1 +0,0 @@
-2.2
@@ -224,7 +224,7 @@ int opt_opencl_bench(void *optctx, const char *opt, const char *arg)
        av_log(NULL, AV_LOG_ERROR, "No OpenCL device detected!\n");
        return AVERROR(EINVAL);
    }
-    if (!(devices = av_malloc(sizeof(OpenCLDeviceBenchmark) * nb_devices))) {
+    if (!(devices = av_malloc_array(nb_devices, sizeof(OpenCLDeviceBenchmark)))) {
        av_log(NULL, AV_LOG_ERROR, "Could not allocate buffer\n");
        return AVERROR(ENOMEM);
    }
@@ -13,7 +13,8 @@
 //
 // You should have received a copy of the GNU General Public License
 // along with this program; if not, write to the Free Software
-// Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA, or visit
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+// MA 02110-1301 USA, or visit
 // http://www.gnu.org/copyleft/gpl.html .
 //
 // As a special exception, I give you permission to link to the
@@ -13,7 +13,8 @@
 //
 // You should have received a copy of the GNU General Public License
 // along with this program; if not, write to the Free Software
-// Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA, or visit
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+// MA 02110-1301 USA, or visit
 // http://www.gnu.org/copyleft/gpl.html .
 //
 // As a special exception, I give you permission to link to the
@@ -3386,7 +3386,7 @@ case "$arch" in
    tilegx|tile-gx)
        arch="tilegx"
    ;;
-    i[3-6]86|i86pc|BePC|x86pc|x86_64|x86_32|amd64)
+    i[3-6]86*|i86pc|BePC|x86pc|x86_64|x86_32|amd64)
        arch="x86"
    ;;
 esac
@@ -31,7 +31,7 @@ PROJECT_NAME           = FFmpeg
 # This could be handy for archiving the generated documentation or
 # if some version control system is used.

-PROJECT_NUMBER         = 2.2
+PROJECT_NUMBER         = 2.2.8

 # With the PROJECT_LOGO tag one can specify a logo or icon that is included
 # in the documentation. The maximum height of the logo should not exceed 55
@@ -62,7 +62,7 @@ AC-3 audio decoder.
 This decoder implements part of ATSC A/52:2010 and ETSI TS 102 366, as well as
 the undocumented RealAudio 3 (a.k.a. dnet).

-@subsubsection AC-3 Decoder Options
+@subsection AC-3 Decoder Options

@table @option

@@ -296,7 +296,7 @@ teletext packet PTS and DTS values untouched.

 Raw video demuxer.

-This demuxer allows to read raw video data. Since there is no header
+This demuxer allows one to read raw video data. Since there is no header
 specifying the assumed video parameters, the user must specify them
 in order to be able to decode the data correctly.

@@ -807,7 +807,7 @@ while producing the worst quality.

@item reservoir
 Enable use of bit reservoir when set to 1. Default value is 1. LAME
-has this enabled by default, but can be overriden by use
+has this enabled by default, but can be overridden by use
@option{--nores} option.

@item joint_stereo (@emph{-m j})
@@ -1271,7 +1271,7 @@ Requires the presence of the libtheora headers and library during
 configuration. You need to explicitly configure the build with
@code{--enable-libtheora}.

-For more informations about the libtheora project see
+For more information about the libtheora project see
@url{http://www.theora.org/}.

@subsection Options
@@ -1525,7 +1525,7 @@ for detail retention (adaptive quantization, psy-RD, psy-trellis).
 Many libx264 encoder options are mapped to FFmpeg global codec
 options, while unique encoder options are provided through private
 options. Additionally the @option{x264opts} and @option{x264-params}
-private options allows to pass a list of key=value tuples as accepted
+private options allows one to pass a list of key=value tuples as accepted
 by the libx264 @code{x264_param_parse} function.

 The x264 project website is at
@@ -1853,7 +1853,7 @@ Override the x264 configuration using a :-separated list of key=value
 parameters.

 This option is functionally the same as the @option{x264opts}, but is
-duplicated for compability with the Libav fork.
+duplicated for compatibility with the Libav fork.

 For example to specify libx264 encoding options with @command{ffmpeg}:
@example
@@ -2047,7 +2047,7 @@ Set physical density of pixels, in dots per meter, unset by default
 Apple ProRes encoder.

 FFmpeg contains 2 ProRes encoders, the prores-aw and prores-ks encoder.
-The used encoder can be choosen with the @code{-vcodec} option.
+The used encoder can be chosen with the @code{-vcodec} option.

@subsection Private Options for prores-ks

@@ -119,8 +119,10 @@ int main(int argc, char *argv[])
 end:
    avformat_close_input(&fmt_ctx);
    /* note: the internal buffer could have changed, and be != avio_ctx_buffer */
-    av_freep(&avio_ctx->buffer);
-    av_freep(&avio_ctx);
+    if (avio_ctx) {
+        av_freep(&avio_ctx->buffer);
+        av_freep(&avio_ctx);
+    }
    av_file_unmap(buffer, buffer_size);

    if (ret < 0) {
@@ -14,7 +14,7 @@

 The FFmpeg resampler provides a high-level interface to the
 libswresample library audio resampling utilities. In particular it
-allows to perform audio resampling, audio channel layout rematrixing,
+allows one to perform audio resampling, audio channel layout rematrixing,
 and convert audio format and packing layout.

@c man end DESCRIPTION
@@ -13,7 +13,7 @@
@c man begin DESCRIPTION

 The FFmpeg rescaler provides a high-level interface to the libswscale
-library image conversion utilities. In particular it allows to perform
+library image conversion utilities. In particular it allows one to perform
 image rescaling and pixel format conversion.

@c man end DESCRIPTION
@@ -1405,11 +1405,11 @@ ffmpeg -f image2 -pattern_type glob -i 'foo-*.jpeg' -r 12 -s WxH foo.avi
 You can put many streams of the same type in the output:

@example
-ffmpeg -i test1.avi -i test2.avi -map 0:3 -map 0:2 -map 0:1 -map 0:0 -c copy test12.nut
+ffmpeg -i test1.avi -i test2.avi -map 1:1 -map 1:0 -map 0:1 -map 0:0 -c copy -y test12.nut
@end example

-The resulting output file @file{test12.avi} will contain first four streams from
-the input file in reverse order.
+The resulting output file @file{test12.nut} will contain the first four streams
+from the input files in reverse order.

@item
 To force CBR video output:
@@ -111,7 +111,7 @@ must be configured in the stream configuration. They are sent to
 the @command{ffmpeg} encoders.

 The @command{ffmpeg} @option{override_ffserver} commandline option
-allows to override the encoding parameters set by the server.
+allows one to override the encoding parameters set by the server.

 Multiple streams can be connected to the same feed.

@@ -172,7 +172,7 @@ terminated when the next special character (belonging to the set

 The name and arguments of the filter are optionally preceded and
 followed by a list of link labels.
-A link label allows to name a link and associate it to a filter output
+A link label allows one to name a link and associate it to a filter output
 or input pad. The preceding labels @var{in_link_1}
 ... @var{in_link_N}, are associated to the filter input pads,
 the following labels @var{out_link_1} ... @var{out_link_M}, are
@@ -491,7 +491,7 @@ aeval=val(ch)/2:c=same
@item
 Invert phase of the second channel:
@example
-eval=val(0)|-val(1)
+aeval=val(0)|-val(1)
@end example
@end itemize

@@ -3921,7 +3921,7 @@ The high threshold selects the "strong" edge pixels, which are then
 connected through 8-connectivity with the "weak" edge pixels selected
 by the low threshold.

-@var{low} and @var{high} threshold values must be choosen in the range
+@var{low} and @var{high} threshold values must be chosen in the range
 [0,1], and @var{low} should be lesser or equal to @var{high}.

 Default value for @var{low} is @code{20/255}, and default value for @var{high}
@@ -5238,7 +5238,7 @@ Set progressive threshold.

 Deinterleave or interleave fields.

-This filter allows to process interlaced images fields without
+This filter allows one to process interlaced images fields without
 deinterlacing them. Deinterleaving splits the input frame into 2
 fields (so called half pictures). Odd lines are moved to the top
 half of the output image, even lines to the bottom half.
@@ -6860,7 +6860,7 @@ rotate=A*sin(2*PI/T*t)
@end example

@item
-Rotate the video, output size is choosen so that the whole rotating
+Rotate the video, output size is chosen so that the whole rotating
 input video is always completely contained in the output:
@example
 rotate='2*PI*t:ow=hypot(iw,ih):oh=ow'
@@ -6983,7 +6983,7 @@ Default value is @samp{0}.
@item flags
 Set libswscale scaling flags. See
@ref{sws_flags,,the ffmpeg-scaler manual,ffmpeg-scaler} for the
-complete list of values. If not explictly specified the filter applies
+complete list of values. If not explicitly specified the filter applies
 the default flags.

@item size, s
@@ -7797,7 +7797,7 @@ Produce 8x8 PNG tiles of all keyframes (@option{-skip_frame nokey}) in a movie:
 ffmpeg -skip_frame nokey -i file.avi -vf 'scale=128:72,tile=8x8' -an -vsync 0 keyframes%03d.png
@end example
 The @option{-vsync 0} is necessary to prevent @command{ffmpeg} from
-duplicating each output frame to accomodate the originally detected frame
+duplicating each output frame to accommodate the originally detected frame
 rate.

@item
@@ -8394,7 +8394,7 @@ Set dithering to reduce the circular banding effects. Default is @code{1}
 (enabled).

@item aspect
-Set vignette aspect. This setting allows to adjust the shape of the vignette.
+Set vignette aspect. This setting allows one to adjust the shape of the vignette.
 Setting this value to the SAR of the input will make a rectangular vignetting
 following the dimensions of the video.

@@ -8850,7 +8850,7 @@ Default value is "all", which will cycle through the list of all tests.

 For example the following:
@example
-testsrc=t=dc_luma
+mptestsrc=t=dc_luma
@end example

 will generate a "dc_luma" test pattern.
@@ -8903,7 +8903,7 @@ horizontally, vertically, or diagonally adjacent.

 At each interaction the grid evolves according to the adopted rule,
 which specifies the number of neighbor alive cells which will make a
-cell stay alive or born. The @option{rule} option allows to specify
+cell stay alive or born. The @option{rule} option allows one to specify
 the rule to adopt.

 This source accepts the following options:
@@ -10323,7 +10323,7 @@ Note that when the movie is looped the source timestamps are not
 changed, so it will generate non monotonically increasing timestamps.
@end table

-This filter allows to overlay a second video on top of main input of
+This filter allows one to overlay a second video on top of main input of
 a filtergraph as shown in this graph:
@example
 input -----------> deltapts0 --> overlay --> output
@@ -299,7 +299,7 @@ the current branch history.
 git commit --amend
@end example

-allows to amend the last commit details quickly.
+allows one to amend the last commit details quickly.

@example
 git rebase -i origin/master
@@ -409,7 +409,7 @@ OpenAL is part of Core Audio, the official Mac OS X Audio interface.
 See @url{http://developer.apple.com/technologies/mac/audio-and-video.html}
@end table

-This device allows to capture from an audio input device handled
+This device allows one to capture from an audio input device handled
 through OpenAL.

 You need to specify the name of the device to capture in the provided
@@ -617,7 +617,7 @@ Select the pixel format (only valid for raw video input).

@item input_format
 Set the preferred pixel format (for raw video) or a codec name.
-This option allows to select the input format, when several are
+This option allows one to select the input format, when several are
 available.

@item framerate
@@ -678,7 +678,7 @@ other filename will be interpreted as device number 0.

 X11 video input device.

-This device allows to capture a region of an X11 display.
+This device allows one to capture a region of an X11 display.

 The filename passed as input has the syntax:
@example
@@ -758,7 +758,7 @@ The segment muxer supports the following options:
@table @option
@item reference_stream @var{specifier}
 Set the reference stream, as specified by the string @var{specifier}.
-If @var{specifier} is set to @code{auto}, the reference is choosen
+If @var{specifier} is set to @code{auto}, the reference is chosen
 automatically. Otherwise it must be a stream specifier (see the ``Stream
 specifiers'' chapter in the ffmpeg manual) which specifies the
 reference stream. The default value is @code{auto}.
@@ -42,7 +42,7 @@ ffmpeg -i INPUT -f alsa hw:1,7

 CACA output device.

-This output device allows to show a video stream in CACA window.
+This output device allows one to show a video stream in CACA window.
 Only one CACA window is allowed per application, so you can
 have only one instance of this output device in an application.

@@ -216,7 +216,7 @@ OpenGL output device.

 To enable this output device you need to configure FFmpeg with @code{--enable-opengl}.

-Device allows to render to OpenGL context.
+This output device allows one to render to OpenGL context.
 Context may be provided by application or default SDL window is created.

 When device renders to external context, application must implement handlers for following messages:
@@ -302,7 +302,7 @@ ffmpeg  -i INPUT -f pulse "stream name"

 SDL (Simple DirectMedia Layer) output device.

-This output device allows to show a video stream in an SDL
+This output device allows one to show a video stream in an SDL
 window. Only one SDL window is allowed per application, so you can
 have only one instance of this output device in an application.

@@ -361,7 +361,7 @@ sndio audio output device.

 XV (XVideo) output device.

-This output device allows to show a video stream in a X Window System
+This output device allows one to show a video stream in a X Window System
 window.

@subsection Options
@@ -960,7 +960,7 @@ used as master salt.

@section tcp

-Trasmission Control Protocol.
+Transmission Control Protocol.

 The required syntax for a TCP url is:
@example
@@ -1066,7 +1066,7 @@ udp://@var{hostname}:@var{port}[?@var{options}]
@var{options} contains a list of &-separated options of the form @var{key}=@var{val}.

 In case threading is enabled on the system, a circular buffer is used
-to store the incoming data, which allows to reduce loss of data due to
+to store the incoming data, which allows one to reduce loss of data due to
 UDP socket buffer overruns. The @var{fifo_size} and
@var{overrun_nonfatal} options are related to this buffer.

@@ -35,7 +35,7 @@ Select nearest neighbor rescaling algorithm.
@item area
 Select averaging area rescaling algorithm.

-@item bicubiclin
+@item bicublin
 Select bicubic scaling algorithm for the luma component, bilinear for
 chroma components.

@@ -1056,7 +1056,7 @@ which can be obtained with @code{ffmpeg -opencl_bench} or @code{av_opencl_get_de
@item device_idx
 Select the index of the device used to run OpenCL code.

-The specifed index must be one of the indexes in the device list which
+The specified index must be one of the indexes in the device list which
 can be obtained with @code{ffmpeg -opencl_bench} or @code{av_opencl_get_device_list()}.

@end table
@@ -514,6 +514,8 @@ static void ffmpeg_cleanup(int ret)
    if (received_sigterm) {
        av_log(NULL, AV_LOG_INFO, "Received signal %d: terminating.\n",
               (int) received_sigterm);
+    } else if (ret) {
+        av_log(NULL, AV_LOG_INFO, "Conversion failed!\n");
    }
    term_exit();
 }
@@ -619,7 +621,8 @@ static void write_frame(AVFormatContext *s, AVPacket *pkt, OutputStream *ost)
        bsfc = bsfc->next;
    }

-    if (!(s->oformat->flags & AVFMT_NOTIMESTAMPS) &&
+    if (!(s->oformat->flags & AVFMT_NOTIMESTAMPS)) {
+     if(
        (avctx->codec_type == AVMEDIA_TYPE_AUDIO || avctx->codec_type == AVMEDIA_TYPE_VIDEO) &&
        pkt->dts != AV_NOPTS_VALUE &&
        ost->last_mux_dts != AV_NOPTS_VALUE) {
@@ -640,6 +643,16 @@ static void write_frame(AVFormatContext *s, AVPacket *pkt, OutputStream *ost)
            pkt->pts = FFMAX(pkt->pts, max);
        pkt->dts = max;
      }
+     }
+        if (pkt->dts != AV_NOPTS_VALUE &&
+            pkt->pts != AV_NOPTS_VALUE &&
+            pkt->dts > pkt->pts) {
+            av_log(s, AV_LOG_WARNING, "Invalid DTS: %"PRId64" PTS: %"PRId64" in output stream %d:%d\n",
+                   pkt->dts, pkt->pts,
+                   ost->file_index, ost->st->index);
+            pkt->pts = AV_NOPTS_VALUE;
+            pkt->dts = AV_NOPTS_VALUE;
+        }
    }
    ost->last_mux_dts = pkt->dts;

@@ -1089,6 +1102,19 @@ static void do_video_stats(OutputStream *ost, int frame_size)
    }
 }

+static void finish_output_stream(OutputStream *ost)
+{
+    OutputFile *of = output_files[ost->file_index];
+    int i;
+
+    ost->finished = ENCODER_FINISHED | MUXER_FINISHED;
+
+    if (of->shortest) {
+        for (i = 0; i < of->ctx->nb_streams; i++)
+            output_streams[of->ost_index + i]->finished = ENCODER_FINISHED | MUXER_FINISHED;
+    }
+}
+
 /**
 * Get and encode new output from any of the filtergraphs, without causing
 * activity.
@@ -1966,7 +1992,7 @@ static int output_packet(InputStream *ist, const AVPacket *pkt)
            if (avpkt.duration) {
                duration = av_rescale_q(avpkt.duration, ist->st->time_base, AV_TIME_BASE_Q);
            } else if(ist->st->codec->time_base.num != 0 && ist->st->codec->time_base.den != 0) {
-                int ticks= ist->st->parser ? ist->st->parser->repeat_pict+1 : ist->st->codec->ticks_per_frame;
+                int ticks= av_stream_get_parser(ist->st) ? av_stream_get_parser(ist->st)->repeat_pict+1 : ist->st->codec->ticks_per_frame;
                duration = ((int64_t)AV_TIME_BASE *
                                ist->st->codec->time_base.num * ticks) /
                                ist->st->codec->time_base.den;
@@ -2023,7 +2049,7 @@ static int output_packet(InputStream *ist, const AVPacket *pkt)
            } else if (pkt->duration) {
                ist->next_dts += av_rescale_q(pkt->duration, ist->st->time_base, AV_TIME_BASE_Q);
            } else if(ist->st->codec->time_base.num != 0) {
-                int ticks= ist->st->parser ? ist->st->parser->repeat_pict + 1 : ist->st->codec->ticks_per_frame;
+                int ticks= av_stream_get_parser(ist->st) ? av_stream_get_parser(ist->st)->repeat_pict + 1 : ist->st->codec->ticks_per_frame;
                ist->next_dts += ((int64_t)AV_TIME_BASE *
                                  ist->st->codec->time_base.num * ticks) /
                                  ist->st->codec->time_base.den;
@@ -3145,7 +3171,7 @@ static int process_input(int file_index)

                if (ost->source_index == ifile->ist_index + i &&
                    (ost->stream_copy || ost->enc->type == AVMEDIA_TYPE_SUBTITLE))
-                    close_output_stream(ost);
+                    finish_output_stream(ost);
            }
        }

@@ -44,12 +44,15 @@ enum AVPixelFormat choose_pixel_fmt(AVStream *st, AVCodec *codec, enum AVPixelFo
        const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(target);
        int has_alpha = desc ? desc->nb_components % 2 == 0 : 0;
        enum AVPixelFormat best= AV_PIX_FMT_NONE;
+        const enum AVPixelFormat mjpeg_formats[] = { AV_PIX_FMT_YUVJ420P, AV_PIX_FMT_YUVJ422P, AV_PIX_FMT_YUV420P, AV_PIX_FMT_YUV422P, AV_PIX_FMT_NONE };
+        const enum AVPixelFormat ljpeg_formats[] = { AV_PIX_FMT_YUVJ420P, AV_PIX_FMT_YUVJ422P, AV_PIX_FMT_YUVJ444P, AV_PIX_FMT_YUV420P,
+                                                     AV_PIX_FMT_YUV422P, AV_PIX_FMT_YUV444P, AV_PIX_FMT_BGRA, AV_PIX_FMT_NONE };
+
        if (st->codec->strict_std_compliance <= FF_COMPLIANCE_UNOFFICIAL) {
            if (st->codec->codec_id == AV_CODEC_ID_MJPEG) {
-                p = (const enum AVPixelFormat[]) { AV_PIX_FMT_YUVJ420P, AV_PIX_FMT_YUVJ422P, AV_PIX_FMT_YUV420P, AV_PIX_FMT_YUV422P, AV_PIX_FMT_NONE };
+                p = mjpeg_formats;
            } else if (st->codec->codec_id == AV_CODEC_ID_LJPEG) {
-                p = (const enum AVPixelFormat[]) { AV_PIX_FMT_YUVJ420P, AV_PIX_FMT_YUVJ422P, AV_PIX_FMT_YUVJ444P, AV_PIX_FMT_YUV420P,
-                                                 AV_PIX_FMT_YUV422P, AV_PIX_FMT_YUV444P, AV_PIX_FMT_BGRA, AV_PIX_FMT_NONE };
+                p =ljpeg_formats;
            }
        }
        for (; *p != AV_PIX_FMT_NONE; p++) {
@@ -825,6 +828,12 @@ static int configure_input_filter(FilterGraph *fg, InputFilter *ifilter,
    av_freep(&ifilter->name);
    DESCRIBE_FILTER_LINK(ifilter, in, 1);

+    if (!ifilter->ist->dec) {
+        av_log(NULL, AV_LOG_ERROR,
+               "No decoder for stream #%d:%d, filtering impossible\n",
+               ifilter->ist->file_index, ifilter->ist->st->index);
+        return AVERROR_DECODER_NOT_FOUND;
+    }
    switch (avfilter_pad_get_type(in->filter_ctx->input_pads, in->pad_idx)) {
    case AVMEDIA_TYPE_VIDEO: return configure_input_video_filter(fg, ifilter, in);
    case AVMEDIA_TYPE_AUDIO: return configure_input_audio_filter(fg, ifilter, in);
@@ -1783,7 +1783,7 @@ static int open_output_file(OptionsContext *o, const char *filename)
        /* pick the "best" stream of each type */

        /* video: highest resolution */
-        if (!o->video_disable && oc->oformat->video_codec != AV_CODEC_ID_NONE) {
+        if (!o->video_disable && av_guess_codec(oc->oformat, NULL, filename, NULL, AVMEDIA_TYPE_VIDEO) != AV_CODEC_ID_NONE) {
            int area = 0, idx = -1;
            int qcr = avformat_query_codec(oc->oformat, oc->oformat->video_codec, 0);
            for (i = 0; i < nb_input_streams; i++) {
@@ -1805,7 +1805,7 @@ static int open_output_file(OptionsContext *o, const char *filename)
        }

        /* audio: most channels */
-        if (!o->audio_disable && oc->oformat->audio_codec != AV_CODEC_ID_NONE) {
+        if (!o->audio_disable && av_guess_codec(oc->oformat, NULL, filename, NULL, AVMEDIA_TYPE_AUDIO) != AV_CODEC_ID_NONE) {
            int channels = 0, idx = -1;
            for (i = 0; i < nb_input_streams; i++) {
                ist = input_streams[i];
@@ -2119,7 +2119,8 @@ static int opt_target(void *optctx, const char *opt, const char *arg)
            for (j = 0; j < nb_input_files; j++) {
                for (i = 0; i < input_files[j]->nb_streams; i++) {
                    AVCodecContext *c = input_files[j]->ctx->streams[i]->codec;
-                    if (c->codec_type != AVMEDIA_TYPE_VIDEO)
+                    if (c->codec_type != AVMEDIA_TYPE_VIDEO ||
+                        !c->time_base.num)
                        continue;
                    fr = c->time_base.den * 1000 / c->time_base.num;
                    if (fr == 25000) {
@@ -2152,19 +2153,19 @@ static int opt_target(void *optctx, const char *opt, const char *arg)

        parse_option(o, "s", norm == PAL ? "352x288" : "352x240", options);
        parse_option(o, "r", frame_rates[norm], options);
-        av_dict_set(&o->g->codec_opts, "g", norm == PAL ? "15" : "18", AV_DICT_DONT_OVERWRITE);
+        opt_default(NULL, "g", norm == PAL ? "15" : "18");

-        av_dict_set(&o->g->codec_opts, "b:v", "1150000", AV_DICT_DONT_OVERWRITE);
-        av_dict_set(&o->g->codec_opts, "maxrate", "1150000", AV_DICT_DONT_OVERWRITE);
-        av_dict_set(&o->g->codec_opts, "minrate", "1150000", AV_DICT_DONT_OVERWRITE);
-        av_dict_set(&o->g->codec_opts, "bufsize", "327680", AV_DICT_DONT_OVERWRITE); // 40*1024*8;
+        opt_default(NULL, "b:v", "1150000");
+        opt_default(NULL, "maxrate", "1150000");
+        opt_default(NULL, "minrate", "1150000");
+        opt_default(NULL, "bufsize", "327680"); // 40*1024*8;

-        av_dict_set(&o->g->codec_opts, "b:a", "224000", AV_DICT_DONT_OVERWRITE);
+        opt_default(NULL, "b:a", "224000");
        parse_option(o, "ar", "44100", options);
        parse_option(o, "ac", "2", options);

-        av_dict_set(&o->g->format_opts, "packetsize", "2324", AV_DICT_DONT_OVERWRITE);
-        av_dict_set(&o->g->format_opts, "muxrate", "1411200", AV_DICT_DONT_OVERWRITE); // 2352 * 75 * 8;
+        opt_default(NULL, "packetsize", "2324");
+        opt_default(NULL, "muxrate", "1411200"); // 2352 * 75 * 8;

        /* We have to offset the PTS, so that it is consistent with the SCR.
           SCR starts at 36000, but the first two packs contain only padding
@@ -2181,18 +2182,18 @@ static int opt_target(void *optctx, const char *opt, const char *arg)
        parse_option(o, "s", norm == PAL ? "480x576" : "480x480", options);
        parse_option(o, "r", frame_rates[norm], options);
        parse_option(o, "pix_fmt", "yuv420p", options);
-        av_dict_set(&o->g->codec_opts, "g", norm == PAL ? "15" : "18", AV_DICT_DONT_OVERWRITE);
+        opt_default(NULL, "g", norm == PAL ? "15" : "18");

-        av_dict_set(&o->g->codec_opts, "b:v", "2040000", AV_DICT_DONT_OVERWRITE);
-        av_dict_set(&o->g->codec_opts, "maxrate", "2516000", AV_DICT_DONT_OVERWRITE);
-        av_dict_set(&o->g->codec_opts, "minrate", "0", AV_DICT_DONT_OVERWRITE); // 1145000;
-        av_dict_set(&o->g->codec_opts, "bufsize", "1835008", AV_DICT_DONT_OVERWRITE); // 224*1024*8;
-        av_dict_set(&o->g->codec_opts, "scan_offset", "1", AV_DICT_DONT_OVERWRITE);
+        opt_default(NULL, "b:v", "2040000");
+        opt_default(NULL, "maxrate", "2516000");
+        opt_default(NULL, "minrate", "0"); // 1145000;
+        opt_default(NULL, "bufsize", "1835008"); // 224*1024*8;
+        opt_default(NULL, "scan_offset", "1");

-        av_dict_set(&o->g->codec_opts, "b:a", "224000", AV_DICT_DONT_OVERWRITE);
+        opt_default(NULL, "b:a", "224000");
        parse_option(o, "ar", "44100", options);

-        av_dict_set(&o->g->format_opts, "packetsize", "2324", AV_DICT_DONT_OVERWRITE);
+        opt_default(NULL, "packetsize", "2324");

    } else if (!strcmp(arg, "dvd")) {

@@ -2203,17 +2204,17 @@ static int opt_target(void *optctx, const char *opt, const char *arg)
        parse_option(o, "s", norm == PAL ? "720x576" : "720x480", options);
        parse_option(o, "r", frame_rates[norm], options);
        parse_option(o, "pix_fmt", "yuv420p", options);
-        av_dict_set(&o->g->codec_opts, "g", norm == PAL ? "15" : "18", AV_DICT_DONT_OVERWRITE);
+        opt_default(NULL, "g", norm == PAL ? "15" : "18");

-        av_dict_set(&o->g->codec_opts, "b:v", "6000000", AV_DICT_DONT_OVERWRITE);
-        av_dict_set(&o->g->codec_opts, "maxrate", "9000000", AV_DICT_DONT_OVERWRITE);
-        av_dict_set(&o->g->codec_opts, "minrate", "0", AV_DICT_DONT_OVERWRITE); // 1500000;
-        av_dict_set(&o->g->codec_opts, "bufsize", "1835008", AV_DICT_DONT_OVERWRITE); // 224*1024*8;
+        opt_default(NULL, "b:v", "6000000");
+        opt_default(NULL, "maxrate", "9000000");
+        opt_default(NULL, "minrate", "0"); // 1500000;
+        opt_default(NULL, "bufsize", "1835008"); // 224*1024*8;

-        av_dict_set(&o->g->format_opts, "packetsize", "2048", AV_DICT_DONT_OVERWRITE);  // from www.mpucoder.com: DVD sectors contain 2048 bytes of data, this is also the size of one pack.
-        av_dict_set(&o->g->format_opts, "muxrate", "10080000", AV_DICT_DONT_OVERWRITE); // from mplex project: data_rate = 1260000. mux_rate = data_rate * 8
+        opt_default(NULL, "packetsize", "2048");  // from www.mpucoder.com: DVD sectors contain 2048 bytes of data, this is also the size of one pack.
+        opt_default(NULL, "muxrate", "10080000"); // from mplex project: data_rate = 1260000. mux_rate = data_rate * 8

-        av_dict_set(&o->g->codec_opts, "b:a", "448000", AV_DICT_DONT_OVERWRITE);
+        opt_default(NULL, "b:a", "448000");
        parse_option(o, "ar", "48000", options);

    } else if (!strncmp(arg, "dv", 2)) {
@@ -2232,6 +2233,10 @@ static int opt_target(void *optctx, const char *opt, const char *arg)
        av_log(NULL, AV_LOG_ERROR, "Unknown target: %s\n", arg);
        return AVERROR(EINVAL);
    }
+
+    av_dict_copy(&o->g->codec_opts,  codec_opts, AV_DICT_DONT_OVERWRITE);
+    av_dict_copy(&o->g->format_opts, format_opts, AV_DICT_DONT_OVERWRITE);
+
    return 0;
 }

@@ -191,6 +191,7 @@ static const char unit_hertz_str[]          = "Hz"   ;
 static const char unit_byte_str[]           = "byte" ;
 static const char unit_bit_per_second_str[] = "bit/s";

+static int nb_streams;
 static uint64_t *nb_streams_packets;
 static uint64_t *nb_streams_frames;
 static int *selected_streams;
@@ -246,6 +247,7 @@ static char *value_string(char *buf, int buf_size, struct unit_value uv)
                vald /= pow(10, index * 3);
                prefix_string = decimal_unit_prefixes[index];
            }
+            vali = vald;
        }

        if (show_float || (use_value_prefix && vald != (long long int)vald))
@@ -336,7 +338,7 @@ static const AVOption writer_options[] = {
    { "replace", NULL, 0, AV_OPT_TYPE_CONST, {.i64 = WRITER_STRING_VALIDATION_REPLACE}, .unit = "sv" },
    { "fail",    NULL, 0, AV_OPT_TYPE_CONST, {.i64 = WRITER_STRING_VALIDATION_FAIL},    .unit = "sv" },
    { "string_validation_replacement", "set string validation replacement string", OFFSET(string_validation_replacement), AV_OPT_TYPE_STRING, {.str=""}},
-    { "svr", "set string validation replacement string", OFFSET(string_validation_replacement), AV_OPT_TYPE_STRING, {.str=""}},
+    { "svr", "set string validation replacement string", OFFSET(string_validation_replacement), AV_OPT_TYPE_STRING, {.str="\xEF\xBF\xBD"}},
    { NULL }
 };

@@ -1631,6 +1633,14 @@ static void writer_register_all(void)
 #define print_section_header(s) writer_print_section_header(w, s)
 #define print_section_footer(s) writer_print_section_footer(w, s)

+#define REALLOCZ_ARRAY_STREAM(ptr, cur_n, new_n)                        \
+{                                                                       \
+    ret = av_reallocp_array(&(ptr), (new_n), sizeof(*(ptr)));           \
+    if (ret < 0)                                                        \
+        goto end;                                                       \
+    memset( (ptr) + (cur_n), 0, ((new_n) - (cur_n)) * sizeof(*(ptr)) ); \
+}
+
 static inline int show_tags(WriterContext *w, AVDictionary *tags, int section_id)
 {
    AVDictionaryEntry *tag = NULL;
@@ -1892,6 +1902,12 @@ static int read_interval_packets(WriterContext *w, AVFormatContext *fmt_ctx,
        goto end;
    }
    while (!av_read_frame(fmt_ctx, &pkt)) {
+        if (fmt_ctx->nb_streams > nb_streams) {
+            REALLOCZ_ARRAY_STREAM(nb_streams_frames,  nb_streams, fmt_ctx->nb_streams);
+            REALLOCZ_ARRAY_STREAM(nb_streams_packets, nb_streams, fmt_ctx->nb_streams);
+            REALLOCZ_ARRAY_STREAM(selected_streams,   nb_streams, fmt_ctx->nb_streams);
+            nb_streams = fmt_ctx->nb_streams;
+        }
        if (selected_streams[pkt.stream_index]) {
            AVRational tb = fmt_ctx->streams[pkt.stream_index]->time_base;

@@ -2366,9 +2382,10 @@ static int probe_file(WriterContext *wctx, const char *filename)

 #define CHECK_END if (ret < 0) goto end

-    nb_streams_frames  = av_calloc(fmt_ctx->nb_streams, sizeof(*nb_streams_frames));
-    nb_streams_packets = av_calloc(fmt_ctx->nb_streams, sizeof(*nb_streams_packets));
-    selected_streams   = av_calloc(fmt_ctx->nb_streams, sizeof(*selected_streams));
+    nb_streams = fmt_ctx->nb_streams;
+    REALLOCZ_ARRAY_STREAM(nb_streams_frames,0,fmt_ctx->nb_streams);
+    REALLOCZ_ARRAY_STREAM(nb_streams_packets,0,fmt_ctx->nb_streams);
+    REALLOCZ_ARRAY_STREAM(selected_streams,0,fmt_ctx->nb_streams);

    for (i = 0; i < fmt_ctx->nb_streams; i++) {
        if (stream_specifier) {
@@ -2989,6 +2989,8 @@ static int prepare_sdp_description(FFStream *stream, uint8_t **pbuffer,
    AVDictionaryEntry *entry = av_dict_get(stream->metadata, "title", NULL, 0);
    int i;

+    *pbuffer = NULL;
+
    avc =  avformat_alloc_context();
    if (avc == NULL || !rtp_format) {
        return -1;
@@ -3025,7 +3027,7 @@ static int prepare_sdp_description(FFStream *stream, uint8_t **pbuffer,
    av_free(avc);
    av_free(avs);

-    return strlen(*pbuffer);
+    return *pbuffer ? strlen(*pbuffer) : AVERROR(ENOMEM);
 }

 static void rtsp_cmd_options(HTTPContext *c, const char *url)
@@ -81,7 +81,7 @@ enum BandType {
    INTENSITY_BT   = 15,    ///< Scalefactor data are intensity stereo positions.
 };

-#define IS_CODEBOOK_UNSIGNED(x) ((x - 1) & 10)
+#define IS_CODEBOOK_UNSIGNED(x) (((x) - 1) & 10)

 enum ChannelPosition {
    AAC_CHANNEL_OFF   = 0,
@@ -34,7 +34,7 @@ static int aac_sync(uint64_t state, AACAC3ParseContext *hdr_info,
    int size;
    union {
        uint64_t u64;
-        uint8_t  u8[8];
+        uint8_t  u8[8 + FF_INPUT_BUFFER_PADDING_SIZE];
    } tmp;

    tmp.u64 = av_be2ne64(state);
@@ -166,7 +166,7 @@ static int ac3_sync(uint64_t state, AACAC3ParseContext *hdr_info,
    int err;
    union {
        uint64_t u64;
-        uint8_t  u8[8];
+        uint8_t  u8[8 + FF_INPUT_BUFFER_PADDING_SIZE];
    } tmp = { av_be2ne64(state) };
    AC3HeaderInfo hdr, *phdr = &hdr;
    GetBitContext gbc;
@@ -549,10 +549,11 @@ static int adpcm_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
            put_bits(&pb, 7,  status->step_index);
            if (avctx->trellis > 0) {
                uint8_t buf[64];
-                adpcm_compress_trellis(avctx, &samples_p[ch][1], buf, status,
+                adpcm_compress_trellis(avctx, &samples_p[ch][0], buf, status,
                                       64, 1);
                for (i = 0; i < 64; i++)
                    put_bits(&pb, 4, buf[i ^ 1]);
+                status->prev_sample = status->predictor;
            } else {
                for (i = 0; i < 64; i += 2) {
                    int t1, t2;
@@ -150,6 +150,7 @@ typedef struct AICContext {
    int16_t        *data_ptr[NUM_BANDS];

    DECLARE_ALIGNED(16, int16_t, block)[64];
+    DECLARE_ALIGNED(16, uint8_t, quant_matrix)[64];
 } AICContext;

 static int aic_decode_header(AICContext *ctx, const uint8_t *src, int size)
@@ -285,7 +286,7 @@ static void recombine_block_il(int16_t *dst, const uint8_t *scan,
    }
 }

-static void unquant_block(int16_t *block, int q)
+static void unquant_block(int16_t *block, int q, uint8_t *quant_matrix)
 {
    int i;

@@ -293,7 +294,7 @@ static void unquant_block(int16_t *block, int q)
        int val  = (uint16_t)block[i];
        int sign = val & 1;

-        block[i] = (((val >> 1) ^ -sign) * q * aic_quant_matrix[i] >> 4)
+        block[i] = (((val >> 1) ^ -sign) * q * quant_matrix[i] >> 4)
                   + sign;
    }
 }
@@ -334,7 +335,7 @@ static int aic_decode_slice(AICContext *ctx, int mb_x, int mb_y,
            else
                recombine_block_il(ctx->block, ctx->scantable.permutated,
                                   &base_y, &ext_y, blk);
-            unquant_block(ctx->block, ctx->quant);
+            unquant_block(ctx->block, ctx->quant, ctx->quant_matrix);
            ctx->dsp.idct(ctx->block);

            if (!ctx->interlaced) {
@@ -352,7 +353,7 @@ static int aic_decode_slice(AICContext *ctx, int mb_x, int mb_y,
        for (blk = 0; blk < 2; blk++) {
            recombine_block(ctx->block, ctx->scantable.permutated,
                            &base_c, &ext_c);
-            unquant_block(ctx->block, ctx->quant);
+            unquant_block(ctx->block, ctx->quant, ctx->quant_matrix);
            ctx->dsp.idct(ctx->block);
            ctx->dsp.put_signed_pixels_clamped(ctx->block, C[blk],
                                               ctx->frame->linesize[blk + 1]);
@@ -430,6 +431,8 @@ static av_cold int aic_decode_init(AVCodecContext *avctx)
    for (i = 0; i < 64; i++)
        scan[i] = i;
    ff_init_scantable(ctx->dsp.idct_permutation, &ctx->scantable, scan);
+    for (i = 0; i < 64; i++)
+        ctx->quant_matrix[ctx->dsp.idct_permutation[i]] = aic_quant_matrix[i];

    ctx->mb_width  = FFALIGN(avctx->width,  16) >> 4;
    ctx->mb_height = FFALIGN(avctx->height, 16) >> 4;
@@ -280,7 +280,7 @@ static av_cold int read_specific_config(ALSDecContext *ctx)
    GetBitContext gb;
    uint64_t ht_size;
    int i, config_offset;
-    MPEG4AudioConfig m4ac;
+    MPEG4AudioConfig m4ac = {0};
    ALSSpecificConfig *sconf = &ctx->sconf;
    AVCodecContext *avctx    = ctx->avctx;
    uint32_t als_id, header_size, trailer_size;
@@ -108,8 +108,12 @@ av_cold void ff_h264dsp_init_arm(H264DSPContext *c, const int bit_depth,
 {
    int cpu_flags = av_get_cpu_flags();

-    if (have_armv6(cpu_flags))
+    if (have_armv6(cpu_flags) && !(have_vfpv3(cpu_flags) || have_neon(cpu_flags))) {
+        // This function uses the 'setend' instruction which is deprecated
+        // on ARMv8. This instruction is serializing on some ARMv7 cores as
+        // well. Therefore, only use the function on ARMv6.
        c->h264_find_start_code_candidate = ff_h264_find_start_code_candidate_armv6;
+    }
    if (have_neon(cpu_flags))
        h264dsp_init_neon(c, bit_depth, chroma_format_idc);
 }
@@ -507,7 +507,6 @@ int av_packet_copy_props(AVPacket *dst, const AVPacket *src)
    dst->convergence_duration = src->convergence_duration;
    dst->flags                = src->flags;
    dst->stream_index         = src->stream_index;
-    dst->side_data_elems      = src->side_data_elems;

    for (i = 0; i < src->side_data_elems; i++) {
         enum AVPacketSideDataType type = src->side_data[i].type;
@@ -214,6 +214,7 @@ typedef struct AVSContext {
    int luma_scan[4];
    int qp;
    int qp_fixed;
+    int pic_qp_fixed;
    int cbp;
    ScanTable scantable;

@@ -904,7 +904,7 @@ static inline int decode_slice_header(AVSContext *h, GetBitContext *gb)

    /* mark top macroblocks as unavailable */
    h->flags &= ~(B_AVAIL | C_AVAIL);
-    if ((h->mby == 0) && (!h->qp_fixed)) {
+    if (!h->pic_qp_fixed) {
        h->qp_fixed = get_bits1(gb);
        h->qp       = get_bits(gb, 6);
    }
@@ -1027,6 +1027,7 @@ static int decode_pic(AVSContext *h)
        skip_bits1(&h->gb);     //advanced_pred_mode_disable
    skip_bits1(&h->gb);        //top_field_first
    skip_bits1(&h->gb);        //repeat_first_field
+    h->pic_qp_fixed =
    h->qp_fixed = get_bits1(&h->gb);
    h->qp       = get_bits(&h->gb, 6);
    if (h->cur.f->pict_type == AV_PICTURE_TYPE_I) {
@@ -261,7 +261,7 @@ static void cdg_scroll(CDGraphicsContext *cc, uint8_t *data,
 static int cdg_decode_frame(AVCodecContext *avctx,
                            void *data, int *got_frame, AVPacket *avpkt)
 {
-    const uint8_t *buf = avpkt->data;
+    GetByteContext gb;
    int buf_size       = avpkt->size;
    int ret;
    uint8_t command, inst;
@@ -278,6 +278,8 @@ static int cdg_decode_frame(AVCodecContext *avctx,
        return AVERROR(EINVAL);
    }

+    bytestream2_init(&gb, avpkt->data, avpkt->size);
+
    if ((ret = ff_reget_buffer(avctx, cc->frame)) < 0)
        return ret;
    if (!avctx->frame_number) {
@@ -285,13 +287,11 @@ static int cdg_decode_frame(AVCodecContext *avctx,
        memset(cc->frame->data[1], 0, AVPALETTE_SIZE);
    }

-    command = bytestream_get_byte(&buf);
-    inst    = bytestream_get_byte(&buf);
+    command = bytestream2_get_byte(&gb);
+    inst    = bytestream2_get_byte(&gb);
    inst    &= CDG_MASK;
-    buf += 2;  /// skipping 2 unneeded bytes
-
-    if (buf_size > CDG_HEADER_SIZE)
-        bytestream_get_buffer(&buf, cdg_data, buf_size - CDG_HEADER_SIZE);
+    bytestream2_skip(&gb, 2);
+    bytestream2_get_buffer(&gb, cdg_data, sizeof(cdg_data));

    if ((command & CDG_MASK) == CDG_COMMAND) {
        switch (inst) {
@@ -353,10 +353,9 @@ static int cdg_decode_frame(AVCodecContext *avctx,
        *got_frame = 1;
    } else {
        *got_frame = 0;
-        buf_size   = 0;
    }

-    return buf_size;
+    return avpkt->size;
 }

 static av_cold int cdg_decode_end(AVCodecContext *avctx)
@@ -1370,7 +1370,7 @@ static int dca_subsubframe(DCAContext *s, int base_channel, int block_index)
         * Decode VQ encoded high frequencies
         */
        if (s->subband_activity[k] > s->vq_start_subband[k]) {
-            if (!s->debug_flag & 0x01) {
+            if (!(s->debug_flag & 0x01)) {
                av_log(s->avctx, AV_LOG_DEBUG,
                       "Stream with high frequencies VQ coding\n");
                s->debug_flag |= 0x01;
@@ -2173,7 +2173,7 @@ static int dca_decode_frame(AVCodecContext *avctx, void *data,
            if (s->core_downmix && (s->core_downmix_amode == DCA_STEREO ||
                                    s->core_downmix_amode == DCA_STEREO_TOTAL)) {
                int sign, code;
-                for (i = 0; i < s->prim_channels + !!s->lfe; i++) {
+                for (i = 0; i < num_core_channels + !!s->lfe; i++) {
                    sign = s->core_downmix_codes[i][0] & 0x100 ? 1 : -1;
                    code = s->core_downmix_codes[i][0] & 0x0FF;
                    s->downmix_coef[i][0] = (!code ? 0.0f :
@@ -2191,19 +2191,19 @@ static int dca_decode_frame(AVCodecContext *avctx, void *data,
                           "Invalid channel mode %d\n", am);
                    return AVERROR_INVALIDDATA;
                }
-                if (s->prim_channels + !!s->lfe >
+                if (num_core_channels + !!s->lfe >
                    FF_ARRAY_ELEMS(dca_default_coeffs[0])) {
                    avpriv_request_sample(s->avctx, "Downmixing %d channels",
                                          s->prim_channels + !!s->lfe);
                    return AVERROR_PATCHWELCOME;
                }
-                for (i = 0; i < s->prim_channels + !!s->lfe; i++) {
+                for (i = 0; i < num_core_channels + !!s->lfe; i++) {
                    s->downmix_coef[i][0] = dca_default_coeffs[am][i][0];
                    s->downmix_coef[i][1] = dca_default_coeffs[am][i][1];
                }
            }
            av_dlog(s->avctx, "Stereo downmix coeffs:\n");
-            for (i = 0; i < s->prim_channels + !!s->lfe; i++) {
+            for (i = 0; i < num_core_channels + !!s->lfe; i++) {
                av_dlog(s->avctx, "L, input channel %d = %f\n", i,
                        s->downmix_coef[i][0]);
                av_dlog(s->avctx, "R, input channel %d = %f\n", i,
@@ -2329,6 +2329,17 @@ static int dca_decode_frame(AVCodecContext *avctx, void *data,
    { /* xxx should also do MA extensions */
        if (s->amode < 16) {
            avctx->channel_layout = dca_core_channel_layout[s->amode];
+
+            if (s->prim_channels + !!s->lfe > 2 &&
+                avctx->request_channel_layout == AV_CH_LAYOUT_STEREO) {
+                /*
+                 * Neither the core's auxiliary data nor our default tables contain
+                 * downmix coefficients for the additional channel coded in the XCh
+                 * extension, so when we're doing a Stereo downmix, don't decode it.
+                 */
+                s->xch_disable = 1;
+            }
+
 #if FF_API_REQUEST_CHANNELS
 FF_DISABLE_DEPRECATION_WARNINGS
            if (s->xch_present && !s->xch_disable &&
@@ -2366,7 +2377,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
                return AVERROR_INVALIDDATA;
            }

-            if (s->prim_channels + !!s->lfe > 2 &&
+            if (num_core_channels + !!s->lfe > 2 &&
                avctx->request_channel_layout == AV_CH_LAYOUT_STEREO) {
                channels = 2;
                s->output = s->prim_channels == 2 ? s->amode : DCA_STEREO;
@@ -2415,7 +2426,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
         * masks in some sense -- unfortunately some channels could overlap */
        if (av_popcount(channel_mask) != av_popcount(channel_layout)) {
            av_log(avctx, AV_LOG_DEBUG,
-                   "DTS-XXCH: Inconsistant avcodec/dts channel layouts\n");
+                   "DTS-XXCH: Inconsistent avcodec/dts channel layouts\n");
            return AVERROR_INVALIDDATA;
        }

@@ -2433,6 +2444,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
                        s->xxch_order_tab[j++] = posn;
                    }
                }
+
            }

            s->lfe_index = av_popcount(channel_layout & (AV_CH_LOW_FREQUENCY-1));
@@ -28,6 +28,7 @@
 #ifndef AVCODEC_DIRAC_ARITH_H
 #define AVCODEC_DIRAC_ARITH_H

+#include "libavutil/x86/asm.h"
 #include "bytestream.h"
 #include "get_bits.h"

@@ -134,7 +135,7 @@ static inline int dirac_get_arith_bit(DiracArith *c, int ctx)

    range_times_prob = (c->range * prob_zero) >> 16;

-#if HAVE_FAST_CMOV && HAVE_INLINE_ASM
+#if HAVE_FAST_CMOV && HAVE_INLINE_ASM && HAVE_6REGS
    low   -= range_times_prob << 16;
    range -= range_times_prob;
    bit = 0;
@@ -201,6 +201,7 @@ typedef struct DiracContext {

    uint16_t *mctmp;            /* buffer holding the MC data multipled by OBMC weights */
    uint8_t *mcscratch;
+    int buffer_stride;

    DECLARE_ALIGNED(16, uint8_t, obmc_weight)[3][MAX_BLOCKSIZE*MAX_BLOCKSIZE];

@@ -343,22 +344,44 @@ static int alloc_sequence_buffers(DiracContext *s)
            return AVERROR(ENOMEM);
    }

-    w = s->source.width;
-    h = s->source.height;
-
    /* fixme: allocate using real stride here */
-    s->sbsplit  = av_malloc(sbwidth * sbheight);
-    s->blmotion = av_malloc(sbwidth * sbheight * 16 * sizeof(*s->blmotion));
-    s->edge_emu_buffer_base = av_malloc((w+64)*MAX_BLOCKSIZE);
+    s->sbsplit  = av_malloc_array(sbwidth, sbheight);
+    s->blmotion = av_malloc_array(sbwidth, sbheight * 16 * sizeof(*s->blmotion));

-    s->mctmp     = av_malloc((w+64+MAX_BLOCKSIZE) * (h+MAX_BLOCKSIZE) * sizeof(*s->mctmp));
-    s->mcscratch = av_malloc((w+64)*MAX_BLOCKSIZE);
-
-    if (!s->sbsplit || !s->blmotion || !s->mctmp || !s->mcscratch)
+    if (!s->sbsplit || !s->blmotion)
        return AVERROR(ENOMEM);
    return 0;
 }

+static int alloc_buffers(DiracContext *s, int stride)
+{
+    int w = s->source.width;
+    int h = s->source.height;
+
+    av_assert0(stride >= w);
+    stride += 64;
+
+    if (s->buffer_stride >= stride)
+        return 0;
+    s->buffer_stride = 0;
+
+    av_freep(&s->edge_emu_buffer_base);
+    memset(s->edge_emu_buffer, 0, sizeof(s->edge_emu_buffer));
+    av_freep(&s->mctmp);
+    av_freep(&s->mcscratch);
+
+    s->edge_emu_buffer_base = av_malloc_array(stride, MAX_BLOCKSIZE);
+
+    s->mctmp     = av_malloc_array((stride+MAX_BLOCKSIZE), (h+MAX_BLOCKSIZE) * sizeof(*s->mctmp));
+    s->mcscratch = av_malloc_array(stride, MAX_BLOCKSIZE);
+
+    if (!s->edge_emu_buffer_base || !s->mctmp || !s->mcscratch)
+        return AVERROR(ENOMEM);
+
+    s->buffer_stride = stride;
+    return 0;
+}
+
 static void free_sequence_buffers(DiracContext *s)
 {
    int i, j, k;
@@ -382,6 +405,7 @@ static void free_sequence_buffers(DiracContext *s)
        av_freep(&s->plane[i].idwt_tmp);
    }

+    s->buffer_stride = 0;
    av_freep(&s->sbsplit);
    av_freep(&s->blmotion);
    av_freep(&s->edge_emu_buffer_base);
@@ -1355,8 +1379,8 @@ static int mc_subpel(DiracContext *s, DiracBlock *block, const uint8_t *src[5],
        motion_y >>= s->chroma_y_shift;
    }

-    mx         = motion_x & ~(-1 << s->mv_precision);
-    my         = motion_y & ~(-1 << s->mv_precision);
+    mx         = motion_x & ~(-1U << s->mv_precision);
+    my         = motion_y & ~(-1U << s->mv_precision);
    motion_x >>= s->mv_precision;
    motion_y >>= s->mv_precision;
    /* normalize subpel coordinates to epel */
@@ -1854,6 +1878,9 @@ static int dirac_decode_data_unit(AVCodecContext *avctx, const uint8_t *buf, int
        s->plane[1].stride = pic->avframe->linesize[1];
        s->plane[2].stride = pic->avframe->linesize[2];

+        if (alloc_buffers(s, FFMAX3(FFABS(s->plane[0].stride), FFABS(s->plane[1].stride), FFABS(s->plane[2].stride))) < 0)
+            return AVERROR(ENOMEM);
+
        /* [DIRAC_STD] 11.1 Picture parse. picture_parse() */
        if (dirac_decode_picture_header(s))
            return -1;
@@ -45,8 +45,11 @@ static int dvdsub_parse(AVCodecParserContext *s,
    DVDSubParseContext *pc = s->priv_data;

    if (pc->packet_index == 0) {
-        if (buf_size < 2)
-            return 0;
+        if (buf_size < 2 || AV_RB16(buf) && buf_size < 6) {
+            if (buf_size)
+                av_log(avctx, AV_LOG_DEBUG, "Parser input %d too small\n", buf_size);
+            return buf_size;
+        }
        pc->packet_len = AV_RB16(buf);
        if (pc->packet_len == 0) /* HD-DVD subpicture packet */
            pc->packet_len = AV_RB32(buf+2);
@@ -29,6 +29,7 @@
 */

 #include "avcodec.h"
+#include "bytestream.h"
 #include "get_bits.h"
 #include "aandcttab.h"
 #include "eaidct.h"
@@ -237,30 +238,32 @@ static int decode_frame(AVCodecContext *avctx,
 {
    const uint8_t *buf = avpkt->data;
    int buf_size       = avpkt->size;
-    const uint8_t *buf_end = buf+buf_size;
    MadContext *s     = avctx->priv_data;
    AVFrame *frame    = data;
+    GetByteContext gb;
    int width, height;
    int chunk_type;
    int inter, ret;

-    if (buf_size < 26) {
-        av_log(avctx, AV_LOG_ERROR, "Input buffer too small\n");
-        *got_frame = 0;
-        return AVERROR_INVALIDDATA;
-    }
+    bytestream2_init(&gb, buf, buf_size);

-    chunk_type = AV_RL32(&buf[0]);
+    chunk_type = bytestream2_get_le32(&gb);
    inter = (chunk_type == MADm_TAG || chunk_type == MADe_TAG);
-    buf += 8;
+    bytestream2_skip(&gb, 10);

    av_reduce(&avctx->time_base.num, &avctx->time_base.den,
-              AV_RL16(&buf[6]), 1000, 1<<30);
+              bytestream2_get_le16(&gb), 1000, 1<<30);

-    width  = AV_RL16(&buf[8]);
-    height = AV_RL16(&buf[10]);
-    calc_quant_matrix(s, buf[13]);
-    buf += 16;
+    width  = bytestream2_get_le16(&gb);
+    height = bytestream2_get_le16(&gb);
+    bytestream2_skip(&gb, 1);
+    calc_quant_matrix(s, bytestream2_get_byte(&gb));
+    bytestream2_skip(&gb, 2);
+
+    if (bytestream2_get_bytes_left(&gb) < 2) {
+        av_log(avctx, AV_LOG_ERROR, "Input data too small\n");
+        return AVERROR_INVALIDDATA;
+    }

    if (width < 16 || height < 16) {
        av_log(avctx, AV_LOG_ERROR, "Dimensions too small\n");
@@ -269,7 +272,7 @@ static int decode_frame(AVCodecContext *avctx,

    if (avctx->width != width || avctx->height != height) {
        av_frame_unref(s->last_frame);
-        if((width * height)/2048*7 > buf_end-buf)
+        if((width * height)/2048*7 > bytestream2_get_bytes_left(&gb))
            return AVERROR_INVALIDDATA;
        if ((ret = ff_set_dimensions(avctx, width, height)) < 0)
            return ret;
@@ -292,12 +295,13 @@ static int decode_frame(AVCodecContext *avctx,
    }

    av_fast_padded_malloc(&s->bitstream_buf, &s->bitstream_buf_size,
-                          buf_end - buf);
+                          bytestream2_get_bytes_left(&gb));
    if (!s->bitstream_buf)
        return AVERROR(ENOMEM);
-    s->dsp.bswap16_buf(s->bitstream_buf, (const uint16_t*)buf, (buf_end-buf)/2);
-    memset((uint8_t*)s->bitstream_buf + (buf_end-buf), 0, FF_INPUT_BUFFER_PADDING_SIZE);
-    init_get_bits(&s->gb, s->bitstream_buf, 8*(buf_end-buf));
+    s->dsp.bswap16_buf(s->bitstream_buf, (const uint16_t *)(buf + bytestream2_tell(&gb)),
+                         bytestream2_get_bytes_left(&gb) / 2);
+    memset((uint8_t*)s->bitstream_buf + bytestream2_get_bytes_left(&gb), 0, FF_INPUT_BUFFER_PADDING_SIZE);
+    init_get_bits(&s->gb, s->bitstream_buf, 8*(bytestream2_get_bytes_left(&gb)));

    for (s->mb_y=0; s->mb_y < (avctx->height+15)/16; s->mb_y++)
        for (s->mb_x=0; s->mb_x < (avctx->width +15)/16; s->mb_x++)
@@ -117,6 +117,7 @@ static void fft_ref(FFTComplex *tabr, FFTComplex *tab, int nbits)
    }
 }

+#if CONFIG_MDCT
 static void imdct_ref(FFTSample *out, FFTSample *in, int nbits)
 {
    int n = 1<<nbits;
@@ -151,8 +152,10 @@ static void mdct_ref(FFTSample *output, FFTSample *input, int nbits)
        output[k] = REF_SCALE(s, nbits - 1);
    }
 }
+#endif /* CONFIG_MDCT */

 #if FFT_FLOAT
+#if CONFIG_DCT
 static void idct_ref(FFTSample *output, FFTSample *input, int nbits)
 {
    int n = 1<<nbits;
@@ -185,6 +188,7 @@ static void dct_ref(FFTSample *output, FFTSample *input, int nbits)
        output[k] = s;
    }
 }
+#endif /* CONFIG_DCT */
 #endif


@@ -310,6 +314,7 @@ int main(int argc, char **argv)
    tab2 = av_malloc(fft_size * sizeof(FFTSample));

    switch (transform) {
+#if CONFIG_MDCT
    case TRANSFORM_MDCT:
        av_log(NULL, AV_LOG_INFO,"Scale factor is set to %f\n", scale);
        if (do_inverse)
@@ -318,6 +323,7 @@ int main(int argc, char **argv)
            av_log(NULL, AV_LOG_INFO,"MDCT");
        ff_mdct_init(m, fft_nbits, do_inverse, scale);
        break;
+#endif /* CONFIG_MDCT */
    case TRANSFORM_FFT:
        if (do_inverse)
            av_log(NULL, AV_LOG_INFO,"IFFT");
@@ -327,6 +333,7 @@ int main(int argc, char **argv)
        fft_ref_init(fft_nbits, do_inverse);
        break;
 #if FFT_FLOAT
+#    if CONFIG_RDFT
    case TRANSFORM_RDFT:
        if (do_inverse)
            av_log(NULL, AV_LOG_INFO,"IDFT_C2R");
@@ -335,6 +342,7 @@ int main(int argc, char **argv)
        ff_rdft_init(r, fft_nbits, do_inverse ? IDFT_C2R : DFT_R2C);
        fft_ref_init(fft_nbits, do_inverse);
        break;
+#    endif /* CONFIG_RDFT */
 #    if CONFIG_DCT
    case TRANSFORM_DCT:
        if (do_inverse)
@@ -343,7 +351,7 @@ int main(int argc, char **argv)
            av_log(NULL, AV_LOG_INFO,"DCT_II");
        ff_dct_init(d, fft_nbits, do_inverse ? DCT_III : DCT_II);
        break;
-#    endif
+#    endif /* CONFIG_DCT */
 #endif
    default:
        av_log(NULL, AV_LOG_ERROR, "Requested transform not supported\n");
@@ -362,6 +370,7 @@ int main(int argc, char **argv)
    av_log(NULL, AV_LOG_INFO,"Checking...\n");

    switch (transform) {
+#if CONFIG_MDCT
    case TRANSFORM_MDCT:
        if (do_inverse) {
            imdct_ref((FFTSample *)tab_ref, (FFTSample *)tab1, fft_nbits);
@@ -375,6 +384,7 @@ int main(int argc, char **argv)
            err = check_diff((FFTSample *)tab_ref, tab2, fft_size / 2, scale);
        }
        break;
+#endif /* CONFIG_MDCT */
    case TRANSFORM_FFT:
        memcpy(tab, tab1, fft_size * sizeof(FFTComplex));
        s->fft_permute(s, tab);
@@ -384,6 +394,7 @@ int main(int argc, char **argv)
        err = check_diff((FFTSample *)tab_ref, (FFTSample *)tab, fft_size * 2, 1.0);
        break;
 #if FFT_FLOAT
+#if CONFIG_RDFT
    case TRANSFORM_RDFT:
        fft_size_2 = fft_size >> 1;
        if (do_inverse) {
@@ -415,6 +426,8 @@ int main(int argc, char **argv)
            err = check_diff((float *)tab_ref, (float *)tab2, fft_size, 1.0);
        }
        break;
+#endif /* CONFIG_RDFT */
+#if CONFIG_DCT
    case TRANSFORM_DCT:
        memcpy(tab, tab1, fft_size * sizeof(FFTComplex));
        d->dct_calc(d, (FFTSample *)tab);
@@ -425,6 +438,7 @@ int main(int argc, char **argv)
        }
        err = check_diff((float *)tab_ref, (float *)tab, fft_size, 1.0);
        break;
+#endif /* CONFIG_DCT */
 #endif
    }

@@ -476,21 +490,25 @@ int main(int argc, char **argv)
    }

    switch (transform) {
+#if CONFIG_MDCT
    case TRANSFORM_MDCT:
        ff_mdct_end(m);
        break;
+#endif /* CONFIG_MDCT */
    case TRANSFORM_FFT:
        ff_fft_end(s);
        break;
 #if FFT_FLOAT
+#    if CONFIG_RDFT
    case TRANSFORM_RDFT:
        ff_rdft_end(r);
        break;
+#    endif /* CONFIG_RDFT */
 #    if CONFIG_DCT
    case TRANSFORM_DCT:
        ff_dct_end(d);
        break;
-#    endif
+#    endif /* CONFIG_DCT */
 #endif
    }

@@ -622,31 +622,31 @@ static int read_header(FFV1Context *f)
                f->state_transition[i] = get_symbol(c, state, 1) + c->one_state[i];
        }

-        colorspace     = get_symbol(c, state, 0); //YUV cs type
+        colorspace          = get_symbol(c, state, 0); //YUV cs type
        bits_per_raw_sample = f->version > 0 ? get_symbol(c, state, 0) : f->avctx->bits_per_raw_sample;
-        chroma_planes  = get_rac(c, state);
-        chroma_h_shift = get_symbol(c, state, 0);
-        chroma_v_shift = get_symbol(c, state, 0);
-        transparency   = get_rac(c, state);
+        chroma_planes       = get_rac(c, state);
+        chroma_h_shift      = get_symbol(c, state, 0);
+        chroma_v_shift      = get_symbol(c, state, 0);
+        transparency        = get_rac(c, state);

        if (f->plane_count) {
-            if (   colorspace    != f->colorspace
-                || bits_per_raw_sample != f->avctx->bits_per_raw_sample
-                || chroma_planes != f->chroma_planes
-                || chroma_h_shift!= f->chroma_h_shift
-                || chroma_v_shift!= f->chroma_v_shift
-                || transparency  != f->transparency) {
+            if (colorspace          != f->colorspace                 ||
+                bits_per_raw_sample != f->avctx->bits_per_raw_sample ||
+                chroma_planes       != f->chroma_planes              ||
+                chroma_h_shift      != f->chroma_h_shift             ||
+                chroma_v_shift      != f->chroma_v_shift             ||
+                transparency        != f->transparency) {
                av_log(f->avctx, AV_LOG_ERROR, "Invalid change of global parameters\n");
                return AVERROR_INVALIDDATA;
            }
        }

-        f->colorspace     = colorspace;
+        f->colorspace                 = colorspace;
        f->avctx->bits_per_raw_sample = bits_per_raw_sample;
-        f->chroma_planes  = chroma_planes;
-        f->chroma_h_shift = chroma_h_shift;
-        f->chroma_v_shift = chroma_v_shift;
-        f->transparency   = transparency;
+        f->chroma_planes              = chroma_planes;
+        f->chroma_h_shift             = chroma_h_shift;
+        f->chroma_v_shift             = chroma_v_shift;
+        f->transparency               = transparency;

        f->plane_count    = 2 + f->transparency;
    }
@@ -246,8 +246,8 @@ static int fic_decode_frame(AVCodecContext *avctx, void *data,
        ctx->slice_data[slice].y_off    = y_off;
    }

-    if (ret = avctx->execute(avctx, fic_decode_slice, ctx->slice_data,
-                             NULL, nslices, sizeof(ctx->slice_data[0])) < 0)
+    if ((ret = avctx->execute(avctx, fic_decode_slice, ctx->slice_data,
+                              NULL, nslices, sizeof(ctx->slice_data[0]))) < 0)
        return ret;

 skip:
@@ -87,6 +87,7 @@ typedef struct G2MContext {

    int        compression;
    int        width, height, bpp;
+    int        orig_width, orig_height;
    int        tile_width, tile_height;
    int        tiles_x, tiles_y, tile_x, tile_y;

@@ -700,8 +701,8 @@ static int g2m_decode_frame(AVCodecContext *avctx, void *data,
            }
            c->width  = bytestream2_get_be32(&bc);
            c->height = bytestream2_get_be32(&bc);
-            if (c->width  < 16 || c->width  > avctx->width ||
-                c->height < 16 || c->height > avctx->height) {
+            if (c->width  < 16 || c->width  > c->orig_width ||
+                c->height < 16 || c->height > c->orig_height) {
                av_log(avctx, AV_LOG_ERROR,
                       "Invalid frame dimensions %dx%d\n",
                       c->width, c->height);
@@ -867,6 +868,10 @@ static av_cold int g2m_decode_init(AVCodecContext *avctx)

    avctx->pix_fmt = AV_PIX_FMT_RGB24;

+    // store original sizes and check against those if resize happens
+    c->orig_width  = avctx->width;
+    c->orig_height = avctx->height;
+
    return 0;
 }

@@ -2285,7 +2285,8 @@ static int pack_bitstream(G723_1_Context *p, unsigned char *frame, int size)
    if (p->cur_rate == RATE_6300) {
        info_bits = 0;
        put_bits(&pb, 2, info_bits);
-    }
+    }else
+        av_assert0(0);

    put_bits(&pb, 8, p->lsp_index[2]);
    put_bits(&pb, 8, p->lsp_index[1]);
@@ -58,7 +58,7 @@ int main(void)
        }
    }

-#define EXTEND(i) (i << 3 | i & 7)
+#define EXTEND(i) ((i) << 3 | (i) & 7)
    init_put_bits(&pb, temp, SIZE);
    for (i = 0; i < COUNT; i++)
        set_ue_golomb(&pb, EXTEND(i));
@@ -219,9 +219,9 @@ static inline int get_se_golomb_long(GetBitContext *gb)
    unsigned int buf = get_ue_golomb_long(gb);

    if (buf & 1)
-        buf = -(buf >> 1);
+        buf = (buf + 1) >> 1;
    else
-        buf = (buf >> 1);
+        buf = -(buf >> 1);

    return buf;
 }
@@ -634,7 +634,7 @@ const uint8_t *ff_h264_decode_nal(H264Context *h, const uint8_t *src,

 #define STARTCODE_TEST                                                  \
    if (i + 2 < length && src[i + 1] == 0 && src[i + 2] <= 3) {         \
-        if (src[i + 2] != 3) {                                          \
+        if (src[i + 2] != 3 && src[i + 2] != 0) {                       \
            /* startcode, so we must be past the end */                 \
            length = i;                                                 \
        }                                                               \
@@ -707,7 +707,7 @@ const uint8_t *ff_h264_decode_nal(H264Context *h, const uint8_t *src,
        if (src[si + 2] > 3) {
            dst[di++] = src[si++];
            dst[di++] = src[si++];
-        } else if (src[si] == 0 && src[si + 1] == 0) {
+        } else if (src[si] == 0 && src[si + 1] == 0 && src[si + 2] != 0) {
            if (src[si + 2] == 3) { // escape
                dst[di++]  = 0;
                dst[di++]  = 0;
@@ -1813,6 +1813,7 @@ static int decode_update_thread_context(AVCodecContext *dst,
        memset(&h->mb, 0, sizeof(h->mb));
        memset(&h->mb_luma_dc, 0, sizeof(h->mb_luma_dc));
        memset(&h->mb_padding, 0, sizeof(h->mb_padding));
+        memset(&h->cur_pic, 0, sizeof(h->cur_pic));

        h->avctx             = dst;
        h->DPB               = NULL;
@@ -2141,10 +2142,10 @@ static void decode_postinit(H264Context *h, int setup_finished)
            stereo->type = AV_STEREO3D_CHECKERBOARD;
            break;
        case 1:
-            stereo->type = AV_STEREO3D_LINES;
+            stereo->type = AV_STEREO3D_COLUMNS;
            break;
        case 2:
-            stereo->type = AV_STEREO3D_COLUMNS;
+            stereo->type = AV_STEREO3D_LINES;
            break;
        case 3:
            if (h->quincunx_subsampling)
@@ -4949,6 +4950,7 @@ again:
                if(!idr_cleared)
                    idr(h); // FIXME ensure we don't lose some frames if there is reordering
                idr_cleared = 1;
+                h->has_recovery_point = 1;
            case NAL_SLICE:
                init_get_bits(&hx->gb, ptr, bit_length);
                hx->intra_gb_ptr      =
@@ -61,10 +61,10 @@
 #define MAX_SLICES 16

 #ifdef ALLOW_INTERLACE
-#define MB_MBAFF(h)    h->mb_mbaff
-#define MB_FIELD(h)    h->mb_field_decoding_flag
-#define FRAME_MBAFF(h) h->mb_aff_frame
-#define FIELD_PICTURE(h) (h->picture_structure != PICT_FRAME)
+#define MB_MBAFF(h)    (h)->mb_mbaff
+#define MB_FIELD(h)    (h)->mb_field_decoding_flag
+#define FRAME_MBAFF(h) (h)->mb_aff_frame
+#define FIELD_PICTURE(h) ((h)->picture_structure != PICT_FRAME)
 #define LEFT_MBS 2
 #define LTOP     0
 #define LBOT     1
@@ -84,12 +84,12 @@
 #define FIELD_OR_MBAFF_PICTURE(h) (FRAME_MBAFF(h) || FIELD_PICTURE(h))

 #ifndef CABAC
-#define CABAC(h) h->pps.cabac
+#define CABAC(h) (h)->pps.cabac
 #endif

-#define CHROMA(h)    (h->sps.chroma_format_idc)
-#define CHROMA422(h) (h->sps.chroma_format_idc == 2)
-#define CHROMA444(h) (h->sps.chroma_format_idc == 3)
+#define CHROMA(h)    ((h)->sps.chroma_format_idc)
+#define CHROMA422(h) ((h)->sps.chroma_format_idc == 2)
+#define CHROMA444(h) ((h)->sps.chroma_format_idc == 3)

 #define EXTENDED_SAR       255

@@ -677,6 +677,8 @@ typedef struct H264Context {

    int frame_recovered;    ///< Initial frame has been completely recovered

+    int has_recovery_point;
+
    int luma_weight_flag[2];    ///< 7.4.3.2 luma_weight_lX_flag
    int chroma_weight_flag[2];  ///< 7.4.3.2 chroma_weight_lX_flag

@@ -689,7 +691,7 @@ typedef struct H264Context {

    int16_t slice_row[MAX_SLICES]; ///< to detect when MAX_SLICES is too low

-    uint8_t parse_history[4];
+    uint8_t parse_history[6];
    int parse_history_count;
    int parse_last_mb;
    uint8_t *edge_emu_buffer;
@@ -28,6 +28,7 @@
 typedef struct H264BSFContext {
    uint8_t  length_size;
    uint8_t  first_idr;
+    uint8_t  idr_sps_pps_seen;
    int      extradata_parsed;
 } H264BSFContext;

@@ -155,6 +156,7 @@ static int h264_mp4toannexb_filter(AVBitStreamFilterContext *bsfc,
            return ret;
        ctx->length_size      = ret;
        ctx->first_idr        = 1;
+        ctx->idr_sps_pps_seen = 0;
        ctx->extradata_parsed = 1;
    }

@@ -174,8 +176,17 @@ static int h264_mp4toannexb_filter(AVBitStreamFilterContext *bsfc,
        if (buf + nal_size > buf_end || nal_size < 0)
            goto fail;

-        /* prepend only to the first type 5 NAL unit of an IDR picture */
-        if (ctx->first_idr && unit_type == 5) {
+        if (ctx->first_idr && (unit_type == 7 || unit_type == 8))
+            ctx->idr_sps_pps_seen = 1;
+
+        /* if this is a new IDR picture following an IDR picture, reset the idr flag.
+         * Just check first_mb_in_slice to be 0 as this is the simplest solution.
+         * This could be checking idr_pic_id instead, but would complexify the parsing. */
+        if (!ctx->first_idr && unit_type == 5 && (buf[1] & 0x80))
+            ctx->first_idr = 1;
+
+        /* prepend only to the first type 5 NAL unit of an IDR picture, if no sps/pps are already present */
+        if (ctx->first_idr && unit_type == 5 && !ctx->idr_sps_pps_seen) {
            if ((ret=alloc_and_copy(poutbuf, poutbuf_size,
                               avctx->extradata, avctx->extradata_size,
                               buf, nal_size)) < 0)
@@ -185,8 +196,10 @@ static int h264_mp4toannexb_filter(AVBitStreamFilterContext *bsfc,
            if ((ret=alloc_and_copy(poutbuf, poutbuf_size,
                               NULL, 0, buf, nal_size)) < 0)
                goto fail;
-            if (!ctx->first_idr && unit_type == 1)
+            if (!ctx->first_idr && unit_type == 1) {
                ctx->first_idr = 1;
+                ctx->idr_sps_pps_seen = 0;
+            }
        }

        buf        += nal_size;
@@ -91,7 +91,7 @@ static int h264_find_frame_end(H264Context *h, const uint8_t *buf,
            state = 7;
        } else {
            h->parse_history[h->parse_history_count++]= buf[i];
-            if (h->parse_history_count>3) {
+            if (h->parse_history_count>5) {
                unsigned int mb, last_mb= h->parse_last_mb;
                GetBitContext gb;

@@ -119,7 +119,7 @@ found:
    pc->frame_start_found = 0;
    if (h->is_avc)
        return next_avc;
-    return i - (state & 5) - 3 * (state > 7);
+    return i - (state & 5) - 5 * (state > 7);
 }

 static int scan_mmco_reset(AVCodecParserContext *s)
@@ -771,7 +771,7 @@ int ff_h264_execute_ref_pic_marking(H264Context *h, MMCO *mmco, int mmco_count)
    if (   err >= 0
        && h->long_ref_count==0
        && (h->short_ref_count<=2 || h->pps.ref_count[0] <= 1 && h->pps.ref_count[1] <= 1 && pps_count == 1)
-        && h->pps.ref_count[0]<=2 + (h->picture_structure != PICT_FRAME)
+        && h->pps.ref_count[0]<=2 + (h->picture_structure != PICT_FRAME) + (2*!h->has_recovery_point)
        && h->cur_pic_ptr->f.pict_type == AV_PICTURE_TYPE_I){
        h->cur_pic_ptr->recovered |= 1;
        if(!h->avctx->has_b_frames)
@@ -183,6 +183,8 @@ static int decode_recovery_point(H264Context *h)
    if (h->avctx->debug & FF_DEBUG_PICT_INFO)
        av_log(h->avctx, AV_LOG_DEBUG, "sei_recovery_frame_cnt: %d\n", h->sei_recovery_frame_cnt);

+    h->has_recovery_point = 1;
+
    return 0;
 }

@@ -102,26 +102,26 @@ static int pic_arrays_init(HEVCContext *s, const HEVCSPS *sps)
        goto fail;

    s->skip_flag    = av_malloc(pic_size_in_ctb);
-    s->tab_ct_depth = av_malloc(sps->min_cb_height * sps->min_cb_width);
+    s->tab_ct_depth = av_malloc_array(sps->min_cb_height, sps->min_cb_width);
    if (!s->skip_flag || !s->tab_ct_depth)
        goto fail;

-    s->cbf_luma = av_malloc(sps->min_tb_width * sps->min_tb_height);
+    s->cbf_luma = av_malloc_array(sps->min_tb_width, sps->min_tb_height);
    s->tab_ipm  = av_mallocz(min_pu_size);
    s->is_pcm   = av_malloc(min_pu_size);
    if (!s->tab_ipm || !s->cbf_luma || !s->is_pcm)
        goto fail;

    s->filter_slice_edges = av_malloc(ctb_count);
-    s->tab_slice_address  = av_malloc(pic_size_in_ctb *
+    s->tab_slice_address  = av_malloc_array(pic_size_in_ctb,
                                      sizeof(*s->tab_slice_address));
-    s->qp_y_tab           = av_malloc(pic_size_in_ctb *
+    s->qp_y_tab           = av_malloc_array(pic_size_in_ctb,
                                      sizeof(*s->qp_y_tab));
    if (!s->qp_y_tab || !s->filter_slice_edges || !s->tab_slice_address)
        goto fail;

-    s->horizontal_bs = av_mallocz(2 * s->bs_width * (s->bs_height + 1));
-    s->vertical_bs   = av_mallocz(2 * s->bs_width * (s->bs_height + 1));
+    s->horizontal_bs = av_mallocz_array(2 * s->bs_width, (s->bs_height + 1));
+    s->vertical_bs   = av_mallocz_array(2 * s->bs_width, (s->bs_height + 1));
    if (!s->horizontal_bs || !s->vertical_bs)
        goto fail;

@@ -652,9 +652,9 @@ static int hls_slice_header(HEVCContext *s)
            av_freep(&sh->entry_point_offset);
            av_freep(&sh->offset);
            av_freep(&sh->size);
-            sh->entry_point_offset = av_malloc(sh->num_entry_point_offsets * sizeof(int));
-            sh->offset = av_malloc(sh->num_entry_point_offsets * sizeof(int));
-            sh->size = av_malloc(sh->num_entry_point_offsets * sizeof(int));
+            sh->entry_point_offset = av_malloc_array(sh->num_entry_point_offsets, sizeof(int));
+            sh->offset = av_malloc_array(sh->num_entry_point_offsets, sizeof(int));
+            sh->size = av_malloc_array(sh->num_entry_point_offsets, sizeof(int));
            if (!sh->entry_point_offset || !sh->offset || !sh->size) {
                sh->num_entry_point_offsets = 0;
                av_log(s->avctx, AV_LOG_ERROR, "Failed to allocate memory\n");
@@ -2059,8 +2059,8 @@ static int hls_decode_entry_wpp(AVCodecContext *avctxt, void *input_ctb_row, int
 static int hls_slice_data_wpp(HEVCContext *s, const uint8_t *nal, int length)
 {
    HEVCLocalContext *lc = s->HEVClc;
-    int *ret = av_malloc((s->sh.num_entry_point_offsets + 1) * sizeof(int));
-    int *arg = av_malloc((s->sh.num_entry_point_offsets + 1) * sizeof(int));
+    int *ret = av_malloc_array(s->sh.num_entry_point_offsets + 1, sizeof(int));
+    int *arg = av_malloc_array(s->sh.num_entry_point_offsets + 1, sizeof(int));
    int offset;
    int startheader, cmpt = 0;
    int i, j, res = 0;
@@ -2818,6 +2818,8 @@ static av_cold int hevc_decode_free(AVCodecContext *avctx)
    for (i = 0; i < FF_ARRAY_ELEMS(s->pps_list); i++)
        av_buffer_unref(&s->pps_list[i]);

+    av_buffer_unref(&s->current_sps);
+
    av_freep(&s->sh.entry_point_offset);
    av_freep(&s->sh.offset);
    av_freep(&s->sh.size);
@@ -2939,6 +2941,13 @@ static int hevc_update_thread_context(AVCodecContext *dst,
        }
    }

+    av_buffer_unref(&s->current_sps);
+    if (s0->current_sps) {
+        s->current_sps = av_buffer_ref(s0->current_sps);
+        if (!s->current_sps)
+            return AVERROR(ENOMEM);
+    }
+
    if (s->sps != s0->sps)
        ret = set_sps(s, s0->sps);

@@ -81,10 +81,10 @@
 #define SAMPLE_CTB(tab, x, y) ((tab)[(y) * min_cb_width + (x)])
 #define SAMPLE_CBF(tab, x, y) ((tab)[((y) & ((1<<log2_trafo_size)-1)) * MAX_CU_SIZE + ((x) & ((1<<log2_trafo_size)-1))])

-#define IS_IDR(s) (s->nal_unit_type == NAL_IDR_W_RADL || s->nal_unit_type == NAL_IDR_N_LP)
-#define IS_BLA(s) (s->nal_unit_type == NAL_BLA_W_RADL || s->nal_unit_type == NAL_BLA_W_LP || \
-                   s->nal_unit_type == NAL_BLA_N_LP)
-#define IS_IRAP(s) (s->nal_unit_type >= 16 && s->nal_unit_type <= 23)
+#define IS_IDR(s) ((s)->nal_unit_type == NAL_IDR_W_RADL || (s)->nal_unit_type == NAL_IDR_N_LP)
+#define IS_BLA(s) ((s)->nal_unit_type == NAL_BLA_W_RADL || (s)->nal_unit_type == NAL_BLA_W_LP || \
+                   (s)->nal_unit_type == NAL_BLA_N_LP)
+#define IS_IRAP(s) ((s)->nal_unit_type >= 16 && (s)->nal_unit_type <= 23)

 /**
 * Table 7-3: NAL unit type codes
@@ -776,6 +776,8 @@ typedef struct HEVCContext {
    AVBufferRef *sps_list[MAX_SPS_COUNT];
    AVBufferRef *pps_list[MAX_PPS_COUNT];

+    AVBufferRef *current_sps;
+
    AVBufferPool *tab_mvf_pool;
    AVBufferPool *rpl_tab_pool;

@@ -331,6 +331,9 @@ static void hevc_close(AVCodecParserContext *s)
    for (i = 0; i < FF_ARRAY_ELEMS(h->pps_list); i++)
        av_buffer_unref(&h->pps_list[i]);

+    av_buffer_unref(&h->current_sps);
+    h->sps = NULL;
+
    for (i = 0; i < h->nals_allocated; i++)
        av_freep(&h->nals[i].rbsp_buffer);
    av_freep(&h->nals);
@@ -956,6 +956,12 @@ int ff_hevc_decode_nal_sps(HEVCContext *s)
            if (s->pps_list[i] && ((HEVCPPS*)s->pps_list[i]->data)->sps_id == sps_id)
                av_buffer_unref(&s->pps_list[i]);
        }
+        if (s->sps_list[sps_id] && s->sps == (HEVCSPS*)s->sps_list[sps_id]->data) {
+            av_buffer_unref(&s->current_sps);
+            s->current_sps = av_buffer_ref(s->sps_list[sps_id]);
+            if (!s->current_sps)
+                s->sps = NULL;
+        }
        av_buffer_unref(&s->sps_list[sps_id]);
        s->sps_list[sps_id] = sps_buf;
    }
@@ -186,7 +186,8 @@ static int generate_joint_tables(HYuvContext *s)
            }
        }
        ff_free_vlc(&s->vlc[4]);
-        if ((ret = init_vlc(&s->vlc[4], VLC_BITS, i, len, 1, 1, bits, 2, 2, 0)) < 0)
+        if ((ret = init_vlc(&s->vlc[4], VLC_BITS, i, len, 1, 1,
+                            bits, 2, 2, 0)) < 0)
            return ret;
    }
    return 0;
@@ -195,21 +196,20 @@ static int generate_joint_tables(HYuvContext *s)
 static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length)
 {
    GetBitContext gb;
-    int i;
-    int ret;
+    int i, ret;
    int count = 3;

-    init_get_bits(&gb, src, length * 8);
+    if ((ret = init_get_bits(&gb, src, length * 8)) < 0)
+        return ret;

    if (s->version > 2)
        count = 1 + s->alpha + 2*s->chroma;

    for (i = 0; i < count; i++) {
-        if (read_len_table(s->len[i], &gb, s->vlc_n) < 0)
-            return -1;
-        if (ff_huffyuv_generate_bits_table(s->bits[i], s->len[i], s->vlc_n) < 0) {
-            return -1;
-        }
+        if ((ret = read_len_table(s->len[i], &gb, s->vlc_n)) < 0)
+            return ret;
+        if ((ret = ff_huffyuv_generate_bits_table(s->bits[i], s->len[i], s->vlc_n)) < 0)
+            return ret;
        ff_free_vlc(&s->vlc[i]);
        if ((ret = init_vlc(&s->vlc[i], VLC_BITS, s->vlc_n, s->len[i], 1, 1,
                           s->bits[i], 4, 4, 0)) < 0)
@@ -225,18 +225,17 @@ static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length)
 static int read_old_huffman_tables(HYuvContext *s)
 {
    GetBitContext gb;
-    int i;
-    int ret;
+    int i, ret;

    init_get_bits(&gb, classic_shift_luma,
                  classic_shift_luma_table_size * 8);
-    if (read_len_table(s->len[0], &gb, 256) < 0)
-        return -1;
+    if ((ret = read_len_table(s->len[0], &gb, 256)) < 0)
+        return ret;

    init_get_bits(&gb, classic_shift_chroma,
                  classic_shift_chroma_table_size * 8);
-    if (read_len_table(s->len[1], &gb, 256) < 0)
-        return -1;
+    if ((ret = read_len_table(s->len[1], &gb, 256)) < 0)
+        return ret;

    for(i=0; i<256; i++) s->bits[0][i] = classic_add_luma  [i];
    for(i=0; i<256; i++) s->bits[1][i] = classic_add_chroma[i];
@@ -264,6 +263,7 @@ static int read_old_huffman_tables(HYuvContext *s)
 static av_cold int decode_init(AVCodecContext *avctx)
 {
    HYuvContext *s = avctx->priv_data;
+    int ret;

    memset(s->vlc, 0, 4 * sizeof(VLC));

@@ -313,10 +313,10 @@ static av_cold int decode_init(AVCodecContext *avctx)
        s->interlaced = (interlace == 1) ? 1 : (interlace == 2) ? 0 : s->interlaced;
        s->context = ((uint8_t*)avctx->extradata)[2] & 0x40 ? 1 : 0;

-        if ( read_huffman_tables(s, ((uint8_t*)avctx->extradata) + 4,
-                                 avctx->extradata_size - 4) < 0)
-            return AVERROR_INVALIDDATA;
-    }else{
+        if ((ret = read_huffman_tables(s, avctx->extradata + 4,
+                                       avctx->extradata_size - 4)) < 0)
+            return ret;
+    } else {
        switch (avctx->bits_per_coded_sample & 7) {
        case 1:
            s->predictor = LEFT;
@@ -342,8 +342,8 @@ static av_cold int decode_init(AVCodecContext *avctx)
        s->bitstream_bpp = avctx->bits_per_coded_sample & ~7;
        s->context = 0;

-        if (read_old_huffman_tables(s) < 0)
-            return AVERROR_INVALIDDATA;
+        if ((ret = read_old_huffman_tables(s)) < 0)
+            return ret;
    }

    if (s->version <= 2) {
@@ -520,13 +520,16 @@ static av_cold int decode_init(AVCodecContext *avctx)
        av_log(avctx, AV_LOG_ERROR, "width must be even for this colorspace\n");
        return AVERROR_INVALIDDATA;
    }
-    if (s->predictor == MEDIAN && avctx->pix_fmt == AV_PIX_FMT_YUV422P && avctx->width%4) {
-        av_log(avctx, AV_LOG_ERROR, "width must be a multiple of 4 this colorspace and predictor\n");
+    if (s->predictor == MEDIAN && avctx->pix_fmt == AV_PIX_FMT_YUV422P &&
+        avctx->width % 4) {
+        av_log(avctx, AV_LOG_ERROR, "width must be a multiple of 4 "
+               "for this combination of colorspace and predictor type.\n");
        return AVERROR_INVALIDDATA;
    }
-    if (ff_huffyuv_alloc_temp(s)) {
+
+    if ((ret = ff_huffyuv_alloc_temp(s)) < 0) {
        ff_huffyuv_common_end(s);
-        return AVERROR(ENOMEM);
+        return ret;
    }

    return 0;
@@ -535,23 +538,23 @@ static av_cold int decode_init(AVCodecContext *avctx)
 static av_cold int decode_init_thread_copy(AVCodecContext *avctx)
 {
    HYuvContext *s = avctx->priv_data;
-    int i;
+    int i, ret;

-    if (ff_huffyuv_alloc_temp(s)) {
+    if ((ret = ff_huffyuv_alloc_temp(s)) < 0) {
        ff_huffyuv_common_end(s);
-        return AVERROR(ENOMEM);
+        return ret;
    }

    for (i = 0; i < 8; i++)
        s->vlc[i].table = NULL;

    if (s->version >= 2) {
-        if (read_huffman_tables(s, ((uint8_t*)avctx->extradata) + 4,
-                                avctx->extradata_size) < 0)
-            return AVERROR_INVALIDDATA;
+        if ((ret = read_huffman_tables(s, avctx->extradata + 4,
+                                       avctx->extradata_size)) < 0)
+            return ret;
    } else {
-        if (read_old_huffman_tables(s) < 0)
-            return AVERROR_INVALIDDATA;
+        if ((ret = read_old_huffman_tables(s)) < 0)
+            return ret;
    }

    return 0;
@@ -798,14 +801,15 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
    if (s->context) {
        table_size = read_huffman_tables(s, s->bitstream_buffer, buf_size);
        if (table_size < 0)
-            return AVERROR_INVALIDDATA;
+            return table_size;
    }

    if ((unsigned)(buf_size-table_size) >= INT_MAX / 8)
        return AVERROR_INVALIDDATA;

-    init_get_bits(&s->gb, s->bitstream_buffer+table_size,
-                  (buf_size-table_size) * 8);
+    if ((ret = init_get_bits(&s->gb, s->bitstream_buffer + table_size,
+                             (buf_size - table_size) * 8)) < 0)
+        return ret;

    fake_ystride = s->interlaced ? p->linesize[0] * 2  : p->linesize[0];
    fake_ustride = s->interlaced ? p->linesize[1] * 2  : p->linesize[1];
@@ -847,9 +847,9 @@ static int decode_frame(AVCodecContext *avctx,
        break;
    case 4:
        bytestream2_init(&gb, buf, buf_size);
-        if (avctx->codec_tag == MKTAG('R', 'G', 'B', '8'))
+        if (avctx->codec_tag == MKTAG('R', 'G', 'B', '8') && avctx->pix_fmt == AV_PIX_FMT_RGB32)
            decode_rgb8(&gb, s->frame->data[0], avctx->width, avctx->height, s->frame->linesize[0]);
-        else if (avctx->codec_tag == MKTAG('R', 'G', 'B', 'N'))
+        else if (avctx->codec_tag == MKTAG('R', 'G', 'B', 'N') && avctx->pix_fmt == AV_PIX_FMT_RGB444)
            decode_rgbn(&gb, s->frame->data[0], avctx->width, avctx->height, s->frame->linesize[0]);
        else
            return unsupported(avctx);
@@ -235,15 +235,15 @@ void ff_ivi_recompose_haar(const IVIPlaneDesc *plane, uint8_t *dst,

 /** butterfly operation for the inverse Haar transform */
 #define IVI_HAAR_BFLY(s1, s2, o1, o2, t) \
-    t  = (s1 - s2) >> 1;\
-    o1 = (s1 + s2) >> 1;\
-    o2 = t;\
+    t  = ((s1) - (s2)) >> 1;\
+    o1 = ((s1) + (s2)) >> 1;\
+    o2 = (t);\

 /** inverse 8-point Haar transform */
 #define INV_HAAR8(s1, s5, s3, s7, s2, s4, s6, s8,\
                  d1, d2, d3, d4, d5, d6, d7, d8,\
                  t0, t1, t2, t3, t4, t5, t6, t7, t8) {\
-    t1 = s1 << 1; t5 = s5 << 1;\
+    t1 = (s1) << 1; t5 = (s5) << 1;\
    IVI_HAAR_BFLY(t1, t5, t1, t5, t0); IVI_HAAR_BFLY(t1, s3, t1, t3, t0);\
    IVI_HAAR_BFLY(t5, s7, t5, t7, t0); IVI_HAAR_BFLY(t1, s2, t1, t2, t0);\
    IVI_HAAR_BFLY(t3, s4, t3, t4, t0); IVI_HAAR_BFLY(t5, s6, t5, t6, t0);\
@@ -485,21 +485,21 @@ void ff_ivi_dc_haar_2d(const int32_t *in, int16_t *out, uint32_t pitch,

 /** butterfly operation for the inverse slant transform */
 #define IVI_SLANT_BFLY(s1, s2, o1, o2, t) \
-    t  = s1 - s2;\
-    o1 = s1 + s2;\
-    o2 = t;\
+    t  = (s1) - (s2);\
+    o1 = (s1) + (s2);\
+    o2 = (t);\

 /** This is a reflection a,b = 1/2, 5/4 for the inverse slant transform */
 #define IVI_IREFLECT(s1, s2, o1, o2, t) \
-    t  = ((s1 + s2*2 + 2) >> 2) + s1;\
-    o2 = ((s1*2 - s2 + 2) >> 2) - s2;\
-    o1 = t;\
+    t  = (((s1) + (s2)*2 + 2) >> 2) + (s1);\
+    o2 = (((s1)*2 - (s2) + 2) >> 2) - (s2);\
+    o1 = (t);\

 /** This is a reflection a,b = 1/2, 7/8 for the inverse slant transform */
 #define IVI_SLANT_PART4(s1, s2, o1, o2, t) \
-    t  = s2 + ((s1*4  - s2 + 4) >> 3);\
-    o2 = s1 + ((-s1 - s2*4 + 4) >> 3);\
-    o1 = t;\
+    t  = (s2) + (((s1)*4  - (s2) + 4) >> 3);\
+    o2 = (s1) + ((-(s1) - (s2)*4 + 4) >> 3);\
+    o1 = (t);\

 /** inverse slant8 transform */
 #define IVI_INV_SLANT8(s1, s4, s8, s5, s2, s6, s3, s7,\
@@ -557,7 +557,7 @@ void ff_ivi_inverse_slant_8x8(const int32_t *in, int16_t *out, uint32_t pitch, c
    }
 #undef COMPENSATE

-#define COMPENSATE(x) ((x + 1)>>1)
+#define COMPENSATE(x) (((x) + 1)>>1)
    src = tmp;
    for (i = 0; i < 8; i++) {
        if (!src[0] && !src[1] && !src[2] && !src[3] && !src[4] && !src[5] && !src[6] && !src[7]) {
@@ -597,7 +597,7 @@ void ff_ivi_inverse_slant_4x4(const int32_t *in, int16_t *out, uint32_t pitch, c
    }
 #undef COMPENSATE

-#define COMPENSATE(x) ((x + 1)>>1)
+#define COMPENSATE(x) (((x) + 1)>>1)
    src = tmp;
    for (i = 0; i < 4; i++) {
        if (!src[0] && !src[1] && !src[2] && !src[3]) {
@@ -631,7 +631,7 @@ void ff_ivi_row_slant8(const int32_t *in, int16_t *out, uint32_t pitch, const ui
    int     i;
    int     t0, t1, t2, t3, t4, t5, t6, t7, t8;

-#define COMPENSATE(x) ((x + 1)>>1)
+#define COMPENSATE(x) (((x) + 1)>>1)
    for (i = 0; i < 8; i++) {
        if (!in[0] && !in[1] && !in[2] && !in[3] && !in[4] && !in[5] && !in[6] && !in[7]) {
            memset(out, 0, 8*sizeof(out[0]));
@@ -673,7 +673,7 @@ void ff_ivi_col_slant8(const int32_t *in, int16_t *out, uint32_t pitch, const ui
    row4 = pitch << 2;
    row8 = pitch << 3;

-#define COMPENSATE(x) ((x + 1)>>1)
+#define COMPENSATE(x) (((x) + 1)>>1)
    for (i = 0; i < 8; i++) {
        if (flags[i]) {
            IVI_INV_SLANT8(in[0], in[8], in[16], in[24], in[32], in[40], in[48], in[56],
@@ -710,7 +710,7 @@ void ff_ivi_row_slant4(const int32_t *in, int16_t *out, uint32_t pitch, const ui
    int     i;
    int     t0, t1, t2, t3, t4;

-#define COMPENSATE(x) ((x + 1)>>1)
+#define COMPENSATE(x) (((x) + 1)>>1)
    for (i = 0; i < 4; i++) {
        if (!in[0] && !in[1] && !in[2] && !in[3]) {
            memset(out, 0, 4*sizeof(out[0]));
@@ -732,7 +732,7 @@ void ff_ivi_col_slant4(const int32_t *in, int16_t *out, uint32_t pitch, const ui

    row2 = pitch << 1;

-#define COMPENSATE(x) ((x + 1)>>1)
+#define COMPENSATE(x) (((x) + 1)>>1)
    for (i = 0; i < 4; i++) {
        if (flags[i]) {
            IVI_INV_SLANT4(in[0], in[4], in[8], in[12],
@@ -224,7 +224,7 @@ int ff_jpeg2000_init_component(Jpeg2000Component *comp,
        if (!comp->i_data)
            return AVERROR(ENOMEM);
    }
-    comp->reslevel = av_calloc(codsty->nreslevels, sizeof(*comp->reslevel));
+    comp->reslevel = av_mallocz_array(codsty->nreslevels, sizeof(*comp->reslevel));
    if (!comp->reslevel)
        return AVERROR(ENOMEM);
    /* LOOP on resolution levels */
@@ -272,7 +272,7 @@ int ff_jpeg2000_init_component(Jpeg2000Component *comp,
                                        reslevel->log2_prec_height) -
                (reslevel->coord[1][0] >> reslevel->log2_prec_height);

-        reslevel->band = av_calloc(reslevel->nbands, sizeof(*reslevel->band));
+        reslevel->band = av_mallocz_array(reslevel->nbands, sizeof(*reslevel->band));
        if (!reslevel->band)
            return AVERROR(ENOMEM);

@@ -368,9 +368,9 @@ int ff_jpeg2000_init_component(Jpeg2000Component *comp,
            for (j = 0; j < 2; j++)
                band->coord[1][j] = ff_jpeg2000_ceildiv(band->coord[1][j], dy);

-            band->prec = av_calloc(reslevel->num_precincts_x *
-                                         (uint64_t)reslevel->num_precincts_y,
-                                         sizeof(*band->prec));
+            band->prec = av_mallocz_array(reslevel->num_precincts_x *
+                                          (uint64_t)reslevel->num_precincts_y,
+                                          sizeof(*band->prec));
            if (!band->prec)
                return AVERROR(ENOMEM);

@@ -504,22 +504,29 @@ void ff_jpeg2000_cleanup(Jpeg2000Component *comp, Jpeg2000CodingStyle *codsty)
    for (reslevelno = 0;
         comp->reslevel && reslevelno < codsty->nreslevels;
         reslevelno++) {
-        Jpeg2000ResLevel *reslevel = comp->reslevel + reslevelno;
+        Jpeg2000ResLevel *reslevel;

+        if (!comp->reslevel)
+            continue;
+
+        reslevel = comp->reslevel + reslevelno;
        for (bandno = 0; bandno < reslevel->nbands; bandno++) {
-            if (reslevel->band) {
-                Jpeg2000Band *band = reslevel->band + bandno;
-                for (precno = 0; precno < reslevel->num_precincts_x * reslevel->num_precincts_y; precno++) {
-                    if (band->prec) {
-                        Jpeg2000Prec *prec = band->prec + precno;
-                        av_freep(&prec->zerobits);
-                        av_freep(&prec->cblkincl);
-                        av_freep(&prec->cblk);
-                    }
-                }
+            Jpeg2000Band *band;

-                av_freep(&band->prec);
+            if (!reslevel->band)
+                continue;
+
+            band = reslevel->band + bandno;
+            for (precno = 0; precno < reslevel->num_precincts_x * reslevel->num_precincts_y; precno++) {
+                if (band->prec) {
+                    Jpeg2000Prec *prec = band->prec + precno;
+                    av_freep(&prec->zerobits);
+                    av_freep(&prec->cblkincl);
+                    av_freep(&prec->cblk);
+                }
            }
+
+            av_freep(&band->prec);
        }
        av_freep(&reslevel->band);
    }
@@ -183,6 +183,7 @@ static int mp3lame_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
    MPADecodeHeader hdr;
    int len, ret, ch;
    int lame_result;
+    uint32_t h;

    if (frame) {
        switch (avctx->sample_fmt) {
@@ -238,7 +239,12 @@ static int mp3lame_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
       determine the frame size. */
    if (s->buffer_index < 4)
        return 0;
-    if (avpriv_mpegaudio_decode_header(&hdr, AV_RB32(s->buffer))) {
+    h = AV_RB32(s->buffer);
+    if (ff_mpa_check_header(h) < 0) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid mp3 header at start of buffer\n");
+        return AVERROR_BUG;
+    }
+    if (avpriv_mpegaudio_decode_header(&hdr, h)) {
        av_log(avctx, AV_LOG_ERROR, "free format output not supported\n");
        return -1;
    }
@@ -349,7 +349,8 @@ static int libvorbis_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
            avctx->delay              = duration;
            av_assert0(!s->afq.remaining_delay);
            s->afq.frames->duration  += duration;
-            s->afq.frames->pts       -= duration;
+            if (s->afq.frames->pts != AV_NOPTS_VALUE)
+                s->afq.frames->pts       -= duration;
            s->afq.remaining_samples += duration;
        }
        ff_af_queue_remove(&s->afq, duration, &avpkt->pts, &avpkt->duration);
@@ -202,10 +202,10 @@ static int X264_frame(AVCodecContext *ctx, AVPacket *pkt, const AVFrame *frame,
            case AV_STEREO3D_CHECKERBOARD:
                fpa_type = 0;
                break;
-            case AV_STEREO3D_LINES:
+            case AV_STEREO3D_COLUMNS:
                fpa_type = 1;
                break;
-            case AV_STEREO3D_COLUMNS:
+            case AV_STEREO3D_LINES:
                fpa_type = 2;
                break;
            case AV_STEREO3D_SIDEBYSIDE:
@@ -391,19 +391,6 @@ static av_cold int X264_init(AVCodecContext *avctx)

    OPT_STR("level", x4->level);

-    if(x4->x264opts){
-        const char *p= x4->x264opts;
-        while(p){
-            char param[256]={0}, val[256]={0};
-            if(sscanf(p, "%255[^:=]=%255[^:]", param, val) == 1){
-                OPT_STR(param, "1");
-            }else
-                OPT_STR(param, val);
-            p= strchr(p, ':');
-            p+=!!p;
-        }
-    }
-
    if (avctx->i_quant_factor > 0)
        x4->params.rc.f_ip_factor         = 1 / fabs(avctx->i_quant_factor);

@@ -589,6 +576,19 @@ static av_cold int X264_init(AVCodecContext *avctx)
    if (avctx->flags & CODEC_FLAG_GLOBAL_HEADER)
        x4->params.b_repeat_headers = 0;

+    if(x4->x264opts){
+        const char *p= x4->x264opts;
+        while(p){
+            char param[256]={0}, val[256]={0};
+            if(sscanf(p, "%255[^:=]=%255[^:]", param, val) == 1){
+                OPT_STR(param, "1");
+            }else
+                OPT_STR(param, val);
+            p= strchr(p, ':');
+            p+=!!p;
+        }
+    }
+
    if (x4->x264_params) {
        AVDictionary *dict    = NULL;
        AVDictionaryEntry *en = NULL;
@@ -81,6 +81,7 @@ static av_cold int libx265_encode_init(AVCodecContext *avctx)
    libx265Context *ctx = avctx->priv_data;
    x265_nal *nal;
    uint8_t *buf;
+    char sar[10];
    int sar_num, sar_den;
    int nnal;
    int ret;
@@ -121,11 +122,11 @@ static av_cold int libx265_encode_init(AVCodecContext *avctx)
    av_reduce(&sar_num, &sar_den,
              avctx->sample_aspect_ratio.num,
              avctx->sample_aspect_ratio.den, 4096);
-    ctx->params->bEnableVuiParametersPresentFlag = 1;
-    ctx->params->bEnableAspectRatioIdc           = 1;
-    ctx->params->aspectRatioIdc                  = 255;
-    ctx->params->sarWidth                        = sar_num;
-    ctx->params->sarHeight                       = sar_den;
+    snprintf(sar, sizeof(sar), "%d:%d", sar_num, sar_den);
+    if (x265_param_parse(ctx->params, "sar", sar) == X265_PARAM_BAD_VALUE) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid SAR: %d:%d.\n", sar_num, sar_den);
+        return AVERROR_INVALIDDATA;
+    }

    if (x265_max_bit_depth == 8)
        ctx->params->internalBitDepth = 8;
@@ -1251,7 +1251,7 @@ static int mjpeg_decode_scan_progressive_ac(MJpegDecodeContext *s, int ss,
    }

    if (!Al) {
-        s->coefs_finished[c] |= (1LL << (se + 1)) - (1LL << ss);
+        s->coefs_finished[c] |= (2LL << se) - (1LL << ss);
        last_scan = !~s->coefs_finished[c];
    }

@@ -1718,7 +1718,7 @@ static int mjpeg_decode_com(MJpegDecodeContext *s)
                parse_avid(s, cbuf, len);
            } else if (!strcmp(cbuf, "CS=ITU601"))
                s->cs_itu601 = 1;
-            else if ((!strncmp(cbuf, "Intel(R) JPEG Library, version 1", 32)) ||
+            else if ((!strncmp(cbuf, "Intel(R) JPEG Library, version 1", 32) && s->avctx->codec_tag) ||
                     (!strncmp(cbuf, "Metasoft MJPEG Codec", 20)))
                s->flipped = 1;

@@ -487,7 +487,7 @@ static void encode_block(MpegEncContext *s, int16_t *block, int n)
        put_bits(&s->pb, huff_size_ac[0], huff_code_ac[0]);
 }

-void ff_mjpeg_encode_mb(MpegEncContext *s, int16_t block[6][64])
+void ff_mjpeg_encode_mb(MpegEncContext *s, int16_t block[12][64])
 {
    int i;
    if (s->chroma_format == CHROMA_444) {
@@ -61,6 +61,6 @@ void ff_mjpeg_encode_stuffing(MpegEncContext *s);
 void ff_mjpeg_init_hvsample(AVCodecContext *avctx, int hsample[3], int vsample[3]);
 void ff_mjpeg_encode_dc(PutBitContext *pb, int val,
                        uint8_t *huff_size, uint16_t *huff_code);
-void ff_mjpeg_encode_mb(MpegEncContext *s, int16_t block[6][64]);
+void ff_mjpeg_encode_mb(MpegEncContext *s, int16_t block[12][64]);

 #endif /* AVCODEC_MJPEGENC_H */
@@ -872,7 +872,7 @@ static int read_decoding_params(MLPDecodeContext *m, GetBitContext *gbp,
    return 0;
 }

-#define MSB_MASK(bits)  (-1u << bits)
+#define MSB_MASK(bits)  (-1u << (bits))

 /** Generate PCM samples using the prediction filters and residual values
 *  read from the data stream, and update the filter state. */
@@ -1878,6 +1878,14 @@ static int mpeg_decode_slice(MpegEncContext *s, int mb_y,
                } else
                    goto eos;
            }
+            if (s->mb_y >= ((s->height + 15) >> 4) &&
+                s->progressive_frame &&
+                !s->progressive_sequence &&
+                get_bits_left(&s->gb) <= 8 &&
+                get_bits_left(&s->gb) >= 0 &&
+                s->mb_skip_run == -1 &&
+                show_bits(&s->gb, 8) == 0)
+                goto eos;

            ff_init_block_index(s);
        }
@@ -24,6 +24,8 @@
 * MPEG Audio header decoder.
 */

+#include "libavutil/common.h"
+
 #include "avcodec.h"
 #include "mpegaudio.h"
 #include "mpegaudiodata.h"
@@ -45,6 +47,8 @@ int avpriv_mpegaudio_decode_header(MPADecodeHeader *s, uint32_t header)
    s->layer = 4 - ((header >> 17) & 3);
    /* extract frequency */
    sample_rate_index = (header >> 10) & 3;
+    if (sample_rate_index >= FF_ARRAY_ELEMS(avpriv_mpa_freq_tab))
+        sample_rate_index = 0;
    sample_rate = avpriv_mpa_freq_tab[sample_rate_index] >> (s->lsf + mpeg25);
    sample_rate_index += 3 * (s->lsf + mpeg25);
    s->sample_rate_index = sample_rate_index;
@@ -1368,6 +1368,9 @@ int ff_MPV_common_frame_size_change(MpegEncContext *s)
 {
    int i, err = 0;

+    if (!s->context_initialized)
+        return AVERROR(EINVAL);
+
    if (s->slice_context_count > 1) {
        for (i = 0; i < s->slice_context_count; i++) {
            free_duplicate_context(s->thread_context[i]);
@@ -1397,8 +1400,8 @@ int ff_MPV_common_frame_size_change(MpegEncContext *s)
        s->mb_height = (s->height + 15) / 16;

    if ((s->width || s->height) &&
-        av_image_check_size(s->width, s->height, 0, s->avctx))
-        return AVERROR_INVALIDDATA;
+        (err = av_image_check_size(s->width, s->height, 0, s->avctx)) < 0)
+        goto fail;

    if ((err = init_context_frame(s)))
        goto fail;
@@ -1414,7 +1417,7 @@ int ff_MPV_common_frame_size_change(MpegEncContext *s)
            }

            for (i = 0; i < nb_slices; i++) {
-                if (init_duplicate_context(s->thread_context[i]) < 0)
+                if ((err = init_duplicate_context(s->thread_context[i])) < 0)
                    goto fail;
                    s->thread_context[i]->start_mb_y =
                        (s->mb_height * (i) + nb_slices / 2) / nb_slices;
@@ -1774,7 +1777,7 @@ int ff_MPV_frame_start(MpegEncContext *s, AVCodecContext *avctx)
            return -1;
        }

-        if (!avctx->hwaccel) {
+        if (!avctx->hwaccel && !(avctx->codec->capabilities&CODEC_CAP_HWACCEL_VDPAU)) {
            for(i=0; i<avctx->height; i++)
                memset(s->last_picture_ptr->f.data[0] + s->last_picture_ptr->f.linesize[0]*i,
                       0x80, avctx->width);
@@ -116,6 +116,9 @@ static int msrle_decode_frame(AVCodecContext *avctx,
        uint8_t *buf = avpkt->data + (avctx->height-1)*istride;
        int i, j;

+        if (linesize < 0)
+            return linesize;
+
        for (i = 0; i < avctx->height; i++) {
            if (avctx->bits_per_coded_sample == 4) {
                for (j = 0; j < avctx->width - 1; j += 2) {
@@ -84,8 +84,8 @@ void ff_mss34_gen_quant_mat(uint16_t *qmat, int quality, int luma)
    blk[6 * step] = (-(t3 + t7) + t8 + tA) >> shift;                \
    blk[7 * step] = (-(t1 + t6) + t9 + tB) >> shift;                \

-#define SOP_ROW(a) ((a) << 16) + 0x2000
-#define SOP_COL(a) ((a + 32) << 16)
+#define SOP_ROW(a) (((a) << 16) + 0x2000)
+#define SOP_COL(a) (((a) + 32) << 16)

 void ff_mss34_dct_put(uint8_t *dst, int stride, int *block)
 {
@@ -364,7 +364,7 @@ static int get_value_cached(GetBitContext *gb, int vec_pos, uint8_t *vec,
    return prev[component];
 }

-#define MKVAL(vals)  (vals[0] | (vals[1] << 3) | (vals[2] << 6))
+#define MKVAL(vals)  ((vals)[0] | ((vals)[1] << 3) | ((vals)[2] << 6))

 /* Image mode - the hardest to comprehend MSS4 coding mode.
 *
@@ -214,6 +214,13 @@ static int parse_picture_segment(AVCodecContext *avctx,
    /* Decode rle bitmap length, stored size includes width/height data */
    rle_bitmap_len = bytestream_get_be24(&buf) - 2*2;

+    if (buf_size > rle_bitmap_len) {
+        av_log(avctx, AV_LOG_ERROR,
+               "Buffer dimension %d larger than the expected RLE data %d\n",
+               buf_size, rle_bitmap_len);
+        return AVERROR_INVALIDDATA;
+    }
+
    /* Get bitmap dimensions from data */
    width  = bytestream_get_be16(&buf);
    height = bytestream_get_be16(&buf);
@@ -224,11 +231,6 @@ static int parse_picture_segment(AVCodecContext *avctx,
        return -1;
    }

-    if (buf_size > rle_bitmap_len) {
-        av_log(avctx, AV_LOG_ERROR, "too much RLE data\n");
-        return AVERROR_INVALIDDATA;
-    }
-
    ctx->pictures[picture_id].w = width;
    ctx->pictures[picture_id].h = height;

@@ -36,12 +36,20 @@

 .macro extfunc name
    .global X(\name)
+#if _CALL_ELF == 2
+    .text
+X(\name):
+    addis %r2, %r12, .TOC.-X(\name)@ha
+    addi %r2, %r2, .TOC.-X(\name)@l
+    .localentry X(\name), .-X(\name)
+#else
    .section .opd, "aw"
 X(\name):
    .quad L(\name), .TOC.@tocbase, 0
    .previous
    .type X(\name), STT_FUNC
 L(\name):
+#endif
 .endm

 .macro movrel rd, sym, gp
@@ -210,6 +210,7 @@ typedef struct ProresContext {
    int bits_per_mb;
    int force_quant;
    int alpha_bits;
+    int warn;

    char *vendor;
    int quant_sel;
@@ -472,7 +473,6 @@ static void put_alpha_run(PutBitContext *pb, int run)

 // todo alpha quantisation for high quants
 static int encode_alpha_plane(ProresContext *ctx, PutBitContext *pb,
-                              const uint16_t *src, int linesize,
                              int mbs_per_slice, uint16_t *blocks,
                              int quant)
 {
@@ -567,11 +567,15 @@ static int encode_slice(AVCodecContext *avctx, const AVFrame *pic,
            get_alpha_data(ctx, src, linesize, xp, yp,
                           pwidth, avctx->height / ctx->pictures_per_frame,
                           ctx->blocks[0], mbs_per_slice, ctx->alpha_bits);
-            sizes[i] = encode_alpha_plane(ctx, pb, src, linesize,
-                                          mbs_per_slice, ctx->blocks[0],
-                                          quant);
+            sizes[i] = encode_alpha_plane(ctx, pb, mbs_per_slice,
+                                          ctx->blocks[0], quant);
        }
        total_size += sizes[i];
+        if (put_bits_left(pb) < 0) {
+            av_log(avctx, AV_LOG_ERROR,
+                   "Underestimated required buffer size.\n");
+            return AVERROR_BUG;
+        }
    }
    return total_size;
 }
@@ -936,15 +940,16 @@ static int encode_frame(AVCodecContext *avctx, AVPacket *pkt,
    int slice_hdr_size = 2 + 2 * (ctx->num_planes - 1);
    int frame_size, picture_size, slice_size;
    int pkt_size, ret;
+    int max_slice_size = (ctx->frame_size_upper_bound - 200) / (ctx->pictures_per_frame * ctx->slices_per_picture + 1);
    uint8_t frame_flags;

    *avctx->coded_frame           = *pic;
    avctx->coded_frame->pict_type = AV_PICTURE_TYPE_I;
    avctx->coded_frame->key_frame = 1;

-    pkt_size = ctx->frame_size_upper_bound + FF_MIN_BUFFER_SIZE;
+    pkt_size = ctx->frame_size_upper_bound;

-    if ((ret = ff_alloc_packet2(avctx, pkt, pkt_size)) < 0)
+    if ((ret = ff_alloc_packet2(avctx, pkt, pkt_size + FF_MIN_BUFFER_SIZE)) < 0)
        return ret;

    orig_buf = pkt->data;
@@ -1020,8 +1025,44 @@ static int encode_frame(AVCodecContext *avctx, AVPacket *pkt,
                bytestream_put_byte(&buf, slice_hdr_size << 3);
                slice_hdr = buf;
                buf += slice_hdr_size - 1;
+                if (pkt_size <= buf - orig_buf + 2 * max_slice_size) {
+                    uint8_t *start = pkt->data;
+                    // Recompute new size according to max_slice_size
+                    // and deduce delta
+                    int delta = 200 + (ctx->pictures_per_frame *
+                                ctx->slices_per_picture + 1) *
+                                max_slice_size - pkt_size;
+
+                    delta = FFMAX(delta, 2 * max_slice_size);
+                    ctx->frame_size_upper_bound += delta;
+
+                    if (!ctx->warn) {
+                        avpriv_request_sample(avctx,
+                                              "Packet too small: is %i,"
+                                              " needs %i (slice: %i). "
+                                              "Correct allocation",
+                                              pkt_size, delta, max_slice_size);
+                        ctx->warn = 1;
+                    }
+
+                    ret = av_grow_packet(pkt, delta);
+                    if (ret < 0)
+                        return ret;
+
+                    pkt_size += delta;
+                    // restore pointers
+                    orig_buf         = pkt->data + (orig_buf         - start);
+                    buf              = pkt->data + (buf              - start);
+                    picture_size_pos = pkt->data + (picture_size_pos - start);
+                    slice_sizes      = pkt->data + (slice_sizes      - start);
+                    slice_hdr        = pkt->data + (slice_hdr        - start);
+                    tmp              = pkt->data + (tmp              - start);
+                }
                init_put_bits(&pb, buf, (pkt_size - (buf - orig_buf)) * 8);
-                encode_slice(avctx, pic, &pb, sizes, x, y, q, mbs_per_slice);
+                ret = encode_slice(avctx, pic, &pb, sizes, x, y, q,
+                                   mbs_per_slice);
+                if (ret < 0)
+                    return ret;

                bytestream_put_byte(&slice_hdr, q);
                slice_size = slice_hdr_size + sizes[ctx->num_planes - 1];
@@ -1031,6 +1072,8 @@ static int encode_frame(AVCodecContext *avctx, AVPacket *pkt,
                }
                bytestream_put_be16(&slice_sizes, slice_size);
                buf += slice_size - slice_hdr_size;
+                if (max_slice_size < slice_size)
+                    max_slice_size = slice_size;
            }
        }

@@ -1203,16 +1246,22 @@ static av_cold int encode_init(AVCodecContext *avctx)
        ctx->bits_per_mb = ls * 8;
        if (ctx->chroma_factor == CFACTOR_Y444)
            ctx->bits_per_mb += ls * 4;
-        if (ctx->num_planes == 4)
-            ctx->bits_per_mb += ls * 4;
    }

-    ctx->frame_size_upper_bound = ctx->pictures_per_frame *
-                                  ctx->slices_per_picture *
+    ctx->frame_size_upper_bound = (ctx->pictures_per_frame *
+                                   ctx->slices_per_picture + 1) *
                                  (2 + 2 * ctx->num_planes +
                                   (mps * ctx->bits_per_mb) / 8)
                                  + 200;

+    if (ctx->alpha_bits) {
+         // The alpha plane is run-coded and might exceed the bit budget.
+         ctx->frame_size_upper_bound += (ctx->pictures_per_frame *
+                                         ctx->slices_per_picture + 1) *
+         /* num pixels per slice */     (ctx->mbs_per_slice * 256 *
+         /* bits per pixel */            (1 + ctx->alpha_bits + 1) + 7 >> 3);
+    }
+
    avctx->codec_tag   = ctx->profile_info->tag;

    av_log(avctx, AV_LOG_DEBUG,
@@ -356,8 +356,10 @@ static int submit_packet(PerThreadContext *p, AVPacket *avpkt)
        memcpy(p->buf, avpkt->data, avpkt->size);
        memset(p->buf + avpkt->size, 0, FF_INPUT_BUFFER_PADDING_SIZE);
    }
-    if ((ret = av_copy_packet_side_data(&p->avpkt, avpkt)) < 0)
+    if ((ret = av_copy_packet_side_data(&p->avpkt, avpkt)) < 0) {
+        pthread_mutex_unlock(&p->mutex);
        return ret;
+    }

    p->state = STATE_SETTING_UP;
    pthread_cond_signal(&p->input_cond);
@@ -34,7 +34,6 @@
 #include "celp_filters.h"
 #include "ra144.h"

-
 static av_cold int ra144_encode_close(AVCodecContext *avctx)
 {
    RA144Context *ractx = avctx->priv_data;
@@ -689,7 +689,7 @@ av_cold void ff_snow_common_end(SnowContext *s)
    for(i=0; i<MAX_REF_FRAMES; i++){
        av_freep(&s->ref_mvs[i]);
        av_freep(&s->ref_scores[i]);
-        if(s->last_picture[i]->data[0]) {
+        if(s->last_picture[i] && s->last_picture[i]->data[0]) {
            av_assert0(s->last_picture[i]->data[0] != s->current_picture->data[0]);
        }
        av_frame_free(&s->last_picture[i]);
@@ -655,7 +655,10 @@ static inline void unpack_coeffs(SnowContext *s, SubBand *b, SubBand * parent, i
                if(v){
                    v= 2*(get_symbol2(&s->c, b->state[context + 2], context-4) + 1);
                    v+=get_rac(&s->c, &b->state[0][16 + 1 + 3 + ff_quant3bA[l&0xFF] + 3*ff_quant3bA[t&0xFF]]);
-
+                    if ((uint16_t)v != v) {
+                        av_log(s->avctx, AV_LOG_ERROR, "Coefficient damaged\n");
+                        v = 1;
+                    }
                    xc->x=x;
                    (xc++)->coeff= v;
                }
@@ -665,6 +668,10 @@ static inline void unpack_coeffs(SnowContext *s, SubBand *b, SubBand * parent, i
                    else           run= INT_MAX;
                    v= 2*(get_symbol2(&s->c, b->state[0 + 2], 0-4) + 1);
                    v+=get_rac(&s->c, &b->state[0][16 + 1 + 3]);
+                    if ((uint16_t)v != v) {
+                        av_log(s->avctx, AV_LOG_ERROR, "Coefficient damaged\n");
+                        v = 1;
+                    }

                    xc->x=x;
                    (xc++)->coeff= v;
@@ -60,6 +60,10 @@ typedef struct SVQ1Context {
    HpelDSPContext hdsp;
    GetBitContext gb;
    AVFrame *prev;
+
+    uint8_t *pkt_swapped;
+    int pkt_swapped_allocated;
+
    int width;
    int height;
    int frame_code;
@@ -624,7 +628,24 @@ static int svq1_decode_frame(AVCodecContext *avctx, void *data,

    /* swap some header bytes (why?) */
    if (s->frame_code != 0x20) {
-        uint32_t *src = (uint32_t *)(buf + 4);
+        uint32_t *src;
+
+        if (buf_size < 9 * 4) {
+            av_log(avctx, AV_LOG_ERROR, "Input packet too small\n");
+            return AVERROR_INVALIDDATA;
+        }
+
+        av_fast_padded_malloc(&s->pkt_swapped, &s->pkt_swapped_allocated,
+                       buf_size);
+        if (!s->pkt_swapped)
+            return AVERROR(ENOMEM);
+
+        memcpy(s->pkt_swapped, buf, buf_size);
+        buf = s->pkt_swapped;
+        init_get_bits(&s->gb, buf, buf_size * 8);
+        skip_bits(&s->gb, 22);
+
+        src = (uint32_t *)(s->pkt_swapped + 4);

        if (buf_size < 36)
            return AVERROR_INVALIDDATA;
@@ -796,6 +817,8 @@ static av_cold int svq1_decode_end(AVCodecContext *avctx)
    SVQ1Context *s = avctx->priv_data;

    av_frame_free(&s->prev);
+    av_freep(&s->pkt_swapped);
+    s->pkt_swapped_allocated = 0;

    return 0;
 }
@@ -1187,7 +1187,7 @@ static int svq3_decode_frame(AVCodecContext *avctx, void *data,
    if (h->pict_type != AV_PICTURE_TYPE_I) {
        if (!s->last_pic->f.data[0]) {
            av_log(avctx, AV_LOG_ERROR, "Missing reference frame.\n");
-            av_frame_unref(s->last_pic);
+            av_frame_unref(&s->last_pic->f);
            ret = get_buffer(avctx, s->last_pic);
            if (ret < 0)
                return ret;
@@ -1200,7 +1200,7 @@ static int svq3_decode_frame(AVCodecContext *avctx, void *data,

        if (h->pict_type == AV_PICTURE_TYPE_B && !s->next_pic->f.data[0]) {
            av_log(avctx, AV_LOG_ERROR, "Missing reference frame.\n");
-            av_frame_unref(s->next_pic);
+            av_frame_unref(&s->next_pic->f);
            ret = get_buffer(avctx, s->next_pic);
            if (ret < 0)
                return ret;
@@ -357,6 +357,8 @@ void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height,
    case AV_PIX_FMT_GBRP12BE:
    case AV_PIX_FMT_GBRP14LE:
    case AV_PIX_FMT_GBRP14BE:
+    case AV_PIX_FMT_GBRP16LE:
+    case AV_PIX_FMT_GBRP16BE:
        w_align = 16; //FIXME assume 16 pixel per macroblock
        h_align = 16 * 2; // interlaced needs 2 macroblocks height
        break;
@@ -70,7 +70,7 @@ static int build_huff(const uint8_t *src, VLC *vlc, int *fsym)
        code += 0x80000000u >> (he[i].len - 1);
    }

-    return ff_init_vlc_sparse(vlc, FFMIN(he[last].len, 10), last + 1,
+    return ff_init_vlc_sparse(vlc, FFMIN(he[last].len, 11), last + 1,
                              bits,  sizeof(*bits),  sizeof(*bits),
                              codes, sizeof(*codes), sizeof(*codes),
                              syms,  sizeof(*syms),  sizeof(*syms), 0);
@@ -1912,9 +1912,10 @@ static void vc1_interp_mc(VC1Context *v)
    uvmx = (mx + ((mx & 3) == 3)) >> 1;
    uvmy = (my + ((my & 3) == 3)) >> 1;
    if (v->field_mode) {
-        if (v->cur_field_type != v->ref_field_type[1])
+        if (v->cur_field_type != v->ref_field_type[1]) {
            my   = my   - 2 + 4 * v->cur_field_type;
            uvmy = uvmy - 2 + 4 * v->cur_field_type;
+        }
    }
    if (v->fastuvmc) {
        uvmx = uvmx + ((uvmx < 0) ? -(uvmx & 1) : (uvmx & 1));
@@ -6004,7 +6005,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data,

    /* skip B-frames if we don't have reference frames */
    if (s->last_picture_ptr == NULL && (s->pict_type == AV_PICTURE_TYPE_B || s->droppable)) {
-        goto err;
+        goto end;
    }
    if ((avctx->skip_frame >= AVDISCARD_NONREF && s->pict_type == AV_PICTURE_TYPE_B) ||
        (avctx->skip_frame >= AVDISCARD_NONKEY && s->pict_type != AV_PICTURE_TYPE_I) ||
@@ -85,6 +85,11 @@ int ff_vorbis_len2vlc(uint8_t *bits, uint32_t *codes, unsigned num)

    ++p;

+    for (i = p; (bits[i] == 0) && (i < num); ++i)
+        ;
+    if (i == num)
+        return 0;
+
    for (; p < num; ++p) {
        if (bits[p] > 32)
             return 1;
@@ -151,7 +151,7 @@ typedef struct vorbis_context_s {
    uint8_t       mode_count;
    vorbis_mode  *modes;
    uint8_t       mode_number; // mode number for the current packet
-    uint8_t       previous_window;
+    int8_t       previous_window;
    float        *channel_residues;
    float        *saved;
 } vorbis_context;
@@ -701,8 +701,7 @@ static int vorbis_parse_setup_hdr_residues(vorbis_context *vc)
        res_setup->partition_size = get_bits(gb, 24) + 1;
        /* Validations to prevent a buffer overflow later. */
        if (res_setup->begin>res_setup->end ||
-            res_setup->end > (res_setup->type == 2 ? vc->audio_channels : 1) * vc->blocksize[1] / 2 ||
-            (res_setup->end-res_setup->begin) / res_setup->partition_size > V_MAX_PARTITIONS) {
+            (res_setup->end-res_setup->begin) / res_setup->partition_size > FFMIN(V_MAX_PARTITIONS, 65535)) {
            av_log(vc->avctx, AV_LOG_ERROR,
                   "partition out of bounds: type, begin, end, size, blocksize: %"PRIu16", %"PRIu32", %"PRIu32", %u, %"PRIu32"\n",
                   res_setup->type, res_setup->begin, res_setup->end,
@@ -989,7 +988,7 @@ static int vorbis_parse_id_hdr(vorbis_context *vc)
    if (!vc->channel_residues || !vc->saved)
        return AVERROR(ENOMEM);

-    vc->previous_window  = 0;
+    vc->previous_window  = -1;

    ff_mdct_init(&vc->mdct[0], bl0, 1, -1.0);
    ff_mdct_init(&vc->mdct[1], bl1, 1, -1.0);
@@ -1372,6 +1371,7 @@ static av_always_inline int vorbis_residue_decode_internal(vorbis_context *vc,
    unsigned pass, ch_used, i, j, k, l;
    unsigned max_output = (ch - 1) * vlen;
    int ptns_to_read = vr->ptns_to_read;
+    int libvorbis_bug = 0;

    if (vr_type == 2) {
        for (j = 1; j < ch; ++j)
@@ -1386,8 +1386,13 @@ static av_always_inline int vorbis_residue_decode_internal(vorbis_context *vc,
    }

    if (max_output > ch_left * vlen) {
-        av_log(vc->avctx, AV_LOG_ERROR, "Insufficient output buffer\n");
-        return AVERROR_INVALIDDATA;
+        if (max_output <= ch_left * vlen + vr->partition_size*ch_used/ch) {
+            ptns_to_read--;
+            libvorbis_bug = 1;
+        } else {
+            av_log(vc->avctx, AV_LOG_ERROR, "Insufficient output buffer\n");
+            return AVERROR_INVALIDDATA;
+        }
    }

    av_dlog(NULL, " residue type 0/1/2 decode begin, ch: %d  cpc %d  \n", ch, c_p_c);
@@ -1496,6 +1501,14 @@ static av_always_inline int vorbis_residue_decode_internal(vorbis_context *vc,
                voffset += vr->partition_size;
            }
        }
+        if (libvorbis_bug && !pass) {
+            for (j = 0; j < ch_used; ++j) {
+                if (!do_not_decode[j]) {
+                    get_vlc2(&vc->gb, vc->codebooks[vr->classbook].vlc.table,
+                                vc->codebooks[vr->classbook].nb_bits, 3);
+                }
+            }
+        }
    }
    return 0;
 }
@@ -1548,7 +1561,7 @@ static int vorbis_parse_audio_packet(vorbis_context *vc, float **floor_ptr)
 {
    GetBitContext *gb = &vc->gb;
    FFTContext *mdct;
-    unsigned previous_window = vc->previous_window;
+    int previous_window = vc->previous_window;
    unsigned mode_number, blockflag, blocksize;
    int i, j;
    uint8_t no_residue[255];
@@ -1581,9 +1594,11 @@ static int vorbis_parse_audio_packet(vorbis_context *vc, float **floor_ptr)
    blocksize = vc->blocksize[blockflag];
    vlen = blocksize / 2;
    if (blockflag) {
-        previous_window = get_bits(gb, 1);
-        skip_bits1(gb); // next_window
-    }
+        int code = get_bits(gb, 2);
+        if (previous_window < 0)
+            previous_window = code>>1;
+    } else if (previous_window < 0)
+        previous_window = 0;

    memset(ch_res_ptr,   0, sizeof(float) * vc->audio_channels * vlen); //FIXME can this be removed ?
    for (i = 0; i < vc->audio_channels; ++i)
@@ -1812,7 +1827,7 @@ static av_cold void vorbis_decode_flush(AVCodecContext *avctx)
        memset(vc->saved, 0, (vc->blocksize[1] / 4) * vc->audio_channels *
                             sizeof(*vc->saved));
    }
-    vc->previous_window = 0;
+    vc->previous_window = -1;
 }

 AVCodec ff_vorbis_decoder = {
@@ -253,6 +253,10 @@ static int wv_get_value(WavpackFrameContext *ctx, GetBitContext *gb,
    return sign ? ~ret : ret;

 error:
+    ret = get_bits_left(gb);
+    if (ret <= 0) {
+        av_log(ctx->avctx, AV_LOG_ERROR, "Too few bits (%d) left\n", ret);
+    }
    *last = 1;
    return 0;
 }
@@ -638,7 +638,7 @@ static uint32_t log2sample(uint32_t v, int limit, uint32_t *result)

    if ((v += v >> 9) < (1 << 8)) {
        dbits = nbits_table[v];
-        result += (dbits << 8) + wp_log2_table[(v << (9 - dbits)) & 0xff];
+        *result += (dbits << 8) + wp_log2_table[(v << (9 - dbits)) & 0xff];
    } else {
        if (v < (1L << 16))
            dbits = nbits_table[v >> 8] + 8;
@@ -647,7 +647,7 @@ static uint32_t log2sample(uint32_t v, int limit, uint32_t *result)
        else
            dbits = nbits_table[v >> 24] + 24;

-        result += dbits = (dbits << 8) + wp_log2_table[(v >> (dbits - 9)) & 0xff];
+        *result += dbits = (dbits << 8) + wp_log2_table[(v >> (dbits - 9)) & 0xff];

        if (limit && dbits >= limit)
            return 1;
@@ -2876,10 +2876,11 @@ static int wavpack_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
            return AVERROR(ENOMEM);
    }

-    if ((ret = ff_alloc_packet2(avctx, avpkt, s->block_samples * avctx->channels * 8)) < 0)
+    buf_size = s->block_samples * avctx->channels * 8
+             + 200 /* for headers */;
+    if ((ret = ff_alloc_packet2(avctx, avpkt, buf_size)) < 0)
        return ret;
    buf = avpkt->data;
-    buf_size = avpkt->size;

    for (s->ch_offset = 0; s->ch_offset < avctx->channels;) {
        set_samplerate(s);
@@ -1024,7 +1024,7 @@ static int apply_color_indexing_transform(WebPContext *s)
    ImageContext *img;
    ImageContext *pal;
    int i, x, y;
-    uint8_t *p, *pi;
+    uint8_t *p;

    img = &s->image[IMAGE_ROLE_ARGB];
    pal = &s->image[IMAGE_ROLE_COLOR_INDEXING];
@@ -1062,11 +1062,11 @@ static int apply_color_indexing_transform(WebPContext *s)
            p = GET_PIXEL(img->frame, x, y);
            i = p[2];
            if (i >= pal->frame->width) {
-                av_log(s->avctx, AV_LOG_ERROR, "invalid palette index %d\n", i);
-                return AVERROR_INVALIDDATA;
+                AV_WB32(p, 0xFF000000);
+            } else {
+                const uint8_t *pi = GET_PIXEL(pal->frame, i, 0);
+                AV_COPY32(p, pi);
            }
-            pi = GET_PIXEL(pal->frame, i, 0);
-            AV_COPY32(p, pi);
        }
    }

@@ -386,9 +386,9 @@ int ff_wma_end(AVCodecContext *avctx)
    }
    for (i = 0; i < 2; i++) {
        ff_free_vlc(&s->coef_vlc[i]);
-        av_free(s->run_table[i]);
-        av_free(s->level_table[i]);
-        av_free(s->int_table[i]);
+        av_freep(&s->run_table[i]);
+        av_freep(&s->level_table[i]);
+        av_freep(&s->int_table[i]);
    }

    return 0;
@@ -61,6 +61,9 @@ cglobal scalarproduct_int16, 3,3,3, v1, v2, order
 %endif
    paddd   m2, m0
    movd   eax, m2
+%if mmsize == 8
+    emms
+%endif
    RET

 ; int scalarproduct_and_madd_int16(int16_t *v1, int16_t *v2, int16_t *v3, int order, int mul)
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .2
 .2.8