avutil/softfloat: use abort() instead of av_assert0(0)

Fixes compilation of host tool aacps_fixed_tablegen.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 9f4a41bf99)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Changelog

@@ -1,7 +1,132 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.
 
-version <next>:
+version 2.8.3
+- avcodec/cabac: Check initial cabac decoder state
+- avcodec/cabac_functions: Fix "left shift of negative value -31767"
+- avcodec/h264_slice: Limit max_contexts when slice_context_count is initialized
+- rtmpcrypt: Do the xtea decryption in little endian mode
+- avformat/matroskadec: Check subtitle stream before dereferencing
+- avcodec/pngdec: Replace assert by request for sample for unsupported TRNS cases
+- avformat/utils: Do not init parser if probing is unfinished
+- avcodec/jpeg2000dec: Fix potential integer overflow with tile dimensions
+- avcodec/jpeg2000: Use av_image_check_size() in ff_jpeg2000_init_component()
+- avcodec/wmaprodec: Check for overread in decode_packet()
+- avcodec/smacker: Check that the data size is a multiple of a sample vector
+- avcodec/takdec: Skip last p2 sample (which is unused)
+- avcodec/dxtory: Fix input size check in dxtory_decode_v1_410()
+- avcodec/dxtory: Fix input size check in dxtory_decode_v1_420()
+- avcodec/error_resilience: avoid accessing previous or next frames tables beyond height
+- avcodec/dpx: Move need_align to act per line
+- avcodec/flashsv: Check size before updating it
+- avcodec/ivi: Check image dimensions
+- avcodec/utils: Better check for channels in av_get_audio_frame_duration()
+- avcodec/jpeg2000dec: Check for duplicate SIZ marker
+- aacsbr: don't call sbr_dequant twice without intermediate read_sbr_data
+- hqx: correct type and size check of info_offset
+- mxfdec: check edit_rate also for physical_track
+- avcodec/jpeg2000: Change coord to 32bit to support larger than 32k width or height
+- avcodec/jpeg2000dec: Check SIZ dimensions to be within the supported range
+- avcodec/jpeg2000: Check comp coords to be within the supported size
+- mpegvideo: clear overread in clear_context
+- avcodec/avrndec: Use the AVFrame format instead of the context
+- dds: disable palette flag for compressed images
+- dds: validate compressed source buffer size
+- dds: validate source buffer size before copying
+- dvdsubdec: validate offset2 similar to offset1
+- brstm: reject negative sample rate
+- aacps: avoid division by zero in stereo_processing
+- softfloat: assert when the argument of av_sqrt_sf is negative
+
+version 2.8.2
+- various fixes in the aac_fixed decoder
+- various fixes in softfloat
+- swresample/resample: increase precision for compensation
+- lavf/mov: add support for sidx fragment indexes
+- avformat/mxfenc: Only store user comment related tags when needed
+- tests/fate/avformat: Fix fate-lavf
+- doc/ffmpeg: Clarify that the sdp_file option requires an rtp output.
+- ffmpeg: Don't try and write sdp info if none of the outputs had an rtp format.
+- apng: use correct size for output buffer
+- jvdec: avoid unsigned overflow in comparison
+- avcodec/jpeg2000dec: Clip all tile coordinates
+- avcodec/microdvddec: Check for string end in 'P' case
+- avcodec/dirac_parser: Fix undefined memcpy() use
+- avformat/xmv: Discard remainder of packet on error
+- avformat/xmv: factor return check out of if/else
+- avcodec/mpeg12dec: Do not call show_bits() with invalid bits
+- avcodec/faxcompr: Add missing runs check in decode_uncompressed()
+- libavutil/channel_layout: Check strtol*() for failure
+- avformat/mpegts: Only start probing data streams within probe_packets
+- avcodec/hevc_ps: Check chroma_format_idc
+- avcodec/ffv1dec: Check for 0 quant tables
+- avcodec/mjpegdec: Reinitialize IDCT on BPP changes
+- avcodec/mjpegdec: Check index in ljpeg_decode_yuv_scan() before using it
+- avutil/file_open: avoid file handle inheritance on Windows
+- avcodec/h264_slice: Disable slice threads if there are multiple access units in a packet
+- avformat/hls: update cookies on setcookie response
+- opusdec: Don't run vector_fmul_scalar on zero length arrays
+- avcodec/opusdec: Fix extra samples read index
+- avcodec/ffv1: Initialize vlc_state on allocation
+- avcodec/ffv1dec: update progress in case of broken pointer chains
+- avcodec/ffv1dec: Clear slice coordinates if they are invalid or slice header decoding fails for other reasons
+- rtsp: Allow $ as interleaved packet indicator before a complete response header
+- videodsp: don't overread edges in vfix3 emu_edge.
+- avformat/mp3dec: improve junk skipping heuristic
+- concatdec: fix file_start_time calculation regression
+- avcodec: loongson optimize h264dsp idct and loop filter with mmi
+- avcodec/jpeg2000dec: Clear properties in jpeg2000_dec_cleanup() too
+- avformat/hls: add support for EXT-X-MAP
+- avformat/hls: fix segment selection regression on track changes of live streams
+- configure: Require libkvazaar < 0.7.
+- avcodec/vp8: Do not use num_coeff_partitions in thread/buffer setup
+
+
+version 2.8.1:
+- swscale: fix ticket #4881
+- doc: fix spelling errors
+- hls: only seek if there is an offset
+- asfdec: add more checks for size left in asf packet buffer
+- asfdec: alloc enough space for storing name in asf_read_metadata_obj
+- avcodec/pngdec: Check blend_op.
+- h264_mp4toannexb: fix pps offfset fault when there are more than one sps in avcc
+- avcodec/h264_mp4toannexb_bsf: Use av_freep() to free spspps_buf
+- avformat/avidec: Workaround broken initial frame
+- avformat/hls: fix some cases of HLS streams which require cookies
+- avcodec/pngdec: reset has_trns after every decode_frame_png()
+- lavf/img2dec: Fix memory leak
+- avcodec/mp3: fix skipping zeros
+- avformat/srtdec: make sure we probe a number
+- configure: check for ID3D11VideoContext
+- avformat/vobsub: compare correct packet stream IDs
+- avformat/srtdec: more lenient first line probing
+- avformat/srtdec: fix number check for the first character
+- avcodec/mips: build fix for MSA 64bit
+- avcodec/mips: build fix for MSA
+- avformat/httpauth: Add space after commas in HTTP/RTSP auth header
+- libavformat/hlsenc: Use of uninitialized memory unlinking old files
+- avcodec/x86/sbrdsp: Fix using uninitialized upper 32bit of noise
+- avcodec/ffv1dec: Fix off by 1 error in quant_table_count check
+- avcodec/ffv1dec: Explicitly check read_quant_table() return value
+- dnxhddata: correct weight tables
+- dnxhddec: decode and use interlace mb flag
+- swscale: fix ticket #4877
+- avcodec/rangecoder: Check e
+- avcodec/ffv1: separate slice_count from max_slice_count
+- swscale: fix ticket 4850
+- cmdutils: Filter dst/srcw/h
+- avutil/log: fix zero length gnu_printf format string warning
+- lavf/webvttenc: Require webvtt file to contain exactly one WebVTT stream.
+- swscale/swscale: Fix "unused variable" warning
+- avcodec/mjpegdec: Fix decoding RGBA RCT LJPEG
+- MAINTAINERS: add 2.8, drop 2.2
+- doc: mention libavcodec can decode Opus natively
+- hevc: properly handle no_rasl_output_flag when removing pictures from the DPB
+- avfilter/af_ladspa: process all channels for nb_handles > 1
+- configure: add libsoxr to swresample's pkgconfig
+- lavc: Fix compilation with --disable-everything --enable-parser=mpeg4video.
+
+version 2.8:
 - colorkey video filter
 - BFSTM/BCSTM demuxer
 - little-endian ADPCM_THP decoder

MAINTAINERS

@@ -564,11 +564,11 @@ x86                                     Michael Niedermayer
 Releases
 ========
 
+2.8                                     Michael Niedermayer
 2.7                                     Michael Niedermayer
 2.6                                     Michael Niedermayer
 2.5                                     Michael Niedermayer
 2.4                                     Michael Niedermayer
-2.2                                     Michael Niedermayer
 
 If you want to maintain an older release, please contact us
 

RELEASE

@@ -1 +1 @@
-2.7.git
+2.8.3

RELEASE_NOTES

@@ -0,0 +1,15 @@
+
+              ┌────────────────────────────────────────┐
+              │ RELEASE NOTES for FFmpeg 2.8 "Feynman" │
+              └────────────────────────────────────────┘
+
+   The FFmpeg Project proudly presents FFmpeg 2.8 "Feynman", about 3
+   months after the release of FFmpeg 2.7.
+
+   A complete Changelog is available at the root of the project, and the
+   complete Git history on http://source.ffmpeg.org.
+
+   We hope you will like this release as much as we enjoyed working on it, and
+   as usual, if you have any questions about it, or any FFmpeg related topic,
+   feel free to join us on the #ffmpeg IRC channel (on irc.freenode.net) or ask
+   on the mailing-lists.

cmdutils.c

@@ -563,6 +563,12 @@ int opt_default(void *optctx, const char *opt, const char *arg)
         struct SwsContext *sws = sws_alloc_context();
         int ret = av_opt_set(sws, opt, arg, 0);
         sws_freeContext(sws);
+        if (!strcmp(opt, "srcw") || !strcmp(opt, "srch") ||
+            !strcmp(opt, "dstw") || !strcmp(opt, "dsth") ||
+            !strcmp(opt, "src_format") || !strcmp(opt, "dst_format")) {
+            av_log(NULL, AV_LOG_ERROR, "Directly using swscale dimensions/format options is not supported, please use the -s or -pix_fmt options\n");
+            return AVERROR(EINVAL);
+        }
         if (ret < 0) {
             av_log(NULL, AV_LOG_ERROR, "Error setting option %s.\n", opt);
             return ret;

configure

@@ -2374,7 +2374,7 @@ zmbv_encoder_select="zlib"
 
 # hardware accelerators
 crystalhd_deps="libcrystalhd_libcrystalhd_if_h"
-d3d11va_deps="d3d11_h dxva_h ID3D11VideoDecoder"
+d3d11va_deps="d3d11_h dxva_h ID3D11VideoDecoder ID3D11VideoContext"
 dxva2_deps="dxva2api_h DXVA2_ConfigPictureDecode"
 vaapi_deps="va_va_h"
 vda_deps="VideoDecodeAcceleration_VDADecoder_h pthreads CoreServices_CoreServices_h"
@@ -5147,6 +5147,7 @@ check_struct "sys/time.h sys/resource.h" "struct rusage" ru_maxrss
 
 check_type "windows.h dxva.h" "DXVA_PicParams_HEVC" -DWINAPI_FAMILY=WINAPI_FAMILY_DESKTOP_APP -D_CRT_BUILD_DESKTOP_APP=0
 check_type "windows.h d3d11.h" "ID3D11VideoDecoder"
+check_type "windows.h d3d11.h" "ID3D11VideoContext"
 check_type "d3d9.h dxva2api.h" DXVA2_ConfigPictureDecode -D_WIN32_WINNT=0x0602
 
 check_type "va/va.h" "VAPictureParameterBufferHEVC"
@@ -5239,7 +5240,7 @@ enabled libgsm            && { for gsm_hdr in "gsm.h" "gsm/gsm.h"; do
                                    check_lib "${gsm_hdr}" gsm_create -lgsm && break;
                                done || die "ERROR: libgsm not found"; }
 enabled libilbc           && require libilbc ilbc.h WebRtcIlbcfix_InitDecode -lilbc
-enabled libkvazaar        && require_pkg_config kvazaar kvazaar.h kvz_api_get
+enabled libkvazaar        && require_pkg_config "kvazaar < 0.7.0" kvazaar.h kvz_api_get
 enabled libmfx            && require_pkg_config libmfx "mfx/mfxvideo.h" MFXInit
 enabled libmodplug        && require_pkg_config libmodplug libmodplug/modplug.h ModPlug_Load
 enabled libmp3lame        && require "libmp3lame >= 3.98.3" lame/lame.h lame_set_VBR_quality -lmp3lame
@@ -5261,7 +5262,7 @@ enabled libshine          && require_pkg_config shine shine/layer3.h shine_encod
 enabled libsmbclient      && { use_pkg_config smbclient libsmbclient.h smbc_init ||
                                require smbclient libsmbclient.h smbc_init -lsmbclient; }
 enabled libsnappy         && require snappy snappy-c.h snappy_compress -lsnappy
-enabled libsoxr           && require libsoxr soxr.h soxr_create -lsoxr
+enabled libsoxr           && require libsoxr soxr.h soxr_create -lsoxr && LIBSOXR="-lsoxr"
 enabled libssh            && require_pkg_config libssh libssh/sftp.h sftp_init
 enabled libspeex          && require_pkg_config speex speex/speex.h speex_decoder_init -lspeex
 enabled libstagefright_h264 && require_cpp libstagefright_h264 "binder/ProcessState.h media/stagefright/MetaData.h
@@ -6264,4 +6265,4 @@ pkgconfig_generate libavfilter   "FFmpeg audio/video filtering library" "$LIBAVF
 pkgconfig_generate libpostproc   "FFmpeg postprocessing library"        "$LIBPOSTPROC_VERSION"   ""
 pkgconfig_generate libavresample "Libav audio resampling library"       "$LIBAVRESAMPLE_VERSION" "$LIBM"
 pkgconfig_generate libswscale    "FFmpeg image rescaling library"       "$LIBSWSCALE_VERSION"    "$LIBM"
-pkgconfig_generate libswresample "FFmpeg audio resampling library"      "$LIBSWRESAMPLE_VERSION" "$LIBM"
+pkgconfig_generate libswresample "FFmpeg audio resampling library"      "$LIBSWRESAMPLE_VERSION" "$LIBM $LIBSOXR"

doc/APIchanges

@@ -15,27 +15,29 @@ libavutil:     2014-08-09
 
 API changes, most recent first:
 
-2015-xx-xx - lavc 56.58.100 - vaapi.h
+-------- 8< --------- FFmpeg 2.8 was cut here -------- 8< ---------
+
+2015-08-27 - 1dd854e1 - lavc 56.58.100 - vaapi.h
   Deprecate old VA-API context (vaapi_context) fields that were only
   set and used by libavcodec. They are all managed internally now.
 
-2015-xx-xx - lavu 54.31.100 - pixfmt.h
+2015-08-19 - 9f8e57ef - lavu 54.31.100 - pixfmt.h
   Add a unique pixel format for VA-API (AV_PIX_FMT_VAAPI) that
   indicates the nature of the underlying storage: a VA surface. This
   yields the same value as AV_PIX_FMT_VAAPI_VLD.
   Deprecate old VA-API related pixel formats: AV_PIX_FMT_VAAPI_MOCO,
   AV_PIX_FMT_VAAPI_IDCT, AV_PIX_FMT_VAAPI_VLD.
 
-2015-xx-xx - lavu 54.30.0
-  xxxxxxx -  Add av_blowfish_alloc().
-  xxxxxxx -  Add av_rc4_alloc().
-  xxxxxxx -  Add av_xtea_alloc().
-  xxxxxxx -  Add av_des_alloc().
+2015-08-02 - lavu 54.30.100 / 54.17.0
+  9ed59f1 / 7a7df34c -  Add av_blowfish_alloc().
+  a130ec9 / ae365453 -  Add av_rc4_alloc().
+  9ca1997 / 5d8bea3b -  Add av_xtea_alloc().
+  3cf08e9 / d9e8b47e -  Add av_des_alloc().
 
-2015-xx-xx - lavc 56.35.0 - avcodec.h
-  xxxxxxxxx - Rename CODEC_FLAG* defines to AV_CODEC_FLAG*.
-  xxxxxxxxx - Rename CODEC_CAP_* defines to AV_CODEC_CAP_*.
-  xxxxxxxxx - Rename FF_INPUT_BUFFER_PADDING_SIZE and FF_MIN_BUFFER_SIZE
+2015-07-27 - lavc 56.56.100 / 56.35.0 - avcodec.h
+  94d68a4 / 7c6eb0a1 - Rename CODEC_FLAG* defines to AV_CODEC_FLAG*.
+  444e987 / def97856 - Rename CODEC_CAP_* defines to AV_CODEC_CAP_*.
+  29d147c / 059a9348 - Rename FF_INPUT_BUFFER_PADDING_SIZE and FF_MIN_BUFFER_SIZE
               to AV_INPUT_BUFFER_PADDING_SIZE and AV_INPUT_BUFFER_MIN_SIZE.
 
 2015-07-22 - c40ecff - lavc 56.51.100 - avcodec.h

doc/Doxyfile

@@ -31,7 +31,7 @@ PROJECT_NAME           = FFmpeg
 # This could be handy for archiving the generated documentation or
 # if some version control system is used.
 
-PROJECT_NUMBER         =
+PROJECT_NUMBER         = 2.8.3
 
 # With the PROJECT_LOGO tag one can specify a logo or icon that is included
 # in the documentation. The maximum height of the logo should not exceed 55

doc/encoders.texi

@@ -1353,7 +1353,7 @@ can be selected with @code{-pred 1}.
 @table @option
 @item format
 Can be set to either @code{j2k} or @code{jp2} (the default) that
-allows to store non-rgb pix_fmts.
+makes it possible to store non-rgb pix_fmts.
 
 @end table
 

doc/ffmpeg.texi

@@ -1205,9 +1205,9 @@ The option is intended for cases where features are needed that cannot be
 specified to @command{ffserver} but can be to @command{ffmpeg}.
 
 @item -sdp_file @var{file} (@emph{global})
-Print sdp information to @var{file}.
+Print sdp information for an output stream to @var{file}.
 This allows dumping sdp information when at least one output isn't an
-rtp stream.
+rtp stream. (Requires at least one of the output formats to be rtp).
 
 @item -discard (@emph{input})
 Allows discarding specific streams or frames of streams at the demuxer.

doc/filters.texi

@@ -1032,7 +1032,7 @@ Number_of_samples
 For example full key look like this @code{lavfi.astats.1.DC_offset} or
 this @code{lavfi.astats.Overall.Peak_count}.
 
-For description what each key means read bellow.
+For description what each key means read below.
 
 @item reset
 Set number of frame after which stats are going to be recalculated.
@@ -2199,7 +2199,7 @@ Amount of milliseconds the signal has to rise above the threshold before gain
 reduction starts. Default is 20. Range is between 0.01 and 2000.
 
 @item release
-Amount of milliseconds the signal has to fall bellow the threshold before
+Amount of milliseconds the signal has to fall below the threshold before
 reduction is decreased again. Default is 250. Range is between 0.01 and 9000.
 
 @item makeup
@@ -4118,7 +4118,7 @@ It accepts the following options:
 @item threshold1
 @item threshold2
 @item threshold3
-Allows to limit the maximum change for each plane, default is 65535.
+Limit the maximum change for each plane, default is 65535.
 If 0, plane will remain unchanged.
 @end table
 
@@ -4321,7 +4321,7 @@ It accepts the following options:
 @item threshold1
 @item threshold2
 @item threshold3
-Allows to limit the maximum change for each plane, default is 65535.
+Limit the maximum change for each plane, default is 65535.
 If 0, plane will remain unchanged.
 
 @item coordinates
@@ -5206,7 +5206,7 @@ It accepts the following options:
 @item threshold1
 @item threshold2
 @item threshold3
-Allows to limit the maximum change for each plane, default is 65535.
+Limit the maximum change for each plane, default is 65535.
 If 0, plane will remain unchanged.
 
 @item coordinates
@@ -6900,7 +6900,7 @@ It accepts the following options:
 @item threshold1
 @item threshold2
 @item threshold3
-Allows to limit the maximum change for each plane, default is 65535.
+Limit the maximum change for each plane, default is 65535.
 If 0, plane will remain unchanged.
 @end table
 
@@ -9881,7 +9881,7 @@ stereo3d=sbsl:aybd
 @end example
 
 @item
-Convert input video from above bellow (left eye above, right eye below) to side by side crosseye.
+Convert input video from above below (left eye above, right eye below) to side by side crosseye.
 @example
 stereo3d=abl:sbsr
 @end example

doc/general.texi

@@ -983,8 +983,8 @@ following image formats are supported:
 @item Musepack SV8           @tab     @tab  X
 @item Nellymoser Asao        @tab  X  @tab  X
 @item On2 AVC (Audio for Video Codec) @tab     @tab  X
-@item Opus                   @tab  E  @tab  E
-    @tab supported through external library libopus
+@item Opus                   @tab  E  @tab  X
+    @tab encoding supported through external library libopus
 @item PCM A-law              @tab  X  @tab  X
 @item PCM mu-law             @tab  X  @tab  X
 @item PCM signed 8-bit planar  @tab  X  @tab  X

doc/muxers.texi

@@ -839,6 +839,21 @@ ffmpeg -i file.mpg -c copy \
      -y out.ts
 @end example
 
+@section mxf, mxf_d10
+
+MXF muxer.
+
+@subsection Options
+
+The muxer options are:
+
+@table @option
+@item store_user_comments @var{bool}
+Set if user comments should be stored if available or never.
+IRT D-10 does not allow user comments. The default is thus to write them for
+mxf but not for mxf_d10
+@end table
+
 @section null
 
 Null muxer.

ffmpeg.c

@@ -2447,6 +2447,9 @@ static void print_sdp(void)
         }
     }
 
+    if (!j)
+        goto fail;
+
     av_sdp_create(avc, j, sdp, sizeof(sdp));
 
     if (!sdp_filename) {
@@ -2462,6 +2465,7 @@ static void print_sdp(void)
         }
     }
 
+fail:
     av_freep(&avc);
 }
 

libavcodec/Makefile

@@ -861,7 +861,7 @@ OBJS-$(CONFIG_MJPEG_PARSER)            += mjpeg_parser.o
 OBJS-$(CONFIG_MLP_PARSER)              += mlp_parser.o mlp.o
 OBJS-$(CONFIG_MPEG4VIDEO_PARSER)       += mpeg4video_parser.o h263.o \
                                           mpeg4videodec.o mpeg4video.o \
-                                          ituh263dec.o h263dec.o
+                                          ituh263dec.o h263dec.o h263data.o
 OBJS-$(CONFIG_PNG_PARSER)              += png_parser.o
 OBJS-$(CONFIG_MPEGAUDIO_PARSER)        += mpegaudio_parser.o \
                                           mpegaudiodecheader.o mpegaudiodata.o

libavcodec/aacdec_template.c

@@ -2889,6 +2889,11 @@ static int aac_decode_er_frame(AVCodecContext *avctx, void *data,
 
     spectral_to_sample(ac, samples);
 
+    if (!ac->frame->data[0] && samples) {
+        av_log(avctx, AV_LOG_ERROR, "no frame data found\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     ac->frame->nb_samples = samples;
     ac->frame->sample_rate = avctx->sample_rate;
     *got_frame_ptr = 1;

libavcodec/aacps.c

@@ -940,7 +940,7 @@ static void stereo_processing(PSContext *ps, INTFLOAT (*l)[32][2], INTFLOAT (*r)
             LOCAL_ALIGNED_16(INTFLOAT, h_step, [2], [4]);
             int start = ps->border_position[e];
             int stop  = ps->border_position[e+1];
-            INTFLOAT width = Q30(1.f) / (stop - start);
+            INTFLOAT width = Q30(1.f) / ((stop - start) ? (stop - start) : 1);
 #if USE_FIXED
             width <<= 1;
 #endif

libavcodec/aacsbr_fixed.c

@@ -169,6 +169,10 @@ static void sbr_dequant(SpectralBandReplication *sbr, int id_aac)
                 else
                   temp1.mant = 0x20000000;
                 temp1.exp = (temp1.exp >> 1) + 1;
+                if (temp1.exp > 66) { // temp1 > 1E20
+                    av_log(NULL, AV_LOG_ERROR, "envelope scalefactor overflow in dequant\n");
+                    temp1 = FLOAT_1;
+                }
 
                 temp2.exp = (pan_offset - sbr->data[1].env_facs[e][k].mant) * alpha;
                 if (temp2.exp & 1)
@@ -188,6 +192,10 @@ static void sbr_dequant(SpectralBandReplication *sbr, int id_aac)
                 temp1.exp = NOISE_FLOOR_OFFSET - \
                     sbr->data[0].noise_facs[e][k].mant + 2;
                 temp1.mant = 0x20000000;
+                if (temp1.exp > 66) { // temp1 > 1E20
+                    av_log(NULL, AV_LOG_ERROR, "envelope scalefactor overflow in dequant\n");
+                    temp1 = FLOAT_1;
+                }
                 temp2.exp = 12 - sbr->data[1].noise_facs[e][k].mant + 1;
                 temp2.mant = 0x20000000;
                 fac   = av_div_sf(temp1, av_add_sf(FLOAT_1, temp2));
@@ -208,7 +216,10 @@ static void sbr_dequant(SpectralBandReplication *sbr, int id_aac)
                     else
                         temp1.mant = 0x20000000;
                     temp1.exp = (temp1.exp >> 1) + 1;
-
+                    if (temp1.exp > 66) { // temp1 > 1E20
+                        av_log(NULL, AV_LOG_ERROR, "envelope scalefactor overflow in dequant\n");
+                        temp1 = FLOAT_1;
+                    }
                     sbr->data[ch].env_facs[e][k] = temp1;
                 }
             for (e = 1; e <= sbr->data[ch].bs_num_noise; e++)
@@ -397,7 +408,8 @@ static void sbr_gain_calc(AACContext *ac, SpectralBandReplication *sbr,
         int delta = !((e == e_a[1]) || (e == e_a[0]));
         for (k = 0; k < sbr->n_lim; k++) {
             SoftFloat gain_boost, gain_max;
-            SoftFloat sum[2] = { { 0, 0}, { 0, 0 } };
+            SoftFloat sum[2];
+            sum[0] = sum[1] = FLOAT_0;
             for (m = sbr->f_tablelim[k] - sbr->kx[1]; m < sbr->f_tablelim[k + 1] - sbr->kx[1]; m++) {
                 const SoftFloat temp = av_div_sf(sbr->e_origmapped[e][m],
                                             av_add_sf(FLOAT_1, sbr->q_mapped[e][m]));

libavcodec/aacsbr_template.c

@@ -70,6 +70,7 @@ av_cold void AAC_RENAME(ff_aac_sbr_init)(void)
 /** Places SBR in pure upsampling mode. */
 static void sbr_turnoff(SpectralBandReplication *sbr) {
     sbr->start = 0;
+    sbr->ready_for_dequant = 0;
     // Init defults used in pure upsampling mode
     sbr->kx[1] = 32; //Typo in spec, kx' inits to 32
     sbr->m[1] = 0;
@@ -177,6 +178,7 @@ static unsigned int read_sbr_header(SpectralBandReplication *sbr, GetBitContext
     SpectrumParameters old_spectrum_params;
 
     sbr->start = 1;
+    sbr->ready_for_dequant = 0;
 
     // Save last spectrum parameters variables to compare to new ones
     memcpy(&old_spectrum_params, &sbr->spectrum_params, sizeof(SpectrumParameters));
@@ -1032,6 +1034,7 @@ static unsigned int read_sbr_data(AACContext *ac, SpectralBandReplication *sbr,
     unsigned int cnt = get_bits_count(gb);
 
     sbr->id_aac = id_aac;
+    sbr->ready_for_dequant = 1;
 
     if (id_aac == TYPE_SCE || id_aac == TYPE_CCE) {
         if (read_sbr_single_channel_element(ac, sbr, gb)) {
@@ -1412,7 +1415,7 @@ static void sbr_env_estimate(AAC_FLOAT (*e_curr)[48], INTFLOAT X_high[64][40][2]
 
             for (p = 0; p < sbr->n[ch_data->bs_freq_res[e + 1]]; p++) {
 #if USE_FIXED
-                SoftFloat sum = { 0, 0 };
+                SoftFloat sum = FLOAT_0;
                 const SoftFloat den = av_int2sf(0x20000000 / (env_size * (table[p + 1] - table[p])), 29);
                 for (k = table[p]; k < table[p + 1]; k++) {
                     sum = av_add_sf(sum, sbr->dsp.sum_square(X_high[k] + ilb, iub - ilb));
@@ -1449,6 +1452,12 @@ void AAC_RENAME(ff_sbr_apply)(AACContext *ac, SpectralBandReplication *sbr, int
         sbr_turnoff(sbr);
     }
 
+    if (sbr->start && !sbr->ready_for_dequant) {
+        av_log(ac->avctx, AV_LOG_ERROR,
+               "No quantized data read for sbr_dequant.\n");
+        sbr_turnoff(sbr);
+    }
+
     if (!sbr->kx_and_m_pushed) {
         sbr->kx[0] = sbr->kx[1];
         sbr->m[0] = sbr->m[1];
@@ -1458,6 +1467,7 @@ void AAC_RENAME(ff_sbr_apply)(AACContext *ac, SpectralBandReplication *sbr, int
 
     if (sbr->start) {
         sbr_dequant(sbr, id_aac);
+        sbr->ready_for_dequant = 0;
     }
     for (ch = 0; ch < nch; ch++) {
         /* decode channel */

libavcodec/avrndec.c

@@ -113,7 +113,7 @@ static int decode_frame(AVCodecContext *avctx, void *data,
             int shift = p->height - avctx->height;
             int subsample_h, subsample_v;
 
-            av_pix_fmt_get_chroma_sub_sample(avctx->pix_fmt, &subsample_h, &subsample_v);
+            av_pix_fmt_get_chroma_sub_sample(p->format, &subsample_h, &subsample_v);
 
             p->data[0] += p->linesize[0] * shift;
             if (p->data[2]) {

libavcodec/cabac.c

@@ -51,7 +51,7 @@ void ff_init_cabac_encoder(CABACContext *c, uint8_t *buf, int buf_size){
  *
  * @param buf_size size of buf in bits
  */
-void ff_init_cabac_decoder(CABACContext *c, const uint8_t *buf, int buf_size){
+int ff_init_cabac_decoder(CABACContext *c, const uint8_t *buf, int buf_size){
     c->bytestream_start=
     c->bytestream= buf;
     c->bytestream_end= buf + buf_size;
@@ -64,6 +64,9 @@ void ff_init_cabac_decoder(CABACContext *c, const uint8_t *buf, int buf_size){
 #endif
     c->low+= ((*c->bytestream++)<<2) + 2;
     c->range= 0x1FE;
+    if ((c->range<<(CABAC_BITS+1)) < c->low)
+        return AVERROR_INVALIDDATA;
+    return 0;
 }
 
 void ff_init_cabac_states(void)

libavcodec/cabac.h

@@ -56,7 +56,7 @@ typedef struct CABACContext{
 }CABACContext;
 
 void ff_init_cabac_encoder(CABACContext *c, uint8_t *buf, int buf_size);
-void ff_init_cabac_decoder(CABACContext *c, const uint8_t *buf, int buf_size);
+int ff_init_cabac_decoder(CABACContext *c, const uint8_t *buf, int buf_size);
 void ff_init_cabac_states(void);
 
 #endif /* AVCODEC_CABAC_H */

libavcodec/cabac_functions.h

@@ -74,7 +74,8 @@ static inline void renorm_cabac_decoder_once(CABACContext *c){
 
 #ifndef get_cabac_inline
 static void refill2(CABACContext *c){
-    int i, x;
+    int i;
+    unsigned x;
 
     x= c->low ^ (c->low-1);
     i= 7 - ff_h264_norm_shift[x>>(CABAC_BITS-1)];
@@ -190,7 +191,8 @@ static av_unused const uint8_t* skip_bytes(CABACContext *c, int n) {
 #endif
     if ((int) (c->bytestream_end - ptr) < n)
         return NULL;
-    ff_init_cabac_decoder(c, ptr + n, c->bytestream_end - ptr - n);
+    if (ff_init_cabac_decoder(c, ptr + n, c->bytestream_end - ptr - n) < 0)
+        return NULL;
 
     return ptr;
 }

libavcodec/dds.c

@@ -141,6 +141,12 @@ static int parse_pixel_format(AVCodecContext *avctx)
     normal_map      = flags & DDPF_NORMALMAP;
     fourcc = bytestream2_get_le32(gbc);
 
+    if (ctx->compressed && ctx->paletted) {
+        av_log(avctx, AV_LOG_WARNING,
+               "Disabling invalid palette flag for compressed dds.\n");
+        ctx->paletted = 0;
+    }
+
     bpp = bytestream2_get_le32(gbc); // rgbbitcount
     r   = bytestream2_get_le32(gbc); // rbitmask
     g   = bytestream2_get_le32(gbc); // gbitmask
@@ -642,9 +648,18 @@ static int dds_decode(AVCodecContext *avctx, void *data,
         return ret;
 
     if (ctx->compressed) {
+        int size = (avctx->coded_height / TEXTURE_BLOCK_H) *
+                   (avctx->coded_width / TEXTURE_BLOCK_W) * ctx->tex_ratio;
         ctx->slice_count = av_clip(avctx->thread_count, 1,
                                    avctx->coded_height / TEXTURE_BLOCK_H);
 
+        if (bytestream2_get_bytes_left(gbc) < size) {
+            av_log(avctx, AV_LOG_ERROR,
+                   "Compressed Buffer is too small (%d < %d).\n",
+                   bytestream2_get_bytes_left(gbc), size);
+            return AVERROR_INVALIDDATA;
+        }
+
         /* Use the decompress function on the texture, one block per thread. */
         ctx->tex_data = gbc->buffer;
         avctx->execute2(avctx, decompress_texture_thread, frame, NULL, ctx->slice_count);
@@ -666,6 +681,12 @@ static int dds_decode(AVCodecContext *avctx, void *data,
             frame->palette_has_changed = 1;
         }
 
+        if (bytestream2_get_bytes_left(gbc) < frame->height * linesize) {
+            av_log(avctx, AV_LOG_ERROR, "Buffer is too small (%d < %d).\n",
+                   bytestream2_get_bytes_left(gbc), frame->height * linesize);
+            return AVERROR_INVALIDDATA;
+        }
+
         av_image_copy_plane(frame->data[0], frame->linesize[0],
                             gbc->buffer, linesize,
                             linesize, frame->height);

libavcodec/dirac_parser.c

@@ -123,7 +123,7 @@ static int dirac_combine_frame(AVCodecParserContext *s, AVCodecContext *avctx,
     DiracParseContext *pc = s->priv_data;
 
     if (pc->overread_index) {
-        memcpy(pc->buffer, pc->buffer + pc->overread_index,
+        memmove(pc->buffer, pc->buffer + pc->overread_index,
                pc->index - pc->overread_index);
         pc->index         -= pc->overread_index;
         pc->overread_index = 0;

libavcodec/dnxhddata.c

@@ -48,7 +48,7 @@ static const uint8_t dnxhd_1235_chroma_weight[] = {
     90, 90, 85, 79, 73, 73, 73, 73,
 };
 
-/* Used in CID 1237, 1253 */
+/* Used in CID 1237, 1253, 1259 */
 static const uint8_t dnxhd_1237_luma_weight[] = {
      0,  32,  33,  34, 34, 36, 37, 36,
     36,  37,  38,  38, 38, 39, 41, 44,
@@ -60,7 +60,7 @@ static const uint8_t dnxhd_1237_luma_weight[] = {
     97, 100, 104, 102, 98, 98, 99, 99,
 };
 
-/* Used in CID 1237, 1253 */
+/* Used in CID 1237, 1253, 1259 */
 static const uint8_t dnxhd_1237_chroma_weight[] = {
      0,  32,  36,  39, 39, 38, 39,  41,
     45,  51,  57,  58, 53, 48, 47,  51,
@@ -204,6 +204,7 @@ static const uint8_t dnxhd_1251_chroma_weight[] = {
     61, 59, 59, 59, 61, 62, 62, 62,
 };
 
+/* Used in CID 1252, 1258 */
 static const uint8_t dnxhd_1252_luma_weight[] = {
       0,  32,  34, 35, 36, 36, 36, 37,
      36,  37,  39, 40, 41, 40, 40, 40,
@@ -214,6 +215,8 @@ static const uint8_t dnxhd_1252_luma_weight[] = {
      71,  82,  90, 90, 88, 87, 90, 95,
     100, 107, 103, 97, 95, 93, 99, 99,
 };
+
+/* Used in CID 1252, 1258 */
 static const uint8_t dnxhd_1252_chroma_weight[] = {
       0,  32,  35,  36,  37,  37,  38,  40,
      42,  46,  49,  50,  50,  49,  49,  53,
@@ -226,80 +229,36 @@ static const uint8_t dnxhd_1252_chroma_weight[] = {
 };
 
 static const uint8_t dnxhd_1256_chroma_weight[] = {
-     0, 32, 32, 32, 32, 32, 32, 33,
-    32, 32, 32, 32, 32, 32, 32, 34,
-    32, 32, 32, 32, 32, 32, 33, 37,
-    32, 32, 32, 32, 32, 32, 36, 39,
-    32, 32, 32, 32, 32, 34, 39, 44,
-    32, 37, 32, 32, 35, 40, 43, 49,
-    32, 33, 36, 36, 40, 43, 50, 60,
-    34, 37, 39, 44, 51, 56, 61, 70,
-};
-
-static const uint8_t dnxhd_1258_luma_weight[] = {
-     0, 32, 36, 36,  40,  40, 55, 60,
-    34, 36, 37, 40,  41,  48, 57, 82,
-    35, 36, 41, 41,  46,  52, 73, 82,
-    37, 40, 42, 45,  50,  65, 80, 87,
-    39, 41, 44, 49,  62,  78, 88, 90,
-    41, 44, 49, 58,  73,  90, 95, 95,
-    43, 52, 55, 68,  90, 100, 97, 93,
-    52, 53, 71, 82, 107, 103, 99, 99,
-};
-
-static const uint8_t dnxhd_1258_chroma_weight[] = {
-     0, 32, 37,  38,  49,  53,  65,  66,
-    35, 37, 40,  49,  56,  64,  65,  82,
-    36, 42, 50,  56,  64,  67,  73,  85,
-    46, 50, 57,  63,  71,  72,  89,  87,
-    49, 58, 65,  72,  78,  88,  88,  90,
-    60, 64, 74,  81,  84,  90,  95, 134,
-    62, 74, 77,  80,  90, 114, 129, 125,
-    74, 74, 90, 100, 128, 125, 116, 116,
-};
-
-static const uint8_t dnxhd_1259_luma_weight[] = {
-     0, 32, 36, 37,  41,  44,  54, 60,
-    33, 34, 36, 39,  43,  51,  62, 78,
-    34, 36, 38, 41,  49,  59,  73, 79,
-    37, 38, 40, 47,  55,  66,  80, 95,
-    38, 41, 46, 54,  63,  79,  93, 96,
-    46, 47, 56, 64,  78,  90,  97, 98,
-    49, 58, 66, 78,  89,  97, 102, 98,
-    61, 65, 82, 87, 100, 104,  99, 99,
-};
-
-static const uint8_t dnxhd_1259_chroma_weight[] = {
-     0, 32, 38, 39,  47,  51,  77, 83,
-    36, 39, 41, 48,  55,  74,  85, 95,
-    39, 45, 53, 58,  72,  83, 105, 89,
-    51, 58, 66, 73,  82, 109,  92, 95,
-    57, 75, 78, 89, 105,  95,  93, 96,
-    81, 82, 99, 99,  94,  90,  97, 98,
-    83, 96, 97, 93,  89,  97, 102, 98,
-    90, 94, 92, 88, 100, 104,  99, 99,
+     0, 32, 32, 32, 32, 32, 32, 32,
+    32, 32, 32, 32, 32, 32, 32, 32,
+    32, 32, 32, 32, 32, 32, 37, 32,
+    32, 32, 32, 32, 33, 32, 32, 32,
+    32, 32, 33, 34, 37, 36, 32, 32,
+    32, 33, 34, 37, 36, 34, 35, 36,
+    39, 44, 40, 40, 39, 39, 44, 43,
+    43, 51, 56, 50, 49, 60, 61, 70,
 };
 
 static const uint8_t dnxhd_1260_luma_weight[] = {
-     0, 32, 37, 37, 40, 41, 52, 53,
-    33, 36, 36, 38, 40, 48, 49, 52,
-    34, 34, 37, 39, 44, 47, 49, 54,
-    33, 35, 38, 40, 45, 46, 54, 51,
-    34, 37, 37, 42, 44, 49, 52, 48,
-    34, 34, 38, 43, 44, 51, 50, 50,
-    33, 36, 41, 44, 51, 52, 50, 54,
-    36, 38, 44, 47, 53, 53, 54, 54,
+     0, 32, 33, 34, 36, 37, 37, 36,
+    34, 33, 34, 35, 37, 38, 40, 41,
+    40, 39, 38, 37, 34, 33, 34, 37,
+    40, 44, 48, 52, 53, 49, 47, 45,
+    42, 38, 36, 36, 38, 41, 43, 44,
+    46, 49, 52, 54, 54, 49, 44, 44,
+    44, 47, 51, 51, 52, 51, 48, 50,
+    52, 53, 53, 50, 50, 54, 54, 54,
 };
 
 static const uint8_t dnxhd_1260_chroma_weight[] = {
-     0, 32, 40, 38, 42, 40, 45, 45,
-    34, 42, 36, 43, 38, 46, 46, 49,
-    38, 35, 43, 39, 44, 47, 47, 49,
-    35, 42, 43, 42, 46, 47, 49, 52,
-    38, 43, 43, 44, 50, 49, 56, 50,
-    42, 43, 44, 50, 51, 57, 52, 53,
-    41, 45, 46, 53, 53, 56, 53, 54,
-    46, 46, 51, 49, 56, 53, 58, 58,
+     0, 32, 34, 38, 42, 40, 38, 36,
+    35, 35, 38, 42, 43, 43, 42, 40,
+    38, 39, 43, 43, 42, 41, 43, 43,
+    42, 44, 46, 45, 45, 46, 47, 46,
+    44, 44, 45, 46, 46, 46, 50, 50,
+    47, 47, 49, 49, 49, 49, 51, 53,
+    51, 49, 53, 57, 56, 52, 50, 52,
+    56, 56, 53, 53, 53, 54, 58, 58,
 };
 
 /* Used in CID 1235, 1241, 1250, 1256 */
@@ -1090,14 +1049,14 @@ const CIDEntry ff_dnxhd_cid_table[] = {
       { 350, 390, 440, 730, 880 },
       { { 24000, 1001 }, { 25, 1 }, { 30000, 1001 }, { 50, 1 }, { 60000, 1001 } } },
     { 1258, 960, 720, 0, 212992, 212992, 4, 8, 5,
-      dnxhd_1258_luma_weight, dnxhd_1258_chroma_weight,
+      dnxhd_1252_luma_weight, dnxhd_1252_chroma_weight,
       dnxhd_1237_dc_codes, dnxhd_1237_dc_bits,
       dnxhd_1252_ac_codes, dnxhd_1252_ac_bits, dnxhd_1252_ac_level,
       dnxhd_1252_ac_flags,
       dnxhd_1250_run_codes, dnxhd_1250_run_bits, dnxhd_1250_run,
       { 42, 60, 75, 115 } },
     { 1259, 1440, 1080, 0, 417792, 417792, 4, 8, 3,
-      dnxhd_1259_luma_weight, dnxhd_1259_chroma_weight,
+      dnxhd_1237_luma_weight, dnxhd_1237_chroma_weight,
       dnxhd_1237_dc_codes, dnxhd_1237_dc_bits,
       dnxhd_1237_ac_codes, dnxhd_1237_ac_bits, dnxhd_1237_ac_level,
       dnxhd_1237_ac_flags,

libavcodec/dnxhddec.c

@@ -349,7 +349,12 @@ static int dnxhd_decode_macroblock(DNXHDContext *ctx, AVFrame *frame,
     uint8_t *dest_y, *dest_u, *dest_v;
     int dct_y_offset, dct_x_offset;
     int qscale, i;
+    int interlaced_mb = 0;
 
+    if (ctx->cid_table->cid == 1260) {
+        interlaced_mb = get_bits1(&ctx->gb);
+        qscale = get_bits(&ctx->gb, 10);
+    } else
     qscale = get_bits(&ctx->gb, 11);
     skip_bits1(&ctx->gb);
 
@@ -386,8 +391,12 @@ static int dnxhd_decode_macroblock(DNXHDContext *ctx, AVFrame *frame,
         dest_u += frame->linesize[1];
         dest_v += frame->linesize[2];
     }
+    if (interlaced_mb) {
+        dct_linesize_luma   <<= 1;
+        dct_linesize_chroma <<= 1;
+    }
 
-    dct_y_offset = dct_linesize_luma << 3;
+    dct_y_offset = interlaced_mb ? frame->linesize[0] : (dct_linesize_luma << 3);
     dct_x_offset = 8 << shift1;
     if (!ctx->is_444) {
         ctx->idsp.idct_put(dest_y,                               dct_linesize_luma, ctx->blocks[0]);
@@ -396,7 +405,7 @@ static int dnxhd_decode_macroblock(DNXHDContext *ctx, AVFrame *frame,
         ctx->idsp.idct_put(dest_y + dct_y_offset + dct_x_offset, dct_linesize_luma, ctx->blocks[5]);
 
         if (!(ctx->avctx->flags & AV_CODEC_FLAG_GRAY)) {
-            dct_y_offset = dct_linesize_chroma << 3;
+            dct_y_offset = interlaced_mb ? frame->linesize[1] : (dct_linesize_chroma << 3);
             ctx->idsp.idct_put(dest_u,                dct_linesize_chroma, ctx->blocks[2]);
             ctx->idsp.idct_put(dest_v,                dct_linesize_chroma, ctx->blocks[3]);
             ctx->idsp.idct_put(dest_u + dct_y_offset, dct_linesize_chroma, ctx->blocks[6]);
@@ -409,7 +418,7 @@ static int dnxhd_decode_macroblock(DNXHDContext *ctx, AVFrame *frame,
         ctx->idsp.idct_put(dest_y + dct_y_offset + dct_x_offset, dct_linesize_luma, ctx->blocks[7]);
 
         if (!(ctx->avctx->flags & AV_CODEC_FLAG_GRAY)) {
-            dct_y_offset = dct_linesize_chroma << 3;
+            dct_y_offset = interlaced_mb ? frame->linesize[1] : (dct_linesize_chroma << 3);
             ctx->idsp.idct_put(dest_u,                               dct_linesize_chroma, ctx->blocks[2]);
             ctx->idsp.idct_put(dest_u + dct_x_offset,                dct_linesize_chroma, ctx->blocks[3]);
             ctx->idsp.idct_put(dest_u + dct_y_offset,                dct_linesize_chroma, ctx->blocks[8]);

libavcodec/dpx.c

@@ -348,11 +348,11 @@ static int decode_frame(AVCodecContext *avctx,
                 // For 12 bit, ignore alpha
                 if (elements == 4)
                     buf += 2;
-                // Jump to next aligned position
-                buf += need_align;
             }
             for (i = 0; i < 3; i++)
                 ptr[i] += p->linesize[i];
+            // Jump to next aligned position
+            buf += need_align;
         }
         break;
     case 16:

libavcodec/dvdsubdec.c

@@ -346,7 +346,7 @@ static int decode_dvd_subtitles(DVDSubContext *ctx, AVSubtitle *sub_header,
             }
         }
     the_end:
-        if (offset1 >= 0) {
+        if (offset1 >= 0 && offset2 >= 0) {
             int w, h;
             uint8_t *bitmap;
 

libavcodec/dxtory.c

@@ -65,7 +65,7 @@ static int dxtory_decode_v1_410(AVCodecContext *avctx, AVFrame *pic,
     uint8_t *Y1, *Y2, *Y3, *Y4, *U, *V;
     int ret;
 
-    if (src_size < avctx->width * avctx->height * 9LL / 8) {
+    if (src_size < FFALIGN(avctx->width, 4) * FFALIGN(avctx->height, 4) * 9LL / 8) {
         av_log(avctx, AV_LOG_ERROR, "packet too small\n");
         return AVERROR_INVALIDDATA;
     }
@@ -108,7 +108,7 @@ static int dxtory_decode_v1_420(AVCodecContext *avctx, AVFrame *pic,
     uint8_t *Y1, *Y2, *U, *V;
     int ret;
 
-    if (src_size < avctx->width * avctx->height * 3LL / 2) {
+    if (src_size < FFALIGN(avctx->width, 2) * FFALIGN(avctx->height, 2) * 3LL / 2) {
         av_log(avctx, AV_LOG_ERROR, "packet too small\n");
         return AVERROR_INVALIDDATA;
     }

libavcodec/error_resilience.c

@@ -381,14 +381,19 @@ static void guess_mv(ERContext *s)
 #define MV_UNCHANGED 1
     const int mb_stride = s->mb_stride;
     const int mb_width  = s->mb_width;
-    const int mb_height = s->mb_height;
+    int mb_height = s->mb_height;
     int i, depth, num_avail;
     int mb_x, mb_y, mot_step, mot_stride;
 
+    if (s->last_pic.f && s->last_pic.f->data[0])
+        mb_height = FFMIN(mb_height, (s->last_pic.f->height+15)>>4);
+    if (s->next_pic.f && s->next_pic.f->data[0])
+        mb_height = FFMIN(mb_height, (s->next_pic.f->height+15)>>4);
+
     set_mv_strides(s, &mot_step, &mot_stride);
 
     num_avail = 0;
-    for (i = 0; i < s->mb_num; i++) {
+    for (i = 0; i < mb_width * mb_height; i++) {
         const int mb_xy = s->mb_index2xy[i];
         int f = 0;
         int error = s->error_status_table[mb_xy];
@@ -413,7 +418,7 @@ static void guess_mv(ERContext *s)
 
     if ((!(s->avctx->error_concealment&FF_EC_GUESS_MVS)) ||
         num_avail <= mb_width / 2) {
-        for (mb_y = 0; mb_y < s->mb_height; mb_y++) {
+        for (mb_y = 0; mb_y < mb_height; mb_y++) {
             for (mb_x = 0; mb_x < s->mb_width; mb_x++) {
                 const int mb_xy = mb_x + mb_y * s->mb_stride;
                 int mv_dir = (s->last_pic.f && s->last_pic.f->data[0]) ? MV_DIR_FORWARD : MV_DIR_BACKWARD;
@@ -442,7 +447,7 @@ static void guess_mv(ERContext *s)
             int score_sum = 0;
 
             changed = 0;
-            for (mb_y = 0; mb_y < s->mb_height; mb_y++) {
+            for (mb_y = 0; mb_y < mb_height; mb_y++) {
                 for (mb_x = 0; mb_x < s->mb_width; mb_x++) {
                     const int mb_xy        = mb_x + mb_y * s->mb_stride;
                     int mv_predictor[8][2] = { { 0 } };
@@ -675,7 +680,7 @@ skip_last_mv:
         if (none_left)
             return;
 
-        for (i = 0; i < s->mb_num; i++) {
+        for (i = 0; i < mb_width * mb_height; i++) {
             int mb_xy = s->mb_index2xy[i];
             if (fixed[mb_xy])
                 fixed[mb_xy] = MV_FROZEN;

libavcodec/faxcompr.c

@@ -189,6 +189,10 @@ static int decode_uncompressed(AVCodecContext *avctx, GetBitContext *gb,
     *mode = !*mode;
     if (newmode != *mode) { //FIXME CHECK
         *(*runs)++ = 0;
+        if (*runs >= runend) {
+            av_log(avctx, AV_LOG_ERROR, "uncompressed run overrun\n");
+            return AVERROR_INVALIDDATA;
+        }
         *mode = newmode;
     }
     return 0;

libavcodec/ffv1.c

@@ -66,7 +66,7 @@ av_cold int ff_ffv1_common_init(AVCodecContext *avctx)
 
 av_cold int ff_ffv1_init_slice_state(FFV1Context *f, FFV1Context *fs)
 {
-    int j;
+    int j, i;
 
     fs->plane_count  = f->plane_count;
     fs->transparency = f->transparency;
@@ -80,10 +80,15 @@ av_cold int ff_ffv1_init_slice_state(FFV1Context *f, FFV1Context *fs)
             if (!p->state)
                 return AVERROR(ENOMEM);
         } else {
-            if (!p->vlc_state)
-                p->vlc_state = av_malloc_array(p->context_count, sizeof(VlcState));
-            if (!p->vlc_state)
-                return AVERROR(ENOMEM);
+            if (!p->vlc_state) {
+                p->vlc_state = av_mallocz_array(p->context_count, sizeof(VlcState));
+                if (!p->vlc_state)
+                    return AVERROR(ENOMEM);
+                for (i = 0; i < p->context_count; i++) {
+                    p->vlc_state[i].error_sum = 4;
+                    p->vlc_state[i].count     = 1;
+                }
+            }
         }
     }
 
@@ -101,7 +106,7 @@ av_cold int ff_ffv1_init_slice_state(FFV1Context *f, FFV1Context *fs)
 av_cold int ff_ffv1_init_slices_state(FFV1Context *f)
 {
     int i, ret;
-    for (i = 0; i < f->slice_count; i++) {
+    for (i = 0; i < f->max_slice_count; i++) {
         FFV1Context *fs = f->slice_context[i];
         if ((ret = ff_ffv1_init_slice_state(f, fs)) < 0)
             return AVERROR(ENOMEM);
@@ -113,10 +118,10 @@ av_cold int ff_ffv1_init_slice_contexts(FFV1Context *f)
 {
     int i;
 
-    f->slice_count = f->num_h_slices * f->num_v_slices;
-    av_assert0(f->slice_count > 0);
+    f->max_slice_count = f->num_h_slices * f->num_v_slices;
+    av_assert0(f->max_slice_count > 0);
 
-    for (i = 0; i < f->slice_count; i++) {
+    for (i = 0; i < f->max_slice_count; i++) {
         int sx          = i % f->num_h_slices;
         int sy          = i / f->num_h_slices;
         int sxs         = f->avctx->width  *  sx      / f->num_h_slices;
@@ -210,7 +215,7 @@ av_cold int ff_ffv1_close(AVCodecContext *avctx)
         ff_thread_release_buffer(avctx, &s->last_picture);
     av_frame_free(&s->last_picture.f);
 
-    for (j = 0; j < s->slice_count; j++) {
+    for (j = 0; j < s->max_slice_count; j++) {
         FFV1Context *fs = s->slice_context[j];
         for (i = 0; i < s->plane_count; i++) {
             PlaneContext *p = &fs->plane[i];
@@ -224,14 +229,14 @@ av_cold int ff_ffv1_close(AVCodecContext *avctx)
     av_freep(&avctx->stats_out);
     for (j = 0; j < s->quant_table_count; j++) {
         av_freep(&s->initial_states[j]);
-        for (i = 0; i < s->slice_count; i++) {
+        for (i = 0; i < s->max_slice_count; i++) {
             FFV1Context *sf = s->slice_context[i];
             av_freep(&sf->rc_stat2[j]);
         }
         av_freep(&s->rc_stat2[j]);
     }
 
-    for (i = 0; i < s->slice_count; i++)
+    for (i = 0; i < s->max_slice_count; i++)
         av_freep(&s->slice_context[i]);
 
     return 0;

libavcodec/ffv1.h

@@ -118,6 +118,7 @@ typedef struct FFV1Context {
 
     struct FFV1Context *slice_context[MAX_SLICES];
     int slice_count;
+    int max_slice_count;
     int num_v_slices;
     int num_h_slices;
     int slice_width;

libavcodec/ffv1dec.c

@@ -47,8 +47,11 @@ static inline av_flatten int get_symbol_inline(RangeCoder *c, uint8_t *state,
     else {
         int i, e, a;
         e = 0;
-        while (get_rac(c, state + 1 + FFMIN(e, 9))) // 1..10
+        while (get_rac(c, state + 1 + FFMIN(e, 9))) { // 1..10
             e++;
+            if (e > 31)
+                return AVERROR_INVALIDDATA;
+        }
 
         a = 1;
         for (i = e - 1; i >= 0; i--)
@@ -302,7 +305,7 @@ static int decode_slice_header(FFV1Context *f, FFV1Context *fs)
     for (i = 0; i < f->plane_count; i++) {
         PlaneContext * const p = &fs->plane[i];
         int idx = get_symbol(c, state, 0);
-        if (idx > (unsigned)f->quant_table_count) {
+        if (idx >= (unsigned)f->quant_table_count) {
             av_log(f->avctx, AV_LOG_ERROR, "quant_table_index out of range\n");
             return -1;
         }
@@ -405,6 +408,7 @@ static int decode_slice(AVCodecContext *c, void *arg)
         if (ff_ffv1_init_slice_state(f, fs) < 0)
             return AVERROR(ENOMEM);
         if (decode_slice_header(f, fs) < 0) {
+            fs->slice_x = fs->slice_y = fs->slice_height = fs->slice_width = 0;
             fs->slice_damaged = 1;
             return AVERROR_INVALIDDATA;
         }
@@ -499,7 +503,10 @@ static int read_quant_tables(RangeCoder *c,
     int context_count = 1;
 
     for (i = 0; i < 5; i++) {
-        context_count *= read_quant_table(c, quant_table[i], context_count);
+        int ret = read_quant_table(c, quant_table[i], context_count);
+        if (ret < 0)
+            return ret;
+        context_count *= ret;
         if (context_count > 32768U) {
             return AVERROR_INVALIDDATA;
         }
@@ -562,7 +569,7 @@ static int read_extra_header(FFV1Context *f)
     }
 
     f->quant_table_count = get_symbol(c, state, 0);
-    if (f->quant_table_count > (unsigned)MAX_QUANT_TABLES)
+    if (f->quant_table_count > (unsigned)MAX_QUANT_TABLES || !f->quant_table_count)
         return AVERROR_INVALIDDATA;
 
     for (i = 0; i < f->quant_table_count; i++) {
@@ -775,6 +782,7 @@ static int read_header(FFV1Context *f)
             av_log(f->avctx, AV_LOG_ERROR, "read_quant_table error\n");
             return AVERROR_INVALIDDATA;
         }
+        f->slice_count = f->max_slice_count;
     } else if (f->version < 3) {
         f->slice_count = get_symbol(c, state, 0);
     } else {
@@ -789,8 +797,8 @@ static int read_header(FFV1Context *f)
             p -= size + trailer;
         }
     }
-    if (f->slice_count > (unsigned)MAX_SLICES || f->slice_count <= 0) {
-        av_log(f->avctx, AV_LOG_ERROR, "slice count %d is invalid\n", f->slice_count);
+    if (f->slice_count > (unsigned)MAX_SLICES || f->slice_count <= 0 || f->slice_count > f->max_slice_count) {
+        av_log(f->avctx, AV_LOG_ERROR, "slice count %d is invalid (max=%d)\n", f->slice_count, f->max_slice_count);
         return AVERROR_INVALIDDATA;
     }
 
@@ -932,6 +940,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac
         else                     v = buf_p - c->bytestream_start;
         if (buf_p - c->bytestream_start < v) {
             av_log(avctx, AV_LOG_ERROR, "Slice pointer chain broken\n");
+            ff_thread_report_progress(&f->picture, INT_MAX, 0);
             return AVERROR_INVALIDDATA;
         }
         buf_p -= v;
@@ -1016,6 +1025,7 @@ static int init_thread_copy(AVCodecContext *avctx)
     f->picture.f      = NULL;
     f->last_picture.f = NULL;
     f->sample_buffer  = NULL;
+    f->max_slice_count = 0;
     f->slice_count = 0;
 
     for (i = 0; i < f->quant_table_count; i++) {
@@ -1091,7 +1101,7 @@ static int update_thread_context(AVCodecContext *dst, const AVCodecContext *src)
         av_assert0(!fdst->sample_buffer);
     }
 
-    av_assert1(fdst->slice_count == fsrc->slice_count);
+    av_assert1(fdst->max_slice_count == fsrc->max_slice_count);
 
 
     ff_thread_release_buffer(dst, &fdst->picture);

libavcodec/ffv1enc.c

@@ -977,6 +977,7 @@ slices_ok:
 
     if ((ret = ff_ffv1_init_slice_contexts(s)) < 0)
         return ret;
+    s->slice_count = s->max_slice_count;
     if ((ret = ff_ffv1_init_slices_state(s)) < 0)
         return ret;
 
@@ -986,7 +987,7 @@ slices_ok:
         if (!avctx->stats_out)
             return AVERROR(ENOMEM);
         for (i = 0; i < s->quant_table_count; i++)
-            for (j = 0; j < s->slice_count; j++) {
+            for (j = 0; j < s->max_slice_count; j++) {
                 FFV1Context *sf = s->slice_context[j];
                 av_assert0(!sf->rc_stat2[i]);
                 sf->rc_stat2[i] = av_mallocz(s->context_count[i] *
@@ -1210,6 +1211,7 @@ static int encode_frame(AVCodecContext *avctx, AVPacket *pkt,
             for (i = 0; i < f->quant_table_count; i++)
                 memset(f->rc_stat2[i], 0, f->context_count[i] * sizeof(*f->rc_stat2[i]));
 
+            av_assert0(f->slice_count == f->max_slice_count);
             for (j = 0; j < f->slice_count; j++) {
                 FFV1Context *fs = f->slice_context[j];
                 for (i = 0; i < 256; i++) {

libavcodec/flashsv.c

@@ -413,6 +413,10 @@ static int flashsv_decode_frame(AVCodecContext *avctx, void *data,
                 }
 
                 if (has_diff) {
+                    if (size < 3) {
+                        av_log(avctx, AV_LOG_ERROR, "size too small for diff\n");
+                        return AVERROR_INVALIDDATA;
+                    }
                     if (!s->keyframe) {
                         av_log(avctx, AV_LOG_ERROR,
                                "Inter frame without keyframe\n");
@@ -440,6 +444,10 @@ static int flashsv_decode_frame(AVCodecContext *avctx, void *data,
                     int row = get_bits(&gb, 8);
                     av_log(avctx, AV_LOG_DEBUG, "%dx%d zlibprime_curr %dx%d\n",
                            i, j, col, row);
+                    if (size < 3) {
+                        av_log(avctx, AV_LOG_ERROR, "size too small for zlibprime_curr\n");
+                        return AVERROR_INVALIDDATA;
+                    }
                     size -= 2;
                     avpriv_request_sample(avctx, "zlibprime_curr");
                     return AVERROR_PATCHWELCOME;

libavcodec/g726.c

@@ -32,7 +32,7 @@
 
 /**
  * G.726 11bit float.
- * G.726 Standard uses rather odd 11bit floating point arithmentic for
+ * G.726 Standard uses rather odd 11bit floating point arithmetic for
  * numerous occasions. It's a mystery to me why they did it this way
  * instead of simply using 32bit integer arithmetic.
  */

libavcodec/h264_cabac.c

@@ -2026,6 +2026,7 @@ decode_intra_mb:
         const int mb_size = ff_h264_mb_sizes[h->sps.chroma_format_idc] *
                             h->sps.bit_depth_luma >> 3;
         const uint8_t *ptr;
+        int ret;
 
         // We assume these blocks are very rare so we do not optimize it.
         // FIXME The two following lines get the bitstream position in the cabac
@@ -2042,7 +2043,9 @@ decode_intra_mb:
         sl->intra_pcm_ptr = ptr;
         ptr += mb_size;
 
-        ff_init_cabac_decoder(&sl->cabac, ptr, sl->cabac.bytestream_end - ptr);
+        ret = ff_init_cabac_decoder(&sl->cabac, ptr, sl->cabac.bytestream_end - ptr);
+        if (ret < 0)
+            return ret;
 
         // All blocks are present
         h->cbp_table[mb_xy] = 0xf7ef;

libavcodec/h264_mp4toannexb_bsf.c

@@ -122,7 +122,7 @@ pps:
         if (!unit_nb && !sps_done++) {
             unit_nb = *extradata++; /* number of pps unit(s) */
             if (unit_nb) {
-                ctx->pps_offset = (extradata - 1) - (avctx->extradata + 4);
+                ctx->pps_offset = total_size;
                 pps_seen = 1;
             }
         }
@@ -276,7 +276,7 @@ static void h264_mp4toannexb_filter_close(AVBitStreamFilterContext *bsfc)
 {
     H264BSFContext *ctx = bsfc->priv_data;
     if (ctx->private_spspps)
-        av_free(ctx->spspps_buf);
+        av_freep(&ctx->spspps_buf);
 }
 
 AVBitStreamFilter ff_h264_mp4toannexb_bsf = {

libavcodec/h264_sei.c

@@ -182,8 +182,6 @@ static int decode_registered_user_data_closed_caption(H264Context *h, int size)
         }
     } else {
         int i;
-        avpriv_request_sample(h->avctx, "Subtitles with data type 0x%02x",
-                              user_data_type_code);
         for (i = 0; i < size - 1; i++)
             skip_bits(&h->gb, 8);
     }

libavcodec/h264_slice.c

@@ -1097,6 +1097,7 @@ static int h264_slice_header_init(H264Context *h)
         nb_slices = max_slices;
     }
     h->slice_context_count = nb_slices;
+    h->max_contexts = FFMIN(h->max_contexts, nb_slices);
 
     if (!HAVE_THREADS || !(h->avctx->active_thread_type & FF_THREAD_SLICE)) {
         ret = ff_h264_slice_context_init(h, &h->slice_ctx[0]);
@@ -1177,6 +1178,15 @@ int ff_h264_decode_slice_header(H264Context *h, H264SliceContext *sl)
                 av_log(h->avctx, AV_LOG_ERROR, "Too many fields\n");
                 return AVERROR_INVALIDDATA;
             }
+            if (h->max_contexts > 1) {
+                if (!h->single_decode_warning) {
+                    av_log(h->avctx, AV_LOG_WARNING, "Cannot decode multiple access units as slice threads\n");
+                    h->single_decode_warning = 1;
+                }
+                h->max_contexts = 1;
+                return SLICE_SINGLETHREAD;
+            }
+
             if (h->cur_pic_ptr && FIELD_PICTURE(h) && h->first_field) {
                 ret = ff_h264_field_end(h, h->slice_ctx, 1);
                 h->current_slice = 0;
@@ -2362,9 +2372,11 @@ static int decode_slice(struct AVCodecContext *avctx, void *arg)
         align_get_bits(&sl->gb);
 
         /* init cabac */
-        ff_init_cabac_decoder(&sl->cabac,
+        ret = ff_init_cabac_decoder(&sl->cabac,
                               sl->gb.buffer + get_bits_count(&sl->gb) / 8,
                               (get_bits_left(&sl->gb) + 7) / 8);
+        if (ret < 0)
+            return ret;
 
         ff_h264_init_cabac_states(h, sl);
 

libavcodec/hevc.c

@@ -809,6 +809,8 @@ static int hls_slice_header(HEVCContext *s)
     s->HEVClc->tu.cu_qp_offset_cb = 0;
     s->HEVClc->tu.cu_qp_offset_cr = 0;
 
+    s->no_rasl_output_flag = IS_IDR(s) || IS_BLA(s) || (s->nal_unit_type == NAL_CRA_NUT && s->last_eos);
+
     return 0;
 }
 
@@ -3135,6 +3137,7 @@ static int hevc_update_thread_context(AVCodecContext *dst,
     s->pocTid0    = s0->pocTid0;
     s->max_ra     = s0->max_ra;
     s->eos        = s0->eos;
+    s->no_rasl_output_flag = s0->no_rasl_output_flag;
 
     s->is_nalff        = s0->is_nalff;
     s->nal_length_size = s0->nal_length_size;
@@ -3239,6 +3242,7 @@ static av_cold int hevc_decode_init(AVCodecContext *avctx)
 
     s->enable_parallel_tiles = 0;
     s->picture_struct = 0;
+    s->eos = 1;
 
     if(avctx->active_thread_type & FF_THREAD_SLICE)
         s->threads_number = avctx->thread_count;
@@ -3280,6 +3284,7 @@ static void hevc_decode_flush(AVCodecContext *avctx)
     HEVCContext *s = avctx->priv_data;
     ff_hevc_flush_dpb(s);
     s->max_ra = INT_MAX;
+    s->eos = 1;
 }
 
 #define OFFSET(x) offsetof(HEVCContext, x)

libavcodec/hevc.h

@@ -866,6 +866,7 @@ typedef struct HEVCContext {
     int bs_height;
 
     int is_decoded;
+    int no_rasl_output_flag;
 
     HEVCPredContext hpc;
     HEVCDSPContext hevcdsp;

libavcodec/hevc_ps.c

@@ -834,6 +834,10 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id,
     }
 
     sps->chroma_format_idc = get_ue_golomb_long(gb);
+    if (sps->chroma_format_idc > 3U) {
+        av_log(avctx, AV_LOG_ERROR, "chroma_format_idc %d is invalid\n", sps->chroma_format_idc);
+        return AVERROR_INVALIDDATA;
+    }
 
     if (sps->chroma_format_idc == 3)
         sps->separate_colour_plane_flag = get_bits1(gb);

libavcodec/hevc_refs.c

@@ -174,7 +174,7 @@ int ff_hevc_output_frame(HEVCContext *s, AVFrame *out, int flush)
         int min_poc   = INT_MAX;
         int i, min_idx, ret;
 
-        if (s->sh.no_output_of_prior_pics_flag == 1) {
+        if (s->sh.no_output_of_prior_pics_flag == 1 && s->no_rasl_output_flag == 1) {
             for (i = 0; i < FF_ARRAY_ELEMS(s->DPB); i++) {
                 HEVCFrame *frame = &s->DPB[i];
                 if (!(frame->flags & HEVC_FRAME_FLAG_BUMPING) && frame->poc != s->poc &&

libavcodec/hqx.c

@@ -417,8 +417,8 @@ static int hqx_decode_frame(AVCodecContext *avctx, void *data,
 
     info_tag    = AV_RL32(src);
     if (info_tag == MKTAG('I', 'N', 'F', 'O')) {
-        int info_offset = AV_RL32(src + 4);
-        if (info_offset > UINT32_MAX - 8 || info_offset + 8 > avpkt->size) {
+        unsigned info_offset = AV_RL32(src + 4);
+        if (info_offset > INT_MAX || info_offset + 8 > avpkt->size) {
             av_log(avctx, AV_LOG_ERROR,
                    "Invalid INFO header offset: 0x%08"PRIX32" is too large.\n",
                    info_offset);

libavcodec/ivi.c

@@ -30,6 +30,7 @@
 
 #define BITSTREAM_READER_LE
 #include "libavutil/attributes.h"
+#include "libavutil/imgutils.h"
 #include "libavutil/timer.h"
 #include "avcodec.h"
 #include "get_bits.h"
@@ -310,7 +311,7 @@ av_cold int ff_ivi_init_planes(IVIPlaneDesc *planes, const IVIPicConfig *cfg,
 
     ivi_free_buffers(planes);
 
-    if (cfg->pic_width < 1 || cfg->pic_height < 1 ||
+    if (av_image_check_size(cfg->pic_width, cfg->pic_height, 0, NULL) < 0 ||
         cfg->luma_bands < 1 || cfg->chroma_bands < 1)
         return AVERROR_INVALIDDATA;
 

libavcodec/jpeg2000.c

@@ -28,6 +28,7 @@
 #include "libavutil/attributes.h"
 #include "libavutil/avassert.h"
 #include "libavutil/common.h"
+#include "libavutil/imgutils.h"
 #include "libavutil/mem.h"
 #include "avcodec.h"
 #include "jpeg2000.h"
@@ -210,9 +211,17 @@ int ff_jpeg2000_init_component(Jpeg2000Component *comp,
                                    codsty->nreslevels2decode - 1,
                                    codsty->transform))
         return ret;
-    // component size comp->coord is uint16_t so ir cannot overflow
+
+    if (av_image_check_size(comp->coord[0][1] - comp->coord[0][0],
+                            comp->coord[1][1] - comp->coord[1][0], 0, avctx))
+        return AVERROR_INVALIDDATA;
     csize = (comp->coord[0][1] - comp->coord[0][0]) *
             (comp->coord[1][1] - comp->coord[1][0]);
+    if (comp->coord[0][1] - comp->coord[0][0] > 32768 ||
+        comp->coord[1][1] - comp->coord[1][0] > 32768) {
+        av_log(avctx, AV_LOG_ERROR, "component size too large\n");
+        return AVERROR_PATCHWELCOME;
+    }
 
     if (codsty->transform == FF_DWT97) {
         csize += AV_INPUT_BUFFER_PADDING_SIZE / sizeof(*comp->f_data);
@@ -450,7 +459,7 @@ int ff_jpeg2000_init_component(Jpeg2000Component *comp,
                     return AVERROR(ENOMEM);
                 for (cblkno = 0; cblkno < nb_codeblocks; cblkno++) {
                     Jpeg2000Cblk *cblk = prec->cblk + cblkno;
-                    uint16_t Cx0, Cy0;
+                    int Cx0, Cy0;
 
                     /* Compute coordinates of codeblocks */
                     /* Compute Cx0*/

libavcodec/jpeg2000.h

@@ -174,21 +174,21 @@ typedef struct Jpeg2000Cblk {
     int nb_terminationsinc;
     int data_start[JPEG2000_MAX_PASSES];
     Jpeg2000Pass passes[JPEG2000_MAX_PASSES];
-    uint16_t coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}
+    int coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}
 } Jpeg2000Cblk; // code block
 
 typedef struct Jpeg2000Prec {
-    uint16_t nb_codeblocks_width;
-    uint16_t nb_codeblocks_height;
+    int nb_codeblocks_width;
+    int nb_codeblocks_height;
     Jpeg2000TgtNode *zerobits;
     Jpeg2000TgtNode *cblkincl;
     Jpeg2000Cblk *cblk;
     int decoded_layers;
-    uint16_t coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}
+    int coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}
 } Jpeg2000Prec; // precinct
 
 typedef struct Jpeg2000Band {
-    uint16_t coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}
+    int coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}
     uint16_t log2_cblk_width, log2_cblk_height;
     int i_stepsize; // quantization stepsize
     float f_stepsize; // quantization stepsize
@@ -197,8 +197,8 @@ typedef struct Jpeg2000Band {
 
 typedef struct Jpeg2000ResLevel {
     uint8_t nbands;
-    uint16_t coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}
-    uint16_t num_precincts_x, num_precincts_y; // number of precincts in x/y direction
+    int coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}
+    int num_precincts_x, num_precincts_y; // number of precincts in x/y direction
     uint8_t log2_prec_width, log2_prec_height; // exponent of precinct size
     Jpeg2000Band *band;
 } Jpeg2000ResLevel; // resolution level
@@ -208,8 +208,8 @@ typedef struct Jpeg2000Component {
     DWTContext dwt;
     float *f_data;
     int *i_data;
-    uint16_t coord[2][2];   // border coordinates {{x0, x1}, {y0, y1}} -- can be reduced with lowres option
-    uint16_t coord_o[2][2]; // border coordinates {{x0, x1}, {y0, y1}} -- original values from jpeg2000 headers
+    int coord[2][2];   // border coordinates {{x0, x1}, {y0, y1}} -- can be reduced with lowres option
+    int coord_o[2][2]; // border coordinates {{x0, x1}, {y0, y1}} -- original values from jpeg2000 headers
 } Jpeg2000Component;
 
 /* misc tools */

libavcodec/jpeg2000dec.c

@@ -30,6 +30,7 @@
 #include "libavutil/attributes.h"
 #include "libavutil/avassert.h"
 #include "libavutil/common.h"
+#include "libavutil/imgutils.h"
 #include "libavutil/opt.h"
 #include "libavutil/pixdesc.h"
 #include "avcodec.h"
@@ -279,6 +280,10 @@ static int get_siz(Jpeg2000DecoderContext *s)
         avpriv_request_sample(s->avctx, "Support for image offsets");
         return AVERROR_PATCHWELCOME;
     }
+    if (av_image_check_size(s->width, s->height, 0, s->avctx)) {
+        avpriv_request_sample(s->avctx, "Large Dimensions");
+        return AVERROR_PATCHWELCOME;
+    }
 
     if (ncomponents <= 0) {
         av_log(s->avctx, AV_LOG_ERROR, "Invalid number of components: %d\n",
@@ -826,10 +831,10 @@ static int init_tile(Jpeg2000DecoderContext *s, int tileno)
     if (!tile->comp)
         return AVERROR(ENOMEM);
 
-    tile->coord[0][0] = FFMAX(tilex       * s->tile_width  + s->tile_offset_x, s->image_offset_x);
-    tile->coord[0][1] = FFMIN((tilex + 1) * s->tile_width  + s->tile_offset_x, s->width);
-    tile->coord[1][0] = FFMAX(tiley       * s->tile_height + s->tile_offset_y, s->image_offset_y);
-    tile->coord[1][1] = FFMIN((tiley + 1) * s->tile_height + s->tile_offset_y, s->height);
+    tile->coord[0][0] = av_clip(tilex       * (int64_t)s->tile_width  + s->tile_offset_x, s->image_offset_x, s->width);
+    tile->coord[0][1] = av_clip((tilex + 1) * (int64_t)s->tile_width  + s->tile_offset_x, s->image_offset_x, s->width);
+    tile->coord[1][0] = av_clip(tiley       * (int64_t)s->tile_height + s->tile_offset_y, s->image_offset_y, s->height);
+    tile->coord[1][1] = av_clip((tiley + 1) * (int64_t)s->tile_height + s->tile_offset_y, s->image_offset_y, s->height);
 
     for (compno = 0; compno < s->ncomponents; compno++) {
         Jpeg2000Component *comp = tile->comp + compno;
@@ -1809,8 +1814,10 @@ static void jpeg2000_dec_cleanup(Jpeg2000DecoderContext *s)
     av_freep(&s->tile);
     memset(s->codsty, 0, sizeof(s->codsty));
     memset(s->qntsty, 0, sizeof(s->qntsty));
+    memset(s->properties, 0, sizeof(s->properties));
     memset(&s->poc  , 0, sizeof(s->poc));
     s->numXtiles = s->numYtiles = 0;
+    s->ncomponents = 0;
 }
 
 static int jpeg2000_read_main_headers(Jpeg2000DecoderContext *s)
@@ -1868,6 +1875,10 @@ static int jpeg2000_read_main_headers(Jpeg2000DecoderContext *s)
 
         switch (marker) {
         case JPEG2000_SIZ:
+            if (s->ncomponents) {
+                av_log(s->avctx, AV_LOG_ERROR, "Duplicate SIZ\n");
+                return AVERROR_INVALIDDATA;
+            }
             ret = get_siz(s);
             if (!s->tile)
                 s->numXtiles = s->numYtiles = 0;

libavcodec/jpeg2000dwt.c

@@ -534,7 +534,7 @@ static void dwt_decode97_int(DWTContext *s, int32_t *t)
         data[i] = (data[i] + ((1<<I_PRESHIFT)>>1)) >> I_PRESHIFT;
 }
 
-int ff_jpeg2000_dwt_init(DWTContext *s, uint16_t border[2][2],
+int ff_jpeg2000_dwt_init(DWTContext *s, int border[2][2],
                          int decomp_levels, int type)
 {
     int i, j, lev = decomp_levels, maxlen,
@@ -623,7 +623,7 @@ void ff_dwt_destroy(DWTContext *s)
 
 #define MAX_W 256
 
-static int test_dwt(int *array, int *ref, uint16_t border[2][2], int decomp_levels, int type, int max_diff) {
+static int test_dwt(int *array, int *ref, int border[2][2], int decomp_levels, int type, int max_diff) {
     int ret, j;
     DWTContext s1={{{0}}}, *s= &s1;
     int64_t err2 = 0;
@@ -662,7 +662,7 @@ static int test_dwt(int *array, int *ref, uint16_t border[2][2], int decomp_leve
     return 0;
 }
 
-static int test_dwtf(float *array, float *ref, uint16_t border[2][2], int decomp_levels, float max_diff) {
+static int test_dwtf(float *array, float *ref, int border[2][2], int decomp_levels, float max_diff) {
     int ret, j;
     DWTContext s1={{{0}}}, *s= &s1;
     double err2 = 0;
@@ -708,7 +708,7 @@ static float reff  [MAX_W * MAX_W];
 int main(void) {
     AVLFG prng;
     int i,j;
-    uint16_t border[2][2];
+    int border[2][2];
     int ret, decomp_levels;
 
     av_lfg_init(&prng, 1);

libavcodec/jpeg2000dwt.h

@@ -42,7 +42,7 @@ enum DWTType {
 
 typedef struct DWTContext {
     /// line lengths { horizontal, vertical } in consecutive decomposition levels
-    uint16_t linelen[FF_DWT_MAX_DECLVLS][2];
+    int linelen[FF_DWT_MAX_DECLVLS][2];
     uint8_t mod[FF_DWT_MAX_DECLVLS][2];  ///< coordinates (x0, y0) of decomp. levels mod 2
     uint8_t ndeclevels;                  ///< number of decomposition levels
     uint8_t type;                        ///< 0 for 9/7; 1 for 5/3
@@ -57,7 +57,7 @@ typedef struct DWTContext {
  * @param decomp_levels     number of decomposition levels
  * @param type              0 for DWT 9/7; 1 for DWT 5/3
  */
-int ff_jpeg2000_dwt_init(DWTContext *s, uint16_t border[2][2],
+int ff_jpeg2000_dwt_init(DWTContext *s, int border[2][2],
                          int decomp_levels, int type);
 
 int ff_dwt_encode(DWTContext *s, void *t);

libavcodec/microdvddec.c

@@ -164,6 +164,8 @@ static char *microdvd_load_tags(struct microdvd_tag *tags, char *s)
 
         /* Position */
         case 'P':
+            if (!*s)
+                break;
             tag.persistent = MICRODVD_PERSISTENT_ON;
             tag.data1 = (*s++ == '1');
             if (*s != '}')

libavcodec/mips/h264dsp_init_mips.c

@@ -82,11 +82,33 @@ static av_cold void h264dsp_init_msa(H264DSPContext *c,
 #endif  // #if HAVE_MSA
 
 #if HAVE_MMI
-static av_cold void h264dsp_init_mmi(H264DSPContext * c,
-                                     const int bit_depth,
-                                     const int chroma_format_idc)
+static av_cold void h264dsp_init_mmi(H264DSPContext * c, const int bit_depth,
+        const int chroma_format_idc)
 {
     if (bit_depth == 8) {
+        c->h264_add_pixels4_clear = ff_h264_add_pixels4_8_mmi;
+        c->h264_idct_add = ff_h264_idct_add_8_mmi;
+        c->h264_idct8_add = ff_h264_idct8_add_8_mmi;
+        c->h264_idct_dc_add = ff_h264_idct_dc_add_8_mmi;
+        c->h264_idct8_dc_add = ff_h264_idct8_dc_add_8_mmi;
+        c->h264_idct_add16 = ff_h264_idct_add16_8_mmi;
+        c->h264_idct_add16intra = ff_h264_idct_add16intra_8_mmi;
+        c->h264_idct8_add4 = ff_h264_idct8_add4_8_mmi;
+
+        if (chroma_format_idc <= 1)
+            c->h264_idct_add8 = ff_h264_idct_add8_8_mmi;
+        else
+            c->h264_idct_add8 = ff_h264_idct_add8_422_8_mmi;
+
+        c->h264_luma_dc_dequant_idct = ff_h264_luma_dc_dequant_idct_8_mmi;
+
+        if (chroma_format_idc <= 1)
+            c->h264_chroma_dc_dequant_idct =
+                ff_h264_chroma_dc_dequant_idct_8_mmi;
+        else
+            c->h264_chroma_dc_dequant_idct =
+                ff_h264_chroma422_dc_dequant_idct_8_mmi;
+
         c->weight_h264_pixels_tab[0] = ff_h264_weight_pixels16_8_mmi;
         c->weight_h264_pixels_tab[1] = ff_h264_weight_pixels8_8_mmi;
         c->weight_h264_pixels_tab[2] = ff_h264_weight_pixels4_8_mmi;
@@ -94,6 +116,21 @@ static av_cold void h264dsp_init_mmi(H264DSPContext * c,
         c->biweight_h264_pixels_tab[0] = ff_h264_biweight_pixels16_8_mmi;
         c->biweight_h264_pixels_tab[1] = ff_h264_biweight_pixels8_8_mmi;
         c->biweight_h264_pixels_tab[2] = ff_h264_biweight_pixels4_8_mmi;
+
+        c->h264_v_loop_filter_chroma       = ff_deblock_v_chroma_8_mmi;
+        c->h264_v_loop_filter_chroma_intra = ff_deblock_v_chroma_intra_8_mmi;
+
+        if (chroma_format_idc <= 1) {
+            c->h264_h_loop_filter_chroma =
+                ff_deblock_h_chroma_8_mmi;
+            c->h264_h_loop_filter_chroma_intra =
+                ff_deblock_h_chroma_intra_8_mmi;
+        }
+
+        c->h264_v_loop_filter_luma = ff_deblock_v_luma_8_mmi;
+        c->h264_v_loop_filter_luma_intra = ff_deblock_v_luma_intra_8_mmi;
+        c->h264_h_loop_filter_luma = ff_deblock_h_luma_8_mmi;
+        c->h264_h_loop_filter_luma_intra = ff_deblock_h_luma_intra_8_mmi;
     }
 }
 #endif /* HAVE_MMI */

libavcodec/mips/h264dsp_mips.h

@@ -319,6 +319,26 @@ void ff_vp8_pred8x8_129_dc_8_msa(uint8_t *src, ptrdiff_t stride);
 void ff_vp8_pred16x16_127_dc_8_msa(uint8_t *src, ptrdiff_t stride);
 void ff_vp8_pred16x16_129_dc_8_msa(uint8_t *src, ptrdiff_t stride);
 
+void ff_h264_add_pixels4_8_mmi(uint8_t *_dst, int16_t *_src, int stride);
+void ff_h264_idct_add_8_mmi(uint8_t *dst, int16_t *block, int stride);
+void ff_h264_idct8_add_8_mmi(uint8_t *dst, int16_t *block, int stride);
+void ff_h264_idct_dc_add_8_mmi(uint8_t *dst, int16_t *block, int stride);
+void ff_h264_idct8_dc_add_8_mmi(uint8_t *dst, int16_t *block, int stride);
+void ff_h264_idct_add16_8_mmi(uint8_t *dst, const int *block_offset,
+        int16_t *block, int stride, const uint8_t nnzc[15*8]);
+void ff_h264_idct_add16intra_8_mmi(uint8_t *dst, const int *block_offset,
+        int16_t *block, int stride, const uint8_t nnzc[15*8]);
+void ff_h264_idct8_add4_8_mmi(uint8_t *dst, const int *block_offset,
+        int16_t *block, int stride, const uint8_t nnzc[15*8]);
+void ff_h264_idct_add8_8_mmi(uint8_t **dest, const int *block_offset,
+        int16_t *block, int stride, const uint8_t nnzc[15*8]);
+void ff_h264_idct_add8_422_8_mmi(uint8_t **dest, const int *block_offset,
+        int16_t *block, int stride, const uint8_t nnzc[15*8]);
+void ff_h264_luma_dc_dequant_idct_8_mmi(int16_t *output, int16_t *input,
+        int qmul);
+void ff_h264_chroma_dc_dequant_idct_8_mmi(int16_t *block, int qmul);
+void ff_h264_chroma422_dc_dequant_idct_8_mmi(int16_t *block, int qmul);
+
 void ff_h264_weight_pixels16_8_mmi(uint8_t *block, int stride, int height,
         int log2_denom, int weight, int offset);
 void ff_h264_biweight_pixels16_8_mmi(uint8_t *dst, uint8_t *src,
@@ -335,6 +355,27 @@ void ff_h264_biweight_pixels4_8_mmi(uint8_t *dst, uint8_t *src,
         int stride, int height, int log2_denom, int weightd, int weights,
         int offset);
 
+void ff_deblock_v_chroma_8_mmi(uint8_t *pix, int stride, int alpha, int beta,
+        int8_t *tc0);
+void ff_deblock_v_chroma_intra_8_mmi(uint8_t *pix, int stride, int alpha,
+        int beta);
+void ff_deblock_h_chroma_8_mmi(uint8_t *pix, int stride, int alpha, int beta,
+        int8_t *tc0);
+void ff_deblock_h_chroma_intra_8_mmi(uint8_t *pix, int stride, int alpha,
+        int beta);
+void ff_deblock_v_luma_8_mmi(uint8_t *pix, int stride, int alpha, int beta,
+        int8_t *tc0);
+void ff_deblock_v_luma_intra_8_mmi(uint8_t *pix, int stride, int alpha,
+        int beta);
+void ff_deblock_h_luma_8_mmi(uint8_t *pix, int stride, int alpha, int beta,
+        int8_t *tc0);
+void ff_deblock_h_luma_intra_8_mmi(uint8_t *pix, int stride, int alpha,
+        int beta);
+void ff_deblock_v8_luma_8_mmi(uint8_t *pix, int stride, int alpha, int beta,
+        int8_t *tc0);
+void ff_deblock_v8_luma_intra_8_mmi(uint8_t *pix, int stride, int alpha,
+        int beta);
+
 void ff_put_h264_qpel16_mc00_mmi(uint8_t *dst, const uint8_t *src,
         ptrdiff_t dst_stride);
 void ff_put_h264_qpel16_mc10_mmi(uint8_t *dst, const uint8_t *src,

libavcodec/mips/hevcpred_msa.c

@@ -1915,24 +1915,24 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
     v16u8 vec0;
     HEVCLocalContext *lc = s->HEVClc;
     int i;
-    int hshift = s->sps->hshift[c_idx];
-    int vshift = s->sps->vshift[c_idx];
+    int hshift = s->ps.sps->hshift[c_idx];
+    int vshift = s->ps.sps->vshift[c_idx];
     int size_in_luma_h = 16 << hshift;
-    int size_in_tbs_h = size_in_luma_h >> s->sps->log2_min_tb_size;
+    int size_in_tbs_h = size_in_luma_h >> s->ps.sps->log2_min_tb_size;
     int size_in_luma_v = 16 << vshift;
-    int size_in_tbs_v = size_in_luma_v >> s->sps->log2_min_tb_size;
+    int size_in_tbs_v = size_in_luma_v >> s->ps.sps->log2_min_tb_size;
     int x = x0 >> hshift;
     int y = y0 >> vshift;
-    int x_tb = (x0 >> s->sps->log2_min_tb_size) & s->sps->tb_mask;
-    int y_tb = (y0 >> s->sps->log2_min_tb_size) & s->sps->tb_mask;
+    int x_tb = (x0 >> s->ps.sps->log2_min_tb_size) & s->ps.sps->tb_mask;
+    int y_tb = (y0 >> s->ps.sps->log2_min_tb_size) & s->ps.sps->tb_mask;
 
     int cur_tb_addr =
-        s->pps->min_tb_addr_zs[(y_tb) * (s->sps->tb_mask + 2) + (x_tb)];
+        s->ps.pps->min_tb_addr_zs[(y_tb) * (s->ps.sps->tb_mask + 2) + (x_tb)];
 
     ptrdiff_t stride = s->frame->linesize[c_idx] / sizeof(uint8_t);
     uint8_t *src = (uint8_t *) s->frame->data[c_idx] + x + y * stride;
 
-    int min_pu_width = s->sps->min_pu_width;
+    int min_pu_width = s->ps.sps->min_pu_width;
 
     enum IntraPredMode mode = c_idx ? lc->tu.intra_pred_mode_c :
         lc->tu.intra_pred_mode;
@@ -1948,41 +1948,41 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
     uint8_t *filtered_top = filtered_top_array + 1;
     int cand_bottom_left = lc->na.cand_bottom_left
         && cur_tb_addr >
-        s->pps->min_tb_addr_zs[((y_tb + size_in_tbs_v) & s->sps->tb_mask) *
-                               (s->sps->tb_mask + 2) + (x_tb - 1)];
+        s->ps.pps->min_tb_addr_zs[((y_tb + size_in_tbs_v) & s->ps.sps->tb_mask) *
+                               (s->ps.sps->tb_mask + 2) + (x_tb - 1)];
     int cand_left = lc->na.cand_left;
     int cand_up_left = lc->na.cand_up_left;
     int cand_up = lc->na.cand_up;
     int cand_up_right = lc->na.cand_up_right
         && cur_tb_addr >
-        s->pps->min_tb_addr_zs[(y_tb - 1) * (s->sps->tb_mask + 2) +
-                               ((x_tb + size_in_tbs_h) & s->sps->tb_mask)];
+        s->ps.pps->min_tb_addr_zs[(y_tb - 1) * (s->ps.sps->tb_mask + 2) +
+                               ((x_tb + size_in_tbs_h) & s->ps.sps->tb_mask)];
 
     int bottom_left_size =
         (((y0 + 2 * size_in_luma_v) >
-          (s->sps->height) ? (s->sps->height) : (y0 +
+          (s->ps.sps->height) ? (s->ps.sps->height) : (y0 +
                                                  2 * size_in_luma_v)) -
          (y0 + size_in_luma_v)) >> vshift;
     int top_right_size =
         (((x0 + 2 * size_in_luma_h) >
-          (s->sps->width) ? (s->sps->width) : (x0 + 2 * size_in_luma_h)) -
+          (s->ps.sps->width) ? (s->ps.sps->width) : (x0 + 2 * size_in_luma_h)) -
          (x0 + size_in_luma_h)) >> hshift;
 
-    if (s->pps->constrained_intra_pred_flag == 1) {
-        int size_in_luma_pu_v = ((size_in_luma_v) >> s->sps->log2_min_pu_size);
-        int size_in_luma_pu_h = ((size_in_luma_h) >> s->sps->log2_min_pu_size);
-        int on_pu_edge_x = !(x0 & ((1 << s->sps->log2_min_pu_size) - 1));
-        int on_pu_edge_y = !(y0 & ((1 << s->sps->log2_min_pu_size) - 1));
+    if (s->ps.pps->constrained_intra_pred_flag == 1) {
+        int size_in_luma_pu_v = ((size_in_luma_v) >> s->ps.sps->log2_min_pu_size);
+        int size_in_luma_pu_h = ((size_in_luma_h) >> s->ps.sps->log2_min_pu_size);
+        int on_pu_edge_x = !(x0 & ((1 << s->ps.sps->log2_min_pu_size) - 1));
+        int on_pu_edge_y = !(y0 & ((1 << s->ps.sps->log2_min_pu_size) - 1));
         if (!size_in_luma_pu_h)
             size_in_luma_pu_h++;
         if (cand_bottom_left == 1 && on_pu_edge_x) {
-            int x_left_pu = ((x0 - 1) >> s->sps->log2_min_pu_size);
+            int x_left_pu = ((x0 - 1) >> s->ps.sps->log2_min_pu_size);
             int y_bottom_pu =
-                ((y0 + size_in_luma_v) >> s->sps->log2_min_pu_size);
+                ((y0 + size_in_luma_v) >> s->ps.sps->log2_min_pu_size);
             int max =
                 ((size_in_luma_pu_v) >
-                 (s->sps->min_pu_height -
-                  y_bottom_pu) ? (s->sps->min_pu_height -
+                 (s->ps.sps->min_pu_height -
+                  y_bottom_pu) ? (s->ps.sps->min_pu_height -
                                   y_bottom_pu) : (size_in_luma_pu_v));
             cand_bottom_left = 0;
             for (i = 0; i < max; i += 2)
@@ -1993,12 +1993,12 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                      PF_INTRA);
         }
         if (cand_left == 1 && on_pu_edge_x) {
-            int x_left_pu = ((x0 - 1) >> s->sps->log2_min_pu_size);
-            int y_left_pu = ((y0) >> s->sps->log2_min_pu_size);
+            int x_left_pu = ((x0 - 1) >> s->ps.sps->log2_min_pu_size);
+            int y_left_pu = ((y0) >> s->ps.sps->log2_min_pu_size);
             int max =
                 ((size_in_luma_pu_v) >
-                 (s->sps->min_pu_height -
-                  y_left_pu) ? (s->sps->min_pu_height -
+                 (s->ps.sps->min_pu_height -
+                  y_left_pu) ? (s->ps.sps->min_pu_height -
                                 y_left_pu) : (size_in_luma_pu_v));
             cand_left = 0;
             for (i = 0; i < max; i += 2)
@@ -2009,20 +2009,20 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                      PF_INTRA);
         }
         if (cand_up_left == 1) {
-            int x_left_pu = ((x0 - 1) >> s->sps->log2_min_pu_size);
-            int y_top_pu = ((y0 - 1) >> s->sps->log2_min_pu_size);
+            int x_left_pu = ((x0 - 1) >> s->ps.sps->log2_min_pu_size);
+            int y_top_pu = ((y0 - 1) >> s->ps.sps->log2_min_pu_size);
             cand_up_left =
                 (s->ref->tab_mvf[(x_left_pu) +
                                  (y_top_pu) * min_pu_width]).pred_flag ==
                 PF_INTRA;
         }
         if (cand_up == 1 && on_pu_edge_y) {
-            int x_top_pu = ((x0) >> s->sps->log2_min_pu_size);
-            int y_top_pu = ((y0 - 1) >> s->sps->log2_min_pu_size);
+            int x_top_pu = ((x0) >> s->ps.sps->log2_min_pu_size);
+            int y_top_pu = ((y0 - 1) >> s->ps.sps->log2_min_pu_size);
             int max =
                 ((size_in_luma_pu_h) >
-                 (s->sps->min_pu_width -
-                  x_top_pu) ? (s->sps->min_pu_width -
+                 (s->ps.sps->min_pu_width -
+                  x_top_pu) ? (s->ps.sps->min_pu_width -
                                x_top_pu) : (size_in_luma_pu_h));
             cand_up = 0;
             for (i = 0; i < max; i += 2)
@@ -2032,13 +2032,13 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                                       min_pu_width]).pred_flag == PF_INTRA);
         }
         if (cand_up_right == 1 && on_pu_edge_y) {
-            int y_top_pu = ((y0 - 1) >> s->sps->log2_min_pu_size);
+            int y_top_pu = ((y0 - 1) >> s->ps.sps->log2_min_pu_size);
             int x_right_pu =
-                ((x0 + size_in_luma_h) >> s->sps->log2_min_pu_size);
+                ((x0 + size_in_luma_h) >> s->ps.sps->log2_min_pu_size);
             int max =
                 ((size_in_luma_pu_h) >
-                 (s->sps->min_pu_width -
-                  x_right_pu) ? (s->sps->min_pu_width -
+                 (s->ps.sps->min_pu_width -
+                  x_right_pu) ? (s->ps.sps->min_pu_width -
                                  x_right_pu) : (size_in_luma_pu_h));
             cand_up_right = 0;
             for (i = 0; i < max; i += 2)
@@ -2093,56 +2093,56 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
         } while (0);
     }
 
-    if (s->pps->constrained_intra_pred_flag == 1) {
+    if (s->ps.pps->constrained_intra_pred_flag == 1) {
         if (cand_bottom_left || cand_left || cand_up_left || cand_up
             || cand_up_right) {
             int size_max_x =
                 x0 + ((2 * 16) << hshift) <
-                s->sps->width ? 2 * 16 : (s->sps->width - x0) >> hshift;
+                s->ps.sps->width ? 2 * 16 : (s->ps.sps->width - x0) >> hshift;
             int size_max_y =
                 y0 + ((2 * 16) << vshift) <
-                s->sps->height ? 2 * 16 : (s->sps->height - y0) >> vshift;
+                s->ps.sps->height ? 2 * 16 : (s->ps.sps->height - y0) >> vshift;
             int j = 16 + (cand_bottom_left ? bottom_left_size : 0) - 1;
             if (!cand_up_right) {
-                size_max_x = x0 + ((16) << hshift) < s->sps->width ?
-                    16 : (s->sps->width - x0) >> hshift;
+                size_max_x = x0 + ((16) << hshift) < s->ps.sps->width ?
+                    16 : (s->ps.sps->width - x0) >> hshift;
             }
             if (!cand_bottom_left) {
-                size_max_y = y0 + ((16) << vshift) < s->sps->height ?
-                    16 : (s->sps->height - y0) >> vshift;
+                size_max_y = y0 + ((16) << vshift) < s->ps.sps->height ?
+                    16 : (s->ps.sps->height - y0) >> vshift;
             }
             if (cand_bottom_left || cand_left || cand_up_left) {
                 while (j > -1
                        &&
                        !((s->ref->tab_mvf[(((x0 +
-                                             ((-1) << hshift)) >> s->sps->
+                                             ((-1) << hshift)) >> s->ps.sps->
                                             log2_min_pu_size)) + (((y0 +
                                                                     ((j) <<
                                                                      vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                    log2_min_pu_size))
                                           * min_pu_width]).pred_flag ==
                          PF_INTRA))
                     j--;
                 if (!
                     ((s->ref->tab_mvf[(((x0 +
-                                         ((-1) << hshift)) >> s->sps->
+                                         ((-1) << hshift)) >> s->ps.sps->
                                         log2_min_pu_size)) + (((y0 + ((j)
                                                                       <<
                                                                       vshift))
-                                                               >> s->sps->
+                                                               >> s->ps.sps->
                                                                log2_min_pu_size))
                                       * min_pu_width]).pred_flag == PF_INTRA)) {
                     j = 0;
                     while (j < size_max_x
                            &&
                            !((s->ref->tab_mvf[(((x0 +
-                                                 ((j) << hshift)) >> s->sps->
+                                                 ((j) << hshift)) >> s->ps.sps->
                                                 log2_min_pu_size)) + (((y0 +
                                                                         ((-1) <<
                                                                          vshift))
                                                                        >> s->
-                                                                       sps->
+                                                                       ps.sps->
                                                                        log2_min_pu_size))
                                               * min_pu_width]).pred_flag ==
                              PF_INTRA))
@@ -2151,12 +2151,12 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                         if (!
                             ((s->ref->tab_mvf[(((x0 +
                                                  ((i -
-                                                   1) << hshift)) >> s->sps->
+                                                   1) << hshift)) >> s->ps.sps->
                                                 log2_min_pu_size)) + (((y0 +
                                                                         ((-1) <<
                                                                          vshift))
                                                                        >> s->
-                                                                       sps->
+                                                                       ps.sps->
                                                                        log2_min_pu_size))
                                               * min_pu_width]).pred_flag ==
                              PF_INTRA))
@@ -2168,11 +2168,11 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                 while (j < size_max_x
                        &&
                        !((s->ref->tab_mvf[(((x0 +
-                                             ((j) << hshift)) >> s->sps->
+                                             ((j) << hshift)) >> s->ps.sps->
                                             log2_min_pu_size)) + (((y0 + ((-1)
                                                                           <<
                                                                           vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                    log2_min_pu_size))
                                           * min_pu_width]).pred_flag ==
                          PF_INTRA))
@@ -2184,11 +2184,11 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                                 ((s->ref->tab_mvf[(((x0 +
                                                      ((i -
                                                        1) << hshift)) >>
-                                                    s->sps->log2_min_pu_size))
+                                                    s->ps.sps->log2_min_pu_size))
                                                   + (((y0 + ((-1)
                                                              << vshift))
                                                       >>
-                                                      s->sps->log2_min_pu_size))
+                                                      s->ps.sps->log2_min_pu_size))
                                                   *
                                                   min_pu_width]).pred_flag ==
                                  PF_INTRA))
@@ -2199,11 +2199,11 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                                 ((s->ref->tab_mvf[(((x0 +
                                                      ((i -
                                                        1) << hshift)) >>
-                                                    s->sps->log2_min_pu_size))
+                                                    s->ps.sps->log2_min_pu_size))
                                                   + (((y0 + ((-1)
                                                              << vshift))
                                                       >>
-                                                      s->sps->log2_min_pu_size))
+                                                      s->ps.sps->log2_min_pu_size))
                                                   *
                                                   min_pu_width]).pred_flag ==
                                  PF_INTRA))
@@ -2218,11 +2218,11 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                 for (i = 0; i < (0) + (size_max_y); i += 4)
                     if (!
                         ((s->ref->tab_mvf[(((x0 +
-                                             ((-1) << hshift)) >> s->sps->
+                                             ((-1) << hshift)) >> s->ps.sps->
                                             log2_min_pu_size)) + (((y0 +
                                                                     ((i) <<
                                                                      vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                    log2_min_pu_size))
                                           * min_pu_width]).pred_flag ==
                          PF_INTRA))
@@ -2247,12 +2247,12 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                      i > (size_max_y - 1) - (size_max_y); i -= 4)
                     if (!
                         ((s->ref->tab_mvf[(((x0 +
-                                             ((-1) << hshift)) >> s->sps->
+                                             ((-1) << hshift)) >> s->ps.sps->
                                             log2_min_pu_size)) + (((y0 +
                                                                     ((i -
                                                                       3) <<
                                                                      vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                    log2_min_pu_size))
                                           * min_pu_width]).pred_flag ==
                          PF_INTRA))
@@ -2261,11 +2261,11 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                         a = ((left[i - 3]) * 0x01010101U);
                 if (!
                     ((s->ref->tab_mvf[(((x0 +
-                                         ((-1) << hshift)) >> s->sps->
+                                         ((-1) << hshift)) >> s->ps.sps->
                                         log2_min_pu_size)) + (((y0 + ((-1)
                                                                       <<
                                                                       vshift))
-                                                               >> s->sps->
+                                                               >> s->ps.sps->
                                                                log2_min_pu_size))
                                       * min_pu_width]).pred_flag == PF_INTRA))
                     left[-1] = left[0];
@@ -2281,12 +2281,12 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                      i > (size_max_y - 1) - (size_max_y); i -= 4)
                     if (!
                         ((s->ref->tab_mvf[(((x0 +
-                                             ((-1) << hshift)) >> s->sps->
+                                             ((-1) << hshift)) >> s->ps.sps->
                                             log2_min_pu_size)) + (((y0 +
                                                                     ((i -
                                                                       3) <<
                                                                      vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                    log2_min_pu_size))
                                           * min_pu_width]).pred_flag ==
                          PF_INTRA))
@@ -2300,11 +2300,11 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                 for (i = 0; i < (0) + (size_max_x); i += 4)
                     if (!
                         ((s->ref->tab_mvf[(((x0 +
-                                             ((i) << hshift)) >> s->sps->
+                                             ((i) << hshift)) >> s->ps.sps->
                                             log2_min_pu_size)) + (((y0 + ((-1)
                                                                           <<
                                                                           vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                    log2_min_pu_size))
                                           * min_pu_width]).pred_flag ==
                          PF_INTRA))
@@ -2376,8 +2376,8 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
     top[-1] = left[-1];
 
 
-    if (!s->sps->intra_smoothing_disabled_flag
-        && (c_idx == 0 || s->sps->chroma_format_idc == 3)) {
+    if (!s->ps.sps->intra_smoothing_disabled_flag
+        && (c_idx == 0 || s->ps.sps->chroma_format_idc == 3)) {
         if (mode != INTRA_DC && 16 != 4) {
             int intra_hor_ver_dist_thresh[] = { 7, 1, 0 };
             int min_dist_vert_hor =
@@ -2432,24 +2432,24 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
     v8i16 mul_val1 = { 1, 2, 3, 4, 5, 6, 7, 8 };
     HEVCLocalContext *lc = s->HEVClc;
     int i;
-    int hshift = s->sps->hshift[c_idx];
-    int vshift = s->sps->vshift[c_idx];
+    int hshift = s->ps.sps->hshift[c_idx];
+    int vshift = s->ps.sps->vshift[c_idx];
     int size_in_luma_h = 32 << hshift;
-    int size_in_tbs_h = size_in_luma_h >> s->sps->log2_min_tb_size;
+    int size_in_tbs_h = size_in_luma_h >> s->ps.sps->log2_min_tb_size;
     int size_in_luma_v = 32 << vshift;
-    int size_in_tbs_v = size_in_luma_v >> s->sps->log2_min_tb_size;
+    int size_in_tbs_v = size_in_luma_v >> s->ps.sps->log2_min_tb_size;
     int x = x0 >> hshift;
     int y = y0 >> vshift;
-    int x_tb = (x0 >> s->sps->log2_min_tb_size) & s->sps->tb_mask;
-    int y_tb = (y0 >> s->sps->log2_min_tb_size) & s->sps->tb_mask;
+    int x_tb = (x0 >> s->ps.sps->log2_min_tb_size) & s->ps.sps->tb_mask;
+    int y_tb = (y0 >> s->ps.sps->log2_min_tb_size) & s->ps.sps->tb_mask;
 
     int cur_tb_addr =
-        s->pps->min_tb_addr_zs[(y_tb) * (s->sps->tb_mask + 2) + (x_tb)];
+        s->ps.pps->min_tb_addr_zs[(y_tb) * (s->ps.sps->tb_mask + 2) + (x_tb)];
 
     ptrdiff_t stride = s->frame->linesize[c_idx] / sizeof(uint8_t);
     uint8_t *src = (uint8_t *) s->frame->data[c_idx] + x + y * stride;
 
-    int min_pu_width = s->sps->min_pu_width;
+    int min_pu_width = s->ps.sps->min_pu_width;
 
     enum IntraPredMode mode = c_idx ? lc->tu.intra_pred_mode_c :
         lc->tu.intra_pred_mode;
@@ -2465,41 +2465,41 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
     uint8_t *filtered_top = filtered_top_array + 1;
     int cand_bottom_left = lc->na.cand_bottom_left
         && cur_tb_addr >
-        s->pps->min_tb_addr_zs[((y_tb + size_in_tbs_v) & s->sps->tb_mask) *
-                               (s->sps->tb_mask + 2) + (x_tb - 1)];
+        s->ps.pps->min_tb_addr_zs[((y_tb + size_in_tbs_v) & s->ps.sps->tb_mask) *
+                               (s->ps.sps->tb_mask + 2) + (x_tb - 1)];
     int cand_left = lc->na.cand_left;
     int cand_up_left = lc->na.cand_up_left;
     int cand_up = lc->na.cand_up;
     int cand_up_right = lc->na.cand_up_right
         && cur_tb_addr >
-        s->pps->min_tb_addr_zs[(y_tb - 1) * (s->sps->tb_mask + 2) +
-                               ((x_tb + size_in_tbs_h) & s->sps->tb_mask)];
+        s->ps.pps->min_tb_addr_zs[(y_tb - 1) * (s->ps.sps->tb_mask + 2) +
+                               ((x_tb + size_in_tbs_h) & s->ps.sps->tb_mask)];
 
     int bottom_left_size =
         (((y0 + 2 * size_in_luma_v) >
-          (s->sps->height) ? (s->sps->height) : (y0 +
+          (s->ps.sps->height) ? (s->ps.sps->height) : (y0 +
                                                  2 * size_in_luma_v)) -
          (y0 + size_in_luma_v)) >> vshift;
     int top_right_size =
         (((x0 + 2 * size_in_luma_h) >
-          (s->sps->width) ? (s->sps->width) : (x0 + 2 * size_in_luma_h)) -
+          (s->ps.sps->width) ? (s->ps.sps->width) : (x0 + 2 * size_in_luma_h)) -
          (x0 + size_in_luma_h)) >> hshift;
 
-    if (s->pps->constrained_intra_pred_flag == 1) {
-        int size_in_luma_pu_v = ((size_in_luma_v) >> s->sps->log2_min_pu_size);
-        int size_in_luma_pu_h = ((size_in_luma_h) >> s->sps->log2_min_pu_size);
-        int on_pu_edge_x = !(x0 & ((1 << s->sps->log2_min_pu_size) - 1));
-        int on_pu_edge_y = !(y0 & ((1 << s->sps->log2_min_pu_size) - 1));
+    if (s->ps.pps->constrained_intra_pred_flag == 1) {
+        int size_in_luma_pu_v = ((size_in_luma_v) >> s->ps.sps->log2_min_pu_size);
+        int size_in_luma_pu_h = ((size_in_luma_h) >> s->ps.sps->log2_min_pu_size);
+        int on_pu_edge_x = !(x0 & ((1 << s->ps.sps->log2_min_pu_size) - 1));
+        int on_pu_edge_y = !(y0 & ((1 << s->ps.sps->log2_min_pu_size) - 1));
         if (!size_in_luma_pu_h)
             size_in_luma_pu_h++;
         if (cand_bottom_left == 1 && on_pu_edge_x) {
-            int x_left_pu = ((x0 - 1) >> s->sps->log2_min_pu_size);
+            int x_left_pu = ((x0 - 1) >> s->ps.sps->log2_min_pu_size);
             int y_bottom_pu =
-                ((y0 + size_in_luma_v) >> s->sps->log2_min_pu_size);
+                ((y0 + size_in_luma_v) >> s->ps.sps->log2_min_pu_size);
             int max =
                 ((size_in_luma_pu_v) >
-                 (s->sps->min_pu_height -
-                  y_bottom_pu) ? (s->sps->min_pu_height -
+                 (s->ps.sps->min_pu_height -
+                  y_bottom_pu) ? (s->ps.sps->min_pu_height -
                                   y_bottom_pu) : (size_in_luma_pu_v));
             cand_bottom_left = 0;
             for (i = 0; i < max; i += 2)
@@ -2510,12 +2510,12 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                      PF_INTRA);
         }
         if (cand_left == 1 && on_pu_edge_x) {
-            int x_left_pu = ((x0 - 1) >> s->sps->log2_min_pu_size);
-            int y_left_pu = ((y0) >> s->sps->log2_min_pu_size);
+            int x_left_pu = ((x0 - 1) >> s->ps.sps->log2_min_pu_size);
+            int y_left_pu = ((y0) >> s->ps.sps->log2_min_pu_size);
             int max =
                 ((size_in_luma_pu_v) >
-                 (s->sps->min_pu_height -
-                  y_left_pu) ? (s->sps->min_pu_height -
+                 (s->ps.sps->min_pu_height -
+                  y_left_pu) ? (s->ps.sps->min_pu_height -
                                 y_left_pu) : (size_in_luma_pu_v));
             cand_left = 0;
             for (i = 0; i < max; i += 2)
@@ -2526,20 +2526,20 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                      PF_INTRA);
         }
         if (cand_up_left == 1) {
-            int x_left_pu = ((x0 - 1) >> s->sps->log2_min_pu_size);
-            int y_top_pu = ((y0 - 1) >> s->sps->log2_min_pu_size);
+            int x_left_pu = ((x0 - 1) >> s->ps.sps->log2_min_pu_size);
+            int y_top_pu = ((y0 - 1) >> s->ps.sps->log2_min_pu_size);
             cand_up_left =
                 (s->ref->tab_mvf[(x_left_pu) +
                                  (y_top_pu) * min_pu_width]).pred_flag ==
                 PF_INTRA;
         }
         if (cand_up == 1 && on_pu_edge_y) {
-            int x_top_pu = ((x0) >> s->sps->log2_min_pu_size);
-            int y_top_pu = ((y0 - 1) >> s->sps->log2_min_pu_size);
+            int x_top_pu = ((x0) >> s->ps.sps->log2_min_pu_size);
+            int y_top_pu = ((y0 - 1) >> s->ps.sps->log2_min_pu_size);
             int max =
                 ((size_in_luma_pu_h) >
-                 (s->sps->min_pu_width -
-                  x_top_pu) ? (s->sps->min_pu_width -
+                 (s->ps.sps->min_pu_width -
+                  x_top_pu) ? (s->ps.sps->min_pu_width -
                                x_top_pu) : (size_in_luma_pu_h));
             cand_up = 0;
             for (i = 0; i < max; i += 2)
@@ -2549,13 +2549,13 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                                       min_pu_width]).pred_flag == PF_INTRA);
         }
         if (cand_up_right == 1 && on_pu_edge_y) {
-            int y_top_pu = ((y0 - 1) >> s->sps->log2_min_pu_size);
+            int y_top_pu = ((y0 - 1) >> s->ps.sps->log2_min_pu_size);
             int x_right_pu =
-                ((x0 + size_in_luma_h) >> s->sps->log2_min_pu_size);
+                ((x0 + size_in_luma_h) >> s->ps.sps->log2_min_pu_size);
             int max =
                 ((size_in_luma_pu_h) >
-                 (s->sps->min_pu_width -
-                  x_right_pu) ? (s->sps->min_pu_width -
+                 (s->ps.sps->min_pu_width -
+                  x_right_pu) ? (s->ps.sps->min_pu_width -
                                  x_right_pu) : (size_in_luma_pu_h));
             cand_up_right = 0;
             for (i = 0; i < max; i += 2)
@@ -2608,56 +2608,56 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
         } while (0);
     }
 
-    if (s->pps->constrained_intra_pred_flag == 1) {
+    if (s->ps.pps->constrained_intra_pred_flag == 1) {
         if (cand_bottom_left || cand_left || cand_up_left || cand_up
             || cand_up_right) {
             int size_max_x =
                 x0 + ((2 * 32) << hshift) <
-                s->sps->width ? 2 * 32 : (s->sps->width - x0) >> hshift;
+                s->ps.sps->width ? 2 * 32 : (s->ps.sps->width - x0) >> hshift;
             int size_max_y =
                 y0 + ((2 * 32) << vshift) <
-                s->sps->height ? 2 * 32 : (s->sps->height - y0) >> vshift;
+                s->ps.sps->height ? 2 * 32 : (s->ps.sps->height - y0) >> vshift;
             int j = 32 + (cand_bottom_left ? bottom_left_size : 0) - 1;
             if (!cand_up_right) {
-                size_max_x = x0 + ((32) << hshift) < s->sps->width ?
-                    32 : (s->sps->width - x0) >> hshift;
+                size_max_x = x0 + ((32) << hshift) < s->ps.sps->width ?
+                    32 : (s->ps.sps->width - x0) >> hshift;
             }
             if (!cand_bottom_left) {
-                size_max_y = y0 + ((32) << vshift) < s->sps->height ?
-                    32 : (s->sps->height - y0) >> vshift;
+                size_max_y = y0 + ((32) << vshift) < s->ps.sps->height ?
+                    32 : (s->ps.sps->height - y0) >> vshift;
             }
             if (cand_bottom_left || cand_left || cand_up_left) {
                 while (j > -1
                        &&
                        !((s->ref->tab_mvf[(((x0 +
-                                             ((-1) << hshift)) >> s->sps->
+                                             ((-1) << hshift)) >> s->ps.sps->
                                             log2_min_pu_size)) + (((y0 +
                                                                     ((j) <<
                                                                      vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                    log2_min_pu_size))
                                           * min_pu_width]).pred_flag ==
                          PF_INTRA))
                     j--;
                 if (!
                     ((s->ref->tab_mvf[(((x0 +
-                                         ((-1) << hshift)) >> s->sps->
+                                         ((-1) << hshift)) >> s->ps.sps->
                                         log2_min_pu_size)) + (((y0 + ((j)
                                                                       <<
                                                                       vshift))
-                                                               >> s->sps->
+                                                               >> s->ps.sps->
                                                                log2_min_pu_size))
                                       * min_pu_width]).pred_flag == PF_INTRA)) {
                     j = 0;
                     while (j < size_max_x
                            &&
                            !((s->ref->tab_mvf[(((x0 +
-                                                 ((j) << hshift)) >> s->sps->
+                                                 ((j) << hshift)) >> s->ps.sps->
                                                 log2_min_pu_size)) + (((y0 +
                                                                         ((-1) <<
                                                                          vshift))
                                                                        >> s->
-                                                                       sps->
+                                                                       ps.sps->
                                                                        log2_min_pu_size))
                                               * min_pu_width]).pred_flag ==
                              PF_INTRA))
@@ -2666,12 +2666,12 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                         if (!
                             ((s->ref->tab_mvf[(((x0 +
                                                  ((i -
-                                                   1) << hshift)) >> s->sps->
+                                                   1) << hshift)) >> s->ps.sps->
                                                 log2_min_pu_size)) + (((y0 +
                                                                         ((-1) <<
                                                                          vshift))
                                                                        >> s->
-                                                                       sps->
+                                                                       ps.sps->
                                                                        log2_min_pu_size))
                                               * min_pu_width]).pred_flag ==
                              PF_INTRA))
@@ -2683,11 +2683,11 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                 while (j < size_max_x
                        &&
                        !((s->ref->tab_mvf[(((x0 +
-                                             ((j) << hshift)) >> s->sps->
+                                             ((j) << hshift)) >> s->ps.sps->
                                             log2_min_pu_size)) + (((y0 + ((-1)
                                                                           <<
                                                                           vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                    log2_min_pu_size))
                                           * min_pu_width]).pred_flag ==
                          PF_INTRA))
@@ -2699,11 +2699,11 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                                 ((s->ref->tab_mvf[(((x0 +
                                                      ((i -
                                                        1) << hshift)) >>
-                                                    s->sps->log2_min_pu_size))
+                                                    s->ps.sps->log2_min_pu_size))
                                                   + (((y0 + ((-1)
                                                              << vshift))
                                                       >>
-                                                      s->sps->log2_min_pu_size))
+                                                      s->ps.sps->log2_min_pu_size))
                                                   *
                                                   min_pu_width]).pred_flag ==
                                  PF_INTRA))
@@ -2714,11 +2714,11 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                                 ((s->ref->tab_mvf[(((x0 +
                                                      ((i -
                                                        1) << hshift)) >>
-                                                    s->sps->log2_min_pu_size))
+                                                    s->ps.sps->log2_min_pu_size))
                                                   + (((y0 + ((-1)
                                                              << vshift))
                                                       >>
-                                                      s->sps->log2_min_pu_size))
+                                                      s->ps.sps->log2_min_pu_size))
                                                   *
                                                   min_pu_width]).pred_flag ==
                                  PF_INTRA))
@@ -2733,11 +2733,11 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                 for (i = 0; i < (0) + (size_max_y); i += 4)
                     if (!
                         ((s->ref->tab_mvf[(((x0 +
-                                             ((-1) << hshift)) >> s->sps->
+                                             ((-1) << hshift)) >> s->ps.sps->
                                             log2_min_pu_size)) + (((y0 +
                                                                     ((i) <<
                                                                      vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                    log2_min_pu_size))
                                           * min_pu_width]).pred_flag ==
                          PF_INTRA))
@@ -2761,12 +2761,12 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                      i > (size_max_y - 1) - (size_max_y); i -= 4)
                     if (!
                         ((s->ref->tab_mvf[(((x0 +
-                                             ((-1) << hshift)) >> s->sps->
+                                             ((-1) << hshift)) >> s->ps.sps->
                                             log2_min_pu_size)) + (((y0 +
                                                                     ((i -
                                                                       3) <<
                                                                      vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                    log2_min_pu_size))
                                           * min_pu_width]).pred_flag ==
                          PF_INTRA))
@@ -2775,11 +2775,11 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                         a = ((left[i - 3]) * 0x01010101U);
                 if (!
                     ((s->ref->tab_mvf[(((x0 +
-                                         ((-1) << hshift)) >> s->sps->
+                                         ((-1) << hshift)) >> s->ps.sps->
                                         log2_min_pu_size)) + (((y0 + ((-1)
                                                                       <<
                                                                       vshift))
-                                                               >> s->sps->
+                                                               >> s->ps.sps->
                                                                log2_min_pu_size))
                                       * min_pu_width]).pred_flag == PF_INTRA))
                     left[-1] = left[0];
@@ -2795,12 +2795,12 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                      i > (size_max_y - 1) - (size_max_y); i -= 4)
                     if (!
                         ((s->ref->tab_mvf[(((x0 +
-                                             ((-1) << hshift)) >> s->sps->
+                                             ((-1) << hshift)) >> s->ps.sps->
                                             log2_min_pu_size)) + (((y0 +
                                                                     ((i -
                                                                       3) <<
                                                                      vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                    log2_min_pu_size))
                                           * min_pu_width]).pred_flag ==
                          PF_INTRA))
@@ -2814,11 +2814,11 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                 for (i = 0; i < (0) + (size_max_x); i += 4)
                     if (!
                         ((s->ref->tab_mvf[(((x0 +
-                                             ((i) << hshift)) >> s->sps->
+                                             ((i) << hshift)) >> s->ps.sps->
                                             log2_min_pu_size)) + (((y0 + ((-1)
                                                                           <<
                                                                           vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                    log2_min_pu_size))
                                           * min_pu_width]).pred_flag ==
                          PF_INTRA))
@@ -2893,8 +2893,8 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
     top[-1] = left[-1];
 
 
-    if (!s->sps->intra_smoothing_disabled_flag
-        && (c_idx == 0 || s->sps->chroma_format_idc == 3)) {
+    if (!s->ps.sps->intra_smoothing_disabled_flag
+        && (c_idx == 0 || s->ps.sps->chroma_format_idc == 3)) {
         if (mode != INTRA_DC && 32 != 4) {
             int intra_hor_ver_dist_thresh[] = { 7, 1, 0 };
             int min_dist_vert_hor =
@@ -2908,7 +2908,7 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                      0 ? ((int) (mode - 26U)) : (-((int) (mode - 26U))))));
             if (min_dist_vert_hor > intra_hor_ver_dist_thresh[5 - 3]) {
                 int threshold = 1 << (8 - 5);
-                if (s->sps->sps_strong_intra_smoothing_enable_flag
+                if (s->ps.sps->sps_strong_intra_smoothing_enable_flag
                     && c_idx == 0
                     && ((top[-1] + top[63] - 2 * top[31]) >=
                         0 ? (top[-1] + top[63] -

libavcodec/mips/idctdsp_init_mips.c

@@ -49,8 +49,6 @@ static av_cold void idctdsp_init_mmi(IDCTDSPContext *c, AVCodecContext *avctx,
         (avctx->bits_per_raw_sample != 10) &&
         (avctx->bits_per_raw_sample != 12) &&
         (avctx->idct_algo == FF_IDCT_AUTO)) {
-                c->idct_put = ff_simple_idct_put_mmi;
-                c->idct_add = ff_simple_idct_add_mmi;
                 c->idct = ff_simple_idct_mmi;
                 c->perm_type = FF_IDCT_PERM_NONE;
     }

libavcodec/mips/simple_idct_mmi.c

@@ -54,7 +54,7 @@ DECLARE_ALIGNED(8, static const int16_t, coeffs)[]= {
                   C3, -C1,               C3, -C1
 };
 
-static void simple_idct_mmi(int16_t *block)
+void ff_simple_idct_mmi(int16_t *block)
 {
         DECLARE_ALIGNED(8, int64_t, align_tmp)[16];
         int16_t * const temp= (int16_t*)align_tmp;
@@ -814,20 +814,3 @@ static void simple_idct_mmi(int16_t *block)
         : "$10","$11"
     );
 }
-
-void ff_simple_idct_mmi(int16_t *block)
-{
-    simple_idct_mmi(block);
-}
-
-void ff_simple_idct_put_mmi(uint8_t *dest, int32_t line_size, int16_t *block)
-{
-    simple_idct_mmi(block);
-    ff_put_pixels_clamped_mmi(block, dest, line_size);
-}
-
-void ff_simple_idct_add_mmi(uint8_t *dest, int32_t line_size, int16_t *block)
-{
-    simple_idct_mmi(block);
-    ff_add_pixels_clamped_mmi(block, dest, line_size);
-}

libavcodec/mips/vp9_lpf_msa.c

@@ -259,7 +259,7 @@
     mask_out = __msa_xori_b(mask_out, 0xff);                       \
 }
 
-void ff_loop_filter_v_4_8_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_v_4_8_msa(uint8_t *src, ptrdiff_t pitch,
                               int32_t b_limit_ptr,
                               int32_t limit_ptr,
                               int32_t thresh_ptr)
@@ -288,7 +288,7 @@ void ff_loop_filter_v_4_8_msa(uint8_t *src, int32_t pitch,
 }
 
 
-void ff_loop_filter_v_44_16_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_v_44_16_msa(uint8_t *src, ptrdiff_t pitch,
                                 int32_t b_limit_ptr,
                                 int32_t limit_ptr,
                                 int32_t thresh_ptr)
@@ -318,7 +318,7 @@ void ff_loop_filter_v_44_16_msa(uint8_t *src, int32_t pitch,
     ST_UB4(p1, p0, q0, q1, (src - 2 * pitch), pitch);
 }
 
-void ff_loop_filter_v_8_8_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_v_8_8_msa(uint8_t *src, ptrdiff_t pitch,
                               int32_t b_limit_ptr,
                               int32_t limit_ptr,
                               int32_t thresh_ptr)
@@ -392,7 +392,7 @@ void ff_loop_filter_v_8_8_msa(uint8_t *src, int32_t pitch,
     }
 }
 
-void ff_loop_filter_v_88_16_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_v_88_16_msa(uint8_t *src, ptrdiff_t pitch,
                                 int32_t b_limit_ptr,
                                 int32_t limit_ptr,
                                 int32_t thresh_ptr)
@@ -471,7 +471,7 @@ void ff_loop_filter_v_88_16_msa(uint8_t *src, int32_t pitch,
     }
 }
 
-void ff_loop_filter_v_84_16_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_v_84_16_msa(uint8_t *src, ptrdiff_t pitch,
                                 int32_t b_limit_ptr,
                                 int32_t limit_ptr,
                                 int32_t thresh_ptr)
@@ -542,7 +542,7 @@ void ff_loop_filter_v_84_16_msa(uint8_t *src, int32_t pitch,
     }
 }
 
-void ff_loop_filter_v_48_16_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_v_48_16_msa(uint8_t *src, ptrdiff_t pitch,
                                 int32_t b_limit_ptr,
                                 int32_t limit_ptr,
                                 int32_t thresh_ptr)
@@ -614,7 +614,7 @@ void ff_loop_filter_v_48_16_msa(uint8_t *src, int32_t pitch,
     }
 }
 
-static int32_t vp9_hz_lpf_t4_and_t8_16w(uint8_t *src, int32_t pitch,
+static int32_t vp9_hz_lpf_t4_and_t8_16w(uint8_t *src, ptrdiff_t pitch,
                                         uint8_t *filter48,
                                         int32_t b_limit_ptr,
                                         int32_t limit_ptr,
@@ -689,7 +689,7 @@ static int32_t vp9_hz_lpf_t4_and_t8_16w(uint8_t *src, int32_t pitch,
     }
 }
 
-static void vp9_hz_lpf_t16_16w(uint8_t *src, int32_t pitch, uint8_t *filter48)
+static void vp9_hz_lpf_t16_16w(uint8_t *src, ptrdiff_t pitch, uint8_t *filter48)
 {
     v16u8 flat, flat2, filter8;
     v16i8 zero = { 0 };
@@ -1021,7 +1021,7 @@ static void vp9_hz_lpf_t16_16w(uint8_t *src, int32_t pitch, uint8_t *filter48)
     }
 }
 
-void ff_loop_filter_v_16_16_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_v_16_16_msa(uint8_t *src, ptrdiff_t pitch,
                                 int32_t b_limit_ptr,
                                 int32_t limit_ptr,
                                 int32_t thresh_ptr)
@@ -1037,7 +1037,7 @@ void ff_loop_filter_v_16_16_msa(uint8_t *src, int32_t pitch,
     }
 }
 
-void ff_loop_filter_v_16_8_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_v_16_8_msa(uint8_t *src, ptrdiff_t pitch,
                                int32_t b_limit_ptr,
                                int32_t limit_ptr,
                                int32_t thresh_ptr)
@@ -1261,7 +1261,7 @@ void ff_loop_filter_v_16_8_msa(uint8_t *src, int32_t pitch,
     }
 }
 
-void ff_loop_filter_h_4_8_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_h_4_8_msa(uint8_t *src, ptrdiff_t pitch,
                               int32_t b_limit_ptr,
                               int32_t limit_ptr,
                               int32_t thresh_ptr)
@@ -1290,7 +1290,7 @@ void ff_loop_filter_h_4_8_msa(uint8_t *src, int32_t pitch,
     ST4x4_UB(vec3, vec3, 0, 1, 2, 3, src, pitch);
 }
 
-void ff_loop_filter_h_44_16_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_h_44_16_msa(uint8_t *src, ptrdiff_t pitch,
                                 int32_t b_limit_ptr,
                                 int32_t limit_ptr,
                                 int32_t thresh_ptr)
@@ -1337,7 +1337,7 @@ void ff_loop_filter_h_44_16_msa(uint8_t *src, int32_t pitch,
     ST4x8_UB(tmp4, tmp5, src, pitch);
 }
 
-void ff_loop_filter_h_8_8_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_h_8_8_msa(uint8_t *src, ptrdiff_t pitch,
                               int32_t b_limit_ptr,
                               int32_t limit_ptr,
                               int32_t thresh_ptr)
@@ -1417,7 +1417,7 @@ void ff_loop_filter_h_8_8_msa(uint8_t *src, int32_t pitch,
     }
 }
 
-void ff_loop_filter_h_88_16_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_h_88_16_msa(uint8_t *src, ptrdiff_t pitch,
                                 int32_t b_limit_ptr,
                                 int32_t limit_ptr,
                                 int32_t thresh_ptr)
@@ -1531,7 +1531,7 @@ void ff_loop_filter_h_88_16_msa(uint8_t *src, int32_t pitch,
     }
 }
 
-void ff_loop_filter_h_84_16_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_h_84_16_msa(uint8_t *src, ptrdiff_t pitch,
                                 int32_t b_limit_ptr,
                                 int32_t limit_ptr,
                                 int32_t thresh_ptr)
@@ -1635,7 +1635,7 @@ void ff_loop_filter_h_84_16_msa(uint8_t *src, int32_t pitch,
     }
 }
 
-void ff_loop_filter_h_48_16_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_h_48_16_msa(uint8_t *src, ptrdiff_t pitch,
                                 int32_t b_limit_ptr,
                                 int32_t limit_ptr,
                                 int32_t thresh_ptr)
@@ -1912,7 +1912,7 @@ static int32_t vp9_vt_lpf_t4_and_t8_8w(uint8_t *src, uint8_t *filter48,
     }
 }
 
-static int32_t vp9_vt_lpf_t16_8w(uint8_t *src, uint8_t *src_org, int32_t pitch,
+static int32_t vp9_vt_lpf_t16_8w(uint8_t *src, uint8_t *src_org, ptrdiff_t pitch,
                                  uint8_t *filter48)
 {
     v16i8 zero = { 0 };
@@ -2136,7 +2136,7 @@ static int32_t vp9_vt_lpf_t16_8w(uint8_t *src, uint8_t *src_org, int32_t pitch,
     }
 }
 
-void ff_loop_filter_h_16_8_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_h_16_8_msa(uint8_t *src, ptrdiff_t pitch,
                                int32_t b_limit_ptr,
                                int32_t limit_ptr,
                                int32_t thresh_ptr)
@@ -2162,7 +2162,7 @@ void ff_loop_filter_h_16_8_msa(uint8_t *src, int32_t pitch,
 }
 
 static int32_t vp9_vt_lpf_t4_and_t8_16w(uint8_t *src, uint8_t *filter48,
-                                        uint8_t *src_org, int32_t pitch,
+                                        uint8_t *src_org, ptrdiff_t pitch,
                                         int32_t b_limit_ptr,
                                         int32_t limit_ptr,
                                         int32_t thresh_ptr)
@@ -2246,7 +2246,7 @@ static int32_t vp9_vt_lpf_t4_and_t8_16w(uint8_t *src, uint8_t *filter48,
     }
 }
 
-static int32_t vp9_vt_lpf_t16_16w(uint8_t *src, uint8_t *src_org, int32_t pitch,
+static int32_t vp9_vt_lpf_t16_16w(uint8_t *src, uint8_t *src_org, ptrdiff_t pitch,
                                   uint8_t *filter48)
 {
     v16u8 flat, flat2, filter8;
@@ -2573,7 +2573,7 @@ static int32_t vp9_vt_lpf_t16_16w(uint8_t *src, uint8_t *src_org, int32_t pitch,
     }
 }
 
-void ff_loop_filter_h_16_16_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_h_16_16_msa(uint8_t *src, ptrdiff_t pitch,
                                 int32_t b_limit_ptr,
                                 int32_t limit_ptr,
                                 int32_t thresh_ptr)

libavcodec/mjpegdec.c

@@ -98,6 +98,15 @@ static void parse_avid(MJpegDecodeContext *s, uint8_t *buf, int len)
         av_log(s->avctx, AV_LOG_INFO, "AVID: len:%d %d\n", len, len > 14 ? buf[12] : -1);
 }
 
+static void init_idct(AVCodecContext *avctx)
+{
+    MJpegDecodeContext *s = avctx->priv_data;
+
+    ff_idctdsp_init(&s->idsp, avctx);
+    ff_init_scantable(s->idsp.idct_permutation, &s->scantable,
+                      ff_zigzag_direct);
+}
+
 av_cold int ff_mjpeg_decode_init(AVCodecContext *avctx)
 {
     MJpegDecodeContext *s = avctx->priv_data;
@@ -112,9 +121,7 @@ av_cold int ff_mjpeg_decode_init(AVCodecContext *avctx)
     s->avctx = avctx;
     ff_blockdsp_init(&s->bdsp, avctx);
     ff_hpeldsp_init(&s->hdsp, avctx->flags);
-    ff_idctdsp_init(&s->idsp, avctx);
-    ff_init_scantable(s->idsp.idct_permutation, &s->scantable,
-                      ff_zigzag_direct);
+    init_idct(avctx);
     s->buffer_size   = 0;
     s->buffer        = NULL;
     s->start_code    = -1;
@@ -267,7 +274,6 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
 
     /* XXX: verify len field validity */
     len     = get_bits(&s->gb, 16);
-    s->avctx->bits_per_raw_sample =
     bits    = get_bits(&s->gb, 8);
 
     if (bits > 16 || bits < 1) {
@@ -275,6 +281,11 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
         return AVERROR_INVALIDDATA;
     }
 
+    if (s->avctx->bits_per_raw_sample != bits) {
+        av_log(s->avctx, AV_LOG_INFO, "Changeing bps to %d\n", bits);
+        s->avctx->bits_per_raw_sample = bits;
+        init_idct(s->avctx);
+    }
     if (s->pegasus_rct)
         bits = 9;
     if (bits == 9 && !s->pegasus_rct)
@@ -995,7 +1006,14 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int nb_components, int p
                 skip_bits(&s->gb, 16); /* skip RSTn */
             }
         }
-        if (s->nb_components == 4) {
+        if (s->rct && s->nb_components == 4) {
+            for (mb_x = 0; mb_x < s->mb_width; mb_x++) {
+                ptr[4*mb_x + 2] = buffer[mb_x][0] - ((buffer[mb_x][1] + buffer[mb_x][2] - 0x200) >> 2);
+                ptr[4*mb_x + 1] = buffer[mb_x][1] + ptr[4*mb_x + 2];
+                ptr[4*mb_x + 3] = buffer[mb_x][2] + ptr[4*mb_x + 2];
+                ptr[4*mb_x + 0] = buffer[mb_x][3];
+            }
+        } else if (s->nb_components == 4) {
             for(i=0; i<nb_components; i++) {
                 int c= s->comp_index[i];
                 if (s->bits <= 8) {
@@ -1086,7 +1104,10 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor,
                         dc = mjpeg_decode_dc(s, s->dc_index[i]);
                         if(dc == 0xFFFFF)
                             return -1;
-                        if(bits<=8){
+                        if (   h * mb_x + x >= s->width
+                            || v * mb_y + y >= s->height) {
+                            // Nothing to do
+                        } else if (bits<=8) {
                         ptr = s->picture_ptr->data[c] + (linesize * (v * mb_y + y)) + (h * mb_x + x); //FIXME optimize this crap
                         if(y==0 && toprow){
                             if(x==0 && leftcol){
@@ -1154,7 +1175,10 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor,
                         dc = mjpeg_decode_dc(s, s->dc_index[i]);
                         if(dc == 0xFFFFF)
                             return -1;
-                        if(bits<=8){
+                        if (   h * mb_x + x >= s->width
+                            || v * mb_y + y >= s->height) {
+                            // Nothing to do
+                        } else if (bits<=8) {
                             ptr = s->picture_ptr->data[c] +
                               (linesize * (v * mb_y + y)) +
                               (h * mb_x + x); //FIXME optimize this crap

libavcodec/mpeg12dec.c

@@ -1953,7 +1953,7 @@ static int mpeg_decode_slice(MpegEncContext *s, int mb_y,
                     (left && show_bits(&s->gb, FFMIN(left, 23)) && !is_d10) ||
                     ((avctx->err_recognition & (AV_EF_BITSTREAM | AV_EF_AGGRESSIVE)) && left > 8)) {
                     av_log(avctx, AV_LOG_ERROR, "end mismatch left=%d %0X\n",
-                           left, show_bits(&s->gb, FFMIN(left, 23)));
+                           left, left>0 ? show_bits(&s->gb, FFMIN(left, 23)) : 0);
                     return AVERROR_INVALIDDATA;
                 } else
                     goto eos;

libavcodec/mpegaudiodec_template.c

@@ -1657,9 +1657,11 @@ static int decode_frame(AVCodecContext * avctx, void *data, int *got_frame_ptr,
     uint32_t header;
     int ret;
 
+    int skipped = 0;
     while(buf_size && !*buf){
         buf++;
         buf_size--;
+        skipped++;
     }
 
     if (buf_size < HEADER_SIZE)
@@ -1714,7 +1716,7 @@ static int decode_frame(AVCodecContext * avctx, void *data, int *got_frame_ptr,
             return ret;
     }
     s->frame_size = 0;
-    return buf_size;
+    return buf_size + skipped;
 }
 
 static void mp_flush(MPADecodeContext *ctx)

libavcodec/mpegvideo.c

@@ -815,6 +815,7 @@ static void clear_context(MpegEncContext *s)
 
     s->parse_context.buffer = NULL;
     s->parse_context.buffer_size = 0;
+    s->parse_context.overread = 0;
     s->bitstream_buffer = NULL;
     s->allocated_bitstream_buffer_size = 0;
     s->picture          = NULL;

libavcodec/mpegvideo_enc.c

@@ -20,6 +20,8 @@
  * You should have received a copy of the GNU Lesser General Public
  * License along with FFmpeg; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ *
+ * non linear quantizers with large QPs and VBV with restrictive qmin fixes sponsored by NOA GmbH
  */
 
 /**

libavcodec/opusdec.c

@@ -565,8 +565,8 @@ static int opus_decode_packet(AVCodecContext *avctx, void *data,
         if (buffer_samples) {
             float *buf[2] = { c->out[2 * i + 0] ? c->out[2 * i + 0] : (float*)frame->extended_data[0],
                               c->out[2 * i + 1] ? c->out[2 * i + 1] : (float*)frame->extended_data[0] };
-            buf[0] += buffer_samples;
-            buf[1] += buffer_samples;
+            buf[0] += decoded_samples;
+            buf[1] += decoded_samples;
             ret = av_audio_fifo_write(c->sync_buffers[i], (void**)buf, buffer_samples);
             if (ret < 0)
                 return ret;
@@ -585,7 +585,7 @@ static int opus_decode_packet(AVCodecContext *avctx, void *data,
             memset(frame->extended_data[i], 0, frame->linesize[0]);
         }
 
-        if (c->gain_i) {
+        if (c->gain_i && decoded_samples > 0) {
             c->fdsp->vector_fmul_scalar((float*)frame->extended_data[i],
                                        (float*)frame->extended_data[i],
                                        c->gain, FFALIGN(decoded_samples, 8));

libavcodec/pngdec.c

@@ -663,7 +663,10 @@ static int decode_idat_chunk(AVCodecContext *avctx, PNGDecContext *s,
                 break;
 
             default:
-                av_assert0(0);
+                avpriv_request_sample(avctx, "bit depth %d "
+                        "and color type %d with TRNS",
+                        s->bit_depth, s->color_type);
+                return AVERROR_INVALIDDATA;
             }
 
             s->bpp += byte_depth;
@@ -912,6 +915,11 @@ static int decode_fctl_chunk(AVCodecContext *avctx, PNGDecContext *s,
         cur_w > s->width - x_offset|| cur_h > s->height - y_offset)
             return AVERROR_INVALIDDATA;
 
+    if (blend_op != APNG_BLEND_OP_OVER && blend_op != APNG_BLEND_OP_SOURCE) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid blend_op %d\n", blend_op);
+        return AVERROR_INVALIDDATA;
+    }
+
     if (sequence_number == 0 && dispose_op == APNG_DISPOSE_OP_PREVIOUS) {
         // No previous frame to revert to for the first frame
         // Spec says to just treat it as a APNG_DISPOSE_OP_BACKGROUND
@@ -1007,7 +1015,7 @@ static int handle_p_frame_apng(AVCodecContext *avctx, PNGDecContext *s,
             for (x = s->x_offset; x < s->x_offset + s->cur_w; ++x, foreground += s->bpp, background += s->bpp) {
                 size_t b;
                 uint8_t foreground_alpha, background_alpha, output_alpha;
-                uint8_t output[4];
+                uint8_t output[10];
 
                 // Since we might be blending alpha onto alpha, we use the following equations:
                 // output_alpha = foreground_alpha + (1 - foreground_alpha) * background_alpha
@@ -1047,6 +1055,8 @@ static int handle_p_frame_apng(AVCodecContext *avctx, PNGDecContext *s,
 
                 output_alpha = foreground_alpha + FAST_DIV255((255 - foreground_alpha) * background_alpha);
 
+                av_assert0(s->bpp <= 10);
+
                 for (b = 0; b < s->bpp - 1; ++b) {
                     if (output_alpha == 0) {
                         output[b] = 0;
@@ -1254,7 +1264,7 @@ static int decode_frame_png(AVCodecContext *avctx,
         return AVERROR_INVALIDDATA;
     }
 
-    s->y = s->state = 0;
+    s->y = s->state = s->has_trns = 0;
 
     /* init the zlib */
     s->zstream.zalloc = ff_png_zalloc;

libavcodec/sbr.h

@@ -137,6 +137,7 @@ typedef struct AACSBRContext {
 struct SpectralBandReplication {
     int                sample_rate;
     int                start;
+    int                ready_for_dequant;
     int                id_aac;
     int                reset;
     SpectrumParameters spectrum_params;

libavcodec/smacker.c

@@ -670,6 +670,10 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data,
 
     /* get output buffer */
     frame->nb_samples = unp_size / (avctx->channels * (bits + 1));
+    if (unp_size % (avctx->channels * (bits + 1))) {
+        av_log(avctx, AV_LOG_ERROR, "unp_size %d is odd\n", unp_size);
+        return AVERROR(EINVAL);
+    }
     if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
         return ret;
     samples  = (int16_t *)frame->data[0];

libavcodec/snow.h

@@ -565,6 +565,8 @@ static inline int get_symbol(RangeCoder *c, uint8_t *state, int is_signed){
         e= 0;
         while(get_rac(c, state+1 + FFMIN(e,9))){ //1..10
             e++;
+            if (e > 31)
+                return AVERROR_INVALIDDATA;
         }
 
         a= 1;

libavcodec/takdec.c

@@ -632,7 +632,7 @@ static int decorrelate(TAKDecContext *s, int c1, int c2, int length)
         for (; length2 > 0; length2 -= tmp) {
             tmp = FFMIN(length2, x);
 
-            for (i = 0; i < tmp; i++)
+            for (i = 0; i < tmp - (tmp == length2); i++)
                 s->residues[filter_order + i] = *p2++ >> dshift;
 
             for (i = 0; i < tmp; i++) {
@@ -656,7 +656,7 @@ static int decorrelate(TAKDecContext *s, int c1, int c2, int length)
                 *p1++ = v;
             }
 
-            memcpy(s->residues, &s->residues[tmp], 2 * filter_order);
+            memmove(s->residues, &s->residues[tmp], 2 * filter_order);
         }
 
         emms_c();

libavcodec/utils.c

@@ -3490,7 +3490,7 @@ int av_get_audio_frame_duration(AVCodecContext *avctx, int frame_bytes)
                 return frame_bytes * 8 / bps;
         }
 
-        if (ch > 0) {
+        if (ch > 0 && ch < INT_MAX/16) {
             /* calc from frame_bytes and channels */
             switch (id) {
             case AV_CODEC_ID_ADPCM_AFC:

libavcodec/vaapi.h

@@ -31,7 +31,7 @@
  */
 
 #include <stdint.h>
-#include <libavutil/attributes.h>
+#include "libavutil/attributes.h"
 #include "version.h"
 
 /**

libavcodec/vaapi_hevc.c

@@ -205,7 +205,7 @@ static void fill_picture_parameters(const HEVCContext *h, VAPictureParameterBuff
     pp->pps_tc_offset_div2 = h->ps.pps->tc_offset / 2;
     pp->log2_parallel_merge_level_minus2 = h->ps.pps->log2_parallel_merge_level - 2;
 
-    /* Diffrent chroma/luma bit depths are currently not supported by ffmpeg. */
+    /* Different chroma/luma bit depths are currently not supported by ffmpeg. */
     pp->bit_depth_luma_minus8 = h->ps.sps->bit_depth - 8;
     pp->bit_depth_chroma_minus8 = h->ps.sps->bit_depth - 8;
 

libavcodec/vp8.c

@@ -164,7 +164,7 @@ int update_dimensions(VP8Context *s, int width, int height, int is_vp7)
     s->mb_height = (s->avctx->coded_height + 15) / 16;
 
     s->mb_layout = is_vp7 || avctx->active_thread_type == FF_THREAD_SLICE &&
-                   FFMIN(s->num_coeff_partitions, avctx->thread_count) > 1;
+                   avctx->thread_count > 1;
     if (!s->mb_layout) { // Frame threading and one thread
         s->macroblocks_base       = av_mallocz((s->mb_width + s->mb_height * 2 + 1) *
                                                sizeof(*s->macroblocks));

libavcodec/wmaprodec.c

@@ -1623,6 +1623,11 @@ static int decode_packet(AVCodecContext *avctx, void *data,
             s->packet_done = 1;
     }
 
+    if (remaining_bits(s, gb) < 0) {
+        av_log(avctx, AV_LOG_ERROR, "Overread %d\n", -remaining_bits(s, gb));
+        s->packet_loss = 1;
+    }
+
     if (s->packet_done && !s->packet_loss &&
         remaining_bits(s, gb) > 0) {
         /** save the rest of the data so that it can be decoded

libavcodec/x86/sbrdsp.asm

@@ -382,6 +382,7 @@ apply_noise_main:
 %else
 %define count m_maxq
 %endif
+    movsxdifnidn    noiseq, noised
     dec    noiseq
     shl    count, 2
 %ifdef PIC

libavcodec/x86/videodsp.asm

@@ -194,8 +194,12 @@ hvar_fn
 %elif (%2-%%off) == 2
     mov            valw, [srcq+%2-2]
 %elifidn %1, body
-    mov            vald, [srcq+%2-3]
-%else
+    mov            valb, [srcq+%2-1]
+    sal            vald, 16
+    mov            valw, [srcq+%2-3]
+%elifidn %1, bottom
+    movd mm %+ %%mmx_idx, [srcq+%2-4]
+%else ; top
     movd mm %+ %%mmx_idx, [srcq+%2-3]
 %endif
 %endif ; (%2-%%off) >= 1
@@ -251,12 +255,15 @@ hvar_fn
     mov     [dstq+%2-2], valw
 %elifidn %1, body
     mov     [dstq+%2-3], valw
-    shr            vald, 16
+    sar            vald, 16
     mov     [dstq+%2-1], valb
 %else
     movd           vald, mm %+ %%mmx_idx
+%ifidn %1, bottom
+    sar            vald, 8
+%endif
     mov     [dstq+%2-3], valw
-    shr            vald, 16
+    sar            vald, 16
     mov     [dstq+%2-1], valb
 %endif
 %endif ; (%2-%%off) >= 1

libavfilter/af_asyncts.c

@@ -205,7 +205,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *buf)
     delta    = pts - s->pts - get_delay(s);
     out_size = avresample_available(s->avr);
 
-    if (labs(delta) > s->min_delta ||
+    if (llabs(delta) > s->min_delta ||
         (s->first_frame && delta && s->first_pts != AV_NOPTS_VALUE)) {
         av_log(ctx, AV_LOG_VERBOSE, "Discontinuity - %"PRId64" samples.\n", delta);
         out_size = av_clipl_int32((int64_t)out_size + delta);

libavfilter/af_ladspa.c

@@ -142,7 +142,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
     AVFilterContext *ctx = inlink->dst;
     LADSPAContext *s = ctx->priv;
     AVFrame *out;
-    int i, h;
+    int i, h, p;
 
     if (!s->nb_outputs ||
         (av_frame_is_writable(in) && s->nb_inputs == s->nb_outputs &&
@@ -159,13 +159,15 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
 
     for (h = 0; h < s->nb_handles; h++) {
         for (i = 0; i < s->nb_inputs; i++) {
+            p = s->nb_handles > 1 ? h : i;
             s->desc->connect_port(s->handles[h], s->ipmap[i],
-                                  (LADSPA_Data*)in->extended_data[i]);
+                                  (LADSPA_Data*)in->extended_data[p]);
         }
 
         for (i = 0; i < s->nb_outputs; i++) {
+            p = s->nb_handles > 1 ? h : i;
             s->desc->connect_port(s->handles[h], s->opmap[i],
-                                  (LADSPA_Data*)out->extended_data[i]);
+                                  (LADSPA_Data*)out->extended_data[p]);
         }
 
         s->desc->run(s->handles[h], in->nb_samples);

libavfilter/x86/vf_removegrain.asm

@@ -359,7 +359,7 @@ cglobal rg_fl_mode_6, 4, 5, 16, 0, dst, src, stride, pixels
         paddw m2, m7 ; c2
         paddw m3, m6 ; c3
         paddw m4, m5 ; c4
-        ; As the differences (d1..d4) can only be postive, there is no need to
+        ; As the differences (d1..d4) can only be positive, there is no need to
         ; clip to zero.  Also, the maximum positive value is less than 768.
 
         pminsw m1, m2
@@ -485,7 +485,7 @@ cglobal rg_fl_mode_8, 4, 5, 16, 0, dst, src, stride, pixels
         paddw m2, m7 ; c1
         paddw m3, m6 ; c1
         paddw m4, m5 ; c1
-        ; As the differences (d1..d4) can only be postive, there is no need to
+        ; As the differences (d1..d4) can only be positive, there is no need to
         ; clip to zero.  Also, the maximum positive value is less than 768.
 
         pminsw m1, m2

libavformat/asfdec_o.c

@@ -583,7 +583,7 @@ static int asf_read_metadata_obj(AVFormatContext *s, const GUIDParseTable *g)
             break;
         type     = avio_rl16(pb);
         val_len  = avio_rl32(pb);
-        name     = av_malloc(name_len);
+        name     = av_malloc(buflen);
         if (!name)
             return AVERROR(ENOMEM);
         avio_get_str16le(pb, name_len, name,
@@ -1042,8 +1042,8 @@ static const GUIDParseTable gdef[] = {
     { "Mutex Language",               { 0xD6, 0xE2, 0x2A, 0x00, 0x25, 0xDA, 0x11, 0xD1, 0x90, 0x34, 0x00, 0xA0, 0xC9, 0x03, 0x49, 0xBE }, asf_read_unknown, 1 },
     { "Mutex Bitrate",                { 0xD6, 0xE2, 0x2A, 0x01, 0x25, 0xDA, 0x11, 0xD1, 0x90, 0x34, 0x00, 0xA0, 0xC9, 0x03, 0x49, 0xBE }, asf_read_unknown, 1 },
     { "Mutex Unknown",                { 0xD6, 0xE2, 0x2A, 0x02, 0x25, 0xDA, 0x11, 0xD1, 0x90, 0x34, 0x00, 0xA0, 0xC9, 0x03, 0x49, 0xBE }, asf_read_unknown, 1 },
-    { "Bandwith Sharing Exclusive",   { 0xAF, 0x60, 0x60, 0xAA, 0x51, 0x97, 0x11, 0xD2, 0xB6, 0xAF, 0x00, 0xC0, 0x4F, 0xD9, 0x08, 0xE9 }, asf_read_unknown, 1 },
-    { "Bandwith Sharing Partial",     { 0xAF, 0x60, 0x60, 0xAB, 0x51, 0x97, 0x11, 0xD2, 0xB6, 0xAF, 0x00, 0xC0, 0x4F, 0xD9, 0x08, 0xE9 }, asf_read_unknown, 1 },
+    { "Bandwidth Sharing Exclusive",  { 0xAF, 0x60, 0x60, 0xAA, 0x51, 0x97, 0x11, 0xD2, 0xB6, 0xAF, 0x00, 0xC0, 0x4F, 0xD9, 0x08, 0xE9 }, asf_read_unknown, 1 },
+    { "Bandwidth Sharing Partial",    { 0xAF, 0x60, 0x60, 0xAB, 0x51, 0x97, 0x11, 0xD2, 0xB6, 0xAF, 0x00, 0xC0, 0x4F, 0xD9, 0x08, 0xE9 }, asf_read_unknown, 1 },
     { "Payload Extension System Timecode", { 0x39, 0x95, 0x95, 0xEC, 0x86, 0x67, 0x4E, 0x2D, 0x8F, 0xDB, 0x98, 0x81, 0x4C, 0xE7, 0x6C, 0x1E }, asf_read_unknown, 1 },
     { "Payload Extension System File Name", { 0xE1, 0x65, 0xEC, 0x0E, 0x19, 0xED, 0x45, 0xD7, 0xB4, 0xA7, 0x25, 0xCB, 0xD1, 0xE2, 0x8E, 0x9B }, asf_read_unknown, 1 },
     { "Payload Extension System Content Type", { 0xD5, 0x90, 0xDC, 0x20, 0x07, 0xBC, 0x43, 0x6C, 0x9C, 0xF7, 0xF3, 0xBB, 0xFB, 0xF1, 0xA4, 0xDC }, asf_read_unknown, 1 },
@@ -1141,7 +1141,7 @@ static int asf_read_replicated_data(AVFormatContext *s, ASFPacket *asf_pkt)
     if (!asf_pkt->data_size) {
         asf_pkt->data_size = asf_pkt->size_left = avio_rl32(pb); // read media object size
         if (asf_pkt->data_size <= 0)
-            return AVERROR_EOF;
+            return AVERROR_INVALIDDATA;
         if ((ret = av_new_packet(&asf_pkt->avpkt, asf_pkt->data_size)) < 0)
             return ret;
     } else
@@ -1163,7 +1163,7 @@ static int asf_read_multiple_payload(AVFormatContext *s, AVPacket *pkt,
     int ret;
     int skip = 0;
 
-    // if replicated lenght is 1, subpayloads are present
+    // if replicated length is 1, subpayloads are present
     if (asf->rep_data_len == 1) {
         asf->sub_left = 1;
         asf->state = READ_MULTI_SUB;
@@ -1190,6 +1190,8 @@ static int asf_read_multiple_payload(AVFormatContext *s, AVPacket *pkt,
             skip = pay_len - asf_pkt->size_left;
             pay_len = asf_pkt->size_left;
         }
+        if (asf_pkt->size_left <= 0)
+            return AVERROR_INVALIDDATA;
         if ((ret = avio_read(pb, p, pay_len)) < 0)
             return ret;
         if (s->key && s->keylen == 20)
@@ -1237,7 +1239,7 @@ static int asf_read_single_payload(AVFormatContext *s, AVPacket *pkt,
         return AVERROR_INVALIDDATA;
     }
     p = asf_pkt->avpkt.data + asf_pkt->data_size - asf_pkt->size_left;
-    if (size > asf_pkt->size_left)
+    if (size > asf_pkt->size_left || asf_pkt->size_left <= 0)
         return AVERROR_INVALIDDATA;
     if (asf_pkt->size_left > size)
         asf_pkt->size_left -= size;

libavformat/async.c

@@ -170,7 +170,7 @@ static int async_open(URLContext *h, const char *arg, int flags, AVDictionary **
     c->interrupt_callback = h->interrupt_callback;
     ret = ffurl_open(&c->inner, arg, flags, &interrupt_callback, options);
     if (ret != 0) {
-        av_log(h, AV_LOG_ERROR, "ffurl_open failed : %s, %s\n", strerror(ret), arg);
+        av_log(h, AV_LOG_ERROR, "ffurl_open failed : %s, %s\n", av_err2str(ret), arg);
         goto url_fail;
     }
 
@@ -179,25 +179,25 @@ static int async_open(URLContext *h, const char *arg, int flags, AVDictionary **
 
     ret = pthread_mutex_init(&c->mutex, NULL);
     if (ret != 0) {
-        av_log(h, AV_LOG_ERROR, "pthread_mutex_init failed : %s\n", strerror(ret));
+        av_log(h, AV_LOG_ERROR, "pthread_mutex_init failed : %s\n", av_err2str(ret));
         goto mutex_fail;
     }
 
     ret = pthread_cond_init(&c->cond_wakeup_main, NULL);
     if (ret != 0) {
-        av_log(h, AV_LOG_ERROR, "pthread_cond_init failed : %s\n", strerror(ret));
+        av_log(h, AV_LOG_ERROR, "pthread_cond_init failed : %s\n", av_err2str(ret));
         goto cond_wakeup_main_fail;
     }
 
     ret = pthread_cond_init(&c->cond_wakeup_background, NULL);
     if (ret != 0) {
-        av_log(h, AV_LOG_ERROR, "pthread_cond_init failed : %s\n", strerror(ret));
+        av_log(h, AV_LOG_ERROR, "pthread_cond_init failed : %s\n", av_err2str(ret));
         goto cond_wakeup_background_fail;
     }
 
     ret = pthread_create(&c->async_buffer_thread, NULL, async_buffer_task, h);
     if (ret) {
-        av_log(h, AV_LOG_ERROR, "pthread_create failed : %s\n", strerror(ret));
+        av_log(h, AV_LOG_ERROR, "pthread_create failed : %s\n", av_err2str(ret));
         goto thread_fail;
     }
 
@@ -229,7 +229,7 @@ static int async_close(URLContext *h)
 
     ret = pthread_join(c->async_buffer_thread, NULL);
     if (ret != 0)
-        av_log(h, AV_LOG_ERROR, "pthread_join(): %s\n", strerror(ret));
+        av_log(h, AV_LOG_ERROR, "pthread_join(): %s\n", av_err2str(ret));
 
     pthread_cond_destroy(&c->cond_wakeup_background);
     pthread_cond_destroy(&c->cond_wakeup_main);

libavformat/avidec.c

@@ -1581,7 +1581,8 @@ static int avi_read_idx1(AVFormatContext *s, int size)
         ast = st->priv_data;
 
         if (first_packet && first_packet_pos) {
-            data_offset  = first_packet_pos - pos;
+            if (avi->movi_list + 4 != pos || pos + 500 > first_packet_pos)
+                data_offset  = first_packet_pos - pos;
             first_packet = 0;
         }
         pos += data_offset;

libavformat/brstm.c

@@ -205,7 +205,7 @@ static int read_header(AVFormatContext *s)
     avio_skip(s->pb, 1); // padding
 
     st->codec->sample_rate = bfstm ? read32(s) : read16(s);
-    if (!st->codec->sample_rate)
+    if (st->codec->sample_rate <= 0)
         return AVERROR_INVALIDDATA;
 
     if (!bfstm)

libavformat/concatdec.c

@@ -314,7 +314,7 @@ static int open_file(AVFormatContext *avf, unsigned fileno)
         file->start_time = !fileno ? 0 :
                            cat->files[fileno - 1].start_time +
                            cat->files[fileno - 1].duration;
-    file->file_start_time = (avf->start_time == AV_NOPTS_VALUE) ? 0 : avf->start_time;
+    file->file_start_time = (cat->avf->start_time == AV_NOPTS_VALUE) ? 0 : cat->avf->start_time;
     file->file_inpoint = (file->inpoint == AV_NOPTS_VALUE) ? file->file_start_time : file->inpoint;
     if ((ret = match_streams(avf)) < 0)
         return ret;

libavformat/ffmdec.c

@@ -151,7 +151,7 @@ static int ffm_read_data(AVFormatContext *s,
     return size1 - size;
 }
 
-/* ensure that acutal seeking happens between FFM_PACKET_SIZE
+/* ensure that actual seeking happens between FFM_PACKET_SIZE
    and file_size - FFM_PACKET_SIZE */
 static int64_t ffm_seek1(AVFormatContext *s, int64_t pos1)
 {

libavformat/hls.c

@@ -73,6 +73,8 @@ struct segment {
     char *key;
     enum KeyType key_type;
     uint8_t iv[16];
+    /* associated Media Initialization Section, treated as a segment */
+    struct segment *init_section;
 };
 
 struct rendition;
@@ -110,6 +112,13 @@ struct playlist {
     int64_t cur_seg_offset;
     int64_t last_load_time;
 
+    /* Currently active Media Initialization Section */
+    struct segment *cur_init_section;
+    uint8_t *init_sec_buf;
+    unsigned int init_sec_buf_size;
+    unsigned int init_sec_data_len;
+    unsigned int init_sec_buf_read_offset;
+
     char key_url[MAX_URL_SIZE];
     uint8_t key[16];
 
@@ -135,6 +144,11 @@ struct playlist {
      * multiple (playlist-less) renditions associated with them. */
     int n_renditions;
     struct rendition **renditions;
+
+    /* Media Initialization Sections (EXT-X-MAP) associated with this
+     * playlist, if any. */
+    int n_init_sections;
+    struct segment **init_sections;
 };
 
 /*
@@ -205,16 +219,29 @@ static void free_segment_list(struct playlist *pls)
     pls->n_segments = 0;
 }
 
+static void free_init_section_list(struct playlist *pls)
+{
+    int i;
+    for (i = 0; i < pls->n_init_sections; i++) {
+        av_freep(&pls->init_sections[i]->url);
+        av_freep(&pls->init_sections[i]);
+    }
+    av_freep(&pls->init_sections);
+    pls->n_init_sections = 0;
+}
+
 static void free_playlist_list(HLSContext *c)
 {
     int i;
     for (i = 0; i < c->n_playlists; i++) {
         struct playlist *pls = c->playlists[i];
         free_segment_list(pls);
+        free_init_section_list(pls);
         av_freep(&pls->renditions);
         av_freep(&pls->id3_buf);
         av_dict_free(&pls->id3_initial);
         ff_id3v2_free_extra_meta(&pls->id3_deferred_extra);
+        av_freep(&pls->init_sec_buf);
         av_free_packet(&pls->pkt);
         av_freep(&pls->pb.buffer);
         if (pls->input)
@@ -352,6 +379,60 @@ static void handle_key_args(struct key_info *info, const char *key,
     }
 }
 
+struct init_section_info {
+    char uri[MAX_URL_SIZE];
+    char byterange[32];
+};
+
+static struct segment *new_init_section(struct playlist *pls,
+                                        struct init_section_info *info,
+                                        const char *url_base)
+{
+    struct segment *sec;
+    char *ptr;
+    char tmp_str[MAX_URL_SIZE];
+
+    if (!info->uri[0])
+        return NULL;
+
+    sec = av_mallocz(sizeof(*sec));
+    if (!sec)
+        return NULL;
+
+    ff_make_absolute_url(tmp_str, sizeof(tmp_str), url_base, info->uri);
+    sec->url = av_strdup(tmp_str);
+    if (!sec->url) {
+        av_free(sec);
+        return NULL;
+    }
+
+    if (info->byterange[0]) {
+        sec->size = atoi(info->byterange);
+        ptr = strchr(info->byterange, '@');
+        if (ptr)
+            sec->url_offset = atoi(ptr+1);
+    } else {
+        /* the entire file is the init section */
+        sec->size = -1;
+    }
+
+    dynarray_add(&pls->init_sections, &pls->n_init_sections, sec);
+
+    return sec;
+}
+
+static void handle_init_section_args(struct init_section_info *info, const char *key,
+                                           int key_len, char **dest, int *dest_len)
+{
+    if (!strncmp(key, "URI=", key_len)) {
+        *dest     =        info->uri;
+        *dest_len = sizeof(info->uri);
+    } else if (!strncmp(key, "BYTERANGE=", key_len)) {
+        *dest     =        info->byterange;
+        *dest_len = sizeof(info->byterange);
+    }
+}
+
 struct rendition_info {
     char type[16];
     char uri[MAX_URL_SIZE];
@@ -516,19 +597,23 @@ static int url_connect(struct playlist *pls, AVDictionary *opts, AVDictionary *o
     av_dict_copy(&tmp, opts, 0);
     av_dict_copy(&tmp, opts2, 0);
 
-    if ((ret = av_opt_set_dict(pls->input, &tmp)) < 0)
-        goto fail;
-
-    if ((ret = ffurl_connect(pls->input, NULL)) < 0) {
+    if ((ret = ffurl_connect(pls->input, &tmp)) < 0) {
         ffurl_close(pls->input);
         pls->input = NULL;
     }
 
-fail:
     av_dict_free(&tmp);
     return ret;
 }
 
+static void update_options(char **dest, const char *name, void *src)
+{
+    av_freep(dest);
+    av_opt_get(src, name, 0, (uint8_t**)dest);
+    if (*dest && !strlen(*dest))
+        av_freep(dest);
+}
+
 static int open_url(HLSContext *c, URLContext **uc, const char *url, AVDictionary *opts)
 {
     AVDictionary *tmp = NULL;
@@ -538,6 +623,12 @@ static int open_url(HLSContext *c, URLContext **uc, const char *url, AVDictionar
     av_dict_copy(&tmp, opts, 0);
 
     ret = ffurl_open(uc, url, AVIO_FLAG_READ, c->interrupt_callback, &tmp);
+    if( ret >= 0) {
+        // update cookies on http response with setcookies.
+        URLContext *u = *uc;
+        update_options(&c->cookies, "cookies", u->priv_data);
+        av_dict_set(&opts, "cookies", c->cookies, 0);
+    }
 
     av_dict_free(&tmp);
 
@@ -561,6 +652,7 @@ static int parse_playlist(HLSContext *c, const char *url,
     uint8_t *new_url = NULL;
     struct variant_info variant_info;
     char tmp_str[MAX_URL_SIZE];
+    struct segment *cur_init_section = NULL;
 
     if (!in) {
 #if 1
@@ -646,6 +738,14 @@ static int parse_playlist(HLSContext *c, const char *url,
                 pls->type = PLS_TYPE_EVENT;
             else if (!strcmp(ptr, "VOD"))
                 pls->type = PLS_TYPE_VOD;
+        } else if (av_strstart(line, "#EXT-X-MAP:", &ptr)) {
+            struct init_section_info info = {{0}};
+            ret = ensure_playlist(c, &pls, url);
+            if (ret < 0)
+                goto fail;
+            ff_parse_key_value(ptr, (ff_parse_key_val_cb) handle_init_section_args,
+                               &info);
+            cur_init_section = new_init_section(pls, &info, url);
         } else if (av_strstart(line, "#EXT-X-ENDLIST", &ptr)) {
             if (pls)
                 pls->finished = 1;
@@ -724,6 +824,8 @@ static int parse_playlist(HLSContext *c, const char *url,
                     seg->url_offset = 0;
                     seg_offset = 0;
                 }
+
+                seg->init_section = cur_init_section;
             }
         }
     }
@@ -737,17 +839,22 @@ fail:
     return ret;
 }
 
+static struct segment *current_segment(struct playlist *pls)
+{
+    return pls->segments[pls->cur_seq_no - pls->start_seq_no];
+}
+
 enum ReadFromURLMode {
     READ_NORMAL,
     READ_COMPLETE,
 };
 
 /* read from URLContext, limiting read to current segment */
-static int read_from_url(struct playlist *pls, uint8_t *buf, int buf_size,
+static int read_from_url(struct playlist *pls, struct segment *seg,
+                         uint8_t *buf, int buf_size,
                          enum ReadFromURLMode mode)
 {
     int ret;
-    struct segment *seg = pls->segments[pls->cur_seq_no - pls->start_seq_no];
 
      /* limit read if the segment was only a part of a file */
     if (seg->size >= 0)
@@ -870,12 +977,13 @@ static void intercept_id3(struct playlist *pls, uint8_t *buf,
     int bytes;
     int id3_buf_pos = 0;
     int fill_buf = 0;
+    struct segment *seg = current_segment(pls);
 
     /* gather all the id3 tags */
     while (1) {
         /* see if we can retrieve enough data for ID3 header */
         if (*len < ID3v2_HEADER_SIZE && buf_size >= ID3v2_HEADER_SIZE) {
-            bytes = read_from_url(pls, buf + *len, ID3v2_HEADER_SIZE - *len, READ_COMPLETE);
+            bytes = read_from_url(pls, seg, buf + *len, ID3v2_HEADER_SIZE - *len, READ_COMPLETE);
             if (bytes > 0) {
 
                 if (bytes == ID3v2_HEADER_SIZE - *len)
@@ -896,7 +1004,6 @@ static void intercept_id3(struct playlist *pls, uint8_t *buf,
             break;
 
         if (ff_id3v2_match(buf, ID3v2_DEFAULT_MAGIC)) {
-            struct segment *seg = pls->segments[pls->cur_seq_no - pls->start_seq_no];
             int64_t maxsize = seg->size >= 0 ? seg->size : 1024*1024;
             int taglen = ff_id3v2_tag_len(buf);
             int tag_got_bytes = FFMIN(taglen, *len);
@@ -928,7 +1035,7 @@ static void intercept_id3(struct playlist *pls, uint8_t *buf,
 
             if (remaining > 0) {
                 /* read the rest of the tag in */
-                if (read_from_url(pls, pls->id3_buf + id3_buf_pos, remaining, READ_COMPLETE) != remaining)
+                if (read_from_url(pls, seg, pls->id3_buf + id3_buf_pos, remaining, READ_COMPLETE) != remaining)
                     break;
                 id3_buf_pos += remaining;
                 av_log(pls->ctx, AV_LOG_DEBUG, "Stripped additional %d HLS ID3 bytes\n", remaining);
@@ -942,7 +1049,7 @@ static void intercept_id3(struct playlist *pls, uint8_t *buf,
 
     /* re-fill buffer for the caller unless EOF */
     if (*len >= 0 && (fill_buf || *len == 0)) {
-        bytes = read_from_url(pls, buf + *len, buf_size - *len, READ_NORMAL);
+        bytes = read_from_url(pls, seg, buf + *len, buf_size - *len, READ_NORMAL);
 
         /* ignore error if we already had some data */
         if (bytes >= 0)
@@ -962,20 +1069,10 @@ static void intercept_id3(struct playlist *pls, uint8_t *buf,
         pls->is_id3_timestamped = (pls->id3_mpegts_timestamp != AV_NOPTS_VALUE);
 }
 
-static void update_options(char **dest, const char *name, void *src)
-{
-    av_freep(dest);
-    av_opt_get(src, name, 0, (uint8_t**)dest);
-    if (*dest && !strlen(*dest))
-        av_freep(dest);
-}
-
-static int open_input(HLSContext *c, struct playlist *pls)
+static int open_input(HLSContext *c, struct playlist *pls, struct segment *seg)
 {
     AVDictionary *opts = NULL;
-    AVDictionary *opts2 = NULL;
     int ret;
-    struct segment *seg = pls->segments[pls->cur_seq_no - pls->start_seq_no];
 
     // broker prior HTTP options that should be consistent across requests
     av_dict_set(&opts, "user-agent", c->user_agent, 0);
@@ -983,9 +1080,6 @@ static int open_input(HLSContext *c, struct playlist *pls)
     av_dict_set(&opts, "headers", c->headers, 0);
     av_dict_set(&opts, "seekable", "0", 0);
 
-    // Same opts for key request (ffurl_open mutilates the opts so it cannot be used twice)
-    av_dict_copy(&opts2, opts, 0);
-
     if (seg->size >= 0) {
         /* try to restrict the HTTP request to the part we want
          * (if this is in fact a HTTP request) */
@@ -1003,14 +1097,12 @@ static int open_input(HLSContext *c, struct playlist *pls)
         char iv[33], key[33], url[MAX_URL_SIZE];
         if (strcmp(seg->key, pls->key_url)) {
             URLContext *uc;
-            if (open_url(pls->parent->priv_data, &uc, seg->key, opts2) == 0) {
+            if (open_url(pls->parent->priv_data, &uc, seg->key, opts) == 0) {
                 if (ffurl_read_complete(uc, pls->key, sizeof(pls->key))
                     != sizeof(pls->key)) {
                     av_log(NULL, AV_LOG_ERROR, "Unable to read key file %s\n",
                            seg->key);
                 }
-                update_options(&c->cookies, "cookies", uc->priv_data);
-                av_dict_set(&opts, "cookies", c->cookies, 0);
                 ffurl_close(uc);
             } else {
                 av_log(NULL, AV_LOG_ERROR, "Unable to open key file %s\n",
@@ -1047,7 +1139,7 @@ static int open_input(HLSContext *c, struct playlist *pls)
     /* Seek to the requested position. If this was a HTTP request, the offset
      * should already be where want it to, but this allows e.g. local testing
      * without a HTTP server. */
-    if (ret == 0 && seg->key_type == KEY_NONE) {
+    if (ret == 0 && seg->key_type == KEY_NONE && seg->url_offset) {
         int seekret = ffurl_seek(pls->input, seg->url_offset, SEEK_SET);
         if (seekret < 0) {
             av_log(pls->parent, AV_LOG_ERROR, "Unable to seek to offset %"PRId64" of HLS segment '%s'\n", seg->url_offset, seg->url);
@@ -1059,11 +1151,70 @@ static int open_input(HLSContext *c, struct playlist *pls)
 
 cleanup:
     av_dict_free(&opts);
-    av_dict_free(&opts2);
     pls->cur_seg_offset = 0;
     return ret;
 }
 
+static int update_init_section(struct playlist *pls, struct segment *seg)
+{
+    static const int max_init_section_size = 1024*1024;
+    HLSContext *c = pls->parent->priv_data;
+    int64_t sec_size;
+    int64_t urlsize;
+    int ret;
+
+    if (seg->init_section == pls->cur_init_section)
+        return 0;
+
+    pls->cur_init_section = NULL;
+
+    if (!seg->init_section)
+        return 0;
+
+    /* this will clobber playlist URLContext stuff, so this should be
+     * called between segments only */
+    ret = open_input(c, pls, seg->init_section);
+    if (ret < 0) {
+        av_log(pls->parent, AV_LOG_WARNING,
+               "Failed to open an initialization section in playlist %d\n",
+               pls->index);
+        return ret;
+    }
+
+    if (seg->init_section->size >= 0)
+        sec_size = seg->init_section->size;
+    else if ((urlsize = ffurl_size(pls->input)) >= 0)
+        sec_size = urlsize;
+    else
+        sec_size = max_init_section_size;
+
+    av_log(pls->parent, AV_LOG_DEBUG,
+           "Downloading an initialization section of size %"PRId64"\n",
+           sec_size);
+
+    sec_size = FFMIN(sec_size, max_init_section_size);
+
+    av_fast_malloc(&pls->init_sec_buf, &pls->init_sec_buf_size, sec_size);
+
+    ret = read_from_url(pls, seg->init_section, pls->init_sec_buf,
+                        pls->init_sec_buf_size, READ_COMPLETE);
+    ffurl_close(pls->input);
+    pls->input = NULL;
+
+    if (ret < 0)
+        return ret;
+
+    pls->cur_init_section = seg->init_section;
+    pls->init_sec_data_len = ret;
+    pls->init_sec_buf_read_offset = 0;
+
+    /* spec says audio elementary streams do not have media initialization
+     * sections, so there should be no ID3 timestamps */
+    pls->is_id3_timestamped = 0;
+
+    return 0;
+}
+
 static int64_t default_reload_interval(struct playlist *pls)
 {
     return pls->n_segments > 0 ?
@@ -1084,6 +1235,7 @@ restart:
 
     if (!v->input) {
         int64_t reload_interval;
+        struct segment *seg;
 
         /* Check that the playlist is still needed before opening a new
          * segment. */
@@ -1137,7 +1289,14 @@ reload:
             goto reload;
         }
 
-        ret = open_input(c, v);
+        seg = current_segment(v);
+
+        /* load/update Media Initialization Section, if any */
+        ret = update_init_section(v, seg);
+        if (ret)
+            return ret;
+
+        ret = open_input(c, v, seg);
         if (ret < 0) {
             if (ff_check_interrupt(c->interrupt_callback))
                 return AVERROR_EXIT;
@@ -1149,7 +1308,15 @@ reload:
         just_opened = 1;
     }
 
-    ret = read_from_url(v, buf, buf_size, READ_NORMAL);
+    if (v->init_sec_buf_read_offset < v->init_sec_data_len) {
+        /* Push init section out first before first actual segment */
+        int copy_size = FFMIN(v->init_sec_data_len - v->init_sec_buf_read_offset, buf_size);
+        memcpy(buf, v->init_sec_buf, copy_size);
+        v->init_sec_buf_read_offset += copy_size;
+        return copy_size;
+    }
+
+    ret = read_from_url(v, current_segment(v), buf, buf_size, READ_NORMAL);
     if (ret > 0) {
         if (just_opened && v->is_id3_timestamped != 0) {
             /* Intercept ID3 tags here, elementary audio streams are required
@@ -1617,6 +1784,7 @@ static int hls_read_packet(AVFormatContext *s, AVPacket *pkt)
     int ret, i, minplaylist = -1;
 
     recheck_discard_flags(s, c->first_packet);
+    c->first_packet = 0;
 
     for (i = 0; i < c->n_playlists; i++) {
         struct playlist *pls = c->playlists[i];

libavformat/hlsenc.c

@@ -163,12 +163,6 @@ static int hls_delete_old_segments(HLSContext *hls) {
             ret = AVERROR(ENOMEM);
             goto fail;
         }
-        sub_path_size = strlen(dirname) + strlen(segment->sub_filename) + 1;
-        sub_path = av_malloc(sub_path_size);
-        if (!sub_path) {
-            ret = AVERROR(ENOMEM);
-            goto fail;
-        }
 
         av_strlcpy(path, dirname, path_size);
         av_strlcat(path, segment->filename, path_size);
@@ -177,14 +171,23 @@ static int hls_delete_old_segments(HLSContext *hls) {
                                      path, strerror(errno));
         }
 
-        av_strlcpy(sub_path, dirname, sub_path_size);
-        av_strlcat(sub_path, segment->sub_filename, sub_path_size);
-        if (unlink(sub_path) < 0) {
-            av_log(hls, AV_LOG_ERROR, "failed to delete old segment %s: %s\n",
-                                     sub_path, strerror(errno));
+        if (segment->sub_filename[0] != '\0') {
+            sub_path_size = strlen(dirname) + strlen(segment->sub_filename) + 1;
+            sub_path = av_malloc(sub_path_size);
+            if (!sub_path) {
+                ret = AVERROR(ENOMEM);
+                goto fail;
+            }
+
+            av_strlcpy(sub_path, dirname, sub_path_size);
+            av_strlcat(sub_path, segment->sub_filename, sub_path_size);
+            if (unlink(sub_path) < 0) {
+                av_log(hls, AV_LOG_ERROR, "failed to delete old segment %s: %s\n",
+                                         sub_path, strerror(errno));
+            }
+            av_free(sub_path);
         }
         av_freep(&path);
-        av_free(sub_path);
         previous_segment = segment;
         segment = previous_segment->next;
         av_free(previous_segment);
@@ -310,6 +313,8 @@ static int hls_append_segment(HLSContext *hls, double duration, int64_t pos,
 
     if(hls->has_subtitle)
         av_strlcpy(en->sub_filename, av_basename(hls->vtt_avf->filename), sizeof(en->sub_filename));
+    else
+        en->sub_filename[0] = '\0';
 
     en->duration = duration;
     en->pos      = pos;

libavformat/httpauth.c

@@ -220,21 +220,21 @@ static char *make_digest_auth(HTTPAuthState *state, const char *username,
 
     /* TODO: Escape the quoted strings properly. */
     av_strlcatf(authstr, len, "username=\"%s\"",   username);
-    av_strlcatf(authstr, len, ",realm=\"%s\"",     state->realm);
-    av_strlcatf(authstr, len, ",nonce=\"%s\"",     digest->nonce);
-    av_strlcatf(authstr, len, ",uri=\"%s\"",       uri);
-    av_strlcatf(authstr, len, ",response=\"%s\"",  response);
+    av_strlcatf(authstr, len, ", realm=\"%s\"",     state->realm);
+    av_strlcatf(authstr, len, ", nonce=\"%s\"",     digest->nonce);
+    av_strlcatf(authstr, len, ", uri=\"%s\"",       uri);
+    av_strlcatf(authstr, len, ", response=\"%s\"",  response);
 
     // we are violating the RFC and use "" because all others seem to do that too.
     if (digest->algorithm[0])
-        av_strlcatf(authstr, len, ",algorithm=\"%s\"",  digest->algorithm);
+        av_strlcatf(authstr, len, ", algorithm=\"%s\"",  digest->algorithm);
 
     if (digest->opaque[0])
-        av_strlcatf(authstr, len, ",opaque=\"%s\"", digest->opaque);
+        av_strlcatf(authstr, len, ", opaque=\"%s\"", digest->opaque);
     if (digest->qop[0]) {
-        av_strlcatf(authstr, len, ",qop=\"%s\"",    digest->qop);
-        av_strlcatf(authstr, len, ",cnonce=\"%s\"", cnonce);
-        av_strlcatf(authstr, len, ",nc=%s",         nc);
+        av_strlcatf(authstr, len, ", qop=\"%s\"",    digest->qop);
+        av_strlcatf(authstr, len, ", cnonce=\"%s\"", cnonce);
+        av_strlcatf(authstr, len, ", nc=%s",         nc);
     }
 
     av_strlcatf(authstr, len, "\r\n");

libavformat/img2dec.c

@@ -444,14 +444,17 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
     }
 
     res = av_new_packet(pkt, size[0] + size[1] + size[2]);
-    if (res < 0)
-        return res;
+    if (res < 0) {
+        goto fail;
+    }
     pkt->stream_index = 0;
     pkt->flags       |= AV_PKT_FLAG_KEY;
     if (s->ts_from_file) {
         struct stat img_stat;
-        if (stat(filename, &img_stat))
-            return AVERROR(EIO);
+        if (stat(filename, &img_stat)) {
+            res = AVERROR(EIO);
+            goto fail;
+        }
         pkt->pts = (int64_t)img_stat.st_mtime;
 #if HAVE_STRUCT_STAT_ST_MTIM_TV_NSEC
         if (s->ts_from_file == 2)
@@ -485,18 +488,29 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
     if (ret[0] <= 0 || ret[1] < 0 || ret[2] < 0) {
         av_free_packet(pkt);
         if (ret[0] < 0) {
-            return ret[0];
+            res = ret[0];
         } else if (ret[1] < 0) {
-            return ret[1];
-        } else if (ret[2] < 0)
-            return ret[2];
-        return AVERROR_EOF;
+            res = ret[1];
+        } else if (ret[2] < 0) {
+            res = ret[2];
+        } else {
+            res = AVERROR_EOF;
+        }
+        goto fail;
     } else {
         s->img_count++;
         s->img_number++;
         s->pts++;
         return 0;
     }
+
+fail:
+    if (!s->is_pipe) {
+        for (i = 0; i < 3; i++) {
+            avio_closep(&f[i]);
+        }
+    }
+    return res;
 }
 
 static int img_read_close(struct AVFormatContext* s1)

libavformat/isom.h

@@ -103,6 +103,7 @@ typedef struct MOVSbgp {
 typedef struct MOVFragmentIndexItem {
     int64_t moof_offset;
     int64_t time;
+    int headers_read;
 } MOVFragmentIndexItem;
 
 typedef struct MOVFragmentIndex {
@@ -197,6 +198,7 @@ typedef struct MOVContext {
     int has_looked_for_mfra;
     MOVFragmentIndex** fragment_index_data;
     unsigned fragment_index_count;
+    int fragment_index_complete;
     int atom_depth;
     unsigned int aax_mode;  ///< 'aax' file has been detected
     uint8_t file_key[20];

libavformat/jvdec.c

@@ -54,7 +54,7 @@ typedef struct JVDemuxContext {
 
 static int read_probe(AVProbeData *pd)
 {
-    if (pd->buf[0] == 'J' && pd->buf[1] == 'V' && strlen(MAGIC) <= pd->buf_size - 4 &&
+    if (pd->buf[0] == 'J' && pd->buf[1] == 'V' && strlen(MAGIC) + 4 <= pd->buf_size &&
         !memcmp(pd->buf + 4, MAGIC, strlen(MAGIC)))
         return AVPROBE_SCORE_MAX;
     return 0;

libavformat/matroskadec.c

@@ -3088,6 +3088,7 @@ static int matroska_read_seek(AVFormatContext *s, int stream_index,
         tracks[i].audio.buf_timecode   = AV_NOPTS_VALUE;
         tracks[i].end_timecode         = 0;
         if (tracks[i].type == MATROSKA_TRACK_TYPE_SUBTITLE &&
+            tracks[i].stream &&
             tracks[i].stream->discard != AVDISCARD_ALL) {
             index_sub = av_index_search_timestamp(
                 tracks[i].stream, st->index_entries[index].timestamp,

libavformat/mov.c

@@ -838,9 +838,9 @@ static int mov_read_adrm(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     }
 
     /* drm blob processing */
-    avio_read(pb, output, 8); // go to offset 8, absolute postion 0x251
+    avio_read(pb, output, 8); // go to offset 8, absolute position 0x251
     avio_read(pb, input, DRM_BLOB_SIZE);
-    avio_read(pb, output, 4); // go to offset 4, absolute postion 0x28d
+    avio_read(pb, output, 4); // go to offset 4, absolute position 0x28d
     avio_read(pb, file_checksum, 20);
 
     av_log(c->fc, AV_LOG_INFO, "[aax] file checksum == "); // required by external tools
@@ -3294,7 +3294,7 @@ static int mov_read_tfhd(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     MOVFragment *frag = &c->fragment;
     MOVTrackExt *trex = NULL;
     MOVFragmentIndex* index = NULL;
-    int flags, track_id, i;
+    int flags, track_id, i, found = 0;
 
     avio_r8(pb); /* version */
     flags = avio_rb24(pb);
@@ -3312,15 +3312,6 @@ static int mov_read_tfhd(MOVContext *c, AVIOContext *pb, MOVAtom atom)
         av_log(c->fc, AV_LOG_ERROR, "could not find corresponding trex\n");
         return AVERROR_INVALIDDATA;
     }
-    for (i = 0; i < c->fragment_index_count; i++) {
-        MOVFragmentIndex* candidate = c->fragment_index_data[i];
-        if (candidate->track_id == frag->track_id) {
-            av_log(c->fc, AV_LOG_DEBUG,
-                   "found fragment index for track %u\n", frag->track_id);
-            index = candidate;
-            break;
-        }
-    }
 
     frag->base_data_offset = flags & MOV_TFHD_BASE_DATA_OFFSET ?
                              avio_rb64(pb) : flags & MOV_TFHD_DEFAULT_BASE_IS_MOOF ?
@@ -3334,23 +3325,32 @@ static int mov_read_tfhd(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     frag->flags    = flags & MOV_TFHD_DEFAULT_FLAGS ?
                      avio_rb32(pb) : trex->flags;
     frag->time     = AV_NOPTS_VALUE;
-    if (index) {
-        int i, found = 0;
-        for (i = index->current_item; i < index->item_count; i++) {
-            if (frag->implicit_offset == index->items[i].moof_offset) {
-                av_log(c->fc, AV_LOG_DEBUG, "found fragment index entry "
-                        "for track %u and moof_offset %"PRId64"\n",
-                        frag->track_id, index->items[i].moof_offset);
-                frag->time = index->items[i].time;
-                index->current_item = i + 1;
-                found = 1;
+    for (i = 0; i < c->fragment_index_count; i++) {
+        int j;
+        MOVFragmentIndex* candidate = c->fragment_index_data[i];
+        if (candidate->track_id == frag->track_id) {
+            av_log(c->fc, AV_LOG_DEBUG,
+                   "found fragment index for track %u\n", frag->track_id);
+            index = candidate;
+            for (j = index->current_item; j < index->item_count; j++) {
+                if (frag->implicit_offset == index->items[j].moof_offset) {
+                    av_log(c->fc, AV_LOG_DEBUG, "found fragment index entry "
+                            "for track %u and moof_offset %"PRId64"\n",
+                            frag->track_id, index->items[j].moof_offset);
+                    frag->time = index->items[j].time;
+                    index->current_item = j + 1;
+                    found = 1;
+                    break;
+                }
             }
+            if (found)
+                break;
         }
-        if (!found) {
-            av_log(c->fc, AV_LOG_WARNING, "track %u has a fragment index "
-                   "but it doesn't have an (in-order) entry for moof_offset "
-                   "%"PRId64"\n", frag->track_id, frag->implicit_offset);
-        }
+    }
+    if (index && !found) {
+        av_log(c->fc, AV_LOG_DEBUG, "track %u has a fragment index but "
+               "it doesn't have an (in-order) entry for moof_offset "
+               "%"PRId64"\n", frag->track_id, frag->implicit_offset);
     }
     av_log(c->fc, AV_LOG_TRACE, "frag flags 0x%x\n", frag->flags);
     return 0;
@@ -3541,7 +3541,106 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom)
         return AVERROR_EOF;
 
     frag->implicit_offset = offset;
-    st->duration = sc->track_end = dts + sc->time_offset;
+
+    sc->track_end = dts + sc->time_offset;
+    if (st->duration < sc->track_end)
+        st->duration = sc->track_end;
+
+    return 0;
+}
+
+static int mov_read_sidx(MOVContext *c, AVIOContext *pb, MOVAtom atom)
+{
+    int64_t offset = avio_tell(pb) + atom.size, pts;
+    uint8_t version;
+    unsigned i, track_id;
+    AVStream *st = NULL;
+    MOVStreamContext *sc;
+    MOVFragmentIndex *index = NULL;
+    MOVFragmentIndex **tmp;
+    AVRational timescale;
+
+    version = avio_r8(pb);
+    if (version > 1) {
+        avpriv_request_sample(c->fc, "sidx version %u", version);
+        return AVERROR_PATCHWELCOME;
+    }
+
+    avio_rb24(pb); // flags
+
+    track_id = avio_rb32(pb); // Reference ID
+    for (i = 0; i < c->fc->nb_streams; i++) {
+        if (c->fc->streams[i]->id == track_id) {
+            st = c->fc->streams[i];
+            break;
+        }
+    }
+    if (!st) {
+        av_log(c->fc, AV_LOG_ERROR, "could not find corresponding track id %d\n", track_id);
+        return AVERROR_INVALIDDATA;
+    }
+
+    sc = st->priv_data;
+
+    timescale = av_make_q(1, avio_rb32(pb));
+
+    if (version == 0) {
+        pts = avio_rb32(pb);
+        offset += avio_rb32(pb);
+    } else {
+        pts = avio_rb64(pb);
+        offset += avio_rb64(pb);
+    }
+
+    avio_rb16(pb); // reserved
+
+    index = av_mallocz(sizeof(MOVFragmentIndex));
+    if (!index)
+        return AVERROR(ENOMEM);
+
+    index->track_id = track_id;
+
+    index->item_count = avio_rb16(pb);
+    index->items = av_mallocz_array(index->item_count, sizeof(MOVFragmentIndexItem));
+
+    if (!index->items) {
+        av_freep(&index);
+        return AVERROR(ENOMEM);
+    }
+
+    for (i = 0; i < index->item_count; i++) {
+        uint32_t size = avio_rb32(pb);
+        uint32_t duration = avio_rb32(pb);
+        if (size & 0x80000000) {
+            avpriv_request_sample(c->fc, "sidx reference_type 1");
+            av_freep(&index->items);
+            av_freep(&index);
+            return AVERROR_PATCHWELCOME;
+        }
+        avio_rb32(pb); // sap_flags
+        index->items[i].moof_offset = offset;
+        index->items[i].time = av_rescale_q(pts, st->time_base, timescale);
+        offset += size;
+        pts += duration;
+    }
+
+    st->duration = sc->track_end = pts;
+
+    tmp = av_realloc_array(c->fragment_index_data,
+                           c->fragment_index_count + 1,
+                           sizeof(MOVFragmentIndex*));
+    if (!tmp) {
+        av_freep(&index->items);
+        av_freep(&index);
+        return AVERROR(ENOMEM);
+    }
+
+    c->fragment_index_data = tmp;
+    c->fragment_index_data[c->fragment_index_count++] = index;
+
+    if (offset == avio_size(pb))
+        c->fragment_index_complete = 1;
+
     return 0;
 }
 
@@ -3799,6 +3898,7 @@ static const MOVParseTableEntry mov_default_parse_table[] = {
 { MKTAG('a','l','a','c'), mov_read_alac }, /* alac specific atom */
 { MKTAG('a','v','c','C'), mov_read_glbl },
 { MKTAG('p','a','s','p'), mov_read_pasp },
+{ MKTAG('s','i','d','x'), mov_read_sidx },
 { MKTAG('s','t','b','l'), mov_read_default },
 { MKTAG('s','t','c','o'), mov_read_stco },
 { MKTAG('s','t','p','s'), mov_read_stps },
@@ -3922,9 +4022,9 @@ static int mov_read_default(MOVContext *c, AVIOContext *pb, MOVAtom atom)
                 return err;
             }
             if (c->found_moov && c->found_mdat &&
-                ((!pb->seekable || c->fc->flags & AVFMT_FLAG_IGNIDX) ||
+                ((!pb->seekable || c->fc->flags & AVFMT_FLAG_IGNIDX || c->fragment_index_complete) ||
                  start_pos + a.size == avio_size(pb))) {
-                if (!pb->seekable || c->fc->flags & AVFMT_FLAG_IGNIDX)
+                if (!pb->seekable || c->fc->flags & AVFMT_FLAG_IGNIDX || c->fragment_index_complete)
                     c->next_root_atom = start_pos + a.size;
                 c->atom_depth --;
                 return 0;
@@ -4529,6 +4629,52 @@ static int should_retry(AVIOContext *pb, int error_code) {
     return 1;
 }
 
+static int mov_switch_root(AVFormatContext *s, int64_t target)
+{
+    MOVContext *mov = s->priv_data;
+    int i, j;
+    int already_read = 0;
+
+    if (avio_seek(s->pb, target, SEEK_SET) != target) {
+        av_log(mov->fc, AV_LOG_ERROR, "root atom offset 0x%"PRIx64": partial file\n", target);
+        return AVERROR_INVALIDDATA;
+    }
+
+    mov->next_root_atom = 0;
+
+    for (i = 0; i < mov->fragment_index_count; i++) {
+        MOVFragmentIndex *index = mov->fragment_index_data[i];
+        int found = 0;
+        for (j = 0; j < index->item_count; j++) {
+            MOVFragmentIndexItem *item = &index->items[j];
+            if (found) {
+                mov->next_root_atom = item->moof_offset;
+                break; // Advance to next index in outer loop
+            } else if (item->moof_offset == target) {
+                index->current_item = FFMIN(j, index->current_item);
+                if (item->headers_read)
+                    already_read = 1;
+                item->headers_read = 1;
+                found = 1;
+            }
+        }
+        if (!found)
+            index->current_item = 0;
+    }
+
+    if (already_read)
+        return 0;
+
+    mov->found_mdat = 0;
+
+    if (mov_read_default(mov, s->pb, (MOVAtom){ AV_RL32("root"), INT64_MAX }) < 0 ||
+        avio_feof(s->pb))
+        return AVERROR_EOF;
+    av_log(s, AV_LOG_TRACE, "read fragments, offset 0x%"PRIx64"\n", avio_tell(s->pb));
+
+    return 1;
+}
+
 static int mov_read_packet(AVFormatContext *s, AVPacket *pkt)
 {
     MOVContext *mov = s->priv_data;
@@ -4539,19 +4685,11 @@ static int mov_read_packet(AVFormatContext *s, AVPacket *pkt)
     mov->fc = s;
  retry:
     sample = mov_find_next_sample(s, &st);
-    if (!sample) {
-        mov->found_mdat = 0;
+    if (!sample || (mov->next_root_atom && sample->pos > mov->next_root_atom)) {
         if (!mov->next_root_atom)
             return AVERROR_EOF;
-        if (avio_seek(s->pb, mov->next_root_atom, SEEK_SET) != mov->next_root_atom) {
-            av_log(mov->fc, AV_LOG_ERROR, "next root atom offset 0x%"PRIx64": partial file\n", mov->next_root_atom);
-            return AVERROR_INVALIDDATA;
-        }
-        mov->next_root_atom = 0;
-        if (mov_read_default(mov, s->pb, (MOVAtom){ AV_RL32("root"), INT64_MAX }) < 0 ||
-            avio_feof(s->pb))
-            return AVERROR_EOF;
-        av_log(s, AV_LOG_TRACE, "read fragments, offset 0x%"PRIx64"\n", avio_tell(s->pb));
+        if ((ret = mov_switch_root(s, mov->next_root_atom)) < 0)
+            return ret;
         goto retry;
     }
     sc = st->priv_data;
@@ -4629,12 +4767,41 @@ static int mov_read_packet(AVFormatContext *s, AVPacket *pkt)
     return 0;
 }
 
+static int mov_seek_fragment(AVFormatContext *s, AVStream *st, int64_t timestamp)
+{
+    MOVContext *mov = s->priv_data;
+    int i, j;
+
+    if (!mov->fragment_index_complete)
+        return 0;
+
+    for (i = 0; i < mov->fragment_index_count; i++) {
+        if (mov->fragment_index_data[i]->track_id == st->id) {
+            MOVFragmentIndex *index = index = mov->fragment_index_data[i];
+            for (j = index->item_count - 1; j >= 0; j--) {
+                if (index->items[j].time <= timestamp) {
+                    if (index->items[j].headers_read)
+                        return 0;
+
+                    return mov_switch_root(s, index->items[j].moof_offset);
+                }
+            }
+        }
+    }
+
+    return 0;
+}
+
 static int mov_seek_stream(AVFormatContext *s, AVStream *st, int64_t timestamp, int flags)
 {
     MOVStreamContext *sc = st->priv_data;
     int sample, time_sample;
     int i;
 
+    int ret = mov_seek_fragment(s, st, timestamp);
+    if (ret < 0)
+        return ret;
+
     sample = av_index_search_timestamp(st, timestamp, flags);
     av_log(s, AV_LOG_TRACE, "stream %d, timestamp %"PRId64", sample %d\n", st->index, timestamp, sample);
     if (sample < 0 && st->nb_index_entries && timestamp < st->index_entries[0].timestamp)

libavformat/mp3dec.c

@@ -42,6 +42,9 @@
 
 #define XING_TOC_COUNT 100
 
+#define SAME_HEADER_MASK \
+   (0xffe00000 | (3 << 17) | (3 << 10) | (3 << 19))
+
 typedef struct {
     AVClass *class;
     int64_t filesize;
@@ -54,7 +57,7 @@ typedef struct {
     int is_cbr;
 } MP3DecContext;
 
-static int check(AVIOContext *pb, int64_t pos);
+static int check(AVIOContext *pb, int64_t pos, uint32_t *header);
 
 /* mp3 read */
 
@@ -374,12 +377,21 @@ static int mp3_read_header(AVFormatContext *s)
 
     off = avio_tell(s->pb);
     for (i = 0; i < 64 * 1024; i++) {
+        uint32_t header, header2;
+        int frame_size;
         if (!(i&1023))
             ffio_ensure_seekback(s->pb, i + 1024 + 4);
-        if (check(s->pb, off + i) >= 0) {
-            av_log(s, AV_LOG_INFO, "Skipping %d bytes of junk at %"PRId64".\n", i, off);
-            avio_seek(s->pb, off + i, SEEK_SET);
-            break;
+        frame_size = check(s->pb, off + i, &header);
+        if (frame_size > 0) {
+            avio_seek(s->pb, off, SEEK_SET);
+            ffio_ensure_seekback(s->pb, i + 1024 + frame_size + 4);
+            if (check(s->pb, off + i + frame_size, &header2) >= 0 &&
+                (header & SAME_HEADER_MASK) == (header2 & SAME_HEADER_MASK))
+            {
+                av_log(s, AV_LOG_INFO, "Skipping %d bytes of junk at %"PRId64".\n", i, off);
+                avio_seek(s->pb, off + i, SEEK_SET);
+                break;
+            }
         }
         avio_seek(s->pb, off, SEEK_SET);
     }
@@ -420,7 +432,7 @@ static int mp3_read_packet(AVFormatContext *s, AVPacket *pkt)
 
 #define SEEK_WINDOW 4096
 
-static int check(AVIOContext *pb, int64_t pos)
+static int check(AVIOContext *pb, int64_t pos, uint32_t *ret_header)
 {
     int64_t ret = avio_seek(pb, pos, SEEK_SET);
     unsigned header;
@@ -434,6 +446,8 @@ static int check(AVIOContext *pb, int64_t pos)
     if (avpriv_mpegaudio_decode_header(&sd, header) == 1)
         return -1;
 
+    if (ret_header)
+        *ret_header = header;
     return sd.frame_size;
 }
 
@@ -461,7 +475,7 @@ static int64_t mp3_sync(AVFormatContext *s, int64_t target_pos, int flags)
             continue;
 
         for(j=0; j<MIN_VALID; j++) {
-            ret = check(s->pb, pos);
+            ret = check(s->pb, pos, NULL);
             if(ret < 0)
                 break;
             if ((target_pos - pos)*dir <= 0 && abs(MIN_VALID/2-j) < score) {

libavformat/mpeg.c

@@ -939,7 +939,7 @@ static int vobsub_read_packet(AVFormatContext *s, AVPacket *pkt)
         total_read += pkt_size;
 
         /* the current chunk doesn't match the stream index (unlikely) */
-        if ((startcode & 0x1f) != idx_pkt.stream_index)
+        if ((startcode & 0x1f) != s->streams[idx_pkt.stream_index]->id)
             break;
 
         ret = av_grow_packet(pkt, to_read);

libavformat/mpegts.c

@@ -841,6 +841,7 @@ static int mpegts_set_stream_info(AVStream *st, PESContext *pes,
     if ((st->codec->codec_id == AV_CODEC_ID_NONE ||
             (st->request_probe > 0 && st->request_probe < AVPROBE_SCORE_STREAM_RETRY / 5)) &&
         !avcodec_is_open(st->codec) &&
+        st->probe_packets > 0 &&
         stream_type == STREAM_TYPE_PRIVATE_DATA) {
         st->codec->codec_type = AVMEDIA_TYPE_DATA;
         st->codec->codec_id   = AV_CODEC_ID_BIN_DATA;

libavformat/mxfdec.c

@@ -1776,6 +1776,16 @@ static int mxf_parse_physical_source_package(MXFContext *mxf, MXFTrack *source_t
                 continue;
             }
 
+        if (physical_track->edit_rate.num <= 0 ||
+            physical_track->edit_rate.den <= 0) {
+            av_log(mxf->fc, AV_LOG_WARNING,
+                   "Invalid edit rate (%d/%d) found on structural"
+                   " component #%d, defaulting to 25/1\n",
+                   physical_track->edit_rate.num,
+                   physical_track->edit_rate.den, i);
+            physical_track->edit_rate = (AVRational){25, 1};
+        }
+
             for (k = 0; k < physical_track->sequence->structural_components_count; k++) {
                 if (!(mxf_tc = mxf_resolve_timecode_component(mxf, &physical_track->sequence->structural_components_refs[k])))
                     continue;