Changelog: update

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
avformat/avidec: Fix infinite loop in avi_read_nikon()
2016-09-05 02:13:28 +02:00 · 2016-09-05 01:01:35 +02:00 · 2016-09-05 01:01:35 +02:00 · 2016-09-05 01:01:35 +02:00 · 2016-09-05 01:01:35 +02:00 · 2016-09-05 01:01:35 +02:00
67 changed files with 471 additions and 121 deletions
@@ -1,6 +1,86 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.

+version 3.0.3:
+- avformat/avidec: Fix infinite loop in avi_read_nikon()
+- avcodec/aacenc: Tighter input checks
+- avformat/wtvdec: Check pointer before use
+- libavcodec/wmalosslessdec: Check the remaining bits
+- avcodec/diracdec: Check numx/y
+- avcodec/cfhd: Increase minimum band dimension to 3
+- avcodec/indeo2: check ctab
+- avformat/swfdec: Fix inflate() error code check
+- avcodec/rawdec: Fix bits_per_coded_sample checks
+- lavc/mjpegdec: Do not skip reading quantization tables.
+- cmdutils: fix implicit declaration of SetDllDirectory function
+- cmdutils: check for SetDllDirectory() availability
+- avcodec/h264: Put context_count check back
+- cmdutils: remove the current working directory from the DLL search path on win32
+- avcodec/raw: Fix decoding of ilacetest.mov
+- avcodec/ffv1enc: Fix assertion failure with non zero bits per sample
+- avformat/oggdec: Fix integer overflow with invalid pts
+- ffplay: Fix invalid array index
+- avcodec/vp9_parser: Check the input frame sizes for being consistent
+- libavformat/rtpdec_asf: zero initialize the AVIOContext struct
+- libavutil/opt: Small bugfix in example.
+- libx264: Increase x264 opts character limit to 4096
+- avformat/mov: Check sample size
+- avformat/format: Fix registering a format more than once and related races
+- avformat/flacdec: Fix seeking close to EOF
+- avcodec/flac_parser: Raise threshold for detecting invalid data
+- avformat/flvdec: Accept last size if its off by 1
+- tests/api/api-codec-param-test: Do not directly access caps_internal
+- avcodec: Add avpriv_codec_get_cap_skip_frame_fill_param()
+- avfilter/vf_telecine: Make frame writable before writing into it
+- avformat/mpegts: adjust probe score for low check_count
+- avcodec/mpc8: Correct end truncation
+- avformat/mp3dec: Increase probe score slightly when the whole data from begin to end is mp3
+- avcodec/cfhd: Set dimensions unconditionally
+- avcodec/mpegvideo: Do not clear the parse context during init
+- avcodec/h264: Fix off by 1 context count
+- avcodec/alsdec: Check r to prevent out of array read
+- avcodec/alsdec: fix max bits in ltp prefix code
+- avcodec/utils: check skip_samples signedness
+- avformat/mpegts: Do not trust BSSD descriptor, it is sometimes not an S302M stream
+- avcodec/bmp_parser: Check fsize
+- avcodec/bmp_parser: reset state
+- avcodec/bmp_parser: Fix remaining size
+- avcodec/bmp_parser: Fix frame_start_found in cross frame cases
+- avfilter/af_amix: do not fail if there are no samples in output_frame()
+- avformat/allformats: Making av_register_all() thread-safe.
+- librtmp: Avoid an infiniloop setting connection arguments
+- avformat/oggparsevp8: fix pts calculation on pages ending with an invisible frame
+- Revert "configure: Enable GCC vectorization on ≥4.9 on x86"
+- avcodec/libopenjpegenc: Set numresolutions by default to a value that is not too large
+- ffplay: Fix usage of private lavfi API
+- tests/checkasm/checkasm: Disable checkasm_check_pixblockdsp for ppc64be
+- avcodec/mpegvideo: Deallocate last/next picture earlier
+- avcodec/bmp_parser: Fix state
+- avformat/oggparseopus: Fix Undefined behavior in oggparseopus.c and libavformat/utils.c
+- avformat/utils: avoid overflow in compute_chapters_end()  with huge durations
+- avformat/utils: avoid overflow in update_stream_timings() with huge durations
+- doc/developer.texi: Add a code of conduct
+- ffserver: fixed deallocation bug in build_feed_streams
+- avcodec/diracdec: Fix potential integer overflow
+- avformat/avidec: Detect index with too short entries
+- avformat/utils: Check negative bps before shifting in ff_get_pcm_codec_id()
+- avformat/utils: Do not compute the bitrate from duration == 0
+- ffmpeg: Check that r_frame_rate is set before attempting to use it
+- swresample/resample: Fix division by 0 with tap_count=1
+- swresample/rematrix: Use clipping s16 rematrixing if overflows are possible
+- swresample/rematrix: Use error diffusion to avoid error in the DC component of the matrix
+- hevc: Fix memory leak related to a53_caption data
+- libavformat/oggdec: Free stream private when header parsing fails.
+- avformat/utils: Check bps before using it in a shift in ff_get_pcm_codec_id()
+- avformat/oggparseopus: Check that granule pos is within the supported range
+- avcodec/mjpegdec: Do not try to detect last scan but apply idct after all scans for progressive jpeg
+- avformat/options_table: Add missing identifier for very strict compliance
+- avformat/ffmdec: Check pix_fmt
+- doc/general: update supported DCA extensions
+- avcodec/rscc: check input buffer size for deflate mode
+- avcodec/dca: fix sync word search error condition
+- lavf/mpegts: Return small probe score for very short transport streams.
+

 version 3.0.2:
 - avcodec/ttaenc: Reallocate packet if its too small
@@ -56,7 +56,7 @@ Communication
 website                                 Deby Barbara Lepage
 fate.ffmpeg.org                         Timothy Gu
 Trac bug tracker                        Alexander Strasser, Michael Niedermayer, Carl Eugen Hoyos, Lou Logan
-mailing lists                           Michael Niedermayer, Baptiste Coudurier, Lou Logan
+mailing lists                           Baptiste Coudurier, Lou Logan
 Google+                                 Paul B Mahol, Michael Niedermayer, Alexander Strasser
 Twitter                                 Lou Logan, Reynaldo H. Verdejo Pinochet
 Launchpad                               Timothy Gu
@@ -168,7 +168,7 @@ Codecs:
  dirac*                                Rostislav Pehlivanov
  dnxhd*                                Baptiste Coudurier
  dpcm.c                                Mike Melanson
-  dss_sp.c                              Oleksij Rempel, Michael Niedermayer
+  dss_sp.c                              Oleksij Rempel
  dv.c                                  Roman Shaposhnik
  dvbsubdec.c                           Anshul Maheshwari
  dxa.c                                 Kostya Shishkov
@@ -422,7 +422,7 @@ Muxers/Demuxers:
  cdxl.c                                Paul B Mahol
  crc.c                                 Michael Niedermayer
  daud.c                                Reimar Doeffinger
-  dss.c                                 Oleksij Rempel, Michael Niedermayer
+  dss.c                                 Oleksij Rempel
  dtshddec.c                            Paul B Mahol
  dv.c                                  Roman Shaposhnik
  dxa.c                                 Kostya Shishkov
@@ -458,7 +458,7 @@ Muxers/Demuxers:
  mgsts.c                               Paul B Mahol
  microdvd*                             Aurelien Jacobs
  mm.c                                  Peter Ross
-  mov.c                                 Michael Niedermayer, Baptiste Coudurier
+  mov.c                                 Baptiste Coudurier
  movenc.c                              Baptiste Coudurier, Matthieu Bouron
  movenccenc.c                          Eran Kornblau
  mpc.c                                 Kostya Shishkov
@@ -563,7 +563,6 @@ Windows MSVC                            Matthew Oliver, Hendrik Leppkes
 Windows ICL                             Matthew Oliver
 ADI/Blackfin DSP                        Marc Hoffman
 Sparc                                   Roman Shaposhnik
-x86                                     Michael Niedermayer
 OS/2                                    KO Myung-Hun


@@ -1 +1 @@
-3.0.2
+3.0.3
@@ -61,6 +61,9 @@
 #include <sys/time.h>
 #include <sys/resource.h>
 #endif
+#if HAVE_SETDLLDIRECTORY
+#include <windows.h>
+#endif

 static int init_report(const char *env);

@@ -107,6 +110,15 @@ static void log_callback_report(void *ptr, int level, const char *fmt, va_list v
    }
 }

+void init_dynload(void)
+{
+#if HAVE_SETDLLDIRECTORY
+    /* Calling SetDllDirectory with the empty string (but not NULL) removes the
+     * current working directory from the DLL search path as a security pre-caution. */
+    SetDllDirectory("");
+#endif
+}
+
 static void (*program_exit)(int ret);

 void register_exit(void (*cb)(int ret))
@@ -61,6 +61,11 @@ void register_exit(void (*cb)(int ret));
 */
 void exit_program(int ret) av_noreturn;

+/**
+ * Initialize dynamic library loading
+ */
+void init_dynload(void);
+
 /**
 * Initialize the cmdutils option system, in particular
 * allocate the *_opts contexts.
@@ -1900,6 +1900,7 @@ SYSTEM_FUNCS="
    sched_getaffinity
    SetConsoleTextAttribute
    SetConsoleCtrlHandler
+    SetDllDirectory
    setmode
    setrlimit
    Sleep
@@ -5317,6 +5318,7 @@ check_func_headers windows.h MapViewOfFile
 check_func_headers windows.h PeekNamedPipe
 check_func_headers windows.h SetConsoleTextAttribute
 check_func_headers windows.h SetConsoleCtrlHandler
+check_func_headers windows.h SetDllDirectory
 check_func_headers windows.h Sleep
 check_func_headers windows.h VirtualAlloc
 check_struct windows.h "CONDITION_VARIABLE" Ptr
@@ -5923,11 +5925,7 @@ elif enabled ccc; then
    add_cflags -msg_disable nonstandcast
    add_cflags -msg_disable unsupieee
 elif enabled gcc; then
-    case $gcc_basever in
-        4.9*) enabled x86 || check_optflags -fno-tree-vectorize ;;
-        4.*)                 check_optflags -fno-tree-vectorize ;;
-        *)    enabled x86 || check_optflags -fno-tree-vectorize ;;
-    esac
+    check_optflags -fno-tree-vectorize
    check_cflags -Werror=format-security
    check_cflags -Werror=implicit-function-declaration
    check_cflags -Werror=missing-prototypes
@@ -31,7 +31,7 @@ PROJECT_NAME           = FFmpeg
 # This could be handy for archiving the generated documentation or
 # if some version control system is used.

-PROJECT_NUMBER         = 3.0.2
+PROJECT_NUMBER         = 3.0.3

 # With the PROJECT_LOGO tag one can specify a logo or icon that is included
 # in the documentation. The maximum height of the logo should not exceed 55
@@ -403,6 +403,35 @@ finding a new maintainer and also don't forget to update the @file{MAINTAINERS}

 We think our rules are not too hard. If you have comments, contact us.

+@section Code of conduct
+
+Be friendly and respectful towards others and third parties.
+Treat others the way you yourself want to be treated.
+
+Be considerate. Not everyone shares the same viewpoint and priorities as you do.
+Different opinions and interpretations help the project.
+Looking at issues from a different perspective assists development.
+
+Do not assume malice for things that can be attributed to incompetence. Even if
+it is malice, it's rarely good to start with that as initial assumption.
+
+Stay friendly even if someone acts contrarily. Everyone has a bad day
+once in a while.
+If you yourself have a bad day or are angry then try to take a break and reply
+once you are calm and without anger if you have to.
+
+Try to help other team members and cooperate if you can.
+
+The goal of software development is to create technical excellence, not for any
+individual to be better and "win" against the others. Large software projects
+are only possible and successful through teamwork.
+
+If someone struggles do not put them down. Give them a helping hand
+instead and point them in the right direction.
+
+Finally, keep in mind the immortal words of Bill and Ted,
+"Be excellent to each other."
+
@anchor{Submitting patches}
@section Submitting patches

@@ -950,7 +950,7 @@ following image formats are supported:
@item COOK                   @tab     @tab  X
    @tab All versions except 5.1 are supported.
@item DCA (DTS Coherent Acoustics)  @tab  X  @tab  X
-    @tab supported extensions: XCh, XLL (partially)
+    @tab supported extensions: XCh, XXCH, X96, XBR, XLL
@item DPCM id RoQ            @tab  X  @tab  X
    @tab Used in Quake III, Jedi Knight 2 and other computer games.
@item DPCM Interplay         @tab     @tab  X
@@ -2893,7 +2893,8 @@ static int transcode_init(void)
             * overhead
             */
            if(!strcmp(oc->oformat->name, "avi")) {
-                if ( copy_tb<0 && av_q2d(ist->st->r_frame_rate) >= av_q2d(ist->st->avg_frame_rate)
+                if ( copy_tb<0 && ist->st->r_frame_rate.num
+                               && av_q2d(ist->st->r_frame_rate) >= av_q2d(ist->st->avg_frame_rate)
                               && 0.5/av_q2d(ist->st->r_frame_rate) > av_q2d(ist->st->time_base)
                               && 0.5/av_q2d(ist->st->r_frame_rate) > av_q2d(dec_ctx->time_base)
                               && av_q2d(ist->st->time_base) < 1.0/500 && av_q2d(dec_ctx->time_base) < 1.0/500
@@ -4267,6 +4268,8 @@ int main(int argc, char **argv)
    int ret;
    int64_t ti;

+    init_dynload();
+
    register_exit(ffmpeg_cleanup);

    setvbuf(stderr,NULL,_IONBF,0); /* win32 runtime needs this */
@@ -2730,7 +2730,7 @@ static int stream_component_open(VideoState *is, int stream_index)
                goto fail;
            link = is->out_audio_filter->inputs[0];
            sample_rate    = link->sample_rate;
-            nb_channels    = link->channels;
+            nb_channels    = avfilter_link_get_channels(link);
            channel_layout = link->channel_layout;
        }
 #else
@@ -2931,7 +2931,7 @@ static int read_thread(void *arg)
        AVStream *st = ic->streams[i];
        enum AVMediaType type = st->codec->codec_type;
        st->discard = AVDISCARD_ALL;
-        if (wanted_stream_spec[type] && st_index[type] == -1)
+        if (type >= 0 && wanted_stream_spec[type] && st_index[type] == -1)
            if (avformat_match_stream_specifier(ic, st, wanted_stream_spec[type]) > 0)
                st_index[type] = i;
    }
@@ -3771,6 +3771,8 @@ int main(int argc, char **argv)
    VideoState *is;
    char dummy_videodriver[] = "SDL_VIDEODRIVER=dummy";

+    init_dynload();
+
    av_log_set_flags(AV_LOG_SKIP_REPEATED);
    parse_loglevel(argc, argv, options);

@@ -3178,6 +3178,8 @@ int main(int argc, char **argv)
    char *w_name = NULL, *w_args = NULL;
    int ret, i;

+    init_dynload();
+
    av_log_set_flags(AV_LOG_SKIP_REPEATED);
    register_exit(ffprobe_cleanup);

@@ -3858,6 +3858,8 @@ drop:
            if (avformat_write_header(s, NULL) < 0) {
                http_log("Container doesn't support the required parameters\n");
                avio_closep(&s->pb);
+                s->streams = NULL;
+                s->nb_streams = 0;
                avformat_free_context(s);
                goto bail;
            }
@@ -3973,6 +3975,7 @@ int main(int argc, char **argv)
    int cfg_parsed;
    int ret = EXIT_FAILURE;

+    init_dynload();

    config.filename = av_strdup("/etc/ffserver.conf");

@@ -609,8 +609,8 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
            }

            for (k = 0; k < 1024; k++) {
-                if (!isfinite(cpe->ch[ch].coeffs[k])) {
-                    av_log(avctx, AV_LOG_ERROR, "Input contains NaN/+-Inf\n");
+                if (!(fabs(cpe->ch[ch].coeffs[k]) < 1E16)) { // Ensure headroom for energy calculation
+                    av_log(avctx, AV_LOG_ERROR, "Input contains (near) NaN/+-Inf\n");
                    return AVERROR(EINVAL);
                }
            }
@@ -765,8 +765,13 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
            bd->ltp_gain[0]   = decode_rice(gb, 1) << 3;
            bd->ltp_gain[1]   = decode_rice(gb, 2) << 3;

-            r                 = get_unary(gb, 0, 3);
+            r                 = get_unary(gb, 0, 4);
            c                 = get_bits(gb, 2);
+            if (r >= 4) {
+                av_log(avctx, AV_LOG_ERROR, "r overflow\n");
+                return AVERROR_INVALIDDATA;
+            }
+
            bd->ltp_gain[2]   = ltp_gain_values[r][c];

            bd->ltp_gain[3]   = decode_rice(gb, 2) << 3;
@@ -53,7 +53,8 @@ restart:
            if (bpc->pc.frame_start_found == 0) {
                if ((state >> 48) == (('B' << 8) | 'M')) {
                    bpc->fsize = av_bswap32(state >> 16);
-                    bpc->pc.frame_start_found = 1;
+                    if (bpc->fsize > 17)
+                        bpc->pc.frame_start_found = 1;
                }
            } else if (bpc->pc.frame_start_found == 2+4+4) {
 //                 unsigned hsize = av_bswap32(state>>32);
@@ -63,12 +64,16 @@ restart:
                    continue;
                }
                bpc->pc.frame_start_found++;
-                bpc->remaining_size = bpc->fsize + FFMAX(i - 17, 0);
+                bpc->remaining_size = bpc->fsize + i - 17;

                if (bpc->pc.index + i > 17) {
                    next = i - 17;
-                } else
+                    state = 0;
+                    break;
+                } else {
+                    bpc->pc.state64 = 0;
                    goto restart;
+                }
            } else if (bpc->pc.frame_start_found)
                bpc->pc.frame_start_found++;
        }
@@ -89,7 +94,10 @@ flush:
    if (ff_combine_frame(&bpc->pc, next, &buf, &buf_size) < 0)
        return buf_size;

-    bpc->pc.frame_start_found = 0;
+    if (next != END_NOT_FOUND && next < 0)
+        bpc->pc.frame_start_found = FFMAX(bpc->pc.frame_start_found - i - 1, 0);
+    else
+        bpc->pc.frame_start_found = 0;

    *poutbuf      = buf;
    *poutbuf_size = buf_size;
@@ -312,7 +312,7 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
            s->plane[s->channel_num].band[0][0].width  = data;
            s->plane[s->channel_num].band[0][0].stride = data;
            av_log(avctx, AV_LOG_DEBUG, "Lowpass width %"PRIu16"\n", data);
-            if (data < 2 || data > s->plane[s->channel_num].band[0][0].a_width) {
+            if (data < 3 || data > s->plane[s->channel_num].band[0][0].a_width) {
                av_log(avctx, AV_LOG_ERROR, "Invalid lowpass width\n");
                ret = AVERROR(EINVAL);
                break;
@@ -320,7 +320,7 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
        } else if (tag == 28) {
            s->plane[s->channel_num].band[0][0].height = data;
            av_log(avctx, AV_LOG_DEBUG, "Lowpass height %"PRIu16"\n", data);
-            if (data < 2 || data > s->plane[s->channel_num].band[0][0].height) {
+            if (data < 3 || data > s->plane[s->channel_num].band[0][0].height) {
                av_log(avctx, AV_LOG_ERROR, "Invalid lowpass height\n");
                ret = AVERROR(EINVAL);
                break;
@@ -358,7 +358,7 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
            s->plane[s->channel_num].band[s->level][s->subband_num].width  = data;
            s->plane[s->channel_num].band[s->level][s->subband_num].stride = FFALIGN(data, 8);
            av_log(avctx, AV_LOG_DEBUG, "Highpass width %i channel %i level %i subband %i\n", data, s->channel_num, s->level, s->subband_num);
-            if (data < 2) {
+            if (data < 3) {
                av_log(avctx, AV_LOG_ERROR, "Invalid highpass width\n");
                ret = AVERROR(EINVAL);
                break;
@@ -366,7 +366,7 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
        } else if (tag == 42) {
            s->plane[s->channel_num].band[s->level][s->subband_num].height = data;
            av_log(avctx, AV_LOG_DEBUG, "Highpass height %i\n", data);
-            if (data < 2) {
+            if (data < 3) {
                av_log(avctx, AV_LOG_ERROR, "Invalid highpass height\n");
                ret = AVERROR(EINVAL);
                break;
@@ -375,7 +375,7 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
            s->plane[s->channel_num].band[s->level][s->subband_num].width  = data;
            s->plane[s->channel_num].band[s->level][s->subband_num].stride = FFALIGN(data, 8);
            av_log(avctx, AV_LOG_DEBUG, "Highpass width2 %i\n", data);
-            if (data < 2) {
+            if (data < 3) {
                av_log(avctx, AV_LOG_ERROR, "Invalid highpass width2\n");
                ret = AVERROR(EINVAL);
                break;
@@ -383,7 +383,7 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
        } else if (tag == 50) {
            s->plane[s->channel_num].band[s->level][s->subband_num].height = data;
            av_log(avctx, AV_LOG_DEBUG, "Highpass height2 %i\n", data);
-            if (data < 2) {
+            if (data < 3) {
                av_log(avctx, AV_LOG_ERROR, "Invalid highpass height2\n");
                ret = AVERROR(EINVAL);
                break;
@@ -425,6 +425,11 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
                    return ret;
                }
            }
+            ret = ff_set_dimensions(avctx, s->coded_width, s->coded_height);
+            if (ret < 0)
+                return ret;
+            frame.f->width =
+            frame.f->height = 0;

            if ((ret = ff_thread_get_buffer(avctx, &frame, 0)) < 0)
                return ret;
@@ -1900,9 +1900,10 @@ static int parse_optional_info(DCACoreDecoder *s)
                }
            }

-            if (s->avctx->err_recognition & AV_EF_EXPLODE) {
+            if (!s->xch_pos) {
                av_log(s->avctx, AV_LOG_ERROR, "XCH sync word not found\n");
-                return AVERROR_INVALIDDATA;
+                if (s->avctx->err_recognition & AV_EF_EXPLODE)
+                    return AVERROR_INVALIDDATA;
            }
            break;

@@ -1922,9 +1923,10 @@ static int parse_optional_info(DCACoreDecoder *s)
                }
            }

-            if (s->avctx->err_recognition & AV_EF_EXPLODE) {
+            if (!s->x96_pos) {
                av_log(s->avctx, AV_LOG_ERROR, "X96 sync word not found\n");
-                return AVERROR_INVALIDDATA;
+                if (s->avctx->err_recognition & AV_EF_EXPLODE)
+                    return AVERROR_INVALIDDATA;
            }
            break;

@@ -1947,9 +1949,10 @@ static int parse_optional_info(DCACoreDecoder *s)
                }
            }

-            if (s->avctx->err_recognition & AV_EF_EXPLODE) {
+            if (!s->xxch_pos) {
                av_log(s->avctx, AV_LOG_ERROR, "XXCH sync word not found\n");
-                return AVERROR_INVALIDDATA;
+                if (s->avctx->err_recognition & AV_EF_EXPLODE)
+                    return AVERROR_INVALIDDATA;
            }
            break;
        }
@@ -903,8 +903,8 @@ static int decode_lowdelay(DiracContext *s)
    } else {
        for (slice_y = 0; bufsize > 0 && slice_y < s->num_y; slice_y++) {
            for (slice_x = 0; bufsize > 0 && slice_x < s->num_x; slice_x++) {
-                bytes = (slice_num+1) * s->lowdelay.bytes.num / s->lowdelay.bytes.den
-                    - slice_num    * s->lowdelay.bytes.num / s->lowdelay.bytes.den;
+                bytes = (slice_num+1) * (int64_t)s->lowdelay.bytes.num / s->lowdelay.bytes.den
+                       - slice_num    * (int64_t)s->lowdelay.bytes.num / s->lowdelay.bytes.den;
                slices[slice_num].bytes   = bytes;
                slices[slice_num].slice_x = slice_x;
                slices[slice_num].slice_y = slice_y;
@@ -1153,6 +1153,11 @@ static int dirac_unpack_idwt_params(DiracContext *s)
    else {
        s->num_x        = svq3_get_ue_golomb(gb);
        s->num_y        = svq3_get_ue_golomb(gb);
+        if (s->num_x * s->num_y == 0 || s->num_x * (uint64_t)s->num_y > INT_MAX) {
+            av_log(s->avctx,AV_LOG_ERROR,"Invalid numx/y\n");
+            s->num_x = s->num_y = 0;
+            return AVERROR_INVALIDDATA;
+        }
        if (s->ld_picture) {
            s->lowdelay.bytes.num = svq3_get_ue_golomb(gb);
            s->lowdelay.bytes.den = svq3_get_ue_golomb(gb);
@@ -780,14 +780,12 @@ FF_ENABLE_DEPRECATION_WARNINGS
        s->colorspace = 1;
        s->transparency = 1;
        s->chroma_planes = 1;
-        if (!avctx->bits_per_raw_sample)
-            s->bits_per_raw_sample = 8;
+        s->bits_per_raw_sample = 8;
        break;
    case AV_PIX_FMT_0RGB32:
        s->colorspace = 1;
        s->chroma_planes = 1;
-        if (!avctx->bits_per_raw_sample)
-            s->bits_per_raw_sample = 8;
+        s->bits_per_raw_sample = 8;
        break;
    case AV_PIX_FMT_GBRP9:
        if (!avctx->bits_per_raw_sample)
@@ -617,8 +617,8 @@ static int flac_parse(AVCodecParserContext *s, AVCodecContext *avctx,

        if (!av_fifo_space(fpc->fifo_buf) &&
            av_fifo_size(fpc->fifo_buf) / FLAC_AVG_FRAME_SIZE >
-            fpc->nb_headers_buffered * 10) {
-            /* There is less than one valid flac header buffered for 10 headers
+            fpc->nb_headers_buffered * 20) {
+            /* There is less than one valid flac header buffered for 20 headers
             * buffered. Therefore the fifo is most likely filled with invalid
             * data and the input is not a flac file. */
            goto handle_error;
@@ -1656,8 +1656,8 @@ again:
                    av_log(h->avctx, AV_LOG_ERROR, "decode_slice_header error\n");
                sl->ref_count[0] = sl->ref_count[1] = sl->list_count = 0;
            } else if (err == SLICE_SINGLETHREAD) {
-                if (context_count > 1) {
-                    ret = ff_h264_execute_decode_slices(h, context_count - 1);
+                if (context_count > 0) {
+                    ret = ff_h264_execute_decode_slices(h, context_count);
                    if (ret < 0 && (h->avctx->err_recognition & AV_EF_EXPLODE))
                        goto end;
                    context_count = 0;
@@ -3149,6 +3149,8 @@ static av_cold int hevc_init_context(AVCodecContext *avctx)
    s->context_initialized = 1;
    s->eos = 0;

+    ff_hevc_reset_sei(s);
+
    return 0;

 fail:
@@ -1092,6 +1092,15 @@ int ff_hevc_split_packet(HEVCContext *s, HEVCPacket *pkt, const uint8_t *buf, in
 int ff_hevc_encode_nal_vps(HEVCVPS *vps, unsigned int id,
                           uint8_t *buf, int buf_size);

+/**
+ * Reset SEI values that are stored on the Context.
+ * e.g. Caption data that was extracted during NAL
+ * parsing.
+ *
+ * @param s HEVCContext.
+ */
+void ff_hevc_reset_sei(HEVCContext *s);
+
 extern const uint8_t ff_hevc_qpel_extra_before[4];
 extern const uint8_t ff_hevc_qpel_extra_after[4];
 extern const uint8_t ff_hevc_qpel_extra[4];
@@ -209,6 +209,8 @@ static inline int parse_nal_units(AVCodecParserContext *s, const uint8_t *buf,

    h->avctx = avctx;

+    ff_hevc_reset_sei(h);
+
    if (!buf_size)
        return 0;

@@ -373,3 +373,9 @@ int ff_hevc_decode_nal_sei(HEVCContext *s)
    } while (more_rbsp_data(&s->HEVClc->gb));
    return 1;
 }
+
+void ff_hevc_reset_sei(HEVCContext *s)
+{
+    s->a53_caption_size = 0;
+    av_freep(&s->a53_caption);
+}
@@ -171,6 +171,12 @@ static int ir2_decode_frame(AVCodecContext *avctx,

    ltab = buf[0x22] & 3;
    ctab = buf[0x22] >> 2;
+
+    if (ctab > 3) {
+        av_log(avctx, AV_LOG_ERROR, "ctab %d is invalid\n", ctab);
+        return AVERROR_INVALIDDATA;
+    }
+
    if (s->decode_delta) { /* intraframe */
        if ((ret = ir2_decode_plane(s, avctx->width, avctx->height,
                                    p->data[0], p->linesize[0],
@@ -293,6 +293,8 @@ const uint8_t *avpriv_find_start_code(const uint8_t *p,
                                      const uint8_t *end,
                                      uint32_t *state);

+int avpriv_codec_get_cap_skip_frame_fill_param(const AVCodec *codec);
+
 /**
 * Check that the provided frame dimensions are valid and set them on the codec
 * context.
@@ -352,6 +352,12 @@ static av_cold int libopenjpeg_encode_init(AVCodecContext *avctx)
    ctx->enc_params.cp_cinema = ctx->cinema_mode;
 #endif

+    if (!ctx->numresolution) {
+        ctx->numresolution = 6;
+        while (FFMIN(avctx->width, avctx->height) >> ctx->numresolution < 1)
+            ctx->numresolution --;
+    }
+
    ctx->enc_params.mode = !!avctx->global_quality;
    ctx->enc_params.prog_order = ctx->prog_order;
    ctx->enc_params.numresolution = ctx->numresolution;
@@ -814,7 +820,7 @@ static const AVOption options[] = {
    { "rpcl",          NULL,                0,                     AV_OPT_TYPE_CONST, { .i64 = OPJ(RPCL)    }, 0,         0,           VE, "prog_order"  },
    { "pcrl",          NULL,                0,                     AV_OPT_TYPE_CONST, { .i64 = OPJ(PCRL)    }, 0,         0,           VE, "prog_order"  },
    { "cprl",          NULL,                0,                     AV_OPT_TYPE_CONST, { .i64 = OPJ(CPRL)    }, 0,         0,           VE, "prog_order"  },
-    { "numresolution", NULL,                OFFSET(numresolution), AV_OPT_TYPE_INT,   { .i64 = 6           }, 1,         INT_MAX,     VE                },
+    { "numresolution", NULL,                OFFSET(numresolution), AV_OPT_TYPE_INT,   { .i64 = 0           }, 0,         INT_MAX,     VE                },
    { "numlayers",     NULL,                OFFSET(numlayers),     AV_OPT_TYPE_INT,   { .i64 = 1           }, 1,         10,          VE                },
    { "disto_alloc",   NULL,                OFFSET(disto_alloc),   AV_OPT_TYPE_INT,   { .i64 = 1           }, 0,         1,           VE                },
    { "fixed_alloc",   NULL,                OFFSET(fixed_alloc),   AV_OPT_TYPE_INT,   { .i64 = 0           }, 0,         1,           VE                },
@@ -783,8 +783,8 @@ FF_ENABLE_DEPRECATION_WARNINGS
    if(x4->x264opts){
        const char *p= x4->x264opts;
        while(p){
-            char param[256]={0}, val[256]={0};
-            if(sscanf(p, "%255[^:=]=%255[^:]", param, val) == 1){
+            char param[4096]={0}, val[4096]={0};
+            if(sscanf(p, "%4095[^:=]=%4095[^:]", param, val) == 1){
                OPT_STR(param, "1");
            }else
                OPT_STR(param, val);
@@ -1369,11 +1369,7 @@ static int mjpeg_decode_scan_progressive_ac(MJpegDecodeContext *s, int ss,
    int mb_x, mb_y;
    int EOBRUN = 0;
    int c = s->comp_index[0];
-    uint8_t *data = s->picture_ptr->data[c];
-    int linesize  = s->linesize[c];
-    int last_scan = 0;
    int16_t *quant_matrix = s->quant_matrixes[s->quant_sindex[0]];
-    int bytes_per_pixel = 1 + (s->bits > 8);

    av_assert0(ss>=0 && Ah>=0 && Al>=0);
    if (se < ss || se > 63) {
@@ -1384,15 +1380,10 @@ static int mjpeg_decode_scan_progressive_ac(MJpegDecodeContext *s, int ss,
    // s->coefs_finished is a bitmask for coefficients coded
    // ss and se are parameters telling start and end coefficients
    s->coefs_finished[c] |= (2ULL << se) - (1ULL << ss);
-    last_scan = !Al && !~s->coefs_finished[c];
-
-    if (s->interlaced && s->bottom_field)
-        data += linesize >> 1;

    s->restart_count = 0;

    for (mb_y = 0; mb_y < s->mb_height; mb_y++) {
-        uint8_t *ptr     = data + (mb_y * linesize * 8 >> s->avctx->lowres);
        int block_idx    = mb_y * s->block_stride[c];
        int16_t (*block)[64] = &s->blocks[c][block_idx];
        uint8_t *last_nnz    = &s->last_nnz[c][block_idx];
@@ -1413,12 +1404,6 @@ static int mjpeg_decode_scan_progressive_ac(MJpegDecodeContext *s, int ss,
                    return AVERROR_INVALIDDATA;
                }

-            if (last_scan) {
-                    s->idsp.idct_put(ptr, linesize, *block);
-                    if (s->bits & 7)
-                        shift_output(s, ptr, linesize);
-                    ptr += bytes_per_pixel*8 >> s->avctx->lowres;
-            }
            if (handle_rstn(s, 0))
                EOBRUN = 0;
        }
@@ -1426,6 +1411,41 @@ static int mjpeg_decode_scan_progressive_ac(MJpegDecodeContext *s, int ss,
    return 0;
 }

+static void mjpeg_idct_scan_progressive_ac(MJpegDecodeContext *s)
+{
+    int mb_x, mb_y;
+    int c;
+    const int bytes_per_pixel = 1 + (s->bits > 8);
+    const int block_size = s->lossless ? 1 : 8;
+
+    for (c = 0; c < s->nb_components; c++) {
+        uint8_t *data = s->picture_ptr->data[c];
+        int linesize  = s->linesize[c];
+        int h = s->h_max / s->h_count[c];
+        int v = s->v_max / s->v_count[c];
+        int mb_width     = (s->width  + h * block_size - 1) / (h * block_size);
+        int mb_height    = (s->height + v * block_size - 1) / (v * block_size);
+
+        if (~s->coefs_finished[c])
+            av_log(s->avctx, AV_LOG_WARNING, "component %d is incomplete\n", c);
+
+        if (s->interlaced && s->bottom_field)
+            data += linesize >> 1;
+
+        for (mb_y = 0; mb_y < mb_height; mb_y++) {
+            uint8_t *ptr     = data + (mb_y * linesize * 8 >> s->avctx->lowres);
+            int block_idx    = mb_y * s->block_stride[c];
+            int16_t (*block)[64] = &s->blocks[c][block_idx];
+            for (mb_x = 0; mb_x < mb_width; mb_x++, block++) {
+                s->idsp.idct_put(ptr, linesize, *block);
+                if (s->bits & 7)
+                    shift_output(s, ptr, linesize);
+                ptr += bytes_per_pixel*8 >> s->avctx->lowres;
+            }
+        }
+    }
+}
+
 int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
                        int mb_bitmask_size, const AVFrame *reference)
 {
@@ -2084,6 +2104,9 @@ int ff_mjpeg_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
            /* Comment */
        else if (start_code == COM)
            mjpeg_decode_com(s);
+        else if (start_code == DQT) {
+            ff_mjpeg_decode_dqt(s);
+        }

        ret = -1;

@@ -2115,9 +2138,6 @@ int ff_mjpeg_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
            s->restart_count    = 0;
            /* nothing to do on SOI */
            break;
-        case DQT:
-            ff_mjpeg_decode_dqt(s);
-            break;
        case DHT:
            if ((ret = ff_mjpeg_decode_dht(s)) < 0) {
                av_log(avctx, AV_LOG_ERROR, "huffman table decode error\n");
@@ -2162,6 +2182,8 @@ int ff_mjpeg_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
            break;
        case EOI:
 eoi_parser:
+            if (avctx->skip_frame != AVDISCARD_ALL && s->progressive && s->cur_scan && s->got_picture)
+                mjpeg_idct_scan_progressive_ac(s);
            s->cur_scan = 0;
            if (!s->got_picture) {
                av_log(avctx, AV_LOG_WARNING,
@@ -415,10 +415,14 @@ static int mpc8_decode_frame(AVCodecContext * avctx, void *data,
    c->cur_frame++;

    c->last_bits_used = get_bits_count(gb);
-    if(get_bits_left(gb) < 8) // we have only padding left
-        c->last_bits_used = buf_size << 3;
    if(c->cur_frame >= c->frames)
        c->cur_frame = 0;
+    if(c->cur_frame == 0 && get_bits_left(gb) < 8) {// we have only padding left
+        c->last_bits_used = buf_size << 3;
+    } else if (get_bits_left(gb) < 0) {
+        av_log(avctx, AV_LOG_ERROR, "Overread %d\n", -get_bits_left(gb));
+        c->last_bits_used = buf_size << 3;
+    }

    *got_frame_ptr = 1;

@@ -822,9 +822,7 @@ static void clear_context(MpegEncContext *s)
    s->sc.b_scratchpad =
    s->sc.obmc_scratchpad = NULL;

-    s->parse_context.buffer = NULL;
-    s->parse_context.buffer_size = 0;
-    s->parse_context.overread = 0;
+
    s->bitstream_buffer = NULL;
    s->allocated_bitstream_buffer_size = 0;
    s->picture          = NULL;
@@ -1216,6 +1214,8 @@ int ff_mpv_frame_start(MpegEncContext *s, AVCodecContext *avctx)
    }

    ff_mpeg_unref_picture(s->avctx, &s->current_picture);
+    ff_mpeg_unref_picture(s->avctx, &s->last_picture);
+    ff_mpeg_unref_picture(s->avctx, &s->next_picture);

    /* release non reference frames */
    for (i = 0; i < MAX_PICTURE_COUNT; i++) {
@@ -1367,14 +1367,12 @@ int ff_mpv_frame_start(MpegEncContext *s, AVCodecContext *avctx)
    memset(s->next_picture.f->data, 0, sizeof(s->next_picture.f->data));
 #endif
    if (s->last_picture_ptr) {
-        ff_mpeg_unref_picture(s->avctx, &s->last_picture);
        if (s->last_picture_ptr->f->buf[0] &&
            (ret = ff_mpeg_ref_picture(s->avctx, &s->last_picture,
                                       s->last_picture_ptr)) < 0)
            return ret;
    }
    if (s->next_picture_ptr) {
-        ff_mpeg_unref_picture(s->avctx, &s->next_picture);
        if (s->next_picture_ptr->f->buf[0] &&
            (ret = ff_mpeg_ref_picture(s->avctx, &s->next_picture,
                                       s->next_picture_ptr)) < 0)
@@ -31,6 +31,7 @@
 const PixelFormatTag ff_raw_pix_fmt_tags[] = {
    { AV_PIX_FMT_YUV420P, MKTAG('I', '4', '2', '0') }, /* Planar formats */
    { AV_PIX_FMT_YUV420P, MKTAG('I', 'Y', 'U', 'V') },
+    { AV_PIX_FMT_YUV420P, MKTAG('y', 'v', '1', '2') },
    { AV_PIX_FMT_YUV420P, MKTAG('Y', 'V', '1', '2') },
    { AV_PIX_FMT_YUV410P, MKTAG('Y', 'U', 'V', '9') },
    { AV_PIX_FMT_YUV410P, MKTAG('Y', 'V', 'U', '9') },
@@ -223,8 +223,9 @@ static int raw_decode(AVCodecContext *avctx, void *data, int *got_frame,
    }
    desc = av_pix_fmt_desc_get(avctx->pix_fmt);

-    if ((avctx->bits_per_coded_sample == 8 || avctx->bits_per_coded_sample == 4
-            || avctx->bits_per_coded_sample <= 2) &&
+    if ((avctx->bits_per_coded_sample == 8 || avctx->bits_per_coded_sample == 4 ||
+         avctx->bits_per_coded_sample == 2 || avctx->bits_per_coded_sample == 1 ||
+         (avctx->bits_per_coded_sample == 0 && (context->is_nut_pal8 || context->is_mono)) ) &&
        (context->is_mono || context->is_pal8) &&
        (!avctx->codec_tag || avctx->codec_tag == MKTAG('r','a','w',' ') ||
                context->is_nut_mono || context->is_nut_pal8)) {
@@ -223,6 +223,12 @@ static int rscc_decode_frame(AVCodecContext *avctx, void *data,

    ff_dlog(avctx, "pixel_size %d packed_size %d.\n", pixel_size, packed_size);

+    if (packed_size < 0) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid tile size %d\n", packed_size);
+        ret = AVERROR_INVALIDDATA;
+        goto end;
+    }
+
    /* Get pixels buffer, it may be deflated or just raw */
    if (pixel_size == packed_size) {
        if (bytestream2_get_bytes_left(gbc) < pixel_size) {
@@ -233,6 +239,11 @@ static int rscc_decode_frame(AVCodecContext *avctx, void *data,
        pixels = gbc->buffer;
    } else {
        uLongf len = ctx->inflated_size;
+        if (bytestream2_get_bytes_left(gbc) < packed_size) {
+            av_log(avctx, AV_LOG_ERROR, "Insufficient input for %d\n", packed_size);
+            ret = AVERROR_INVALIDDATA;
+            goto end;
+        }
        ret = uncompress(ctx->inflated_buf, &len, gbc->buffer, packed_size);
        if (ret) {
            av_log(avctx, AV_LOG_ERROR, "Pixel deflate error %d.\n", ret);
@@ -1126,6 +1126,10 @@ int av_codec_get_max_lowres(const AVCodec *codec)
    return codec->max_lowres;
 }

+int avpriv_codec_get_cap_skip_frame_fill_param(const AVCodec *codec){
+    return !!(codec->caps_internal & FF_CODEC_CAP_SKIP_FRAME_FILL_PARAM);
+}
+
 static void get_subtitle_defaults(AVSubtitle *sub)
 {
    memset(sub, 0, sizeof(*sub));
@@ -2254,7 +2258,7 @@ int attribute_align_arg avcodec_decode_audio4(AVCodecContext *avctx,
            skip_reason = AV_RL8(side + 8);
            discard_reason = AV_RL8(side + 9);
        }
-        if (avctx->internal->skip_samples && *got_frame_ptr &&
+        if (avctx->internal->skip_samples > 0 && *got_frame_ptr &&
            !(avctx->flags2 & AV_CODEC_FLAG2_SKIP_MANUAL)) {
            if(frame->nb_samples <= avctx->internal->skip_samples){
                *got_frame_ptr = 0;
@@ -28,6 +28,7 @@
 typedef struct VP9ParseContext {
    int n_frames; // 1-8
    int size[8];
+    int marker_size;
    int64_t pts;
 } VP9ParseContext;

@@ -88,6 +89,21 @@ static int parse(AVCodecParserContext *ctx,
        return 0;
    }

+    if (s->n_frames > 0) {
+        int i;
+        int size_sum = 0;
+
+        for (i = 0; i < s->n_frames ;i++)
+            size_sum += s->size[i];
+        size_sum += s->marker_size;
+
+        if (size_sum != size) {
+            av_log(avctx, AV_LOG_ERROR, "Inconsistent input frame sizes %d %d\n",
+                   size_sum, size);
+            s->n_frames = 0;
+        }
+    }
+
    if (s->n_frames > 0) {
        *out_data = data;
        *out_size = s->size[--s->n_frames];
@@ -131,6 +147,7 @@ static int parse(AVCodecParserContext *ctx,
                    data += sz; \
                    size -= sz; \
                } \
+                s->marker_size = size; \
                parse_frame(ctx, *out_data, *out_size); \
                return s->n_frames > 0 ? *out_size : full_size

@@ -1252,6 +1252,11 @@ static int decode_packet(AVCodecContext *avctx, void *data, int *got_frame_ptr,
        }
    }

+    if (remaining_bits(s, gb) < 0) {
+        av_log(avctx, AV_LOG_ERROR, "Overread %d\n", -remaining_bits(s, gb));
+        s->packet_loss = 1;
+    }
+
    if (s->packet_done && !s->packet_loss &&
        remaining_bits(s, gb) > 0) {
        /* save the rest of the data so that it can be decoded
@@ -312,6 +312,9 @@ static int output_frame(AVFilterLink *outlink)

    calculate_scales(s, nb_samples);

+    if (nb_samples == 0)
+        return 0;
+
    out_buf = ff_get_audio_buffer(outlink, nb_samples);
    if (!out_buf)
        return AVERROR(ENOMEM);
@@ -190,6 +190,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *inpicref)
    }

    if (s->occupied) {
+        av_frame_make_writable(s->frame[nout]);
        for (i = 0; i < s->nb_planes; i++) {
            // fill in the EARLIER field from the buffered pic
            av_image_copy_plane(s->frame[nout]->data[i] + s->frame[nout]->linesize[i] * s->first_field,
@@ -213,6 +214,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *inpicref)

    while (len >= 2) {
        // output THIS image as-is
+        av_frame_make_writable(s->frame[nout]);
        for (i = 0; i < s->nb_planes; i++)
            av_image_copy_plane(s->frame[nout]->data[i], s->frame[nout]->linesize[i],
                                inpicref->data[i], inpicref->linesize[i],
@@ -54,7 +54,6 @@ void av_register_all(void)

    if (initialized)
        return;
-    initialized = 1;

    avcodec_register_all();

@@ -418,4 +417,6 @@ void av_register_all(void)
    REGISTER_PROTOCOL(LIBRTMPTE,        librtmpte);
    REGISTER_PROTOCOL(LIBSSH,           libssh);
    REGISTER_PROTOCOL(LIBSMBCLIENT,     libsmbclient);
+
+    initialized = 1;
 }
@@ -344,14 +344,14 @@ static void avi_metadata_creation_time(AVDictionary **metadata, char *date)

 static void avi_read_nikon(AVFormatContext *s, uint64_t end)
 {
-    while (avio_tell(s->pb) < end) {
+    while (avio_tell(s->pb) < end && !avio_feof(s->pb)) {
        uint32_t tag  = avio_rl32(s->pb);
        uint32_t size = avio_rl32(s->pb);
        switch (tag) {
        case MKTAG('n', 'c', 't', 'g'):  /* Nikon Tags */
        {
            uint64_t tag_end = avio_tell(s->pb) + size;
-            while (avio_tell(s->pb) < tag_end) {
+            while (avio_tell(s->pb) < tag_end && !avio_feof(s->pb)) {
                uint16_t tag     = avio_rl16(s->pb);
                uint16_t size    = avio_rl16(s->pb);
                const char *name = NULL;
@@ -1695,6 +1695,8 @@ static int guess_ni_flag(AVFormatContext *s)
            size = avio_rl32(s->pb);
            if (get_stream_idx(tag) == i && pos + size > st->index_entries[1].pos)
                last_start = INT64_MAX;
+            if (get_stream_idx(tag) == i && size == st->index_entries[0].size + 8)
+                last_start = INT64_MAX;
        }

        if (st->index_entries[0].pos > last_start)
@@ -27,6 +27,7 @@
 #include "libavutil/opt.h"
 #include "libavutil/avassert.h"
 #include "libavutil/avstring.h"
+#include "libavutil/pixdesc.h"
 #include "avformat.h"
 #include "internal.h"
 #include "ffm.h"
@@ -377,6 +378,11 @@ static int ffm2_read_header(AVFormatContext *s)
            codec->height = avio_rb16(pb);
            codec->gop_size = avio_rb16(pb);
            codec->pix_fmt = avio_rb32(pb);
+            if (!av_pix_fmt_desc_get(codec->pix_fmt)) {
+                av_log(s, AV_LOG_ERROR, "Invalid pix fmt id: %d\n", codec->pix_fmt);
+                codec->pix_fmt = AV_PIX_FMT_NONE;
+                goto fail;
+            }
            codec->qmin = avio_r8(pb);
            codec->qmax = avio_r8(pb);
            codec->max_qdiff = avio_r8(pb);
@@ -569,6 +575,11 @@ static int ffm_read_header(AVFormatContext *s)
            codec->height = avio_rb16(pb);
            codec->gop_size = avio_rb16(pb);
            codec->pix_fmt = avio_rb32(pb);
+            if (!av_pix_fmt_desc_get(codec->pix_fmt)) {
+                av_log(s, AV_LOG_ERROR, "Invalid pix fmt id: %d\n", codec->pix_fmt);
+                codec->pix_fmt = AV_PIX_FMT_NONE;
+                goto fail;
+            }
            codec->qmin = avio_r8(pb);
            codec->qmax = avio_r8(pb);
            codec->max_qdiff = avio_r8(pb);
@@ -259,8 +259,10 @@ static av_unused int64_t flac_read_timestamp(AVFormatContext *s, int stream_inde
        if (ret < 0){
            if (ret == AVERROR(EAGAIN))
                continue;
-            else
-                break;
+            else {
+                av_packet_unref(&pkt);
+                av_assert1(!pkt.size);
+            }
        }
        av_init_packet(&out_pkt);
        av_parser_parse2(parser, st->codec,
@@ -277,7 +279,8 @@ static av_unused int64_t flac_read_timestamp(AVFormatContext *s, int stream_inde
                pts = parser->pts;
                break;
            }
-        }
+        } else if (ret < 0)
+            break;
    }
    av_parser_close(parser);
    return pts;
@@ -1144,7 +1144,7 @@ retry_duration:

 leave:
    last = avio_rb32(s->pb);
-    if (last != orig_size + 11 &&
+    if (last != orig_size + 11 && last != orig_size + 10 &&
        (last != orig_size || !last) && last != flv->sum_flv_tag_size &&
        !flv->broken_sizes) {
        av_log(s, AV_LOG_ERROR, "Packet mismatch %d %d\n", last, orig_size + 11);
@@ -62,20 +62,24 @@ void av_register_input_format(AVInputFormat *format)
 {
    AVInputFormat **p = last_iformat;

-    format->next = NULL;
-    while(*p || avpriv_atomic_ptr_cas((void * volatile *)p, NULL, format))
+    // Note, format could be added after the first 2 checks but that implies that *p is no longer NULL
+    while(p != &format->next && !format->next && avpriv_atomic_ptr_cas((void * volatile *)p, NULL, format))
        p = &(*p)->next;
-    last_iformat = &format->next;
+
+    if (!format->next)
+        last_iformat = &format->next;
 }

 void av_register_output_format(AVOutputFormat *format)
 {
    AVOutputFormat **p = last_oformat;

-    format->next = NULL;
-    while(*p || avpriv_atomic_ptr_cas((void * volatile *)p, NULL, format))
+    // Note, format could be added after the first 2 checks but that implies that *p is no longer NULL
+    while(p != &format->next && !format->next && avpriv_atomic_ptr_cas((void * volatile *)p, NULL, format))
        p = &(*p)->next;
-    last_oformat = &format->next;
+
+    if (!format->next)
+        last_oformat = &format->next;
 }

 int av_match_ext(const char *filename, const char *extensions)
@@ -193,6 +193,8 @@ static int rtmp_open(URLContext *s, const char *uri, int flags)

            if (sep)
                p = sep + 1;
+            else
+                break;
        }
    }
    if (ctx->playpath) {
@@ -2750,7 +2750,12 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
                sample_size = sc->stsz_sample_size > 0 ? sc->stsz_sample_size : sc->sample_sizes[current_sample];
                if (sc->pseudo_stream_id == -1 ||
                   sc->stsc_data[stsc_index].id - 1 == sc->pseudo_stream_id) {
-                    AVIndexEntry *e = &st->index_entries[st->nb_index_entries++];
+                    AVIndexEntry *e;
+                    if (sample_size > 0x3FFFFFFF) {
+                        av_log(mov->fc, AV_LOG_ERROR, "Sample size %u is too large\n", sample_size);
+                        return;
+                    }
+                    e = &st->index_entries[st->nb_index_entries++];
                    e->pos = current_offset;
                    e->timestamp = current_dts;
                    e->size = sample_size;
@@ -2875,6 +2880,10 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
                    av_log(mov->fc, AV_LOG_ERROR, "wrong chunk count %d\n", total);
                    return;
                }
+                if (size > 0x3FFFFFFF) {
+                    av_log(mov->fc, AV_LOG_ERROR, "Sample size %u is too large\n", size);
+                    return;
+                }
                e = &st->index_entries[st->nb_index_entries++];
                e->pos = current_offset;
                e->timestamp = current_dts;
@@ -64,6 +64,7 @@ static int check(AVIOContext *pb, int64_t pos, uint32_t *header);
 static int mp3_read_probe(AVProbeData *p)
 {
    int max_frames, first_frames = 0;
+    int whole_used = 0;
    int frames, ret;
    uint32_t header;
    const uint8_t *buf, *buf0, *buf2, *end;
@@ -88,8 +89,11 @@ static int mp3_read_probe(AVProbeData *p)
            buf2 += h.frame_size;
        }
        max_frames = FFMAX(max_frames, frames);
-        if(buf == buf0)
+        if(buf == buf0) {
            first_frames= frames;
+            if (buf2 == end + sizeof(uint32_t))
+                whole_used = 1;
+        }
    }
    // keep this in sync with ac3 probe, both need to avoid
    // issues with MPEG-files!
@@ -98,6 +102,7 @@ static int mp3_read_probe(AVProbeData *p)
    else if(max_frames>=4 && max_frames >= p->buf_size/10000) return AVPROBE_SCORE_EXTENSION / 2;
    else if(ff_id3v2_match(buf0, ID3v2_DEFAULT_MAGIC) && 2*ff_id3v2_tag_len(buf0) >= p->buf_size)
                           return p->buf_size < PROBE_BUF_MAX ? AVPROBE_SCORE_EXTENSION / 4 : AVPROBE_SCORE_EXTENSION - 2;
+    else if(first_frames > 1 && whole_used) return 5;
    else if(max_frames>=1 && max_frames >= p->buf_size/10000) return 1;
    else                   return 0;
 //mpegps_mp3_unrecognized_format.mpg has max_frames=3
@@ -1769,8 +1769,11 @@ int ff_parse_mpeg2_descriptor(AVFormatContext *fc, AVStream *st, int stream_type
    case 0x05: /* registration descriptor */
        st->codec->codec_tag = bytestream_get_le32(pp);
        av_log(fc, AV_LOG_TRACE, "reg_desc=%.4s\n", (char *)&st->codec->codec_tag);
-        if (st->codec->codec_id == AV_CODEC_ID_NONE || st->request_probe > 0)
+        if (st->codec->codec_id == AV_CODEC_ID_NONE || st->request_probe > 0) {
            mpegts_find_stream_type(st, st->codec->codec_tag, REGD_types);
+            if (st->codec->codec_tag == MKTAG('B', 'S', 'S', 'D'))
+                st->request_probe = 50;
+        }
        break;
    case 0x52: /* stream identifier descriptor */
        st->stream_identifier = 1 + get8(pp, desc_end);
@@ -2441,7 +2444,7 @@ static int mpegts_probe(AVProbeData *p)
 #define CHECK_COUNT 10
 #define CHECK_BLOCK 100

-    if (check_count < CHECK_COUNT)
+    if (!check_count)
        return 0;

    for (i = 0; i<check_count; i+=CHECK_BLOCK) {
@@ -2459,10 +2462,17 @@ static int mpegts_probe(AVProbeData *p)

    ff_dlog(0, "TS score: %d %d\n", sumscore, maxscore);

-    if      (sumscore > 6) return AVPROBE_SCORE_MAX   + sumscore - CHECK_COUNT;
-    else if (maxscore > 6) return AVPROBE_SCORE_MAX/2 + sumscore - CHECK_COUNT;
-    else
+    if        (check_count > CHECK_COUNT && sumscore > 6) {
+        return AVPROBE_SCORE_MAX   + sumscore - CHECK_COUNT;
+    } else if (check_count >= CHECK_COUNT && sumscore > 6) {
+        return AVPROBE_SCORE_MAX/2 + sumscore - CHECK_COUNT;
+    } else if (check_count >= CHECK_COUNT && maxscore > 6) {
+        return AVPROBE_SCORE_MAX/2 + sumscore - CHECK_COUNT;
+    } else if (sumscore > 6) {
+        return 2;
+    } else {
        return 0;
+    }
 }

 /* return the 90kHz PCR and the extension for the 27MHz PCR. return
@@ -701,6 +701,7 @@ static int ogg_read_header(AVFormatContext *s)
        if (ogg->streams[i].header < 0) {
            av_log(s, AV_LOG_ERROR, "Header parsing failed for stream %d\n", i);
            ogg->streams[i].codec = NULL;
+            av_freep(&ogg->streams[i].private);
        } else if (os->codec && os->nb_header < os->codec->nb_header) {
            av_log(s, AV_LOG_WARNING,
                   "Headers mismatch for stream %d: "
@@ -162,6 +162,11 @@ ogg_gptopts (AVFormatContext * s, int i, uint64_t gp, int64_t *dts)
        if (dts)
            *dts = pts;
    }
+    if (pts > INT64_MAX && pts != AV_NOPTS_VALUE) {
+        // The return type is unsigned, we thus cannot return negative pts
+        av_log(s, AV_LOG_ERROR, "invalid pts %"PRId64"\n", pts);
+        pts = AV_NOPTS_VALUE;
+    }

    return pts;
 }
@@ -117,6 +117,10 @@ static int opus_packet(AVFormatContext *avf, int idx)

    if (!os->psize)
        return AVERROR_INVALIDDATA;
+    if (os->granule > (1LL << 62)) {
+        av_log(avf, AV_LOG_ERROR, "Unsupported huge granule pos %"PRId64 "\n", os->granule);
+        return AVERROR_INVALIDDATA;
+    }

    if ((!os->lastpts || os->lastpts == AV_NOPTS_VALUE) && !(os->flags & OGG_FLAG_EOS)) {
        int seg, d;
@@ -82,7 +82,11 @@ static uint64_t vp8_gptopts(AVFormatContext *s, int idx,
    struct ogg *ogg = s->priv_data;
    struct ogg_stream *os = ogg->streams + idx;

-    uint64_t pts  = (granule >> 32);
+    int invcnt    = !((granule >> 30) & 3);
+    // If page granule is that of an invisible vp8 frame, its pts will be
+    // that of the end of the next visible frame. We substract 1 for those
+    // to prevent messing up pts calculations.
+    uint64_t pts  = (granule >> 32) - invcnt;
    uint32_t dist = (granule >>  3) & 0x07ffffff;

    if (!dist)
@@ -87,6 +87,7 @@ static const AVOption avformat_options[] = {
 {"max_interleave_delta", "maximum buffering duration for interleaving", OFFSET(max_interleave_delta), AV_OPT_TYPE_INT64, { .i64 = 10000000 }, 0, INT64_MAX, E },
 {"f_strict", "how strictly to follow the standards (deprecated; use strict, save via avconv)", OFFSET(strict_std_compliance), AV_OPT_TYPE_INT, {.i64 = DEFAULT }, INT_MIN, INT_MAX, D|E, "strict"},
 {"strict", "how strictly to follow the standards", OFFSET(strict_std_compliance), AV_OPT_TYPE_INT, {.i64 = DEFAULT }, INT_MIN, INT_MAX, D|E, "strict"},
+{"very", "strictly conform to a older more strict version of the spec or reference software", 0, AV_OPT_TYPE_CONST, {.i64 = FF_COMPLIANCE_VERY_STRICT }, INT_MIN, INT_MAX, D|E, "strict"},
 {"strict", "strictly conform to all the things in the spec no matter what the consequences", 0, AV_OPT_TYPE_CONST, {.i64 = FF_COMPLIANCE_STRICT }, INT_MIN, INT_MAX, D|E, "strict"},
 {"normal", NULL, 0, AV_OPT_TYPE_CONST, {.i64 = FF_COMPLIANCE_NORMAL }, INT_MIN, INT_MAX, D|E, "strict"},
 {"unofficial", "allow unofficial extensions", 0, AV_OPT_TYPE_CONST, {.i64 = FF_COMPLIANCE_UNOFFICIAL }, INT_MIN, INT_MAX, D|E, "strict"},
@@ -101,7 +101,7 @@ int ff_wms_parse_sdp_a_line(AVFormatContext *s, const char *p)
 {
    int ret = 0;
    if (av_strstart(p, "pgmpu:data:application/vnd.ms.wms-hdr.asfv1;base64,", &p)) {
-        AVIOContext pb;
+        AVIOContext pb = { 0 };
        RTSPState *rt = s->priv_data;
        AVDictionary *opts = NULL;
        int len = strlen(p) * 6 / 8;
@@ -119,10 +119,10 @@ retry:
    z->avail_out = buf_size;

    ret = inflate(z, Z_NO_FLUSH);
-    if (ret < 0)
-        return AVERROR(EINVAL);
    if (ret == Z_STREAM_END)
        return AVERROR_EOF;
+    if (ret != Z_OK)
+        return AVERROR(EINVAL);

    if (buf_size - z->avail_out == 0)
        goto retry;
@@ -297,7 +297,7 @@ static int set_codec_from_probe_data(AVFormatContext *s, AVStream *st,
    int score;
    AVInputFormat *fmt = av_probe_input_format3(pd, 1, &score);

-    if (fmt && st->request_probe <= score) {
+    if (fmt) {
        int i;
        av_log(s, AV_LOG_DEBUG,
               "Probe with size=%d, packets=%d detected %s with score=%d\n",
@@ -305,6 +305,9 @@ static int set_codec_from_probe_data(AVFormatContext *s, AVStream *st,
               fmt->name, score);
        for (i = 0; fmt_id_type[i].name; i++) {
            if (!strcmp(fmt->name, fmt_id_type[i].name)) {
+                if (st->request_probe > score &&
+                    st->codec->codec_id != fmt_id_type[i].id)
+                    continue;
                st->codec->codec_id   = fmt_id_type[i].id;
                st->codec->codec_type = fmt_id_type[i].type;
                return score;
@@ -2370,7 +2373,7 @@ static void update_stream_timings(AVFormatContext *ic)
            end_time1 = av_rescale_q_rnd(st->duration, st->time_base,
                                         AV_TIME_BASE_Q,
                                         AV_ROUND_NEAR_INF|AV_ROUND_PASS_MINMAX);
-            if (end_time1 != AV_NOPTS_VALUE) {
+            if (end_time1 != AV_NOPTS_VALUE && start_time1 <= INT64_MAX - end_time1) {
                end_time1 += start_time1;
                end_time = FFMAX(end_time, end_time1);
            }
@@ -2408,7 +2411,7 @@ static void update_stream_timings(AVFormatContext *ic)
    if (duration != INT64_MIN && duration > 0 && ic->duration == AV_NOPTS_VALUE) {
        ic->duration = duration;
    }
-    if (ic->pb && (filesize = avio_size(ic->pb)) > 0 && ic->duration != AV_NOPTS_VALUE) {
+    if (ic->pb && (filesize = avio_size(ic->pb)) > 0 && ic->duration > 0) {
        /* compute the bitrate */
        double bitrate = (double) filesize * 8.0 * AV_TIME_BASE /
                         (double) ic->duration;
@@ -2833,6 +2836,9 @@ enum AVCodecID ff_codec_get_id(const AVCodecTag *tags, unsigned int tag)

 enum AVCodecID ff_get_pcm_codec_id(int bps, int flt, int be, int sflags)
 {
+    if (bps <= 0 || bps > 64)
+        return AV_CODEC_ID_NONE;
+
    if (flt) {
        switch (bps) {
        case 32:
@@ -2916,7 +2922,7 @@ static void compute_chapters_end(AVFormatContext *s)
    unsigned int i, j;
    int64_t max_time = 0;

-    if (s->duration > 0)
+    if (s->duration > 0 && s->start_time < INT64_MAX - s->duration)
        max_time = s->duration +
                       ((s->start_time == AV_NOPTS_VALUE) ? 0 : s->start_time);

@@ -1033,7 +1033,7 @@ static int read_header(AVFormatContext *s)
                    while (1) {
                        uint64_t frame_nb = avio_rl64(pb);
                        uint64_t position = avio_rl64(pb);
-                        while (frame_nb > e->size && e <= e_end) {
+                        while (e <= e_end && frame_nb > e->size) {
                            e->pos = last_position;
                            e++;
                        }
@@ -58,7 +58,7 @@
 * The following example illustrates an AVOptions-enabled struct:
 * @code
 * typedef struct test_struct {
- *     AVClass *class;
+ *     const AVClass *class;
 *     int      int_opt;
 *     char    *str_opt;
 *     uint8_t *bin_opt;
@@ -96,7 +96,7 @@
 * @code
 * test_struct *alloc_test_struct(void)
 * {
- *     test_struct *ret = av_malloc(sizeof(*ret));
+ *     test_struct *ret = av_mallocz(sizeof(*ret));
 *     ret->class = &test_class;
 *     av_opt_set_defaults(ret);
 *     return ret;
@@ -32,6 +32,9 @@

 #define TEMPLATE_REMATRIX_S16
 #include "rematrix_template.c"
+#define TEMPLATE_CLIP
+#include "rematrix_template.c"
+#undef TEMPLATE_CLIP
 #undef TEMPLATE_REMATRIX_S16

 #define TEMPLATE_REMATRIX_S32
@@ -367,17 +370,33 @@ av_cold int swri_rematrix_init(SwrContext *s){
            return r;
    }
    if (s->midbuf.fmt == AV_SAMPLE_FMT_S16P){
+        int maxsum = 0;
        s->native_matrix = av_calloc(nb_in * nb_out, sizeof(int));
        s->native_one    = av_mallocz(sizeof(int));
        if (!s->native_matrix || !s->native_one)
            return AVERROR(ENOMEM);
-        for (i = 0; i < nb_out; i++)
-            for (j = 0; j < nb_in; j++)
-                ((int*)s->native_matrix)[i * nb_in + j] = lrintf(s->matrix[i][j] * 32768);
+        for (i = 0; i < nb_out; i++) {
+            double rem = 0;
+            int sum = 0;
+
+            for (j = 0; j < nb_in; j++) {
+                double target = s->matrix[i][j] * 32768 + rem;
+                ((int*)s->native_matrix)[i * nb_in + j] = lrintf(target);
+                rem += target - ((int*)s->native_matrix)[i * nb_in + j];
+                sum += FFABS(((int*)s->native_matrix)[i * nb_in + j]);
+            }
+            maxsum = FFMAX(maxsum, sum);
+        }
        *((int*)s->native_one) = 32768;
-        s->mix_1_1_f = (mix_1_1_func_type*)copy_s16;
-        s->mix_2_1_f = (mix_2_1_func_type*)sum2_s16;
-        s->mix_any_f = (mix_any_func_type*)get_mix_any_func_s16(s);
+        if (maxsum <= 32768) {
+            s->mix_1_1_f = (mix_1_1_func_type*)copy_s16;
+            s->mix_2_1_f = (mix_2_1_func_type*)sum2_s16;
+            s->mix_any_f = (mix_any_func_type*)get_mix_any_func_s16(s);
+        } else {
+            s->mix_1_1_f = (mix_1_1_func_type*)copy_clip_s16;
+            s->mix_2_1_f = (mix_2_1_func_type*)sum2_clip_s16;
+            s->mix_any_f = (mix_any_func_type*)get_mix_any_func_clip_s16(s);
+        }
    }else if(s->midbuf.fmt == AV_SAMPLE_FMT_FLTP){
        s->native_matrix = av_calloc(nb_in * nb_out, sizeof(float));
        s->native_one    = av_mallocz(sizeof(float));
@@ -31,11 +31,16 @@
 #    define INTER double
 #    define RENAME(x) x ## _double
 #elif defined(TEMPLATE_REMATRIX_S16)
-#    define R(x) (((x) + 16384)>>15)
 #    define SAMPLE int16_t
 #    define COEFF int
 #    define INTER int
+#  ifdef TEMPLATE_CLIP
+#    define R(x) av_clip_int16(((x) + 16384)>>15)
+#    define RENAME(x) x ## _clip_s16
+#  else
+#    define R(x) (((x) + 16384)>>15)
 #    define RENAME(x) x ## _s16
+#  endif
 #elif defined(TEMPLATE_REMATRIX_S32)
 #    define R(x) (((x) + 16384)>>15)
 #    define SAMPLE int32_t
@@ -203,7 +203,7 @@ static int build_filter(ResampleContext *c, void *filter, double factor, int tap
        case AV_SAMPLE_FMT_S16P:
            for(i=0;i<tap_count;i++)
                ((int16_t*)filter)[ph * alloc + i] = av_clip_int16(lrintf(tab[i] * scale / norm));
-            if (tap_count % 2 == 0) {
+            if (tap_count % 2 == 0 || tap_count == 1) {
                for (i = 0; i < tap_count; i++)
                    ((int16_t*)filter)[(phase_count-ph) * alloc + tap_count-1-i] = ((int16_t*)filter)[ph * alloc + i];
            }
@@ -216,7 +216,7 @@ static int build_filter(ResampleContext *c, void *filter, double factor, int tap
        case AV_SAMPLE_FMT_S32P:
            for(i=0;i<tap_count;i++)
                ((int32_t*)filter)[ph * alloc + i] = av_clipl_int32(llrint(tab[i] * scale / norm));
-            if (tap_count % 2 == 0) {
+            if (tap_count % 2 == 0 || tap_count == 1) {
                for (i = 0; i < tap_count; i++)
                    ((int32_t*)filter)[(phase_count-ph) * alloc + tap_count-1-i] = ((int32_t*)filter)[ph * alloc + i];
            }
@@ -229,7 +229,7 @@ static int build_filter(ResampleContext *c, void *filter, double factor, int tap
        case AV_SAMPLE_FMT_FLTP:
            for(i=0;i<tap_count;i++)
                ((float*)filter)[ph * alloc + i] = tab[i] * scale / norm;
-            if (tap_count % 2 == 0) {
+            if (tap_count % 2 == 0 || tap_count == 1) {
                for (i = 0; i < tap_count; i++)
                    ((float*)filter)[(phase_count-ph) * alloc + tap_count-1-i] = ((float*)filter)[ph * alloc + i];
            }
@@ -241,7 +241,7 @@ static int build_filter(ResampleContext *c, void *filter, double factor, int tap
        case AV_SAMPLE_FMT_DBLP:
            for(i=0;i<tap_count;i++)
                ((double*)filter)[ph * alloc + i] = tab[i] * scale / norm;
-            if (tap_count % 2 == 0) {
+            if (tap_count % 2 == 0 || tap_count == 1) {
                for (i = 0; i < tap_count; i++)
                    ((double*)filter)[(phase_count-ph) * alloc + tap_count-1-i] = ((double*)filter)[ph * alloc + i];
            }
@@ -50,7 +50,7 @@ static int try_decode_video_frame(AVCodecContext *codec_ctx, AVPacket *pkt, int
        goto end;
    }

-    if (!decode && codec_ctx->codec->caps_internal & FF_CODEC_CAP_SKIP_FRAME_FILL_PARAM) {
+    if (!decode && avpriv_codec_get_cap_skip_frame_fill_param(codec_ctx->codec)) {
        codec_ctx->skip_frame = AVDISCARD_ALL;
    }

@@ -92,7 +92,7 @@ static const struct {
    #if CONFIG_JPEG2000_DECODER
        { "jpeg2000dsp", checkasm_check_jpeg2000dsp },
    #endif
-    #if CONFIG_PIXBLOCKDSP
+    #if CONFIG_PIXBLOCKDSP && !(ARCH_PPC64 && HAVE_BIGENDIAN)
        { "pixblockdsp", checkasm_check_pixblockdsp },
    #endif
    #if CONFIG_V210_ENCODER
@@ -1,5 +1,5 @@
 yuv410p             a6c9b4065e8253d8120772f69be0bf04
 yuv411p             b913e634ad37ce046240252bed8681fb
-yuv420p             d448d95326eadeeb12ea0cc348067958
+yuv420p             a9286560141eb14595e427dbe5829b00
 yuv422p             11ad22ce00c5e8a30d0472f29fb15434
 yuv444p             9350a3f23cd7d95ec441a49f63f55953
@@ -1 +1 @@
 .0.2
 .0.3