Update for 2.4.6

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
doc/examples: fix lib math dep for decoding_encoding
2015-01-13 17:14:46 +01:00 · 2015-01-10 05:03:51 +01:00 · 2015-01-10 05:02:19 +01:00 · 2015-01-09 17:18:41 +01:00 · 2015-01-09 17:18:41 +01:00 · 2015-01-09 17:18:41 +01:00
110 changed files with 1588 additions and 280 deletions
@@ -0,0 +1 @@
+*.pnm -diff -text
@@ -3,6 +3,127 @@ releases are sorted from youngest to oldest.

 version <next>:

+
+version 2.4.6:
+- doc/examples: fix lib math dep for decoding_encoding
+- avformat/movenc: workaround bug in "PathScale EKOPath(tm) Compiler Suite Version 4.0.12.1"
+- vp9: fix parser return values in error case
+- ffmpeg: Clear error message array at init.
+- avcodec/dvdsubdec: fix accessing dangling pointers
+- avcodec/dvdsubdec: error on bitmaps with size 0
+- avformat/mov: Fix mixed declaration and statement warning
+- cmdutils: Use 64bit for file size/offset related variable in cmdutils_read_file()
+- avformat/utils: Clear pointer in ff_alloc_extradata() to avoid leaving a stale pointer in memory
+- avformat/matroskadec: Use av_freep() to avoid leaving stale pointers in memory
+- lavfi: check av_strdup() return value
+- mov: Fix negative size calculation in mov_read_default().
+- avformat/mov: fix integer overflow in mov_read_udta_string()
+- mov: Avoid overflow with mov_metadata_raw()
+- avcodec/dvdsubdec: fix out of bounds accesses
+- avfilter/vf_sab: fix filtering tiny images
+- avformat/flvdec: Increase string array size
+- avformat/flvdec: do not inject dts=0 metadata packets which failed to be parsed into a new data stream
+- avformat/cdxl: Fix integer overflow of image_size
+- avformat/segment: Use av_freep() avoid leaving stale pointers in memory
+- avformat/mov: Fix memleaks for duplicate STCO/CO64/STSC atoms
+- mov: avoid a memleak when multiple stss boxes are presen
+
+version 2.4.5:
+- lavu/frame: fix malloc error path in av_frame_copy_props()
+- avformat/utils: Do not update programs streams from program-less streams in update_wrap_reference()
+- avformat/aviobuf: Check that avio_seek() target is non negative
+- swresample/soxr_resample: fix error handling
+- avformat/flvdec: fix potential use of uninitialized variables
+- avformat/matroskadec: fix handling of recursive SeekHead elements
+- doc/examples/transcoding: check encoder before using it
+- swscale/x86/rgb2rgb_template: fix crash with tiny size and nv12 output
+- avformat/rmdec: Check codec_data_size
+- avformat/aviobuf: Fix infinite loop in ff_get_line()
+- vc1: Do not assume seek happens after decoding
+- mmvideo: check frame dimensions
+- jvdec: check frame dimensions
+- avcodec/indeo3: ensure offsets are non negative
+- avcodec/h264: Check *log2_weight_denom
+- avcodec/hevc_ps: Check diff_cu_qp_delta_depth
+- avcodec/h264: Clear delayed_pic on deallocation
+- avcodec/hevc: clear filter_slice_edges() on allocation
+- avcodec/dcadec: Check that the added xch channel isnt already there
+- avcodec/indeo3: use signed variables to avoid underflow
+- swscale: increase yuv2rgb table headroom
+- avformat/mov: fix integer overflow of size
+- avformat/mov: check atom nesting depth
+- avcodec/utvideodec: Fix handling of slice_height=0
+- avcodec/vmdvideo: Check len before using it in method 3
+- avformat/flvdec: Use av_freep() avoid leaving stale pointers in memory
+- avformat/hdsenc: Use av_freep() avoid leaving stale pointers in memory
+- configure: create the tests directory like the doc directory
+- v4l2: Make use of the VIDIOC_ENUM_FRAMESIZES ioctl on OpenBSD
+- avcodec/motion_est: use 2x8x8 for interlaced qpel
+- Treat all '*.pnm' files as non-text file
+
+version 2.4.4:
+- avformat: replace some odd 30-60 rates by higher less odd ones in  get_std_framerate()
+- swscale: fix yuv2yuvX_8 assembly on x86
+- avcodec/hevc_ps: Check num_long_term_ref_pics_sps
+- avcodec/mjpegdec: Fix integer overflow in shift
+- avcodec/hevc_ps: Check return code from pps_range_extensions()
+- avcodec/rawdec: Check the return code of avpicture_get_size()
+- avcodec/pngdec: Check IHDR/IDAT order
+- avcodec/flacdec: Call ff_flacdsp_init() unconditionally
+- avcodec/utils: Check that the data is complete in avpriv_bprint_to_extradata()
+- avcodec/mjpegdec: Fix context fields becoming inconsistent
+- avcodec/mjpegdec: Check for pixfmtid 0x42111100 || 0x24111100 with more than 8 bits
+- swscale/x86/rgb2rgb_template: handle the first 2 lines with C in rgb24toyv12_*()
+- doc/APIchanges: Fix some wrong versions
+- avformat/hlsenc: Free context after hls_append_segment
+- avcodec/mpeg4video_parser: fix spurious extradata parse warnings
+- lavu/opt: fix av_opt_get function
+- avcodec/wmaprodec: Fix integer overflow in sfb_offsets initialization
+- avcodec/utvideodec: fix assumtation that slice_height >= 1
+- avcodec/options_table fix min of audio channels and sample rate
+- libavutil/thread.h: Support OS/2 threads
+- fix Makefile objects for pulseaudio support
+- opusdec: make sure all substreams have the same number of coded samples
+- lavu: add wrappers for the pthreads mutex API
+- avformat/avidec: fix handling dv in avi
+- avfilter/vf_lut: gammaval709()
+- cinedec: report white balance gain coefficients using metadata
+- swscale/utils: support bayer input + scaling, and bayer input + any supported output
+- swscale: support internal scaler cascades
+- avformat/dtsdec: dts_probe: check reserved bit, check lfe, check sr_code similarity
+- avformat/segment: export inner muxer timebase
+- Remove fminf() emulation, fix build issues
+- avcodec/mpegaudio_parser: fix off by 1 error in bitrate calculation
+- Use -fno-optimize-sibling-calls on parisc also for gcc 4.9.
+- ffmpeg_opt: store canvas size in decoder context
+- avcodec/mpeg12dec: do not trust AVCodecContext input dimensions
+
+version 2.4.3:
+- avcodec/svq1dec: zero terminate embedded message before printing
+- avcodec/cook: check that the subpacket sizes fit in block_align
+- avcodec/g2meet: check tile dimensions to avoid integer overflow
+- avcodec/utils: Align dimensions by at least their chroma sub-sampling factors.
+- avcodec/dnxhddec: treat pix_fmt like width/height
+- avcodec/dxa: check dimensions
+- avcodec/dirac_arith: fix integer overflow
+- avcodec/diracdec: Tighter checks on CODEBLOCKS_X/Y
+- avcodec/diracdec: Use 64bit in calculation of codeblock coordinates
+- avcodec/sgidec: fix count check
+- avcodec/sgidec: fix linesize for 16bit
+- avcodec/hevc_ps: Check default display window bitstream and skip if invalid
+- avcodec/tiffenc: properly compute packet size
+- lavd: export all symbols with av_ prefix
+- avformat/mxfdec: Fix termination of mxf_data_essence_container_uls
+- postproc: fix qp count
+- postproc/postprocess: fix quant store for fq mode
+- vf_drawtext: add missing clear of pointers after av_expr_free()
+- utvideoenc: properly set slice height/last line
+- swresample: fix sample drop loop end condition
+- resample: Avoid off-by-1 errors in PTS calcs.
+- imc: fix order of operations in coefficients read
+- hevc_mvs: make sure to always initialize the temporal MV fully
+- hevc_mvs: initialize the temporal MV in case of missing reference
+
 version 2.4.2:
 - avcodec/on2avc: Check number of channels
 - avcodec/hevc: fix chroma transform_add size
@@ -111,7 +111,7 @@ endef

 $(foreach P,$(PROGS),$(eval $(call DOPROG,$(P:$(PROGSSUF)$(EXESUF)=))))

-ffprobe.o cmdutils.o : libavutil/ffversion.h
+ffprobe.o cmdutils.o libavcodec/utils.o libavformat/utils.o libavdevice/avdevice.o libavfilter/avfilter.o libavutil/utils.o libpostproc/postprocess.o libswresample/swresample.o libswscale/utils.o : libavutil/ffversion.h

 $(PROGS): %$(PROGSSUF)$(EXESUF): %$(PROGSSUF)_g$(EXESUF)
 	$(CP) $< $@
@@ -1 +1 @@
-2.4.2
+2.4.6
@@ -1857,7 +1857,7 @@ int read_yesno(void)

 int cmdutils_read_file(const char *filename, char **bufptr, size_t *size)
 {
-    int ret;
+    int64_t ret;
    FILE *f = av_fopen_utf8(filename, "rb");

    if (!f) {
@@ -1668,7 +1668,6 @@ MATH_FUNCS="
    exp2
    exp2f
    expf
-    fminf
    isinf
    isnan
    ldexpf
@@ -3934,6 +3933,9 @@ case "$arch" in
    ;;
    x86)
        check_64bit x86_32 x86_64 'sizeof(void *) > 4'
+        # Treat x32 as x64 for now. Note it also needs spic=$shared
+        test "$subarch" = "x86_32" && check_cpp_condition stddef.h 'defined(__x86_64__)' &&
+            subarch=x86_64
        if test "$subarch" = "x86_64"; then
            spic=$shared
        fi
@@ -4500,7 +4502,7 @@ elif enabled parisc; then

    if enabled gcc; then
        case $($cc -dumpversion) in
-            4.[3-8].*) check_cflags -fno-optimize-sibling-calls ;;
+            4.[3-9].*) check_cflags -fno-optimize-sibling-calls ;;
        esac
    fi

@@ -4782,7 +4784,6 @@ disabled crystalhd || check_lib libcrystalhd/libcrystalhd_if.h DtsCrystalHDVersi
 atan2f_args=2
 ldexpf_args=2
 powf_args=2
-fminf_args=2

 for func in $MATH_FUNCS; do
    eval check_mathfunc $func \${${func}_args:-1}
@@ -4943,6 +4944,7 @@ check_header linux/videodev2.h
 check_code cc linux/videodev2.h "struct v4l2_frmsizeenum vfse; vfse.discrete.width = 0;" && enable_safe struct_v4l2_frmivalenum_discrete

 check_header sys/videoio.h
+check_code cc sys/videoio.h "struct v4l2_frmsizeenum vfse; vfse.discrete.width = 0;" && enable_safe struct_v4l2_frmivalenum_discrete

 check_func_headers "windows.h vfw.h" capCreateCaptureWindow "$vfwcap_indev_extralibs"
 # check that WM_CAP_DRIVER_CONNECT is defined to the proper value
@@ -5598,7 +5600,7 @@ cat > $TMPH <<EOF
 #define FFMPEG_CONFIG_H
 #define FFMPEG_CONFIGURATION "$(c_escape $FFMPEG_CONFIGURATION)"
 #define FFMPEG_LICENSE "$(c_escape $license)"
-#define CONFIG_THIS_YEAR 2014
+#define CONFIG_THIS_YEAR 2015
 #define FFMPEG_DATADIR "$(eval c_escape $datadir)"
 #define AVCONV_DATADIR "$(eval c_escape $datadir)"
 #define CC_IDENT "$(c_escape ${cc_ident:-Unknown compiler})"
@@ -5626,6 +5628,7 @@ enabled getenv || echo "#define getenv(x) NULL" >> $TMPH


 mkdir -p doc
+mkdir -p tests
 echo "@c auto-generated by configure" > doc/config.texi

 print_config ARCH_   "$config_files" $ARCH_LIST
@@ -214,10 +214,10 @@ API changes, most recent first:
 2014-05-11 - 14aef38 / 66e6c8a - lavu 52.83.100 / 53.14.0 - pixfmt.h
  Add AV_PIX_FMT_VDA for new-style VDA acceleration.

-2014-05-xx - xxxxxxx - lavu 52.82.0 - fifo.h
+2014-05-xx - xxxxxxx - lavu 52.82.100 - fifo.h
  Add av_fifo_freep() function.

-2014-05-02 - ba52fb11 - lavu 52.81.0 - opt.h
+2014-05-02 - ba52fb11 - lavu 52.81.100 - opt.h
  Add av_opt_set_dict2() function.

 2014-05-01 - e77b985 / a2941c8 - lavc 55.60.103 / 55.50.3 - avcodec.h
@@ -31,7 +31,7 @@ PROJECT_NAME           = FFmpeg
 # This could be handy for archiving the generated documentation or
 # if some version control system is used.

-PROJECT_NUMBER         = 2.4.2
+PROJECT_NUMBER         = 2.4.6

 # With the PROJECT_LOGO tag one can specify a logo or icon that is included
 # in the documentation. The maximum height of the logo should not exceed 55
@@ -29,6 +29,7 @@ OBJS=$(addsuffix .o,$(EXAMPLES))

 # the following examples make explicit use of the math library
 avcodec:           LDLIBS += -lm
+decoding_encoding: LDLIBS += -lm
 muxing:            LDLIBS += -lm
 resampling_audio:  LDLIBS += -lm

@@ -116,6 +116,10 @@ static int open_output_file(const char *filename)
                || dec_ctx->codec_type == AVMEDIA_TYPE_AUDIO) {
            /* in this example, we choose transcoding to same codec */
            encoder = avcodec_find_encoder(dec_ctx->codec_id);
+            if (!encoder) {
+                av_log(NULL, AV_LOG_FATAL, "Neccessary encoder not found\n");
+                return AVERROR_INVALIDDATA;
+            }

            /* In this example, we transcode to same properties (picture size,
             * sample rate etc.). These properties can be changed for output
@@ -14,9 +14,9 @@
 # FFmpeg is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-# Lesser General Public License for more details.
+# General Public License for more details.
 #
-# You should have received a copy of the GNU Lesser General Public
+# You should have received a copy of the GNU General Public
 # License along with FFmpeg; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA

@@ -978,10 +978,8 @@ static void do_video_out(AVFormatContext *s,
        /* raw pictures are written as AVPicture structure to
           avoid any copies. We support temporarily the older
           method. */
-        mux_enc->coded_frame->interlaced_frame = in_picture->interlaced_frame;
-        mux_enc->coded_frame->top_field_first  = in_picture->top_field_first;
-        if (mux_enc->coded_frame->interlaced_frame)
-            mux_enc->field_order = mux_enc->coded_frame->top_field_first ? AV_FIELD_TB:AV_FIELD_BT;
+        if (in_picture->interlaced_frame)
+            mux_enc->field_order = in_picture->top_field_first ? AV_FIELD_TB:AV_FIELD_BT;
        else
            mux_enc->field_order = AV_FIELD_PROGRESSIVE;
        pkt.data   = (uint8_t *)in_picture;
@@ -2463,7 +2461,7 @@ static int transcode_init(void)
    AVFormatContext *oc;
    OutputStream *ost;
    InputStream *ist;
-    char error[1024];
+    char error[1024] = {0};
    int want_sdp = 1;

    for (i = 0; i < nb_filtergraphs; i++) {
@@ -702,7 +702,7 @@ static void add_input_streams(OptionsContext *o, AVFormatContext *ic)
            MATCH_PER_STREAM_OPT(fix_sub_duration, i, ist->fix_sub_duration, ic, st);
            MATCH_PER_STREAM_OPT(canvas_sizes, str, canvas_size, ic, st);
            if (canvas_size &&
-                av_parse_video_size(&dec->width, &dec->height, canvas_size) < 0) {
+                av_parse_video_size(&ist->dec_ctx->width, &ist->dec_ctx->height, canvas_size) < 0) {
                av_log(NULL, AV_LOG_FATAL, "Invalid canvas size: %s.\n", canvas_size);
                exit_program(1);
            }
@@ -1215,8 +1215,8 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)

        q->num_subpackets++;
        s++;
-        if (s > MAX_SUBPACKETS) {
-            avpriv_request_sample(avctx, "subpackets > %d", MAX_SUBPACKETS);
+        if (s > FFMIN(MAX_SUBPACKETS, avctx->block_align)) {
+            avpriv_request_sample(avctx, "subpackets > %d", FFMIN(MAX_SUBPACKETS, avctx->block_align));
            return AVERROR_PATCHWELCOME;
        }
    }
@@ -2359,6 +2359,10 @@ FF_ENABLE_DEPRECATION_WARNINGS
 #else
            if (s->xch_present && !s->xch_disable) {
 #endif
+                if (avctx->channel_layout & AV_CH_BACK_CENTER) {
+                    avpriv_request_sample(avctx, "XCh with Back center channel");
+                    return AVERROR_INVALIDDATA;
+                }
                avctx->channel_layout |= AV_CH_BACK_CENTER;
                if (s->lfe) {
                    avctx->channel_layout |= AV_CH_LOW_FREQUENCY;
@@ -171,6 +171,10 @@ static inline int dirac_get_arith_uint(DiracArith *c, int follow_ctx, int data_c
 {
    int ret = 1;
    while (!dirac_get_arith_bit(c, follow_ctx)) {
+        if (ret >= 0x40000000) {
+            av_log(NULL, AV_LOG_ERROR, "dirac_get_arith_uint overflow\n");
+            return -1;
+        }
        ret <<= 1;
        ret += dirac_get_arith_bit(c, data_ctx);
        follow_ctx = ff_dirac_next_ctx[follow_ctx];
@@ -612,10 +612,10 @@ static av_always_inline void decode_subband_internal(DiracContext *s, SubBand *b

    top = 0;
    for (cb_y = 0; cb_y < cb_height; cb_y++) {
-        bottom = (b->height * (cb_y+1)) / cb_height;
+        bottom = (b->height * (cb_y+1LL)) / cb_height;
        left = 0;
        for (cb_x = 0; cb_x < cb_width; cb_x++) {
-            right = (b->width * (cb_x+1)) / cb_width;
+            right = (b->width * (cb_x+1LL)) / cb_width;
            codeblock(s, b, &gb, &c, left, right, top, bottom, blockcnt_one, is_arith);
            left = right;
        }
@@ -1004,8 +1004,8 @@ static int dirac_unpack_idwt_params(DiracContext *s)
        /* Codeblock parameters (core syntax only) */
        if (get_bits1(gb)) {
            for (i = 0; i <= s->wavelet_depth; i++) {
-                CHECKEDREAD(s->codeblock[i].width , tmp < 1, "codeblock width invalid\n")
-                CHECKEDREAD(s->codeblock[i].height, tmp < 1, "codeblock height invalid\n")
+                CHECKEDREAD(s->codeblock[i].width , tmp < 1 || tmp > (s->avctx->width >>s->wavelet_depth-i), "codeblock width invalid\n")
+                CHECKEDREAD(s->codeblock[i].height, tmp < 1 || tmp > (s->avctx->height>>s->wavelet_depth-i), "codeblock height invalid\n")
            }

            CHECKEDREAD(s->codeblock_mode, tmp > 1, "unknown codeblock mode\n")
@@ -38,6 +38,7 @@ typedef struct DNXHDContext {
    BlockDSPContext bdsp;
    int64_t cid;                        ///< compression id
    unsigned int width, height;
+    enum AVPixelFormat pix_fmt;
    unsigned int mb_width, mb_height;
    uint32_t mb_scan_index[68];         /* max for 1080p */
    int cur_field;                      ///< current interlaced field
@@ -141,7 +142,7 @@ static int dnxhd_decode_header(DNXHDContext *ctx, AVFrame *frame,

    ctx->is_444 = 0;
    if (buf[0x4] == 0x2) {
-        ctx->avctx->pix_fmt = AV_PIX_FMT_YUV444P10;
+        ctx->pix_fmt = AV_PIX_FMT_YUV444P10;
        ctx->avctx->bits_per_raw_sample = 10;
        if (ctx->bit_depth != 10) {
            ff_blockdsp_init(&ctx->bdsp, ctx->avctx);
@@ -151,7 +152,7 @@ static int dnxhd_decode_header(DNXHDContext *ctx, AVFrame *frame,
        }
        ctx->is_444 = 1;
    } else if (buf[0x21] & 0x40) {
-        ctx->avctx->pix_fmt = AV_PIX_FMT_YUV422P10;
+        ctx->pix_fmt = AV_PIX_FMT_YUV422P10;
        ctx->avctx->bits_per_raw_sample = 10;
        if (ctx->bit_depth != 10) {
            ff_blockdsp_init(&ctx->bdsp, ctx->avctx);
@@ -160,7 +161,7 @@ static int dnxhd_decode_header(DNXHDContext *ctx, AVFrame *frame,
            ctx->decode_dct_block = dnxhd_decode_dct_block_10;
        }
    } else {
-        ctx->avctx->pix_fmt = AV_PIX_FMT_YUV422P;
+        ctx->pix_fmt = AV_PIX_FMT_YUV422P;
        ctx->avctx->bits_per_raw_sample = 8;
        if (ctx->bit_depth != 8) {
            ff_blockdsp_init(&ctx->bdsp, ctx->avctx);
@@ -446,7 +447,13 @@ decode_coding_unit:
               avctx->width, avctx->height, ctx->width, ctx->height);
        first_field = 1;
    }
+    if (avctx->pix_fmt != AV_PIX_FMT_NONE && avctx->pix_fmt != ctx->pix_fmt) {
+        av_log(avctx, AV_LOG_WARNING, "pix_fmt changed: %s -> %s\n",
+               av_get_pix_fmt_name(avctx->pix_fmt), av_get_pix_fmt_name(ctx->pix_fmt));
+        first_field = 1;
+    }

+    avctx->pix_fmt = ctx->pix_fmt;
    ret = ff_set_dimensions(avctx, ctx->width, ctx->height);
    if (ret < 0)
        return ret;
@@ -37,7 +37,7 @@ typedef struct DVDSubContext
  int      has_palette;
  uint8_t  colormap[4];
  uint8_t  alpha[256];
-  uint8_t *buf;
+  uint8_t  buf[0x10000];
  int      buf_size;
 #ifdef DEBUG
  int sub_id;
@@ -105,6 +105,12 @@ static int decode_rle(uint8_t *bitmap, int linesize, int w, int h,
    int x, y, len, color;
    uint8_t *d;

+    if (start >= buf_size)
+        return -1;
+
+    if (w <= 0 || h <= 0)
+        return -1;
+
    bit_len = (buf_size - start) * 8;
    init_get_bits(&gb, buf + start, bit_len);

@@ -356,10 +362,12 @@ static int decode_dvd_subtitles(DVDSubContext *ctx, AVSubtitle *sub_header,
                sub_header->rects[0] = av_mallocz(sizeof(AVSubtitleRect));
                sub_header->num_rects = 1;
                sub_header->rects[0]->pict.data[0] = bitmap;
-                decode_rle(bitmap, w * 2, w, (h + 1) / 2,
-                           buf, offset1, buf_size, is_8bit);
-                decode_rle(bitmap + w, w * 2, w, h / 2,
-                           buf, offset2, buf_size, is_8bit);
+                if (decode_rle(bitmap, w * 2, w, (h + 1) / 2,
+                               buf, offset1, buf_size, is_8bit) < 0)
+                    goto fail;
+                if (decode_rle(bitmap + w, w * 2, w, h / 2,
+                               buf, offset2, buf_size, is_8bit) < 0)
+                    goto fail;
                sub_header->rects[0]->pict.data[1] = av_mallocz(AVPALETTE_SIZE);
                if (is_8bit) {
                    if (!yuv_palette)
@@ -498,15 +506,11 @@ static int append_to_cached_buf(AVCodecContext *avctx,
 {
    DVDSubContext *ctx = avctx->priv_data;

-    if (ctx->buf_size > 0xffff - buf_size) {
+    if (ctx->buf_size >= sizeof(ctx->buf) - buf_size) {
        av_log(avctx, AV_LOG_WARNING, "Attempt to reconstruct "
               "too large SPU packets aborted.\n");
-        av_freep(&ctx->buf);
        return AVERROR_INVALIDDATA;
    }
-    ctx->buf = av_realloc(ctx->buf, ctx->buf_size + buf_size);
-    if (!ctx->buf)
-        return AVERROR(ENOMEM);
    memcpy(ctx->buf + ctx->buf_size, buf, buf_size);
    ctx->buf_size += buf_size;
    return 0;
@@ -522,7 +526,7 @@ static int dvdsub_decode(AVCodecContext *avctx,
    AVSubtitle *sub = data;
    int is_menu;

-    if (ctx->buf) {
+    if (ctx->buf_size) {
        int ret = append_to_cached_buf(avctx, buf, buf_size);
        if (ret < 0) {
            *data_size = 0;
@@ -561,7 +565,6 @@ static int dvdsub_decode(AVCodecContext *avctx,
    }
 #endif

-    av_freep(&ctx->buf);
    ctx->buf_size = 0;
    *data_size = 1;
    return buf_size;
@@ -643,7 +646,6 @@ static av_cold int dvdsub_init(AVCodecContext *avctx)
 static av_cold int dvdsub_close(AVCodecContext *avctx)
 {
    DVDSubContext *ctx = avctx->priv_data;
-    av_freep(&ctx->buf);
    ctx->buf_size = 0;
    return 0;
 }
@@ -329,6 +329,11 @@ static av_cold int decode_init(AVCodecContext *avctx)
 {
    DxaDecContext * const c = avctx->priv_data;

+    if (avctx->width%4 || avctx->height%4) {
+        avpriv_request_sample(avctx, "dimensions are not a multiple of 4");
+        return AVERROR_INVALIDDATA;
+    }
+
    c->prev = av_frame_alloc();
    if (!c->prev)
        return AVERROR(ENOMEM);
@@ -473,10 +473,10 @@ static int decode_frame(FLACContext *s)
        ret = allocate_buffers(s);
        if (ret < 0)
            return ret;
-        ff_flacdsp_init(&s->dsp, s->avctx->sample_fmt, s->bps);
        s->got_streaminfo = 1;
        dump_headers(s->avctx, (FLACStreaminfo *)s);
    }
+    ff_flacdsp_init(&s->dsp, s->avctx->sample_fmt, s->bps);

 //    dump_headers(s->avctx, (FLACStreaminfo *)s);

@@ -736,8 +736,10 @@ static int g2m_decode_frame(AVCodecContext *avctx, void *data,
            }
            c->tile_width  = bytestream2_get_be32(&bc);
            c->tile_height = bytestream2_get_be32(&bc);
-            if (!c->tile_width || !c->tile_height ||
-                ((c->tile_width | c->tile_height) & 0xF)) {
+            if (c->tile_width <= 0 || c->tile_height <= 0 ||
+                ((c->tile_width | c->tile_height) & 0xF) ||
+                c->tile_width * 4LL * c->tile_height >= INT_MAX
+            ) {
                av_log(avctx, AV_LOG_ERROR,
                       "Invalid tile dimensions %dx%d\n",
                       c->tile_width, c->tile_height);
@@ -282,7 +282,7 @@ static int gif_read_image(GifState *s, AVFrame *frame)
                break;
            }
            while (y1 >= height) {
-                y1 = 4 >> pass;
+                y1  = 4 >> pass;
                ptr = ptr1 + linesize * y1;
                pass++;
            }
@@ -391,6 +391,7 @@ void ff_h264_free_tables(H264Context *h, int free_rbsp)
    if (free_rbsp && h->DPB) {
        for (i = 0; i < H264_MAX_PICTURE_COUNT; i++)
            ff_h264_unref_picture(h, &h->DPB[i]);
+        memset(h->delayed_pic, 0, sizeof(h->delayed_pic));
        av_freep(&h->DPB);
    } else if (h->DPB) {
        for (i = 0; i < H264_MAX_PICTURE_COUNT; i++)
@@ -990,6 +991,16 @@ int ff_pred_weight_table(H264Context *h)
    h->luma_log2_weight_denom = get_ue_golomb(&h->gb);
    if (h->sps.chroma_format_idc)
        h->chroma_log2_weight_denom = get_ue_golomb(&h->gb);
+
+    if (h->luma_log2_weight_denom > 7U) {
+        av_log(h->avctx, AV_LOG_ERROR, "luma_log2_weight_denom %d is out of range\n", h->luma_log2_weight_denom);
+        h->luma_log2_weight_denom = 0;
+    }
+    if (h->chroma_log2_weight_denom > 7U) {
+        av_log(h->avctx, AV_LOG_ERROR, "chroma_log2_weight_denom %d is out of range\n", h->chroma_log2_weight_denom);
+        h->chroma_log2_weight_denom = 0;
+    }
+
    luma_def   = 1 << h->luma_log2_weight_denom;
    chroma_def = 1 << h->chroma_log2_weight_denom;

@@ -1330,43 +1341,6 @@ int ff_set_ref_count(H264Context *h)

 static const uint8_t start_code[] = { 0x00, 0x00, 0x01 };

-static int find_start_code(const uint8_t *buf, int buf_size,
-                           int buf_index, int next_avc)
-{
-    // start code prefix search
-    for (; buf_index + 3 < next_avc; buf_index++)
-        // This should always succeed in the first iteration.
-        if (buf[buf_index]     == 0 &&
-            buf[buf_index + 1] == 0 &&
-            buf[buf_index + 2] == 1)
-            break;
-
-    buf_index += 3;
-
-    if (buf_index >= buf_size)
-        return buf_size;
-
-    return buf_index;
-}
-
-static int get_avc_nalsize(H264Context *h, const uint8_t *buf,
-                           int buf_size, int *buf_index)
-{
-    int i, nalsize = 0;
-
-    if (*buf_index >= buf_size - h->nal_length_size)
-        return -1;
-
-    for (i = 0; i < h->nal_length_size; i++)
-        nalsize = (nalsize << 8) | buf[(*buf_index)++];
-    if (nalsize <= 0 || nalsize > buf_size - *buf_index) {
-        av_log(h->avctx, AV_LOG_ERROR,
-               "AVC: nal size %d\n", nalsize);
-        return -1;
-    }
-    return nalsize;
-}
-
 static int get_bit_length(H264Context *h, const uint8_t *buf,
                          const uint8_t *ptr, int dst_length,
                          int i, int next_avc)
@@ -36,6 +36,7 @@
 #include "h264dsp.h"
 #include "h264pred.h"
 #include "h264qpel.h"
+#include "internal.h" // for avpriv_find_start_code()
 #include "me_cmp.h"
 #include "mpegutils.h"
 #include "parser.h"
@@ -337,6 +338,7 @@ typedef struct H264Picture {
 * H264Context
 */
 typedef struct H264Context {
+    AVClass *av_class;
    AVCodecContext *avctx;
    MECmpContext mecc;
    VideoDSPContext vdsp;
@@ -1092,6 +1094,34 @@ static av_always_inline int get_dct8x8_allowed(H264Context *h)
                  0x0001000100010001ULL));
 }

+static inline int find_start_code(const uint8_t *buf, int buf_size,
+                           int buf_index, int next_avc)
+{
+    uint32_t state = -1;
+
+    buf_index = avpriv_find_start_code(buf + buf_index, buf + next_avc + 1, &state) - buf - 1;
+
+    return FFMIN(buf_index, buf_size);
+}
+
+static inline int get_avc_nalsize(H264Context *h, const uint8_t *buf,
+                           int buf_size, int *buf_index)
+{
+    int i, nalsize = 0;
+
+    if (*buf_index >= buf_size - h->nal_length_size)
+        return -1;
+
+    for (i = 0; i < h->nal_length_size; i++)
+        nalsize = ((unsigned)nalsize << 8) | buf[(*buf_index)++];
+    if (nalsize <= 0 || nalsize > buf_size - *buf_index) {
+        av_log(h->avctx, AV_LOG_ERROR,
+               "AVC: nal size %d\n", nalsize);
+        return -1;
+    }
+    return nalsize;
+}
+
 int ff_h264_field_end(H264Context *h, int in_setup);

 int ff_h264_ref_picture(H264Context *h, H264Picture *dst, H264Picture *src);
@@ -202,10 +202,10 @@ static int scan_mmco_reset(AVCodecParserContext *s)
 */
 static inline int parse_nal_units(AVCodecParserContext *s,
                                  AVCodecContext *avctx,
-                                  const uint8_t *buf, int buf_size)
+                                  const uint8_t * const buf, int buf_size)
 {
    H264Context *h         = s->priv_data;
-    const uint8_t *buf_end = buf + buf_size;
+    int buf_index, next_avc;
    unsigned int pps_id;
    unsigned int slice_type;
    int state = -1, got_reset = 0;
@@ -225,26 +225,26 @@ static inline int parse_nal_units(AVCodecParserContext *s,
    if (!buf_size)
        return 0;

+    buf_index     = 0;
+    next_avc      = h->is_avc ? 0 : buf_size;
    for (;;) {
        int src_length, dst_length, consumed, nalsize = 0;
-        if (h->is_avc) {
-            int i;
-            if (h->nal_length_size >= buf_end - buf) break;
-            nalsize = 0;
-            for (i = 0; i < h->nal_length_size; i++)
-                nalsize = (nalsize << 8) | *buf++;
-            if (nalsize <= 0 || nalsize > buf_end - buf) {
-                av_log(h->avctx, AV_LOG_ERROR, "AVC: nal size %d\n", nalsize);
+
+        if (buf_index >= next_avc) {
+            nalsize = get_avc_nalsize(h, buf, buf_size, &buf_index);
+            if (nalsize < 0)
                break;
-            }
-            src_length = nalsize;
+            next_avc = buf_index + nalsize;
        } else {
-        buf = avpriv_find_start_code(buf, buf_end, &state);
-        if (buf >= buf_end)
-            break;
-        --buf;
-        src_length = buf_end - buf;
+            buf_index = find_start_code(buf, buf_size, buf_index, next_avc);
+            if (buf_index >= buf_size)
+                break;
+            if (buf_index >= next_avc)
+                continue;
        }
+        src_length = next_avc - buf_index;
+
+        state = buf[buf_index];
        switch (state & 0x1f) {
        case NAL_SLICE:
        case NAL_IDR_SLICE:
@@ -261,10 +261,13 @@ static inline int parse_nal_units(AVCodecParserContext *s,
            }
            break;
        }
-        ptr = ff_h264_decode_nal(h, buf, &dst_length, &consumed, src_length);
+        ptr = ff_h264_decode_nal(h, buf + buf_index, &dst_length,
+                                 &consumed, src_length);
        if (!ptr || dst_length < 0)
            break;

+        buf_index += consumed;
+
        init_get_bits(&h->gb, ptr, 8 * dst_length);
        switch (h->nal_unit_type) {
        case NAL_SPS:
@@ -439,7 +442,6 @@ static inline int parse_nal_units(AVCodecParserContext *s,

            return 0; /* no need to evaluate the rest */
        }
-        buf += h->is_avc ? nalsize : consumed;
    }
    if (q264)
        return 0;
@@ -281,7 +281,7 @@ static int decode_display_orientation(H264Context *h)

 int ff_h264_decode_sei(H264Context *h)
 {
-    while (get_bits_left(&h->gb) > 16) {
+    while (get_bits_left(&h->gb) > 16 && show_bits(&h->gb, 16)) {
        int type = 0;
        unsigned size = 0;
        unsigned next;
@@ -585,6 +585,17 @@ int ff_h264_update_thread_context(AVCodecContext *dst,
        h->mb_type_pool      = NULL;
        h->ref_index_pool    = NULL;
        h->motion_val_pool   = NULL;
+        h->intra4x4_pred_mode= NULL;
+        h->non_zero_count    = NULL;
+        h->slice_table_base  = NULL;
+        h->slice_table       = NULL;
+        h->cbp_table         = NULL;
+        h->chroma_pred_mode_table = NULL;
+        memset(h->mvd_table, 0, sizeof(h->mvd_table));
+        h->direct_table      = NULL;
+        h->list_counts       = NULL;
+        h->mb2b_xy           = NULL;
+        h->mb2br_xy          = NULL;
        for (i = 0; i < 2; i++) {
            h->rbsp_buffer[i] = NULL;
            h->rbsp_buffer_size[i] = 0;
@@ -108,7 +108,7 @@ static int pic_arrays_init(HEVCContext *s, const HEVCSPS *sps)
    if (!s->tab_ipm || !s->cbf_luma || !s->is_pcm)
        goto fail;

-    s->filter_slice_edges = av_malloc(ctb_count);
+    s->filter_slice_edges = av_mallocz(ctb_count);
    s->tab_slice_address  = av_malloc_array(pic_size_in_ctb,
                                      sizeof(*s->tab_slice_address));
    s->qp_y_tab           = av_malloc_array(pic_size_in_ctb,
@@ -227,8 +227,10 @@ static int temporal_luma_motion_vector(HEVCContext *s, int x0, int y0,

    HEVCFrame *ref = s->ref->collocated_ref;

-    if (!ref)
+    if (!ref) {
+        memset(mvLXCol, 0, sizeof(*mvLXCol));
        return 0;
+    }

    tab_mvf = ref->tab_mvf;
    colPic  = ref->poc;
@@ -415,14 +417,10 @@ static void derive_spatial_merge_candidates(HEVCContext *s, int x0, int y0,

        if (available_l0 || available_l1) {
            mergecandlist[nb_merge_cand].pred_flag = available_l0 + (available_l1 << 1);
-            if (available_l0) {
-                mergecandlist[nb_merge_cand].mv[0]      = mv_l0_col;
-                mergecandlist[nb_merge_cand].ref_idx[0] = 0;
-            }
-            if (available_l1) {
-                mergecandlist[nb_merge_cand].mv[1]      = mv_l1_col;
-                mergecandlist[nb_merge_cand].ref_idx[1] = 0;
-            }
+            AV_ZERO16(mergecandlist[nb_merge_cand].ref_idx);
+            mergecandlist[nb_merge_cand].mv[0]      = mv_l0_col;
+            mergecandlist[nb_merge_cand].mv[1]      = mv_l1_col;
+
            if (merge_idx == nb_merge_cand)
                return;
            nb_merge_cand++;
@@ -488,8 +486,6 @@ void ff_hevc_luma_mv_merge_mode(HEVCContext *s, int x0, int y0, int nPbW,
    int nPbH2 = nPbH;
    HEVCLocalContext *lc = s->HEVClc;

-    memset(mergecand_list, 0, MRG_MAX_NUM_CANDS * sizeof(*mergecand_list));
-
    if (s->pps->log2_parallel_merge_level > 2 && nCS == 8) {
        singleMCLFlag = 1;
        x0            = lc->cu.x;
@@ -525,7 +525,11 @@ static void decode_vui(HEVCContext *s, HEVCSPS *sps)
    vui->field_seq_flag                = get_bits1(gb);
    vui->frame_field_info_present_flag = get_bits1(gb);

-    vui->default_display_window_flag = get_bits1(gb);
+    if (get_bits_left(gb) >= 68 && show_bits_long(gb, 21) == 0x100000) {
+        vui->default_display_window_flag = 0;
+        av_log(s->avctx, AV_LOG_WARNING, "Invalid default display window\n");
+    } else
+        vui->default_display_window_flag = get_bits1(gb);
    // Backup context in case an alternate header is detected
    memcpy(&backup, gb, sizeof(backup));

@@ -947,6 +951,11 @@ int ff_hevc_decode_nal_sps(HEVCContext *s)
    sps->long_term_ref_pics_present_flag = get_bits1(gb);
    if (sps->long_term_ref_pics_present_flag) {
        sps->num_long_term_ref_pics_sps = get_ue_golomb_long(gb);
+        if (sps->num_long_term_ref_pics_sps > 31U) {
+            av_log(0, AV_LOG_ERROR, "num_long_term_ref_pics_sps %d is out of range.\n",
+                   sps->num_long_term_ref_pics_sps);
+            goto err;
+        }
        for (i = 0; i < sps->num_long_term_ref_pics_sps; i++) {
            sps->lt_ref_pic_poc_lsb_sps[i]       = get_bits(gb, sps->log2_max_poc_lsb);
            sps->used_by_curr_pic_lt_sps_flag[i] = get_bits1(gb);
@@ -1248,6 +1257,14 @@ int ff_hevc_decode_nal_pps(HEVCContext *s)
    if (pps->cu_qp_delta_enabled_flag)
        pps->diff_cu_qp_delta_depth = get_ue_golomb_long(gb);

+    if (pps->diff_cu_qp_delta_depth < 0 ||
+        pps->diff_cu_qp_delta_depth > sps->log2_diff_max_min_coding_block_size) {
+        av_log(s->avctx, AV_LOG_ERROR, "diff_cu_qp_delta_depth %d is invalid\n",
+               pps->diff_cu_qp_delta_depth);
+        ret = AVERROR_INVALIDDATA;
+        goto err;
+    }
+
    pps->cb_qp_offset = get_se_golomb(gb);
    if (pps->cb_qp_offset < -12 || pps->cb_qp_offset > 12) {
        av_log(s->avctx, AV_LOG_ERROR, "pps_cb_qp_offset out of range: %d\n",
@@ -1371,7 +1388,8 @@ int ff_hevc_decode_nal_pps(HEVCContext *s)
        int pps_range_extensions_flag = get_bits1(gb);
        /* int pps_extension_7bits = */ get_bits(gb, 7);
        if (sps->ptl.general_ptl.profile_idc == FF_PROFILE_HEVC_REXT && pps_range_extensions_flag) {
-            pps_range_extensions(s, pps, sps);
+            if ((ret = pps_range_extensions(s, pps, sps)) < 0)
+                goto err;
        }
    }

@@ -887,14 +887,14 @@ static int imc_decode_block(AVCodecContext *avctx, IMCContext *q, int ch)

    flag = get_bits1(&q->gb);
    if (stream_format_code & 0x1)
-        imc_decode_level_coefficients_raw(q, chctx->levlCoeffBuf,
-                                          chctx->flcoeffs1, chctx->flcoeffs2);
-    else if (stream_format_code & 0x1)
        imc_read_level_coeffs_raw(q, stream_format_code, chctx->levlCoeffBuf);
    else
        imc_read_level_coeffs(q, stream_format_code, chctx->levlCoeffBuf);

-    if (stream_format_code & 0x4)
+    if (stream_format_code & 0x1)
+        imc_decode_level_coefficients_raw(q, chctx->levlCoeffBuf,
+                                          chctx->flcoeffs1, chctx->flcoeffs2);
+    else if (stream_format_code & 0x4)
        imc_decode_level_coefficients(q, chctx->levlCoeffBuf,
                                      chctx->flcoeffs1, chctx->flcoeffs2);
    else
@@ -94,7 +94,7 @@ typedef struct Indeo3DecodeContext {

    int16_t         width, height;
    uint32_t        frame_num;      ///< current frame number (zero-based)
-    uint32_t        data_size;      ///< size of the frame data in bytes
+    int             data_size;      ///< size of the frame data in bytes
    uint16_t        frame_flags;    ///< frame properties
    uint8_t         cb_offset;      ///< needed for selecting VQ tables
    uint8_t         buf_sel;        ///< active frame buffer: 0 - primary, 1 -secondary
@@ -899,7 +899,8 @@ static int decode_frame_headers(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
    GetByteContext gb;
    const uint8_t   *bs_hdr;
    uint32_t        frame_num, word2, check_sum, data_size;
-    uint32_t        y_offset, u_offset, v_offset, starts[3], ends[3];
+    int             y_offset, u_offset, v_offset;
+    uint32_t        starts[3], ends[3];
    uint16_t        height, width;
    int             i, j;

@@ -981,7 +982,8 @@ static int decode_frame_headers(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
    ctx->y_data_size = ends[0] - starts[0];
    ctx->v_data_size = ends[1] - starts[1];
    ctx->u_data_size = ends[2] - starts[2];
-    if (FFMAX3(y_offset, v_offset, u_offset) >= ctx->data_size - 16 ||
+    if (FFMIN3(y_offset, v_offset, u_offset) < 0 ||
+        FFMAX3(y_offset, v_offset, u_offset) >= ctx->data_size - 16 ||
        FFMIN3(y_offset, v_offset, u_offset) < gb.buffer - bs_hdr + 16 ||
        FFMIN3(ctx->y_data_size, ctx->v_data_size, ctx->u_data_size) <= 0) {
        av_log(avctx, AV_LOG_ERROR, "One of the y/u/v offsets is invalid\n");
@@ -43,6 +43,13 @@ static av_cold int decode_init(AVCodecContext *avctx)
 {
    JvContext *s = avctx->priv_data;

+    if (!avctx->width || !avctx->height ||
+        (avctx->width & 7) || (avctx->height & 7)) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid video dimensions: %dx%d\n",
+               avctx->width, avctx->height);
+        return AVERROR(EINVAL);
+    }
+
    s->frame = av_frame_alloc();
    if (!s->frame)
        return AVERROR(ENOMEM);
@@ -244,9 +244,10 @@ int ff_mjpeg_decode_dht(MJpegDecodeContext *s)

 int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
 {
-    int len, nb_components, i, width, height, bits, pix_fmt_id, ret;
-    int h_count[MAX_COMPONENTS];
-    int v_count[MAX_COMPONENTS];
+    int len, nb_components, i, width, height, bits, ret;
+    unsigned pix_fmt_id;
+    int h_count[MAX_COMPONENTS] = { 0 };
+    int v_count[MAX_COMPONENTS] = { 0 };

    s->cur_scan = 0;
    s->upscale_h = s->upscale_v = 0;
@@ -254,7 +255,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
    /* XXX: verify len field validity */
    len     = get_bits(&s->gb, 16);
    s->avctx->bits_per_raw_sample =
-    bits = get_bits(&s->gb, 8);
+    bits    = get_bits(&s->gb, 8);

    if (s->pegasus_rct)
        bits = 9;
@@ -300,8 +301,6 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
    s->nb_components = nb_components;
    s->h_max         = 1;
    s->v_max         = 1;
-    memset(h_count, 0, sizeof(h_count));
-    memset(v_count, 0, sizeof(v_count));
    for (i = 0; i < nb_components; i++) {
        /* component id */
        s->component_id[i] = get_bits(&s->gb, 8) - 1;
@@ -336,10 +335,9 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)


    /* if different size, realloc/alloc picture */
-    if (   width != s->width || height != s->height
-        || bits != s->bits
-        || memcmp(s->h_count, h_count, sizeof(h_count))
-        || memcmp(s->v_count, v_count, sizeof(v_count))) {
+    if (width != s->width || height != s->height || bits != s->bits ||
+        memcmp(s->h_count, h_count, sizeof(h_count))                ||
+        memcmp(s->v_count, v_count, sizeof(v_count))) {

        s->width      = width;
        s->height     = height;
@@ -378,7 +376,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
        else if (!s->lossless)
            s->rgb = 0;
    /* XXX: not complete test ! */
-    pix_fmt_id = (s->h_count[0] << 28) | (s->v_count[0] << 24) |
+    pix_fmt_id = ((unsigned)s->h_count[0] << 28) | (s->v_count[0] << 24) |
                 (s->h_count[1] << 20) | (s->v_count[1] << 16) |
                 (s->h_count[2] << 12) | (s->v_count[2] <<  8) |
                 (s->h_count[3] <<  4) |  s->v_count[3];
@@ -514,6 +512,8 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
        else              s->avctx->pix_fmt = AV_PIX_FMT_YUV420P16;
        s->avctx->color_range = s->cs_itu601 ? AVCOL_RANGE_MPEG : AVCOL_RANGE_JPEG;
        if (pix_fmt_id == 0x42111100) {
+            if (s->bits > 8)
+                goto unk_pixfmt;
            s->upscale_h = 6;
            s->chroma_height = (s->height + 1) / 2;
        }
@@ -1594,6 +1594,8 @@ static int mjpeg_decode_app(MJpegDecodeContext *s)
    }

    if (id == AV_RB32("LJIF")) {
+        int rgb = s->rgb;
+        int pegasus_rct = s->pegasus_rct;
        if (s->avctx->debug & FF_DEBUG_PICT_INFO)
            av_log(s->avctx, AV_LOG_INFO,
                   "Pegasus lossless jpeg header found\n");
@@ -1603,17 +1605,27 @@ static int mjpeg_decode_app(MJpegDecodeContext *s)
        skip_bits(&s->gb, 16); /* unknown always 0? */
        switch (i=get_bits(&s->gb, 8)) {
        case 1:
-            s->rgb         = 1;
-            s->pegasus_rct = 0;
+            rgb         = 1;
+            pegasus_rct = 0;
            break;
        case 2:
-            s->rgb         = 1;
-            s->pegasus_rct = 1;
+            rgb         = 1;
+            pegasus_rct = 1;
            break;
        default:
            av_log(s->avctx, AV_LOG_ERROR, "unknown colorspace %d\n", i);
        }
+
        len -= 9;
+        if (s->got_picture)
+            if (rgb != s->rgb || pegasus_rct != s->pegasus_rct) {
+                av_log(s->avctx, AV_LOG_WARNING, "Mismatching LJIF tag\n");
+                goto out;
+            }
+
+        s->rgb = rgb;
+        s->pegasus_rct = pegasus_rct;
+
        goto out;
    }
    if (id == AV_RL32("colr") && len > 0) {
@@ -61,6 +61,13 @@ static av_cold int mm_decode_init(AVCodecContext *avctx)

    avctx->pix_fmt = AV_PIX_FMT_PAL8;

+    if (!avctx->width || !avctx->height ||
+        (avctx->width & 1) || (avctx->height & 1)) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid video dimensions: %dx%d\n",
+               avctx->width, avctx->height);
+        return AVERROR(EINVAL);
+    }
+
    s->frame = av_frame_alloc();
    if (!s->frame)
        return AVERROR(ENOMEM);
@@ -193,7 +193,13 @@ static av_always_inline int cmp_inline(MpegEncContext *s, const int x, const int
        int uvdxy;              /* no, it might not be used uninitialized */
        if(dxy){
            if(qpel){
-                c->qpel_put[size][dxy](c->temp, ref[0] + x + y*stride, stride); //FIXME prototype (add h)
+                if (h << size == 16) {
+                    c->qpel_put[size][dxy](c->temp, ref[0] + x + y*stride, stride); //FIXME prototype (add h)
+                } else if (size == 0 && h == 8) {
+                    c->qpel_put[1][dxy](c->temp    , ref[0] + x + y*stride    , stride);
+                    c->qpel_put[1][dxy](c->temp + 8, ref[0] + x + y*stride + 8, stride);
+                } else
+                    av_assert2(0);
                if(chroma){
                    int cx= hx/2;
                    int cy= hy/2;
@@ -1120,6 +1120,10 @@ static av_cold int mpeg_decode_init(AVCodecContext *avctx)
    MpegEncContext *s2 = &s->mpeg_enc_ctx;

    ff_mpv_decode_defaults(s2);
+
+    if (   avctx->codec_tag != AV_RL32("VCR2")
+        && avctx->codec_tag != AV_RL32("BW10"))
+        avctx->coded_width = avctx->coded_height = 0; // do not trust dimensions from input
    ff_mpv_decode_init(s2, avctx);

    s->mpeg_enc_ctx.avctx  = avctx;
@@ -88,7 +88,7 @@ static int mpeg4_decode_header(AVCodecParserContext *s1, AVCodecContext *avctx,
    if (avctx->extradata_size && pc->first_picture) {
        init_get_bits(gb, avctx->extradata, avctx->extradata_size * 8);
        ret = ff_mpeg4_decode_picture_header(dec_ctx, gb);
-        if (ret < 0)
+        if (ret < -1)
            av_log(avctx, AV_LOG_WARNING, "Failed to parse extradata\n");
    }

@@ -2793,7 +2793,7 @@ AVCodec ff_mpeg4_vdpau_decoder = {
    .long_name      = NULL_IF_CONFIG_SMALL("MPEG-4 part 2 (VDPAU)"),
    .type           = AVMEDIA_TYPE_VIDEO,
    .id             = AV_CODEC_ID_MPEG4,
-    .priv_data_size = sizeof(MpegEncContext),
+    .priv_data_size = sizeof(Mpeg4DecContext),
    .init           = decode_init,
    .close          = ff_h263_decode_end,
    .decode         = ff_h263_decode_frame,
@@ -73,20 +73,21 @@ static int mpegaudio_parse(AVCodecParserContext *s1,
                    if (i > 4)
                        s->header_count = -2;
                } else {
+                    int header_threshold = avctx->codec_id != AV_CODEC_ID_NONE && avctx->codec_id != codec_id;
                    if((state&SAME_HEADER_MASK) != (s->header&SAME_HEADER_MASK) && s->header)
                        s->header_count= -3;
                    s->header= state;
                    s->header_count++;
                    s->frame_size = ret-4;

-                    if (s->header_count > 0 + (avctx->codec_id != AV_CODEC_ID_NONE && avctx->codec_id != codec_id)) {
+                    if (s->header_count > header_threshold) {
                        avctx->sample_rate= sr;
                        avctx->channels   = channels;
                        s1->duration      = frame_size;
                        avctx->codec_id   = codec_id;
                        if (s->no_bitrate || !avctx->bit_rate) {
                            s->no_bitrate = 1;
-                            avctx->bit_rate += (bit_rate - avctx->bit_rate) / s->header_count;
+                            avctx->bit_rate += (bit_rate - avctx->bit_rate) / (s->header_count - header_threshold);
                        }
                    }
                    break;
@@ -923,6 +923,7 @@ static av_cold int on2avc_decode_init(AVCodecContext *avctx)
        av_log(avctx, AV_LOG_ERROR, "0x500 version should be mono\n");
        return AVERROR_INVALIDDATA;
    }
+
    if (avctx->channels == 2)
        av_log(avctx, AV_LOG_WARNING,
               "Stereo mode support is not good, patch is welcome\n");
@@ -105,8 +105,8 @@ static const AVOption avcodec_options[] = {
 {"extradata_size", NULL, OFFSET(extradata_size), AV_OPT_TYPE_INT, {.i64 = DEFAULT }, INT_MIN, INT_MAX},
 {"time_base", NULL, OFFSET(time_base), AV_OPT_TYPE_RATIONAL, {.dbl = 0}, INT_MIN, INT_MAX},
 {"g", "set the group of picture (GOP) size", OFFSET(gop_size), AV_OPT_TYPE_INT, {.i64 = 12 }, INT_MIN, INT_MAX, V|E},
-{"ar", "set audio sampling rate (in Hz)", OFFSET(sample_rate), AV_OPT_TYPE_INT, {.i64 = DEFAULT }, INT_MIN, INT_MAX, A|D|E},
-{"ac", "set number of audio channels", OFFSET(channels), AV_OPT_TYPE_INT, {.i64 = DEFAULT }, INT_MIN, INT_MAX, A|D|E},
+{"ar", "set audio sampling rate (in Hz)", OFFSET(sample_rate), AV_OPT_TYPE_INT, {.i64 = DEFAULT }, 0, INT_MAX, A|D|E},
+{"ac", "set number of audio channels", OFFSET(channels), AV_OPT_TYPE_INT, {.i64 = DEFAULT }, 0, INT_MAX, A|D|E},
 {"cutoff", "set cutoff bandwidth", OFFSET(cutoff), AV_OPT_TYPE_INT, {.i64 = DEFAULT }, INT_MIN, INT_MAX, A|E},
 {"frame_size", NULL, OFFSET(frame_size), AV_OPT_TYPE_INT, {.i64 = DEFAULT }, INT_MIN, INT_MAX, A|E},
 {"frame_number", NULL, OFFSET(frame_number), AV_OPT_TYPE_INT, {.i64 = DEFAULT }, INT_MIN, INT_MAX},
@@ -499,6 +499,12 @@ static int opus_decode_packet(AVCodecContext *avctx, void *data,
                av_log(avctx, AV_LOG_ERROR, "Error parsing the packet header.\n");
                return ret;
            }
+            if (coded_samples != s->packet.frame_count * s->packet.frame_duration) {
+                av_log(avctx, AV_LOG_ERROR,
+                       "Mismatching coded sample count in substream %d.\n", i);
+                return AVERROR_INVALIDDATA;
+            }
+
            s->silk_samplerate = get_silk_samplerate(s->packet.config);
        }

@@ -582,6 +582,12 @@ static int decode_frame(AVCodecContext *avctx,
        case MKTAG('I', 'H', 'D', 'R'):
            if (length != 13)
                goto fail;
+
+            if (s->state & PNG_IDAT) {
+                av_log(avctx, AV_LOG_ERROR, "IHDR after IDAT\n");
+                goto fail;
+            }
+
            s->width  = bytestream2_get_be32(&s->gb);
            s->height = bytestream2_get_be32(&s->gb);
            if (av_image_check_size(s->width, s->height, 0, avctx)) {
@@ -172,6 +172,9 @@ static int raw_decode(AVCodecContext *avctx, void *data, int *got_frame,
        context->frame_size = avpicture_get_size(avctx->pix_fmt, avctx->width,
                                                 avctx->height);
    }
+    if (context->frame_size < 0)
+        return context->frame_size;
+
    need_copy = !avpkt->buf || context->is_2_4_bpp || context->is_yuv2 || context->is_lt_16bpp;

    frame->pict_type        = AV_PICTURE_TYPE_I;
@@ -98,7 +98,7 @@ static int expand_rle_row16(SgiState *s, uint16_t *out_buf,
            break;

        /* Check for buffer overflow. */
-        if (pixelstride * (count - 1) >= len) {
+        if (out_end - out_buf <= pixelstride * (count - 1)) {
            av_log(s->avctx, AV_LOG_ERROR, "Invalid pixel count.\n");
            return AVERROR_INVALIDDATA;
        }
@@ -145,7 +145,7 @@ static int read_rle_sgi(uint8_t *out_buf, SgiState *s)
    for (z = 0; z < s->depth; z++) {
        dest_row = out_buf;
        for (y = 0; y < s->height; y++) {
-            linesize = s->width * s->depth * s->bytes_per_channel;
+            linesize = s->width * s->depth;
            dest_row -= s->linesize;
            start_offset = bytestream2_get_be32(&g_table);
            bytestream2_seek(&s->g, start_offset, SEEK_SET);
@@ -70,7 +70,7 @@ typedef struct SmcContext {
        row_ptr += stride * 4; \
    } \
    total_blocks--; \
-    if (total_blocks < 0 + !!n_blocks) \
+    if (total_blocks < !!n_blocks) \
    { \
        av_log(s->avctx, AV_LOG_INFO, "warning: block counter just went negative (this should not happen)\n"); \
        return; \
@@ -499,7 +499,7 @@ static int svq1_decode_delta_block(AVCodecContext *avctx, HpelDSPContext *hdsp,
    return result;
 }

-static void svq1_parse_string(GetBitContext *bitbuf, uint8_t *out)
+static void svq1_parse_string(GetBitContext *bitbuf, uint8_t out[257])
 {
    uint8_t seed;
    int i;
@@ -511,6 +511,7 @@ static void svq1_parse_string(GetBitContext *bitbuf, uint8_t *out)
        out[i] = get_bits(bitbuf, 8) ^ seed;
        seed   = string_table[out[i] ^ seed];
    }
+    out[i] = 0;
 }

 static int svq1_decode_frame_header(AVCodecContext *avctx, AVFrame *frame)
@@ -553,12 +554,12 @@ static int svq1_decode_frame_header(AVCodecContext *avctx, AVFrame *frame)
        }

        if ((s->frame_code ^ 0x10) >= 0x50) {
-            uint8_t msg[256];
+            uint8_t msg[257];

            svq1_parse_string(bitbuf, msg);

            av_log(avctx, AV_LOG_INFO,
-                   "embedded message:\n%s\n", (char *)msg);
+                   "embedded message:\n%s\n", ((char *)msg) + 1);
        }

        skip_bits(bitbuf, 2);
@@ -305,7 +305,9 @@ static int encode_frame(AVCodecContext *avctx, AVPacket *pkt,

    strips = (s->height - 1) / s->rps + 1;

-    packet_size = avctx->height * ((avctx->width * s->bpp + 7) >> 3) * 2 +
+    bytes_per_row = (((s->width - 1) / s->subsampling[0] + 1) * s->bpp *
+                     s->subsampling[0] * s->subsampling[1] + 7) >> 3;
+    packet_size = avctx->height * bytes_per_row * 2 +
                  avctx->height * 4 + FF_MIN_BUFFER_SIZE;

    if ((ret = ff_alloc_packet2(avctx, pkt, packet_size)) < 0)
@@ -333,8 +335,6 @@ static int encode_frame(AVCodecContext *avctx, AVPacket *pkt,
        goto fail;
    }

-    bytes_per_row = (((s->width - 1) / s->subsampling[0] + 1) * s->bpp *
-                     s->subsampling[0] * s->subsampling[1] + 7) >> 3;
    if (is_yuv) {
        av_fast_padded_malloc(&s->yuv_line, &s->yuv_line_size, bytes_per_row);
        if (s->yuv_line == NULL) {
@@ -66,6 +66,9 @@
 #include "compat/os2threads.h"
 #endif

+#include "libavutil/ffversion.h"
+const char av_codec_ffversion[] = "FFmpeg version " FFMPEG_VERSION;
+
 #if HAVE_PTHREADS || HAVE_W32THREADS || HAVE_OS2THREADS
 static int default_lockmgr_cb(void **arg, enum AVLockOp op)
 {
@@ -279,6 +282,12 @@ void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height,
    int i;
    int w_align = 1;
    int h_align = 1;
+    AVPixFmtDescriptor const *desc = av_pix_fmt_desc_get(s->pix_fmt);
+
+    if (desc) {
+        w_align = 1 << desc->log2_chroma_w;
+        h_align = 1 << desc->log2_chroma_h;
+    }

    switch (s->pix_fmt) {
    case AV_PIX_FMT_YUV420P:
@@ -406,8 +415,6 @@ void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height,
        }
        break;
    default:
-        w_align = 1;
-        h_align = 1;
        break;
    }

@@ -3606,6 +3613,11 @@ int avpriv_bprint_to_extradata(AVCodecContext *avctx, struct AVBPrint *buf)
    ret = av_bprint_finalize(buf, &str);
    if (ret < 0)
        return ret;
+    if (!av_bprint_is_complete(buf)) {
+        av_free(str);
+        return AVERROR(ENOMEM);
+    }
+
    avctx->extradata = str;
    /* Note: the string is NUL terminated (so extradata can be read as a
     * string), but the ending character is not accounted in the size (in
@@ -214,6 +214,8 @@ static void restore_median(uint8_t *src, int step, int stride,
        slice_height = ((((slice + 1) * height) / slices) & cmask) -
                       slice_start;

+        if (!slice_height)
+            continue;
        bsrc = src + slice_start * stride;

        // first line - left neighbour prediction
@@ -224,7 +226,7 @@ static void restore_median(uint8_t *src, int step, int stride,
            A        = bsrc[i];
        }
        bsrc += stride;
-        if (slice_height == 1)
+        if (slice_height <= 1)
            continue;
        // second line - first element has top prediction, the rest uses median
        C        = bsrc[-stride];
@@ -269,6 +271,8 @@ static void restore_median_il(uint8_t *src, int step, int stride,
        slice_height   = ((((slice + 1) * height) / slices) & cmask) -
                         slice_start;
        slice_height >>= 1;
+        if (!slice_height)
+            continue;

        bsrc = src + slice_start * stride;

@@ -284,7 +288,7 @@ static void restore_median_il(uint8_t *src, int step, int stride,
            A                 = bsrc[stride + i];
        }
        bsrc += stride2;
-        if (slice_height == 1)
+        if (slice_height <= 1)
            continue;
        // second line - first element has top prediction, the rest uses median
        C        = bsrc[-stride2];
@@ -389,7 +389,7 @@ static int write_huff_codes(uint8_t *src, uint8_t *dst, int dst_size,
 }

 static int encode_plane(AVCodecContext *avctx, uint8_t *src,
-                        uint8_t *dst, int stride,
+                        uint8_t *dst, int stride, int plane_no,
                        int width, int height, PutByteContext *pb)
 {
    UtvideoContext *c        = avctx->priv_data;
@@ -399,6 +399,7 @@ static int encode_plane(AVCodecContext *avctx, uint8_t *src,
    HuffEntry he[256];

    uint32_t offset = 0, slice_len = 0;
+    const int cmask = ~(!plane_no && avctx->pix_fmt == AV_PIX_FMT_YUV420P);
    int      i, sstart, send = 0;
    int      symbol;
    int      ret;
@@ -408,7 +409,7 @@ static int encode_plane(AVCodecContext *avctx, uint8_t *src,
    case PRED_NONE:
        for (i = 0; i < c->slices; i++) {
            sstart = send;
-            send   = height * (i + 1) / c->slices;
+            send   = height * (i + 1) / c->slices & cmask;
            av_image_copy_plane(dst + sstart * width, width,
                                src + sstart * stride, stride,
                                width, send - sstart);
@@ -417,7 +418,7 @@ static int encode_plane(AVCodecContext *avctx, uint8_t *src,
    case PRED_LEFT:
        for (i = 0; i < c->slices; i++) {
            sstart = send;
-            send   = height * (i + 1) / c->slices;
+            send   = height * (i + 1) / c->slices & cmask;
            left_predict(src + sstart * stride, dst + sstart * width,
                         stride, width, send - sstart);
        }
@@ -425,7 +426,7 @@ static int encode_plane(AVCodecContext *avctx, uint8_t *src,
    case PRED_MEDIAN:
        for (i = 0; i < c->slices; i++) {
            sstart = send;
-            send   = height * (i + 1) / c->slices;
+            send   = height * (i + 1) / c->slices & cmask;
            median_predict(c, src + sstart * stride, dst + sstart * width,
                           stride, width, send - sstart);
        }
@@ -489,7 +490,7 @@ static int encode_plane(AVCodecContext *avctx, uint8_t *src,
    send = 0;
    for (i = 0; i < c->slices; i++) {
        sstart  = send;
-        send    = height * (i + 1) / c->slices;
+        send    = height * (i + 1) / c->slices & cmask;

        /*
         * Write the huffman codes to a buffer,
@@ -571,7 +572,7 @@ static int utvideo_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
    case AV_PIX_FMT_RGBA:
        for (i = 0; i < c->planes; i++) {
            ret = encode_plane(avctx, c->slice_buffer[i] + 2 * c->slice_stride,
-                               c->slice_buffer[i], c->slice_stride,
+                               c->slice_buffer[i], c->slice_stride, i,
                               width, height, &pb);

            if (ret) {
@@ -583,7 +584,7 @@ static int utvideo_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
    case AV_PIX_FMT_YUV422P:
        for (i = 0; i < c->planes; i++) {
            ret = encode_plane(avctx, pic->data[i], c->slice_buffer[0],
-                               pic->linesize[i], width >> !!i, height, &pb);
+                               pic->linesize[i], i, width >> !!i, height, &pb);

            if (ret) {
                av_log(avctx, AV_LOG_ERROR, "Error encoding plane %d.\n", i);
@@ -594,7 +595,7 @@ static int utvideo_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
    case AV_PIX_FMT_YUV420P:
        for (i = 0; i < c->planes; i++) {
            ret = encode_plane(avctx, pic->data[i], c->slice_buffer[0],
-                               pic->linesize[i], width >> !!i, height >> !!i,
+                               pic->linesize[i], i, width >> !!i, height >> !!i,
                               &pb);

            if (ret) {
@@ -339,6 +339,9 @@ static int vmd_decode(VmdVideoContext *s, AVFrame *frame)
                        ofs += slen;
                        bytestream2_skip(&gb, len);
                    } else {
+                        if (ofs + len > frame_width ||
+                            bytestream2_get_bytes_left(&gb) < len)
+                            return AVERROR_INVALIDDATA;
                        bytestream2_get_buffer(&gb, &dp[ofs], len);
                        ofs += len;
                    }
@@ -77,6 +77,8 @@ static int parse(AVCodecParserContext *ctx,
                    idx += a; \
                    if (sz > size) { \
                        s->n_frames = 0; \
+                        *out_size = 0; \
+                        *out_data = data; \
                        av_log(avctx, AV_LOG_ERROR, \
                               "Superframe packet size too big: %u > %d\n", \
                               sz, size); \
@@ -422,6 +422,9 @@ static av_cold int decode_init(AVCodecContext *avctx)
            offset &= ~3;
            if (offset > s->sfb_offsets[i][band - 1])
                s->sfb_offsets[i][band++] = offset;
+
+            if (offset >= subframe_len)
+                break;
        }
        s->sfb_offsets[i][band - 1] = subframe_len;
        s->num_sfb[i]               = band - 1;
@@ -34,7 +34,7 @@ OBJS-$(CONFIG_OPENGL_OUTDEV)             += opengl_enc.o
 OBJS-$(CONFIG_OSS_INDEV)                 += oss_audio.o oss_audio_dec.o
 OBJS-$(CONFIG_OSS_OUTDEV)                += oss_audio.o oss_audio_enc.o
 OBJS-$(CONFIG_PULSE_INDEV)               += pulse_audio_dec.o \
-                                            pulse_audio_common.o
+                                            pulse_audio_common.o timefilter.o
 OBJS-$(CONFIG_PULSE_OUTDEV)              += pulse_audio_enc.o \
                                            pulse_audio_common.o
 OBJS-$(CONFIG_QTKIT_INDEV)               += qtkit.o
@@ -23,6 +23,9 @@
 #include "avdevice.h"
 #include "config.h"

+#include "libavutil/ffversion.h"
+const char av_device_ffversion[] = "FFmpeg version " FFMPEG_VERSION;
+
 #define E AV_OPT_FLAG_ENCODING_PARAM
 #define D AV_OPT_FLAG_DECODING_PARAM
 #define A AV_OPT_FLAG_AUDIO_PARAM
@@ -1,4 +1,4 @@
 LIBAVDEVICE_$MAJOR {
-        global: avdevice_*;
+        global: avdevice_*; av_*;
        local: *;
 };
@@ -873,9 +873,6 @@ static int v4l2_read_header(AVFormatContext *ctx)

    avpriv_set_pts_info(st, 64, 1, 1000000); /* 64 bits pts in us */

-    if ((res = v4l2_set_parameters(ctx)) < 0)
-        goto fail;
-
    if (s->pixel_format) {
        AVCodec *codec = avcodec_find_decoder_by_name(s->pixel_format);

@@ -926,6 +923,9 @@ static int v4l2_read_header(AVFormatContext *ctx)

    s->frame_format = desired_format;

+    if ((res = v4l2_set_parameters(ctx)) < 0)
+        goto fail;
+
    st->codec->pix_fmt = avpriv_fmt_v4l2ff(desired_format, codec_id);
    s->frame_size =
        avpicture_get_size(st->codec->pix_fmt, s->width, s->height);
@@ -496,6 +496,8 @@ static av_cold int init(AVFilterContext *ctx)
        snprintf(name, sizeof(name), "input%d", i);
        pad.type           = AVMEDIA_TYPE_AUDIO;
        pad.name           = av_strdup(name);
+        if (!pad.name)
+            return AVERROR(ENOMEM);
        pad.filter_frame   = filter_frame;

        ff_insert_inpad(ctx, i, &pad);
@@ -214,6 +214,8 @@ static av_cold int join_init(AVFilterContext *ctx)
        snprintf(name, sizeof(name), "input%d", i);
        pad.type           = AVMEDIA_TYPE_AUDIO;
        pad.name           = av_strdup(name);
+        if (!pad.name)
+            return AVERROR(ENOMEM);
        pad.filter_frame   = filter_frame;

        pad.needs_fifo = 1;
@@ -41,6 +41,7 @@ typedef struct ResampleContext {
    AVDictionary *options;

    int64_t next_pts;
+    int64_t next_in_pts;

    /* set by filter_frame() to signal an output frame to request_frame() */
    int got_output;
@@ -153,6 +154,7 @@ static int config_output(AVFilterLink *outlink)

    outlink->time_base = (AVRational){ 1, outlink->sample_rate };
    s->next_pts        = AV_NOPTS_VALUE;
+    s->next_in_pts     = AV_NOPTS_VALUE;

    av_get_channel_layout_string(buf1, sizeof(buf1),
                                 -1, inlink ->channel_layout);
@@ -254,7 +256,12 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
            }

            out->sample_rate = outlink->sample_rate;
-            if (in->pts != AV_NOPTS_VALUE) {
+            /* Only convert in->pts if there is a discontinuous jump.
+               This ensures that out->pts tracks the number of samples actually
+               output by the resampler in the absence of such a jump.
+               Otherwise, the rounding in av_rescale_q() and av_rescale()
+               causes off-by-1 errors. */
+            if (in->pts != AV_NOPTS_VALUE && in->pts != s->next_in_pts) {
                out->pts = av_rescale_q(in->pts, inlink->time_base,
                                            outlink->time_base) -
                               av_rescale(delay, outlink->sample_rate,
@@ -263,6 +270,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
                out->pts = s->next_pts;

            s->next_pts = out->pts + out->nb_samples;
+            s->next_in_pts = in->pts + in->nb_samples;

            ret = ff_filter_frame(outlink, out);
            s->got_output = 1;
@@ -37,6 +37,9 @@
 #include "formats.h"
 #include "internal.h"

+#include "libavutil/ffversion.h"
+const char av_filter_ffversion[] = "FFmpeg version " FFMPEG_VERSION;
+
 static int ff_filter_frame_framed(AVFilterLink *link, AVFrame *frame);

 void ff_tlog_ref(void *ctx, AVFrame *ref, int end)
@@ -52,6 +52,8 @@ static av_cold int split_init(AVFilterContext *ctx)
        snprintf(name, sizeof(name), "output%d", i);
        pad.type = ctx->filter->inputs[0].type;
        pad.name = av_strdup(name);
+        if (!pad.name)
+            return AVERROR(ENOMEM);

        ff_insert_outpad(ctx, i, &pad);
    }
@@ -289,6 +289,8 @@ static av_cold int movie_common_init(AVFilterContext *ctx)
        snprintf(name, sizeof(name), "out%d", i);
        pad.type          = movie->st[i].st->codec->codec_type;
        pad.name          = av_strdup(name);
+        if (!pad.name)
+            return AVERROR(ENOMEM);
        pad.config_props  = movie_config_output_props;
        pad.request_frame = movie_request_frame;
        ff_insert_outpad(ctx, i, &pad);
@@ -716,6 +716,8 @@ static av_cold void uninit(AVFilterContext *ctx)
 #if FF_API_DRAWTEXT_OLD_TIMELINE
    av_expr_free(s->draw_pexpr);
    s->x_pexpr = s->y_pexpr = s->draw_pexpr = NULL;
+#else
+    s->x_pexpr = s->y_pexpr = NULL;
 #endif
    av_freep(&s->positions);
    s->nb_positions = 0;
@@ -161,15 +161,32 @@ static double compute_gammaval(void *opaque, double gamma)
    return pow((val-minval)/(maxval-minval), gamma) * (maxval-minval)+minval;
 }

+/**
+ * Compute Rec.709 gama correction of value val
+ */
+static double compute_gammaval709(void *opaque, double gamma)
+{
+    LutContext *s = opaque;
+    double val    = s->var_values[VAR_CLIPVAL];
+    double minval = s->var_values[VAR_MINVAL];
+    double maxval = s->var_values[VAR_MAXVAL];
+    double level = (val - minval) / (maxval - minval);
+    level = level < 0.018 ? 4.5 * level
+                          : 1.099 * pow(level, 1.0 / gamma) - 0.099;
+    return level * (maxval - minval) + minval;
+}
+
 static double (* const funcs1[])(void *, double) = {
    (void *)clip,
    (void *)compute_gammaval,
+    (void *)compute_gammaval709,
    NULL
 };

 static const char * const funcs1_names[] = {
    "clip",
    "gammaval",
+    "gammaval709",
    NULL
 };

@@ -220,6 +220,19 @@ static int config_props(AVFilterLink *inlink)

 #define NB_PLANES 4

+static inline int mirror(int x, int w)
+{
+    if (!w)
+        return 0;
+
+    while ((unsigned)x > (unsigned)w) {
+        x = -x;
+        if (x < 0)
+            x += 2 * w;
+    }
+    return x;
+}
+
 static void blur(uint8_t       *dst, const int dst_linesize,
                 const uint8_t *src, const int src_linesize,
                 const int w, const int h, FilterParam *fp)
@@ -253,8 +266,7 @@ static void blur(uint8_t       *dst, const int dst_linesize,
                for (dy = 0; dy < radius*2 + 1; dy++) {
                    int dx;
                    int iy = y+dy - radius;
-                    if      (iy < 0)  iy = -iy;
-                    else if (iy >= h) iy = h+h-iy-1;
+                    iy = mirror(iy, h-1);

                    for (dx = 0; dx < radius*2 + 1; dx++) {
                        const int ix = x+dx - radius;
@@ -265,13 +277,11 @@ static void blur(uint8_t       *dst, const int dst_linesize,
                for (dy = 0; dy < radius*2+1; dy++) {
                    int dx;
                    int iy = y+dy - radius;
-                    if      (iy <  0) iy = -iy;
-                    else if (iy >= h) iy = h+h-iy-1;
+                    iy = mirror(iy, h-1);

                    for (dx = 0; dx < radius*2 + 1; dx++) {
                        int ix = x+dx - radius;
-                        if      (ix < 0)  ix = -ix;
-                        else if (ix >= w) ix = w+w-ix-1;
+                        ix = mirror(ix, w-1);
                        UPDATE_FACTOR;
                    }
                }
@@ -916,7 +916,7 @@ typedef struct AVStream {
    /**
     * Stream information used internally by av_find_stream_info()
     */
-#define MAX_STD_TIMEBASES (60*12+6)
+#define MAX_STD_TIMEBASES (30*12+7+6)
    struct {
        int64_t last_dts;
        int64_t duration_gcd;
@@ -1141,7 +1141,7 @@ start_sync:
            goto start_sync;
        }

-        n = avi->dv_demux ? 0 : get_stream_idx(d);
+        n = get_stream_idx(d);

        if (!((i - avi->last_pkt_pos) & 1) &&
            get_stream_idx(d + 1) < s->nb_streams)
@@ -1153,6 +1153,9 @@ start_sync:
            goto start_sync;
        }

+        if (avi->dv_demux && n != 0)
+            continue;
+
        // parse ##dc/##wb
        if (n < s->nb_streams) {
            AVStream *st;
@@ -221,6 +221,9 @@ int64_t avio_seek(AVIOContext *s, int64_t offset, int whence)
            return offset1;
        offset += offset1;
    }
+    if (offset < 0)
+        return AVERROR(EINVAL);
+
    offset1 = offset - pos;
    if (!s->must_flush && (!s->direct || !s->seek) &&
        offset1 >= 0 && offset1 <= buffer_size) {
@@ -674,7 +677,7 @@ int ff_get_line(AVIOContext *s, char *buf, int maxlen)
        if (c && i < maxlen-1)
            buf[i++] = c;
    } while (c != '\n' && c != '\r' && c);
-    if (c == '\r' && avio_r8(s) != '\n')
+    if (c == '\r' && avio_r8(s) != '\n' && !avio_feof(s))
        avio_skip(s, -1);

    buf[i] = 0;
@@ -127,6 +127,8 @@ static int cdxl_read_packet(AVFormatContext *s, AVPacket *pkt)
    height       = AV_RB16(&cdxl->header[16]);
    palette_size = AV_RB16(&cdxl->header[20]);
    audio_size   = AV_RB16(&cdxl->header[22]);
+    if (FFALIGN(width, 16) * (uint64_t)height * cdxl->header[19] > INT_MAX)
+        return AVERROR_INVALIDDATA;
    image_size   = FFALIGN(width, 16) * height * cdxl->header[19] / 8;
    video_size   = palette_size + image_size;

@@ -27,6 +27,7 @@

 #include "libavutil/intreadwrite.h"
 #include "libavcodec/bmp.h"
+#include "libavutil/intfloat.h"
 #include "avformat.h"
 #include "internal.h"

@@ -78,6 +79,16 @@ static int set_metadata_int(AVDictionary **dict, const char *key, int value, int
    return 0;
 }

+static int set_metadata_float(AVDictionary **dict, const char *key, float value, int allow_zero)
+{
+    if (value != 0 || allow_zero) {
+        char tmp[64];
+        snprintf(tmp, sizeof(tmp), "%f", value);
+        return av_dict_set(dict, key, tmp, 0);
+    }
+    return 0;
+}
+
 static int cine_read_header(AVFormatContext *avctx)
 {
    AVIOContext *pb = avctx->pb;
@@ -177,7 +188,10 @@ static int cine_read_header(AVFormatContext *avctx)
    set_metadata_int(&st->metadata, "contrast", avio_rl32(pb), 1);
    set_metadata_int(&st->metadata, "gamma", avio_rl32(pb), 1);

-    avio_skip(pb, 72); // Reserved1 .. WBView
+    avio_skip(pb, 12 + 16); // Reserved1 .. AutoExpRect
+    set_metadata_float(&st->metadata, "wbgain[0].r", av_int2float(avio_rl32(pb)), 1);
+    set_metadata_float(&st->metadata, "wbgain[0].b", av_int2float(avio_rl32(pb)), 1);
+    avio_skip(pb, 36); // WBGain[1].. WBView

    st->codec->bits_per_coded_sample = avio_rl32(pb);

@@ -34,7 +34,7 @@ static int dts_probe(AVProbeData *p)
 {
    const uint8_t *buf, *bufp;
    uint32_t state = -1;
-    int markers[4] = {0};
+    int markers[4*16] = {0};
    int sum, max, i;
    int64_t diff = 0;
    uint8_t hdr[12 + FF_INPUT_BUFFER_PADDING_SIZE] = { 0 };
@@ -43,6 +43,7 @@ static int dts_probe(AVProbeData *p)

    for(; buf < (p->buf+p->buf_size)-2; buf+=2) {
        int marker, sample_blocks, sample_rate, sr_code, framesize;
+        int lfe;
        GetBitContext gb;

        bufp = buf;
@@ -89,13 +90,27 @@ static int dts_probe(AVProbeData *p)
        if (sample_rate == 0)
            continue;

+        get_bits(&gb, 5);
+        if (get_bits(&gb, 1))
+            continue;
+
+        skip_bits_long(&gb, 9);
+        lfe = get_bits(&gb, 2);
+        if (lfe > 2)
+            continue;
+
+        marker += 4* sr_code;
+
        markers[marker] ++;
    }
-    sum = markers[0] + markers[1] + markers[2] + markers[3];
-    max = 0;
-    for (i=1; i<4; i++)
+
+    sum = max = 0;
+    for (i=0; i<FF_ARRAY_ELEMS(markers); i++) {
+        sum += markers[i];
        if (markers[max] < markers[i])
            max = i;
+    }
+
    if (markers[max] > 3 && p->buf_size / markers[max] < 32*1024 &&
        markers[max] * 4 > sum * 3 &&
        diff / p->buf_size > 200)
@@ -390,7 +390,7 @@ static int amf_parse_object(AVFormatContext *s, AVStream *astream,
    FLVContext *flv = s->priv_data;
    AVIOContext *ioc;
    AMFDataType amf_type;
-    char str_val[256];
+    char str_val[1024];
    double num_val;

    num_val  = 0;
@@ -459,11 +459,11 @@ static int amf_parse_object(AVFormatContext *s, AVStream *astream,
    }

    if (key) {
+        acodec = astream ? astream->codec : NULL;
+        vcodec = vstream ? vstream->codec : NULL;
+
        // stream info doesn't live any deeper than the first object
        if (depth == 1) {
-            acodec = astream ? astream->codec : NULL;
-            vcodec = vstream ? vstream->codec : NULL;
-
            if (amf_type == AMF_DATA_TYPE_NUMBER ||
                amf_type == AMF_DATA_TYPE_BOOL) {
                if (!strcmp(key, "duration"))
@@ -558,13 +558,13 @@ static int flv_read_metabody(AVFormatContext *s, int64_t next_pos)
    type = avio_r8(ioc);
    if (type != AMF_DATA_TYPE_STRING ||
        amf_get_string(ioc, buffer, sizeof(buffer)) < 0)
-        return -1;
+        return 2;

    if (!strcmp(buffer, "onTextData"))
        return 1;

    if (strcmp(buffer, "onMetaData") && strcmp(buffer, "onCuePoint"))
-        return -1;
+        return 2;

    // find the streams now so that amf_parse_object doesn't need to do
    // the lookup every time it is called.
@@ -623,7 +623,7 @@ static int flv_read_close(AVFormatContext *s)

 static int flv_get_extradata(AVFormatContext *s, AVStream *st, int size)
 {
-    av_free(st->codec->extradata);
+    av_freep(&st->codec->extradata);
    if (ff_get_extradata(st->codec, s->pb, size) < 0)
        return AVERROR(ENOMEM);
    return 0;
@@ -822,7 +822,7 @@ static int flv_read_packet(AVFormatContext *s, AVPacket *pkt)
            stream_type=FLV_STREAM_TYPE_DATA;
            if (size > 13 + 1 + 4 && dts == 0) { // Header-type metadata stuff
                meta_pos = avio_tell(s->pb);
-                if (flv_read_metabody(s, next) == 0) {
+                if (flv_read_metabody(s, next) <= 0) {
                    goto skip;
                }
                avio_seek(s->pb, meta_pos, SEEK_SET);
@@ -145,15 +145,15 @@ static void hds_free(AVFormatContext *s)
        if (os->ctx && os->ctx_inited)
            av_write_trailer(os->ctx);
        if (os->ctx && os->ctx->pb)
-            av_free(os->ctx->pb);
+            av_freep(&os->ctx->pb);
        if (os->ctx)
            avformat_free_context(os->ctx);
-        av_free(os->metadata);
+        av_freep(&os->metadata);
        for (j = 0; j < os->nb_extra_packets; j++)
-            av_free(os->extra_packets[j]);
+            av_freep(&os->extra_packets[j]);
        for (j = 0; j < os->nb_fragments; j++)
-            av_free(os->fragments[j]);
-        av_free(os->fragments);
+            av_freep(&os->fragments[j]);
+        av_freep(&os->fragments);
    }
    av_freep(&c->streams);
 }
@@ -506,7 +506,7 @@ static int hds_flush(AVFormatContext *s, OutputStream *os, int final,
        if (remove > 0) {
            for (i = 0; i < remove; i++) {
                unlink(os->fragments[i]->file);
-                av_free(os->fragments[i]);
+                av_freep(&os->fragments[i]);
            }
            os->nb_fragments -= remove;
            memmove(os->fragments, os->fragments + remove,
@@ -329,9 +329,10 @@ static int hls_write_trailer(struct AVFormatContext *s)

    av_write_trailer(oc);
    avio_closep(&oc->pb);
-    avformat_free_context(oc);
    av_free(hls->basename);
    hls_append_segment(hls, hls->duration);
+    avformat_free_context(oc);
+    hls->avf = NULL;
    hls_window(s, 1);

    hls_free_segments(hls);
@@ -171,6 +171,7 @@ typedef struct MOVContext {
    int *bitrates;          ///< bitrates read before streams creation
    int bitrates_count;
    int moov_retry;
+    int atom_depth;
 } MOVContext;

 int ff_mp4_read_descr_len(AVIOContext *pb);
@@ -1078,7 +1078,7 @@ static void ebml_free(EbmlSyntax *syntax, void *data)
                for (j = 0; j < list->nb_elem;
                     j++, ptr += syntax[i].list_elem_size)
                    ebml_free(syntax[i].def.n, ptr);
-                av_free(list->elem);
+                av_freep(&list->elem);
            } else
                ebml_free(syntax[i].def.n, data_off);
        default:
@@ -1412,13 +1412,17 @@ static void matroska_execute_seekhead(MatroskaDemuxContext *matroska)
    EbmlList *seekhead_list = &matroska->seekhead;
    int64_t before_pos = avio_tell(matroska->ctx->pb);
    int i;
+    int nb_elem;

    // we should not do any seeking in the streaming case
    if (!matroska->ctx->pb->seekable ||
        (matroska->ctx->flags & AVFMT_FLAG_IGNIDX))
        return;

-    for (i = 0; i < seekhead_list->nb_elem; i++) {
+    // do not read entries that are added while parsing seekhead entries
+    nb_elem = seekhead_list->nb_elem;
+
+    for (i = 0; i < nb_elem; i++) {
        MatroskaSeekhead *seekhead = seekhead_list->elem;
        if (seekhead[i].pos <= before_pos)
            continue;
@@ -1920,7 +1924,8 @@ static int matroska_parse_tracks(AVFormatContext *s)
                av_reduce(&st->avg_frame_rate.num, &st->avg_frame_rate.den,
                          1000000000, track->default_duration, 30000);
 #if FF_API_R_FRAME_RATE
-                if (st->avg_frame_rate.num < st->avg_frame_rate.den * 1000L)
+                if (   st->avg_frame_rate.num < st->avg_frame_rate.den * 1000L
+                    && st->avg_frame_rate.num > st->avg_frame_rate.den * 5L)
                    st->r_frame_rate = st->avg_frame_rate;
 #endif
            }
@@ -2127,7 +2132,7 @@ static int matroska_deliver_packet(MatroskaDemuxContext *matroska,
 {
    if (matroska->num_packets > 0) {
        memcpy(pkt, matroska->packets[0], sizeof(AVPacket));
-        av_free(matroska->packets[0]);
+        av_freep(&matroska->packets[0]);
        if (matroska->num_packets > 1) {
            void *newpackets;
            memmove(&matroska->packets[0], &matroska->packets[1],
@@ -2158,7 +2163,7 @@ static void matroska_clear_queue(MatroskaDemuxContext *matroska)
        int n;
        for (n = 0; n < matroska->num_packets; n++) {
            av_free_packet(matroska->packets[n]);
-            av_free(matroska->packets[n]);
+            av_freep(&matroska->packets[n]);
        }
        av_freep(&matroska->packets);
        matroska->num_packets = 0;
@@ -2990,7 +2995,7 @@ static int matroska_read_close(AVFormatContext *s)

    for (n = 0; n < matroska->tracks.nb_elem; n++)
        if (tracks[n].type == MATROSKA_TRACK_TYPE_AUDIO)
-            av_free(tracks[n].audio.buf);
+            av_freep(&tracks[n].audio.buf);
    ebml_free(matroska_cluster, &matroska->current_cluster);
    ebml_free(matroska_segment, matroska);

@@ -210,7 +210,11 @@ static int mov_read_covr(MOVContext *c, AVIOContext *pb, int type, int len)
 static int mov_metadata_raw(MOVContext *c, AVIOContext *pb,
                            unsigned len, const char *key)
 {
-    char *value = av_malloc(len + 1);
+    char *value;
+    // Check for overflow.
+    if (len >= INT_MAX)
+        return AVERROR(EINVAL);
+    value = av_malloc(len + 1);
    if (!value)
        return AVERROR(ENOMEM);
    avio_read(pb, value, len);
@@ -355,7 +359,7 @@ static int mov_read_udta_string(MOVContext *c, AVIOContext *pb, MOVAtom atom)

    if (!key)
        return 0;
-    if (atom.size < 0)
+    if (atom.size < 0 || str_size >= INT_MAX/2)
        return AVERROR_INVALIDDATA;

    str_size = FFMIN3(sizeof(str)-1, str_size, atom.size);
@@ -1174,10 +1178,12 @@ static int mov_read_stco(MOVContext *c, AVIOContext *pb, MOVAtom atom)

    if (!entries)
        return 0;
-    if (entries >= UINT_MAX/sizeof(int64_t))
-        return AVERROR_INVALIDDATA;

-    sc->chunk_offsets = av_malloc(entries * sizeof(int64_t));
+    if (sc->chunk_offsets)
+        av_log(c->fc, AV_LOG_WARNING, "Duplicate STCO atom\n");
+    av_free(sc->chunk_offsets);
+    sc->chunk_count = 0;
+    sc->chunk_offsets = av_malloc_array(entries, sizeof(*sc->chunk_offsets));
    if (!sc->chunk_offsets)
        return AVERROR(ENOMEM);
    sc->chunk_count = entries;
@@ -1453,7 +1459,7 @@ static void mov_parse_stsd_audio(MOVContext *c, AVIOContext *pb,

 static void mov_parse_stsd_subtitle(MOVContext *c, AVIOContext *pb,
                                    AVStream *st, MOVStreamContext *sc,
-                                    int size)
+                                    int64_t size)
 {
    // ttxt stsd contains display flags, justification, background
    // color, fonts, and default styles, so fake an atom to read it
@@ -1518,10 +1524,10 @@ static int mov_rewrite_dvd_sub_extradata(AVStream *st)

 static int mov_parse_stsd_data(MOVContext *c, AVIOContext *pb,
                                AVStream *st, MOVStreamContext *sc,
-                                int size)
+                                int64_t size)
 {
    if (st->codec->codec_tag == MKTAG('t','m','c','d')) {
-        if (ff_get_extradata(st->codec, pb, size) < 0)
+        if ((int)size != size || ff_get_extradata(st->codec, pb, size) < 0)
            return AVERROR(ENOMEM);
        if (size > 16) {
            MOVStreamContext *tmcd_ctx = st->priv_data;
@@ -1766,9 +1772,11 @@ static int mov_read_stsc(MOVContext *c, AVIOContext *pb, MOVAtom atom)

    if (!entries)
        return 0;
-    if (entries >= UINT_MAX / sizeof(*sc->stsc_data))
-        return AVERROR_INVALIDDATA;
-    sc->stsc_data = av_malloc(entries * sizeof(*sc->stsc_data));
+    if (sc->stsc_data)
+        av_log(c->fc, AV_LOG_WARNING, "Duplicate STSC atom\n");
+    av_free(sc->stsc_data);
+    sc->stsc_count = 0;
+    sc->stsc_data = av_malloc_array(entries, sizeof(*sc->stsc_data));
    if (!sc->stsc_data)
        return AVERROR(ENOMEM);

@@ -1800,9 +1808,11 @@ static int mov_read_stps(MOVContext *c, AVIOContext *pb, MOVAtom atom)
    avio_rb32(pb); // version + flags

    entries = avio_rb32(pb);
-    if (entries >= UINT_MAX / sizeof(*sc->stps_data))
-        return AVERROR_INVALIDDATA;
-    sc->stps_data = av_malloc(entries * sizeof(*sc->stps_data));
+    if (sc->stps_data)
+        av_log(c->fc, AV_LOG_WARNING, "Duplicate STPS atom\n");
+    av_free(sc->stps_data);
+    sc->stps_count = 0;
+    sc->stps_data = av_malloc_array(entries, sizeof(*sc->stps_data));
    if (!sc->stps_data)
        return AVERROR(ENOMEM);

@@ -1844,9 +1854,13 @@ static int mov_read_stss(MOVContext *c, AVIOContext *pb, MOVAtom atom)
            st->need_parsing = AVSTREAM_PARSE_HEADERS;
        return 0;
    }
+    if (sc->keyframes)
+        av_log(c->fc, AV_LOG_WARNING, "Duplicated STSS atom\n");
    if (entries >= UINT_MAX / sizeof(int))
        return AVERROR_INVALIDDATA;
-    sc->keyframes = av_malloc(entries * sizeof(int));
+    av_freep(&sc->keyframes);
+    sc->keyframe_count = 0;
+    sc->keyframes = av_malloc_array(entries, sizeof(*sc->keyframes));
    if (!sc->keyframes)
        return AVERROR(ENOMEM);

@@ -1905,9 +1919,13 @@ static int mov_read_stsz(MOVContext *c, AVIOContext *pb, MOVAtom atom)

    if (!entries)
        return 0;
-    if (entries >= UINT_MAX / sizeof(int) || entries >= (UINT_MAX - 4) / field_size)
+    if (entries >= (UINT_MAX - 4) / field_size)
        return AVERROR_INVALIDDATA;
-    sc->sample_sizes = av_malloc(entries * sizeof(int));
+    if (sc->sample_sizes)
+        av_log(c->fc, AV_LOG_WARNING, "Duplicate STSZ atom\n");
+    av_free(sc->sample_sizes);
+    sc->sample_count = 0;
+    sc->sample_sizes = av_malloc_array(entries, sizeof(*sc->sample_sizes));
    if (!sc->sample_sizes)
        return AVERROR(ENOMEM);

@@ -1961,11 +1979,11 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
    av_dlog(c->fc, "track[%i].stts.entries = %i\n",
            c->fc->nb_streams-1, entries);

-    if (entries >= UINT_MAX / sizeof(*sc->stts_data))
-        return -1;
-
+    if (sc->stts_data)
+        av_log(c->fc, AV_LOG_WARNING, "Duplicate STTS atom\n");
    av_free(sc->stts_data);
-    sc->stts_data = av_malloc(entries * sizeof(*sc->stts_data));
+    sc->stts_count = 0;
+    sc->stts_data = av_malloc_array(entries, sizeof(*sc->stts_data));
    if (!sc->stts_data)
        return AVERROR(ENOMEM);

@@ -2104,9 +2122,11 @@ static int mov_read_sbgp(MOVContext *c, AVIOContext *pb, MOVAtom atom)
    entries = avio_rb32(pb);
    if (!entries)
        return 0;
-    if (entries >= UINT_MAX / sizeof(*sc->rap_group))
-        return AVERROR_INVALIDDATA;
-    sc->rap_group = av_malloc(entries * sizeof(*sc->rap_group));
+    if (sc->rap_group)
+        av_log(c->fc, AV_LOG_WARNING, "Duplicate SBGP atom\n");
+    av_free(sc->rap_group);
+    sc->rap_group_count = 0;
+    sc->rap_group = av_malloc_array(entries, sizeof(*sc->rap_group));
    if (!sc->rap_group)
        return AVERROR(ENOMEM);

@@ -3172,6 +3192,12 @@ static int mov_read_default(MOVContext *c, AVIOContext *pb, MOVAtom atom)
    MOVAtom a;
    int i;

+    if (c->atom_depth > 10) {
+        av_log(c->fc, AV_LOG_ERROR, "Atoms too deeply nested\n");
+        return AVERROR_INVALIDDATA;
+    }
+    c->atom_depth ++;
+
    if (atom.size < 0)
        atom.size = INT64_MAX;
    while (total_size + 8 <= atom.size && !avio_feof(pb)) {
@@ -3201,11 +3227,12 @@ static int mov_read_default(MOVContext *c, AVIOContext *pb, MOVAtom atom)
                {
                    av_log(c->fc, AV_LOG_ERROR, "Broken file, trak/mdat not at top-level\n");
                    avio_skip(pb, -8);
+                    c->atom_depth --;
                    return 0;
                }
            }
            total_size += 8;
-            if (a.size == 1) { /* 64 bit extended size */
+            if (a.size == 1 && total_size + 8 <= atom.size) { /* 64 bit extended size */
                a.size = avio_rb64(pb) - 8;
                total_size += 8;
            }
@@ -3237,13 +3264,16 @@ static int mov_read_default(MOVContext *c, AVIOContext *pb, MOVAtom atom)
            int64_t start_pos = avio_tell(pb);
            int64_t left;
            int err = parse(c, pb, a);
-            if (err < 0)
+            if (err < 0) {
+                c->atom_depth --;
                return err;
+            }
            if (c->found_moov && c->found_mdat &&
                ((!pb->seekable || c->fc->flags & AVFMT_FLAG_IGNIDX) ||
                 start_pos + a.size == avio_size(pb))) {
                if (!pb->seekable || c->fc->flags & AVFMT_FLAG_IGNIDX)
                    c->next_root_atom = start_pos + a.size;
+                c->atom_depth --;
                return 0;
            }
            left = a.size - avio_tell(pb) + start_pos;
@@ -3263,6 +3293,7 @@ static int mov_read_default(MOVContext *c, AVIOContext *pb, MOVAtom atom)
    if (total_size < atom.size && atom.size < 0x7ffff)
        avio_skip(pb, atom.size - total_size);

+    c->atom_depth --;
    return 0;
 }

@@ -2190,7 +2190,8 @@ static int mov_write_mvhd_tag(AVIOContext *pb, MOVMuxContext *mov)
    }

    version = max_track_len < UINT32_MAX ? 0 : 1;
-    (version == 1) ? avio_wb32(pb, 120) : avio_wb32(pb, 108); /* size */
+    avio_wb32(pb, version == 1 ? 120 : 108); /* size */
+
    ffio_wfourcc(pb, "mvhd");
    avio_w8(pb, version);
    avio_wb24(pb, 0); /* flags */
@@ -988,7 +988,7 @@ static const MXFCodecUL mxf_sound_essence_container_uls[] = {

 static const MXFCodecUL mxf_data_essence_container_uls[] = {
    { { 0x06,0x0e,0x2b,0x34,0x04,0x01,0x01,0x09,0x0d,0x01,0x03,0x01,0x02,0x0e,0x00,0x00 }, 16, 0 },
-    { { 0x06,0x0e,0x2b,0x34,0x04,0x01,0x01,0x09,0x0d,0x01,0x03,0x01,0x02,0x0e,0x00,0x00 }, 16, AV_CODEC_ID_NONE },
+    { { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },  0, AV_CODEC_ID_NONE },
 };

 static const char* const mxf_data_essence_descriptor[] = {
@@ -93,6 +93,7 @@ static const AVOption avformat_options[] = {
 {"strict", "how strictly to follow the standards", OFFSET(strict_std_compliance), AV_OPT_TYPE_INT, {.i64 = DEFAULT }, INT_MIN, INT_MAX, D|E, "strict"},
 {"strict", "strictly conform to all the things in the spec no matter what the consequences", 0, AV_OPT_TYPE_CONST, {.i64 = FF_COMPLIANCE_STRICT }, INT_MIN, INT_MAX, D|E, "strict"},
 {"normal", NULL, 0, AV_OPT_TYPE_CONST, {.i64 = FF_COMPLIANCE_NORMAL }, INT_MIN, INT_MAX, D|E, "strict"},
+{"unofficial", "allow unofficial extensions", 0, AV_OPT_TYPE_CONST, {.i64 = FF_COMPLIANCE_UNOFFICIAL }, INT_MIN, INT_MAX, D|E, "strict"},
 {"experimental", "allow non-standardized experimental variants", 0, AV_OPT_TYPE_CONST, {.i64 = FF_COMPLIANCE_EXPERIMENTAL }, INT_MIN, INT_MAX, D|E, "strict"},
 {"max_ts_probe", "maximum number of packets to read while waiting for the first timestamp", OFFSET(max_ts_probe), AV_OPT_TYPE_INT, { .i64 = 50 }, 0, INT_MAX, D },
 {NULL},
@@ -312,6 +312,9 @@ ff_rm_read_mdpr_codecdata (AVFormatContext *s, AVIOContext *pb,
    int64_t codec_pos;
    int ret;

+    if (codec_data_size < 0)
+        return AVERROR_INVALIDDATA;
+
    avpriv_set_pts_info(st, 64, 1, 1000);
    codec_pos = avio_tell(pb);
    v = avio_rb32(pb);
@@ -70,7 +70,7 @@ static int rsd_read_header(AVFormatContext *s)
    codec->codec_tag  = avio_rl32(pb);
    codec->codec_id   = ff_codec_get_id(rsd_tags, codec->codec_tag);
    if (!codec->codec_id) {
-        char tag_buf[5];
+        char tag_buf[32];

        av_get_codec_tag_string(tag_buf, sizeof(tag_buf), codec->codec_tag);
        for (i=0; i < FF_ARRAY_ELEMS(rsd_unsupported_tags); i++) {
@@ -340,7 +340,7 @@ static int segment_end(AVFormatContext *s, int write_trailer, int is_last)
            if (seg->list_size && seg->segment_count >= seg->list_size) {
                entry = seg->segment_list_entries;
                seg->segment_list_entries = seg->segment_list_entries->next;
-                av_free(entry->filename);
+                av_freep(&entry->filename);
                av_freep(&entry);
            }

@@ -498,10 +498,10 @@ static int open_null_ctx(AVIOContext **ctx)
    return 0;
 }

-static void close_null_ctx(AVIOContext *pb)
+static void close_null_ctxp(AVIOContext **pb)
 {
-    av_free(pb->buffer);
-    av_free(pb);
+    av_freep(&(*pb)->buffer);
+    av_freep(pb);
 }

 static int select_reference_stream(AVFormatContext *s)
@@ -567,6 +567,7 @@ static int seg_write_header(AVFormatContext *s)
    AVFormatContext *oc = NULL;
    AVDictionary *options = NULL;
    int ret;
+    int i;

    seg->segment_count = 0;
    if (!seg->write_header_trailer)
@@ -672,11 +673,18 @@ static int seg_write_header(AVFormatContext *s)
    }
    seg->segment_frame_count = 0;

+    av_assert0(s->nb_streams == oc->nb_streams);
+    for (i = 0; i < s->nb_streams; i++) {
+        AVStream *inner_st  = oc->streams[i];
+        AVStream *outer_st = s->streams[i];
+        avpriv_set_pts_info(outer_st, inner_st->pts_wrap_bits, inner_st->time_base.num, inner_st->time_base.den);
+    }
+
    if (oc->avoid_negative_ts > 0 && s->avoid_negative_ts < 0)
        s->avoid_negative_ts = 1;

    if (!seg->write_header_trailer) {
-        close_null_ctx(oc->pb);
+        close_null_ctxp(&oc->pb);
        if ((ret = avio_open2(&oc->pb, oc->filename, AVIO_FLAG_WRITE,
                              &s->interrupt_callback, NULL)) < 0)
            goto fail;
@@ -813,7 +821,7 @@ static int seg_write_trailer(struct AVFormatContext *s)
            goto fail;
        open_null_ctx(&oc->pb);
        ret = av_write_trailer(oc);
-        close_null_ctx(oc->pb);
+        close_null_ctxp(&oc->pb);
    } else {
        ret = segment_end(s, 1, 1);
    }
@@ -829,7 +837,7 @@ fail:
    cur = seg->segment_list_entries;
    while (cur) {
        next = cur->next;
-        av_free(cur->filename);
+        av_freep(&cur->filename);
        av_free(cur);
        cur = next;
    }
@@ -53,6 +53,9 @@
 #include "riff.h"
 #include "url.h"

+#include "libavutil/ffversion.h"
+const char av_format_ffversion[] = "FFmpeg version " FFMPEG_VERSION;
+
 /**
 * @file
 * various utility functions for use within FFmpeg
@@ -568,6 +571,8 @@ static int update_wrap_reference(AVFormatContext *s, AVStream *st, int stream_in
        int default_stream_index = av_find_default_stream_index(s);
        if (s->streams[default_stream_index]->pts_wrap_reference == AV_NOPTS_VALUE) {
            for (i = 0; i < s->nb_streams; i++) {
+                if (av_find_program_from_stream(s, NULL, i))
+                    continue;
                s->streams[i]->pts_wrap_reference = pts_wrap_reference;
                s->streams[i]->pts_wrap_behavior = pts_wrap_behavior;
            }
@@ -2743,10 +2748,16 @@ static void compute_chapters_end(AVFormatContext *s)

 static int get_std_framerate(int i)
 {
-    if (i < 60 * 12)
+    if (i < 30*12)
        return (i + 1) * 1001;
-    else
-        return ((const int[]) { 24, 30, 60, 12, 15, 48 })[i - 60 * 12] * 1000 * 12;
+    i -= 30*12;
+
+    if (i < 7)
+        return ((const int[]) { 40, 48, 50, 60, 80, 120, 240})[i] * 1001 * 12;
+
+    i -= 7;
+
+    return ((const int[]) { 24, 30, 60, 12, 15, 48 })[i] * 1000 * 12;
 }

 /* Is the time base unreliable?
@@ -2781,6 +2792,7 @@ int ff_alloc_extradata(AVCodecContext *avctx, int size)
    int ret;

    if (size < 0 || size >= INT32_MAX - FF_INPUT_BUFFER_PADDING_SIZE) {
+        avctx->extradata = NULL;
        avctx->extradata_size = 0;
        return AVERROR(EINVAL);
    }
@@ -789,6 +789,8 @@ static int parse_chunks(AVFormatContext *s, int mode, int64_t seekts, int *len_p
        len = avio_rl32(pb);
        if (len < 32) {
            int ret;
+            if (avio_feof(pb))
+                return AVERROR_EOF;
            av_log(s, AV_LOG_WARNING, "encountered broken chunk\n");
            if ((ret = recover(wtv, avio_tell(pb) - 20)) < 0)
                return ret;
@@ -23,6 +23,10 @@
 #include "buffer_internal.h"
 #include "common.h"
 #include "mem.h"
+#include "thread.h"
+
+//#define USE_ATOMICS !(HAVE_PTHREADS || HAVE_W32THREADS)
+#define USE_ATOMICS 1 // can be changed to the above once it received more testing in master

 AVBufferRef *av_buffer_create(uint8_t *data, int size,
                              void (*free)(void *opaque, uint8_t *data),
@@ -209,6 +213,8 @@ AVBufferPool *av_buffer_pool_init(int size, AVBufferRef* (*alloc)(int size))
    if (!pool)
        return NULL;

+    ff_mutex_init(&pool->mutex, NULL);
+
    pool->size     = size;
    pool->alloc    = alloc ? alloc : av_buffer_alloc;

@@ -230,6 +236,7 @@ static void buffer_pool_free(AVBufferPool *pool)
        buf->free(buf->opaque, buf->data);
        av_freep(&buf);
    }
+    ff_mutex_destroy(&pool->mutex);
    av_freep(&pool);
 }

@@ -290,7 +297,15 @@ static void pool_release_buffer(void *opaque, uint8_t *data)
    if(CONFIG_MEMORY_POISONING)
        memset(buf->data, FF_MEMORY_POISON, pool->size);

+#if USE_ATOMICS
    add_to_pool(buf);
+#else
+    ff_mutex_lock(&pool->mutex);
+    buf->next = pool->pool;
+    pool->pool = buf;
+    ff_mutex_unlock(&pool->mutex);
+#endif
+
    if (!avpriv_atomic_int_add_and_fetch(&pool->refcount, -1))
        buffer_pool_free(pool);
 }
@@ -320,8 +335,10 @@ static AVBufferRef *pool_alloc_buffer(AVBufferPool *pool)
    ret->buffer->opaque = buf;
    ret->buffer->free   = pool_release_buffer;

+#if USE_ATOMICS
    avpriv_atomic_int_add_and_fetch(&pool->refcount, 1);
    avpriv_atomic_int_add_and_fetch(&pool->nb_allocated, 1);
+#endif

    return ret;
 }
@@ -331,6 +348,7 @@ AVBufferRef *av_buffer_pool_get(AVBufferPool *pool)
    AVBufferRef *ret;
    BufferPoolEntry *buf;

+#if USE_ATOMICS
    /* check whether the pool is empty */
    buf = get_pool(pool);
    if (!buf && pool->refcount <= pool->nb_allocated) {
@@ -352,7 +370,24 @@ AVBufferRef *av_buffer_pool_get(AVBufferPool *pool)
        add_to_pool(buf);
        return NULL;
    }
-    avpriv_atomic_int_add_and_fetch(&pool->refcount, 1);
+#else
+    ff_mutex_lock(&pool->mutex);
+    buf = pool->pool;
+    if (buf) {
+        ret = av_buffer_create(buf->data, pool->size, pool_release_buffer,
+                               buf, 0);
+        if (ret) {
+            pool->pool = buf->next;
+            buf->next = NULL;
+        }
+    } else {
+        ret = pool_alloc_buffer(pool);
+    }
+    ff_mutex_unlock(&pool->mutex);
+#endif
+
+    if (ret)
+        avpriv_atomic_int_add_and_fetch(&pool->refcount, 1);

    return ret;
 }
@@ -22,6 +22,7 @@
 #include <stdint.h>

 #include "buffer.h"
+#include "thread.h"

 /**
 * The buffer is always treated as read-only.
@@ -72,6 +73,7 @@ typedef struct BufferPoolEntry {
 } BufferPoolEntry;

 struct AVBufferPool {
+    AVMutex mutex;
    BufferPoolEntry * volatile pool;

    /*
@@ -503,6 +503,7 @@ int av_frame_copy_props(AVFrame *dst, const AVFrame *src)
                free_side_data(&dst->side_data[i]);
            }
            av_freep(&dst->side_data);
+            dst->nb_side_data = 0;
            return AVERROR(ENOMEM);
        }
        memcpy(sd_dst->data, sd_src->data, sd_src->size);
@@ -82,16 +82,6 @@ static av_always_inline float cbrtf(float x)
 #define exp2f(x) ((float)exp2(x))
 #endif /* HAVE_EXP2F */

-#if !HAVE_FMINF
-#undef fminf
-static av_always_inline av_const float fminf(float x, float y)
-{
-    //Note, the NaN special case is needed for C spec compliance, it should be
-    //optimized away if the users compiler is configured to assume no NaN
-    return x > y ? y : (x == x ? x : y);
-}
-#endif
-
 #if !HAVE_ISINF
 static av_always_inline av_const int isinf(float x)
 {
@@ -725,6 +725,10 @@ int av_opt_get(void *obj, const char *name, int search_flags, uint8_t **out_val)
            return AVERROR(EINVAL);
        if (!(*out_val = av_malloc(len*2 + 1)))
            return AVERROR(ENOMEM);
+        if (!len) {
+            *out_val[0] = '\0';
+            return 0;
+        }
        bin = *(uint8_t**)dst;
        for (i = 0; i < len; i++)
            snprintf(*out_val + i*2, 3, "%02X", bin[i]);
@@ -740,12 +744,14 @@ int av_opt_get(void *obj, const char *name, int search_flags, uint8_t **out_val)
        break;
    case AV_OPT_TYPE_DURATION:
        i64 = *(int64_t *)dst;
-        ret = snprintf(buf, sizeof(buf), "%"PRIi64"d:%02d:%02d.%06d",
+        ret = snprintf(buf, sizeof(buf), "%"PRIi64":%02d:%02d.%06d",
                       i64 / 3600000000, (int)((i64 / 60000000) % 60),
                       (int)((i64 / 1000000) % 60), (int)(i64 % 1000000));
        break;
    case AV_OPT_TYPE_COLOR:
-        ret = snprintf(buf, sizeof(buf), "0x%02x%02x%02x%02x", ((int *)dst)[0], ((int *)dst)[1], ((int *)dst)[2], ((int *)dst)[3]);
+        ret = snprintf(buf, sizeof(buf), "0x%02x%02x%02x%02x",
+                       (int)((uint8_t *)dst)[0], (int)((uint8_t *)dst)[1],
+                       (int)((uint8_t *)dst)[2], (int)((uint8_t *)dst)[3]);
        break;
    case AV_OPT_TYPE_CHANNEL_LAYOUT:
        i64 = *(int64_t *)dst;
@@ -0,0 +1,55 @@
+/*
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+// This header should only be used to simplify code where
+// threading is optional, not as a generic threading abstraction.
+
+#ifndef AVUTIL_THREAD_H
+#define AVUTIL_THREAD_H
+
+#include "config.h"
+
+#if HAVE_PTHREADS || HAVE_W32THREADS || HAVE_OS2THREADS
+
+#if HAVE_PTHREADS
+#include <pthread.h>
+#elif HAVE_OS2THREADS
+#include "compat/os2threads.h"
+#else
+#include "compat/w32pthreads.h"
+#endif
+
+#define AVMutex pthread_mutex_t
+
+#define ff_mutex_init    pthread_mutex_init
+#define ff_mutex_lock    pthread_mutex_lock
+#define ff_mutex_unlock  pthread_mutex_unlock
+#define ff_mutex_destroy pthread_mutex_destroy
+
+#else
+
+#define AVMutex char
+
+#define ff_mutex_init(mutex, attr) (0)
+#define ff_mutex_lock(mutex) (0)
+#define ff_mutex_unlock(mutex) (0)
+#define ff_mutex_destroy(mutex) (0)
+
+#endif
+
+#endif /* AVUTIL_THREAD_H */
@@ -27,6 +27,9 @@
 * various utility functions
 */

+#include "libavutil/ffversion.h"
+const char av_util_ffversion[] = "FFmpeg version " FFMPEG_VERSION;
+
 unsigned avutil_version(void)
 {
    static int checks_done;
@@ -89,6 +89,9 @@ try to unroll inner for(x=0 ... loop to avoid these damn if(x ... checks
 #include "postprocess_internal.h"
 #include "libavutil/avstring.h"

+#include "libavutil/ffversion.h"
+const char postproc_ffversion[] = "FFmpeg version " FFMPEG_VERSION;
+
 unsigned postproc_version(void)
 {
    av_assert0(LIBPOSTPROC_VERSION_MICRO >= 100);
@@ -979,7 +982,7 @@ void  pp_postprocess(const uint8_t * src[3], const int srcStride[3],

    if(pict_type & PP_PICT_TYPE_QP2){
        int i;
-        const int count= mbHeight * absQPStride;
+        const int count= FFMAX(mbHeight * absQPStride, mbWidth);
        for(i=0; i<(count>>2); i++){
            ((uint32_t*)c->stdQPTable)[i] = (((const uint32_t*)QP_store)[i]>>1) & 0x7F7F7F7F;
        }
@@ -1004,7 +1007,7 @@ void  pp_postprocess(const uint8_t * src[3], const int srcStride[3],
    if((pict_type&7)!=3){
        if (QPStride >= 0){
            int i;
-            const int count= mbHeight * QPStride;
+            const int count= FFMAX(mbHeight * QPStride, mbWidth);
            for(i=0; i<(count>>2); i++){
                ((uint32_t*)c->nonBQPTable)[i] = ((const uint32_t*)QP_store)[i] & 0x3F3F3F3F;
            }
@@ -76,8 +76,12 @@ static int process(
        AudioData *src, int src_size, int *consumed){
    size_t idone, odone;
    soxr_error_t error = soxr_set_error((soxr_t)c, soxr_set_num_channels((soxr_t)c, src->ch_count));
-    error = soxr_process((soxr_t)c, src->ch, (size_t)src_size,
-            &idone, dst->ch, (size_t)dst_size, &odone);
+    if (!error)
+        error = soxr_process((soxr_t)c, src->ch, (size_t)src_size,
+                             &idone, dst->ch, (size_t)dst_size, &odone);
+    else
+        idone = 0;
+
    *consumed = (int)idone;
    return error? -1 : odone;
 }
@@ -28,6 +28,9 @@

 #define ALIGN 32

+#include "libavutil/ffversion.h"
+const char swr_ffversion[] = "FFmpeg version " FFMPEG_VERSION;
+
 unsigned swresample_version(void)
 {
    av_assert0(LIBSWRESAMPLE_VERSION_MICRO >= 100);
@@ -663,6 +666,8 @@ int swr_convert(struct SwrContext *s, uint8_t *out_arg[SWR_CH_MAX], int out_coun
        in_count = 0;
        if(ret>0) {
            s->drop_output -= ret;
+            if (!s->drop_output && !out_arg)
+                return 0;
            continue;
        }

@@ -27,6 +27,7 @@
 #include "libavutil/avutil.h"
 #include "libavutil/bswap.h"
 #include "libavutil/cpu.h"
+#include "libavutil/imgutils.h"
 #include "libavutil/intreadwrite.h"
 #include "libavutil/mathematics.h"
 #include "libavutil/pixdesc.h"
@@ -899,6 +900,18 @@ int attribute_align_arg sws_scale(struct SwsContext *c,
        av_log(c, AV_LOG_ERROR, "One of the input parameters to sws_scale() is NULL, please check the calling code\n");
        return 0;
    }
+    if (c->cascaded_context[0] && srcSliceY == 0 && srcSliceH == c->cascaded_context[0]->srcH) {
+        ret = sws_scale(c->cascaded_context[0],
+                        srcSlice, srcStride, srcSliceY, srcSliceH,
+                        c->cascaded_tmp, c->cascaded_tmpStride);
+        if (ret < 0)
+            return ret;
+        ret = sws_scale(c->cascaded_context[1],
+                        (const uint8_t * const * )c->cascaded_tmp, c->cascaded_tmpStride, 0, c->cascaded_context[0]->dstH,
+                        dst, dstStride);
+        return ret;
+    }
+
    memcpy(src2, srcSlice, sizeof(src2));
    memcpy(dst2, dst, sizeof(dst2));

--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .4.2
 .4.6