Changelog: update

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
avformat/utils: Check cur_dts in update_initial_timestamps() more
2018-04-13 23:11:26 +02:00 · 2018-04-13 23:10:00 +02:00 · 2018-04-13 23:09:12 +02:00 · 2018-04-13 23:00:30 +02:00 · 2018-04-13 22:59:22 +02:00 · 2018-04-13 01:54:06 +02:00
79 changed files with 761 additions and 374 deletions
@@ -1,6 +1,113 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.

+version 3.3.7:
+- avformat/utils: Check cur_dts in update_initial_timestamps() more
+- avcodec/utils: Enforce minimum width also for VP5/6
+- avcodec/truemotion2: Propagate out of bounds error from GET_TOK()
+- avformat/utils: Fix integer overflow in end time calculation in update_stream_timings()
+- avformat/utils: fix mixed declarations and code
+- avcodec/mjpegdec: Check input buffer size.
+- avcodec/h264_slice: Fix integer overflow with last_poc
+- avformat/mov: Fix extradata memleak
+- lavc/libopusdec: Allow avcodec_open2 to call .close
+- avcodec/movtextdec: Check style_start/end
+- avcodec/aacsbr_fixed: Fix integer overflow in sbr_hf_assemble()
+- libavcodec/rv34: error out earlier on missing references
+- swresample/swresample: Fix for seg fault in swr_convert_internal() -> sum2_float during dithering.
+- avcodec/aacdec_fixed: Fix integer overflow in apply_independent_coupling_fixed()
+- avcodec/cscd: Error out when LZ* decompression fails
+- avcodec/imgconvert: Fix loss mask bug in avcodec_find_best_pix_fmt_of_list()
+- avfilter/vf_signature: use av_strlcpy()
+- avcodec/utvideodec: Set pro flag based on fourcc
+- avcodec/wmalosslessdec: Fix null pointer dereference in decode_frame()
+- avcodec/tableprint_vlc: Fix build failure with --enable-hardcoded-tables
+- avformat/mov: Move +1 in check to avoid hypothetical overflow in add_ctts_entry()
+- avcodec/get_bits: Make sure the input bitstream with padding can be addressed
+- avformat/mov: Check STSC and remove invalid entries
+- avcodec/nuv: rtjpeg with dimensions less than 16 would result in no decoded pixels thus reject it
+- avcodec/nuv: Check for minimum input size for uncomprssed and rtjpeg
+- avcodec/wmalosslessdec: Reset num_saved_bits on error path
+- avformat/mov: Fix integer overflows related to sample_duration
+- avformat/oggparsedaala: Do not adjust AV_NOPTS_VALUE
+- avformat/oggparseogm: Check lb against psize
+- avformat/oggparseogm: Fix undefined shift in ogm_packet()
+- avformat/avidec: Fix integer overflow in cum_len check
+- avformat/oggparsetheora: Do not adjust AV_NOPTS_VALUE
+- avformat/utils: Fix integer overflow of fps_first/last_dts
+- avformat/oggdec: Fix metadata memleak on multiple headers
+- libavformat/oggparsevorbis: Fix memleak on multiple headers
+- avcodec/truemotion2rt: Check input buffer size
+- avcodec/g2meet: Check tile dimensions with av_image_check_size2()
+- avcodec/exr: fix invalid shift in unpack_14()
+- avcodec/bintext: sanity check dimensions
+- avcodec/utvideodec: Check subsample factors
+- avcodec/smc: Check input packet size
+- avcodec/cavsdec: Check alpha/beta offset
+- avcodec/diracdec: Fix integer overflow in mv computation
+- avcodec/h264_parse: Clear invalid chroma weights in ff_h264_pred_weight_table()
+- avcodec/aacdec_templat: Fix integer overflow in apply_ltp()
+- avcodec/jpeg2000dwt: Fix integer overflows in sr_1d53()
+- avcodec/diracdec: Use int64 in global mv to prevent overflow
+- avcodec/dxtory: Remove code that corrupts dimensions
+- avcodec/dirac_dwt_template: Fix Integer overflow in horizontal_compose_dd137i()
+- avcodec/hevcdec: Check luma/chroma_log2_weight_denom
+- avcodec/jpeg2000dec: Use av_image_check_size2()
+- avcodec/vp8: Check for bitstream end before vp7_fade_frame()
+- avcodec/exr: Check remaining bits in last get code loop
+- avutil/common: Fix integer overflow in av_clip_uint8_c() and av_clip_uint16_c()
+- avcodec/h264_cabac: Tighten allowed coeff_abs range
+- avcodec/h264_cavlc: Set valid qscale value in ff_h264_decode_mb_cavlc()
+- avcodec/vp3: Error out on invalid num_coeffs in unpack_vlcs()
+- avcodec/mpeg4videodec: Ignore multiple VOL headers
+- avcodec/vp3: Check eob_run
+- avcodec/pafvideo: Check allocated frame size
+- avcodec/scpr: Fix reading a pixel before the first
+- avcodec/mpeg2dec: Fix field selection for skipped macroblocks
+- avcodec/huffyuvdec: Check input buffer size
+- avcodec/utvideodec: Fix bytes left check in decode_frame()
+- avcodec/wavpack: Fix integer overflow in FFABS
+- avcodec/aacsbr_fixed: Fix overflows in rounding in sbr_hf_assemble()
+- avcodec/exr: Fix memleaks in decode_header()
+- avcodec/dirac_dwt: Fix several integer overflows
+- avcodec/indeo5: Do not leave frame_type set to an invalid value
+- avcodec/hevc_ps: Check log2_sao_offset_scale_*
+- avcodec/hevc_ps: extract SPS fields required for hvcC construction
+- avcodec/mpeg4videodec: Avoid possibly aliasing violating casts
+- avcodec/get_bits: Document the return code of get_vlc2()
+- avcodec/mpeg4videodec: Check mb_num also against 0
+- avfilter/vf_transpose: Fix used plane count.
+- avcodec/hevc_cabac: Check prefix so as to avoid invalid shifts in coeff_abs_level_remaining_decode()
+- avcodec/mjpegdec: Fix integer overflow in DC dequantization
+- avcodec/dxtory: Fix bits left checks
+- avcodec/hevc_cabac: Move prefix check in coeff_abs_level_remaining_decode() down
+- avcodec/truemotion2: Fix integer overflow in TM2_RECALC_BLOCK()
+- avcodec/snowdec: Fix integer overflow before htaps check
+- avcodec/ulti: Check number of blocks at init
+- avcodec/jpeg2000: Check sum of sizes of band->prec before allocating
+- avcodec/ac3dec_fixed: Fix integer overflow in scale_coefs()
+- avformat/lrcdec: Fix memory leak in lrc_read_header()
+- avformat/matroskadec: Fix float-cast-overflow undefined behavior in matroska_parse_tracks()
+- configure: bump year
+- avcodec/utils: Avoid hardcoding duplicated types in sizeof()
+- avcodec/arm/sbrdsp_neon: Use a free register instead of putting 2 things in one
+- avcodec/h264addpx_template: Fixes integer overflows
+- avcodec/dirac_dwt: Fix overflows in COMPOSE_HAARiH0/COMPOSE_HAARiL0
+- avcodec/diracdec: Fix integer overflow with quant
+- avcodec/opus_parser: Check payload_len in parse_opus_ts_header()
+- avcodec/jpeg2000dsp: Fix integer overflows in ict_int()
+- avcodec/h264_slice: Do not attempt to render into frames already output
+- avcodec/dnxhddec: Check dc vlc
+- avformat/hvcc: zero initialize the nal buffers past the last written byte
+- swresample/rematrix: fix update of channel matrix if input or output layout is undefined
+- configure: add support for libnpp* from cuda sdk 9
+- avcodec/nvenc: also clear data pointer after unregistering a resource
+- avcodec/nvenc: add some more error case checks
+- avcodec/nvenc: unregister input resource when unmapping
+- avcodec/nvenc: refcount input frame mappings
+- avformat/libssh: check the user provided a password before trying to use it
+
+
 version 3.3.6:
 - x264: Support version 153
 - avcodec/exr: Check buf_size more completely
@@ -1 +1 @@
-3.3.6
+3.3.7
@@ -5797,7 +5797,9 @@ enabled libmfx            && require_pkg_config libmfx "mfx/mfxvideo.h" MFXInit
 enabled libmodplug        && require_pkg_config libmodplug libmodplug/modplug.h ModPlug_Load
 enabled libmp3lame        && require "libmp3lame >= 3.98.3" lame/lame.h lame_set_VBR_quality -lmp3lame
 enabled libnut            && require libnut libnut.h nut_demuxer_init -lnut
-enabled libnpp            && require libnpp npp.h nppGetLibVersion -lnppi -lnppc
+enabled libnpp            && { check_lib npp.h nppGetLibVersion -lnppig -lnppicc -lnppc ||
+                               check_lib npp.h nppGetLibVersion -lnppi -lnppc ||
+                               die "ERROR: libnpp not found"; }
 enabled libopencore_amrnb && require libopencore_amrnb opencore-amrnb/interf_dec.h Decoder_Interface_init -lopencore-amrnb
 enabled libopencore_amrwb && require libopencore_amrwb opencore-amrwb/dec_if.h D_IF_init -lopencore-amrwb
 enabled libopencv         && { check_header opencv2/core/core_c.h &&
@@ -6797,7 +6799,7 @@ cat > $TMPH <<EOF
 #define FFMPEG_CONFIG_H
 #define FFMPEG_CONFIGURATION "$(c_escape $FFMPEG_CONFIGURATION)"
 #define FFMPEG_LICENSE "$(c_escape $license)"
-#define CONFIG_THIS_YEAR 2017
+#define CONFIG_THIS_YEAR 2018
 #define FFMPEG_DATADIR "$(eval c_escape $datadir)"
 #define AVCONV_DATADIR "$(eval c_escape $datadir)"
 #define CC_IDENT "$(c_escape ${cc_ident:-Unknown compiler})"
@@ -38,7 +38,7 @@ PROJECT_NAME           = FFmpeg
 # could be handy for archiving the generated documentation or if some version
 # control system is used.

-PROJECT_NUMBER         = 3.3.6
+PROJECT_NUMBER         = 3.3.7

 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
@@ -417,7 +417,7 @@ static void apply_independent_coupling_fixed(AACContext *ac,
    int i, c, shift, round, tmp;
    const int gain = cce->coup.gain[index][0];
    const int *src = cce->ch[0].ret;
-    int *dest = target->ret;
+    unsigned int *dest = target->ret;
    const int len = 1024 << (ac->oc[1].m4ac.sbr == 1);

    c = cce_scale_fixed[gain & 7];
@@ -2522,7 +2522,7 @@ static void apply_ltp(AACContext *ac, SingleChannelElement *sce)
        for (sfb = 0; sfb < FFMIN(sce->ics.max_sfb, MAX_LTP_LONG_SFB); sfb++)
            if (ltp->used[sfb])
                for (i = offsets[sfb]; i < offsets[sfb + 1]; i++)
-                    sce->coeffs[i] += predFreq[i];
+                    sce->coeffs[i] += (UINTFLOAT)predFreq[i];
    }
 }

@@ -571,8 +571,9 @@ static void sbr_hf_assemble(int Y1[38][64][2],
                int idx = indexsine&1;
                int A = (1-((indexsine+(kx & 1))&2));
                int B = (A^(-idx)) + idx;
-                int *out = &Y1[i][kx][idx];
-                int shift, round;
+                unsigned *out = &Y1[i][kx][idx];
+                int shift;
+                unsigned round;

                SoftFloat *in  = sbr->s_m[e];
                for (m = 0; m+1 < m_max; m+=2) {
@@ -585,12 +586,12 @@ static void sbr_hf_assemble(int Y1[38][64][2],
                    }
                    if (shift < 32) {
                        round = 1 << (shift-1);
-                        out[2*m  ] += (in[m  ].mant * A + round) >> shift;
+                        out[2*m  ] += (int)(in[m  ].mant * A + round) >> shift;
                    }

                    if (shift2 < 32) {
                        round = 1 << (shift2-1);
-                        out[2*m+2] += (in[m+1].mant * B + round) >> shift2;
+                        out[2*m+2] += (int)(in[m+1].mant * B + round) >> shift2;
                    }
                }
                if(m_max&1)
@@ -601,7 +602,7 @@ static void sbr_hf_assemble(int Y1[38][64][2],
                        return;
                    } else if (shift < 32) {
                        round = 1 << (shift-1);
-                        out[2*m  ] += (in[m  ].mant * A + round) >> shift;
+                        out[2*m  ] += (int)(in[m  ].mant * A + round) >> shift;
                    }
                }
            }
@@ -64,8 +64,8 @@ static void scale_coefs (
    int dynrng,
    int len)
 {
-    int i, shift, round;
-    unsigned mul;
+    int i, shift;
+    unsigned mul, round;
    int temp, temp1, temp2, temp3, temp4, temp5, temp6, temp7;

    mul = (dynrng & 0x1f) + 0x20;
@@ -336,11 +336,11 @@ function ff_sbr_hf_apply_noise_0_neon, export=1
        vld1.32         {d0},     [r0,:64]
        vld1.32         {d6},     [lr,:64]
        vld1.32         {d2[]},   [r1,:32]!
-        vld1.32         {d3[]},   [r2,:32]!
+        vld1.32         {d18[]},  [r2,:32]!
        vceq.f32        d4,  d2,  #0
        veor            d2,  d2,  d3
        vmov            d1,  d0
-        vmla.f32        d0,  d6,  d3
+        vmla.f32        d0,  d6,  d18
        vadd.f32        s2,  s2,  s4
        vbif            d0,  d1,  d4
        vst1.32         {d0},     [r0,:64]!
@@ -35,6 +35,8 @@
 #include "bintext.h"
 #include "internal.h"

+#define FONT_WIDTH 8
+
 typedef struct XbinContext {
    AVFrame *frame;
    int palette[16];
@@ -91,6 +93,9 @@ static av_cold int decode_init(AVCodecContext *avctx)
            break;
        }
    }
+    if (avctx->width < FONT_WIDTH || avctx->height < s->font_height)
+        return AVERROR_INVALIDDATA;
+

    s->frame = av_frame_alloc();
    if (!s->frame)
@@ -113,8 +118,6 @@ av_unused static void hscroll(AVCodecContext *avctx)
    }
 }

-#define FONT_WIDTH 8
-
 /**
 * Draw character to screen
 */
@@ -1067,6 +1067,11 @@ static int decode_pic(AVSContext *h)
    if (!h->loop_filter_disable && get_bits1(&h->gb)) {
        h->alpha_offset        = get_se_golomb(&h->gb);
        h->beta_offset         = get_se_golomb(&h->gb);
+        if (   h->alpha_offset < -64 || h->alpha_offset > 64
+            || h-> beta_offset < -64 || h-> beta_offset > 64) {
+            h->alpha_offset = h->beta_offset  = 0;
+            return AVERROR_INVALIDDATA;
+        }
    } else {
        h->alpha_offset = h->beta_offset  = 0;
    }
@@ -81,15 +81,19 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
    switch ((buf[0] >> 1) & 7) {
        case 0: { // lzo compression
            int outlen = c->decomp_size, inlen = buf_size - 2;
-            if (av_lzo1x_decode(c->decomp_buf, &outlen, &buf[2], &inlen))
+            if (av_lzo1x_decode(c->decomp_buf, &outlen, &buf[2], &inlen)) {
                av_log(avctx, AV_LOG_ERROR, "error during lzo decompression\n");
+                return AVERROR_INVALIDDATA;
+            }
            break;
        }
        case 1: { // zlib compression
 #if CONFIG_ZLIB
            unsigned long dlen = c->decomp_size;
-            if (uncompress(c->decomp_buf, &dlen, &buf[2], buf_size - 2) != Z_OK)
+            if (uncompress(c->decomp_buf, &dlen, &buf[2], buf_size - 2) != Z_OK) {
                av_log(avctx, AV_LOG_ERROR, "error during zlib decompression\n");
+                return AVERROR_INVALIDDATA;
+            }
            break;
 #else
            av_log(avctx, AV_LOG_ERROR, "compiled without zlib support\n");
@@ -93,10 +93,10 @@ void ff_spatial_idwt_slice2(DWTContext *d, int y);

 // shared stuff for simd optimizations
 #define COMPOSE_53iL0(b0, b1, b2)\
-    (b1 - ((int)(b0 + (unsigned)(b2) + 2) >> 2))
+    (b1 - (unsigned)((int)(b0 + (unsigned)(b2) + 2) >> 2))

 #define COMPOSE_DIRAC53iH0(b0, b1, b2)\
-    (b1 + ((int)(b0 + (unsigned)(b2) + 1) >> 1))
+    (b1 + (unsigned)((int)(b0 + (unsigned)(b2) + 1) >> 1))

 #define COMPOSE_DD97iH0(b0, b1, b2, b3, b4)\
    (int)(((unsigned)(b2) + ((int)(-b0 + 9U*b1 + 9U*b3 - b4 + 8) >> 4)))
@@ -105,10 +105,10 @@ void ff_spatial_idwt_slice2(DWTContext *d, int y);
    (int)(((unsigned)(b2) - ((int)(-b0 + 9U*b1 + 9U*b3 - b4 + 16) >> 5)))

 #define COMPOSE_HAARiL0(b0, b1)\
-    (b0 - ((b1 + 1) >> 1))
+    ((int)(b0 - (unsigned)((int)(b1 + 1U) >> 1)))

 #define COMPOSE_HAARiH0(b0, b1)\
-    (b0 + b1)
+    ((int)(b0 + (unsigned)(b1)))

 #define COMPOSE_FIDELITYiL0(b0, b1, b2, b3, b4, b5, b6, b7, b8)\
    ((unsigned)b4 - ((int)(-8*(b0+(unsigned)b8) + 21*(b1+(unsigned)b7) - 46*(b2+(unsigned)b6) + 161*(b3+(unsigned)b5) + 128) >> 8))
@@ -49,7 +49,7 @@ static void RENAME(vertical_compose53iL0)(uint8_t *_b0, uint8_t *_b1, uint8_t *_
    TYPE *b1 = (TYPE *)_b1;
    TYPE *b2 = (TYPE *)_b2;
    for (i = 0; i < width; i++)
-        b1[i] -= (int)(b0[i] + (unsigned)b2[i] + 2) >> 2;
+        b1[i] -= (unsigned)((int)(b0[i] + (unsigned)b2[i] + 2) >> 2);
 }

 static av_always_inline void RENAME(interleave)(TYPE *dst, TYPE *src0, TYPE *src1, int w2,
@@ -95,8 +95,8 @@ static void RENAME(horizontal_compose_dd97i)(uint8_t *_b, uint8_t *_tmp, int w)
    tmp[w2+1] = tmp[w2] = tmp[w2-1];

    for (x = 0; x < w2; x++) {
-        b[2*x  ] = (tmp[x] + 1)>>1;
-        b[2*x+1] = (COMPOSE_DD97iH0(tmp[x-1], tmp[x], b[x+w2], tmp[x+1], tmp[x+2]) + 1)>>1;
+        b[2*x  ] = ((int)(tmp[x] + 1U))>>1;
+        b[2*x+1] = ((int)(COMPOSE_DD97iH0(tmp[x-1], tmp[x], b[x+w2], tmp[x+1], tmp[x+2]) + 1U))>>1;
    }
 }

@@ -118,8 +118,8 @@ static void RENAME(horizontal_compose_dd137i)(uint8_t *_b, uint8_t *_tmp, int w)
    tmp[w2+1] = tmp[w2] = tmp[w2-1];

    for (x = 0; x < w2; x++) {
-        b[2*x  ] = (tmp[x] + 1)>>1;
-        b[2*x+1] = (COMPOSE_DD97iH0(tmp[x-1], tmp[x], b[x+w2], tmp[x+1], tmp[x+2]) + 1)>>1;
+        b[2*x  ] = ((int)(tmp[x] + 1U))>>1;
+        b[2*x+1] = ((int)(COMPOSE_DD97iH0(tmp[x-1], tmp[x], b[x+w2], tmp[x+1], tmp[x+2]) + 1U))>>1;
    }
 }

@@ -508,16 +508,16 @@ static inline void codeblock(DiracContext *s, SubBand *b,
    }

    if (s->codeblock_mode && !(s->old_delta_quant && blockcnt_one)) {
-        int quant = b->quant;
+        int quant;
        if (is_arith)
-            quant += dirac_get_arith_int(c, CTX_DELTA_Q_F, CTX_DELTA_Q_DATA);
+            quant = dirac_get_arith_int(c, CTX_DELTA_Q_F, CTX_DELTA_Q_DATA);
        else
-            quant += dirac_get_se_golomb(gb);
-        if (quant < 0) {
+            quant = dirac_get_se_golomb(gb);
+        if (quant > INT_MAX - b->quant || b->quant + quant < 0) {
            av_log(s->avctx, AV_LOG_ERROR, "Invalid quant\n");
            return;
        }
-        b->quant = quant;
+        b->quant += quant;
    }

    if (b->quant > (DIRAC_MAX_QUANT_INDEX - 1)) {
@@ -1399,8 +1399,8 @@ static void global_mv(DiracContext *s, DiracBlock *block, int x, int y, int ref)
    int *c      = s->globalmc[ref].perspective;

    int m       = (1<<ep) - (c[0]*x + c[1]*y);
-    int mx      = m * ((A[0][0] * x + A[0][1]*y) + (1<<ez) * b[0]);
-    int my      = m * ((A[1][0] * x + A[1][1]*y) + (1<<ez) * b[1]);
+    int64_t mx  = m * (int64_t)((A[0][0] * x + A[0][1]*y) + (1<<ez) * b[0]);
+    int64_t my  = m * (int64_t)((A[1][0] * x + A[1][1]*y) + (1<<ez) * b[1]);

    block->u.mv[ref][0] = (mx + (1<<(ez+ep))) >> (ez+ep);
    block->u.mv[ref][1] = (my + (1<<(ez+ep))) >> (ez+ep);
@@ -1437,8 +1437,8 @@ static void decode_block_params(DiracContext *s, DiracArith arith[8], DiracBlock
                global_mv(s, block, x, y, i);
            } else {
                pred_mv(block, stride, x, y, i);
-                block->u.mv[i][0] += dirac_get_arith_int(arith + 4 + 2 * i, CTX_MV_F1, CTX_MV_DATA);
-                block->u.mv[i][1] += dirac_get_arith_int(arith + 5 + 2 * i, CTX_MV_F1, CTX_MV_DATA);
+                block->u.mv[i][0] += (unsigned)dirac_get_arith_int(arith + 4 + 2 * i, CTX_MV_F1, CTX_MV_DATA);
+                block->u.mv[i][1] += (unsigned)dirac_get_arith_int(arith + 5 + 2 * i, CTX_MV_F1, CTX_MV_DATA);
            }
        }
 }
@@ -377,6 +377,10 @@ static av_always_inline int dnxhd_decode_dct_block(const DNXHDContext *ctx,

    UPDATE_CACHE(bs, &row->gb);
    GET_VLC(len, bs, &row->gb, ctx->dc_vlc.table, DNXHD_DC_VLC_BITS, 1);
+    if (len < 0) {
+        ret = len;
+        goto error;
+    }
    if (len) {
        level = GET_CACHE(bs, &row->gb);
        LAST_SKIP_BITS(bs, &row->gb, len);
@@ -430,7 +434,7 @@ static av_always_inline int dnxhd_decode_dct_block(const DNXHDContext *ctx,
        GET_VLC(index1, bs, &row->gb, ctx->ac_vlc.table,
                DNXHD_VLC_BITS, 2);
    }
-
+error:
    CLOSE_READER(bs, &row->gb);
    return ret;
 }
@@ -305,11 +305,7 @@ static int dxtory_decode_v2(AVCodecContext *avctx, AVFrame *pic,
    }

    if (avctx->height - line) {
-        av_log(avctx, AV_LOG_VERBOSE,
-               "Not enough slice data available, "
-               "cropping the frame by %d pixels\n",
-                avctx->height - line);
-        avctx->height = line;
+        avpriv_request_sample(avctx, "Not enough slice data available");
    }

    return 0;
@@ -326,7 +322,7 @@ static int dx2_decode_slice_5x5(GetBitContext *gb, AVFrame *frame,
    int stride   = frame->linesize[0];
    uint8_t *dst = frame->data[0] + stride * line;

-    for (y = 0; y < left && get_bits_left(gb) > 16; y++) {
+    for (y = 0; y < left && get_bits_left(gb) > 6 * width; y++) {
        for (x = 0; x < width; x++) {
            b = decode_sym_565(gb, lru[0], 5);
            g = decode_sym_565(gb, lru[1], is_565 ? 6 : 5);
@@ -392,7 +388,7 @@ static int dx2_decode_slice_rgb(GetBitContext *gb, AVFrame *frame,
    int stride   = frame->linesize[0];
    uint8_t *dst = frame->data[0] + stride * line;

-    for (y = 0; y < left && get_bits_left(gb) > 16; y++) {
+    for (y = 0; y < left && get_bits_left(gb) > 6 * width; y++) {
        for (x = 0; x < width; x++) {
            dst[x * 3 + 0] = decode_sym(gb, lru[0]);
            dst[x * 3 + 1] = decode_sym(gb, lru[1]);
@@ -437,7 +433,7 @@ static int dx2_decode_slice_410(GetBitContext *gb, AVFrame *frame,
    uint8_t *U  = frame->data[1] + (ustride >> 2) * line;
    uint8_t *V  = frame->data[2] + (vstride >> 2) * line;

-    for (y = 0; y < left - 3 && get_bits_left(gb) > 16; y += 4) {
+    for (y = 0; y < left - 3 && get_bits_left(gb) > 9 * width; y += 4) {
        for (x = 0; x < width; x += 4) {
            for (j = 0; j < 4; j++)
                for (i = 0; i < 4; i++)
@@ -481,7 +477,7 @@ static int dx2_decode_slice_420(GetBitContext *gb, AVFrame *frame,
    uint8_t *V  = frame->data[2] + (vstride >> 1) * line;


-    for (y = 0; y < left - 1 && get_bits_left(gb) > 16; y += 2) {
+    for (y = 0; y < left - 1 && get_bits_left(gb) > 6 * width; y += 2) {
        for (x = 0; x < width; x += 2) {
            Y[x + 0 + 0 * ystride] = decode_sym(gb, lru[0]);
            Y[x + 1 + 0 * ystride] = decode_sym(gb, lru[0]);
@@ -524,7 +520,7 @@ static int dx2_decode_slice_444(GetBitContext *gb, AVFrame *frame,
    uint8_t *U  = frame->data[1] + ustride * line;
    uint8_t *V  = frame->data[2] + vstride * line;

-    for (y = 0; y < left && get_bits_left(gb) > 16; y++) {
+    for (y = 0; y < left && get_bits_left(gb) > 6 * width; y++) {
        for (x = 0; x < width; x++) {
            Y[x] = decode_sym(gb, lru[0]);
            U[x] = decode_sym(gb, lru[1]) ^ 0x80;
@@ -574,7 +574,7 @@ static int huf_decode(const uint64_t *hcode, const HufDec *hdecod,
    while (lc > 0) {
        const HufDec pl = hdecod[(c << (HUF_DECBITS - lc)) & HUF_DECMASK];

-        if (pl.len) {
+        if (pl.len && lc >= pl.len) {
            lc -= pl.len;
            get_code(pl.lit, rlc, c, lc, gb, out, oe, outb);
        } else {
@@ -910,7 +910,7 @@ static int pxr24_uncompress(EXRContext *s, const uint8_t *src,

 static void unpack_14(const uint8_t b[14], uint16_t s[16])
 {
-    unsigned short shift = (b[ 2] >> 2);
+    unsigned short shift = (b[ 2] >> 2) & 15;
    unsigned short bias = (0x20 << shift);
    int i;

@@ -1317,6 +1317,7 @@ static int decode_header(EXRContext *s, AVFrame *frame)
    AVDictionary *metadata = NULL;
    int magic_number, version, i, flags, sar = 0;
    int layer_match = 0;
+    int ret;

    s->current_channel_offset = 0;
    s->xmin               = ~0;
@@ -1375,8 +1376,10 @@ static int decode_header(EXRContext *s, AVFrame *frame)
        if ((var_size = check_header_variable(s, "channels",
                                              "chlist", 38)) >= 0) {
            GetByteContext ch_gb;
-            if (!var_size)
-                return AVERROR_INVALIDDATA;
+            if (!var_size) {
+                ret = AVERROR_INVALIDDATA;
+                goto fail;
+            }

            bytestream2_init(&ch_gb, s->gb.buffer, var_size);

@@ -1435,14 +1438,16 @@ static int decode_header(EXRContext *s, AVFrame *frame)

                if (bytestream2_get_bytes_left(&ch_gb) < 4) {
                    av_log(s->avctx, AV_LOG_ERROR, "Incomplete header.\n");
-                    return AVERROR_INVALIDDATA;
+                    ret = AVERROR_INVALIDDATA;
+                    goto fail;
                }

                current_pixel_type = bytestream2_get_le32(&ch_gb);
                if (current_pixel_type >= EXR_UNKNOWN) {
                    avpriv_report_missing_feature(s->avctx, "Pixel type %d",
                                                  current_pixel_type);
-                    return AVERROR_PATCHWELCOME;
+                    ret = AVERROR_PATCHWELCOME;
+                    goto fail;
                }

                bytestream2_skip(&ch_gb, 4);
@@ -1453,7 +1458,8 @@ static int decode_header(EXRContext *s, AVFrame *frame)
                    avpriv_report_missing_feature(s->avctx,
                                                  "Subsampling %dx%d",
                                                  xsub, ysub);
-                    return AVERROR_PATCHWELCOME;
+                    ret = AVERROR_PATCHWELCOME;
+                    goto fail;
                }

                if (channel_index >= 0 && s->channel_offsets[channel_index] == -1) { /* channel has not been previously assigned */
@@ -1461,7 +1467,8 @@ static int decode_header(EXRContext *s, AVFrame *frame)
                        s->pixel_type != current_pixel_type) {
                        av_log(s->avctx, AV_LOG_ERROR,
                               "RGB channels not of the same depth.\n");
-                        return AVERROR_INVALIDDATA;
+                        ret = AVERROR_INVALIDDATA;
+                        goto fail;
                    }
                    s->pixel_type                     = current_pixel_type;
                    s->channel_offsets[channel_index] = s->current_channel_offset;
@@ -1469,8 +1476,10 @@ static int decode_header(EXRContext *s, AVFrame *frame)

                s->channels = av_realloc(s->channels,
                                         ++s->nb_channels * sizeof(EXRChannel));
-                if (!s->channels)
-                    return AVERROR(ENOMEM);
+                if (!s->channels) {
+                    ret = AVERROR(ENOMEM);
+                    goto fail;
+                }
                channel             = &s->channels[s->nb_channels - 1];
                channel->pixel_type = current_pixel_type;
                channel->xsub       = xsub;
@@ -1495,7 +1504,8 @@ static int decode_header(EXRContext *s, AVFrame *frame)
                        av_log(s->avctx, AV_LOG_ERROR, "Missing green channel.\n");
                    if (s->channel_offsets[2] < 0)
                        av_log(s->avctx, AV_LOG_ERROR, "Missing blue channel.\n");
-                    return AVERROR_INVALIDDATA;
+                    ret = AVERROR_INVALIDDATA;
+                    goto fail;
                }
            }

@@ -1504,8 +1514,10 @@ static int decode_header(EXRContext *s, AVFrame *frame)
            continue;
        } else if ((var_size = check_header_variable(s, "dataWindow", "box2i",
                                                     31)) >= 0) {
-            if (!var_size)
-                return AVERROR_INVALIDDATA;
+            if (!var_size) {
+                ret = AVERROR_INVALIDDATA;
+                goto fail;
+            }

            s->xmin   = bytestream2_get_le32(&s->gb);
            s->ymin   = bytestream2_get_le32(&s->gb);
@@ -1517,8 +1529,10 @@ static int decode_header(EXRContext *s, AVFrame *frame)
            continue;
        } else if ((var_size = check_header_variable(s, "displayWindow",
                                                     "box2i", 34)) >= 0) {
-            if (!var_size)
-                return AVERROR_INVALIDDATA;
+            if (!var_size) {
+                ret = AVERROR_INVALIDDATA;
+                goto fail;
+            }

            bytestream2_skip(&s->gb, 8);
            s->w = bytestream2_get_le32(&s->gb) + 1;
@@ -1528,29 +1542,36 @@ static int decode_header(EXRContext *s, AVFrame *frame)
        } else if ((var_size = check_header_variable(s, "lineOrder",
                                                     "lineOrder", 25)) >= 0) {
            int line_order;
-            if (!var_size)
-                return AVERROR_INVALIDDATA;
+            if (!var_size) {
+                ret = AVERROR_INVALIDDATA;
+                goto fail;
+            }

            line_order = bytestream2_get_byte(&s->gb);
            av_log(s->avctx, AV_LOG_DEBUG, "line order: %d.\n", line_order);
            if (line_order > 2) {
                av_log(s->avctx, AV_LOG_ERROR, "Unknown line order.\n");
-                return AVERROR_INVALIDDATA;
+                ret = AVERROR_INVALIDDATA;
+                goto fail;
            }

            continue;
        } else if ((var_size = check_header_variable(s, "pixelAspectRatio",
                                                     "float", 31)) >= 0) {
-            if (!var_size)
-                return AVERROR_INVALIDDATA;
+            if (!var_size) {
+                ret = AVERROR_INVALIDDATA;
+                goto fail;
+            }

            sar = bytestream2_get_le32(&s->gb);

            continue;
        } else if ((var_size = check_header_variable(s, "compression",
                                                     "compression", 29)) >= 0) {
-            if (!var_size)
-                return AVERROR_INVALIDDATA;
+            if (!var_size) {
+                ret = AVERROR_INVALIDDATA;
+                goto fail;
+            }

            if (s->compression == EXR_UNKN)
                s->compression = bytestream2_get_byte(&s->gb);
@@ -1577,13 +1598,15 @@ static int decode_header(EXRContext *s, AVFrame *frame)
            if (s->tile_attr.level_mode >= EXR_TILE_LEVEL_UNKNOWN){
                avpriv_report_missing_feature(s->avctx, "Tile level mode %d",
                                              s->tile_attr.level_mode);
-                return AVERROR_PATCHWELCOME;
+                ret = AVERROR_PATCHWELCOME;
+                goto fail;
            }

            if (s->tile_attr.level_round >= EXR_TILE_ROUND_UNKNOWN) {
                avpriv_report_missing_feature(s->avctx, "Tile level round %d",
                                              s->tile_attr.level_round);
-                return AVERROR_PATCHWELCOME;
+                ret = AVERROR_PATCHWELCOME;
+                goto fail;
            }

            continue;
@@ -1600,7 +1623,8 @@ static int decode_header(EXRContext *s, AVFrame *frame)
        // Check if there are enough bytes for a header
        if (bytestream2_get_bytes_left(&s->gb) <= 9) {
            av_log(s->avctx, AV_LOG_ERROR, "Incomplete header\n");
-            return AVERROR_INVALIDDATA;
+            ret = AVERROR_INVALIDDATA;
+            goto fail;
        }

        // Process unknown variables
@@ -1615,19 +1639,22 @@ static int decode_header(EXRContext *s, AVFrame *frame)

    if (s->compression == EXR_UNKN) {
        av_log(s->avctx, AV_LOG_ERROR, "Missing compression attribute.\n");
-        return AVERROR_INVALIDDATA;
+        ret = AVERROR_INVALIDDATA;
+        goto fail;
    }

    if (s->is_tile) {
        if (s->tile_attr.xSize < 1 || s->tile_attr.ySize < 1) {
            av_log(s->avctx, AV_LOG_ERROR, "Invalid tile attribute.\n");
-            return AVERROR_INVALIDDATA;
+            ret = AVERROR_INVALIDDATA;
+            goto fail;
        }
    }

    if (bytestream2_get_bytes_left(&s->gb) <= 0) {
        av_log(s->avctx, AV_LOG_ERROR, "Incomplete frame.\n");
-        return AVERROR_INVALIDDATA;
+        ret = AVERROR_INVALIDDATA;
+        goto fail;
    }

    av_frame_set_metadata(frame, metadata);
@@ -1635,6 +1662,9 @@ static int decode_header(EXRContext *s, AVFrame *frame)
    // aaand we are done
    bytestream2_skip(&s->gb, 1);
    return 0;
+fail:
+    av_dict_free(&metadata);
+    return ret;
 }

 static int decode_frame(AVCodecContext *avctx, void *data,
@@ -28,6 +28,7 @@
 #include <inttypes.h>
 #include <zlib.h>

+#include "libavutil/imgutils.h"
 #include "libavutil/intreadwrite.h"

 #include "avcodec.h"
@@ -1451,7 +1452,8 @@ static int g2m_decode_frame(AVCodecContext *avctx, void *data,
            c->tile_height = bytestream2_get_be32(&bc);
            if (c->tile_width <= 0 || c->tile_height <= 0 ||
                ((c->tile_width | c->tile_height) & 0xF) ||
-                c->tile_width * (uint64_t)c->tile_height >= INT_MAX / 4
+                c->tile_width * (uint64_t)c->tile_height >= INT_MAX / 4 ||
+                av_image_check_size2(c->tile_width, c->tile_height, avctx->max_pixels, avctx->pix_fmt, 0, avctx) < 0
            ) {
                av_log(avctx, AV_LOG_ERROR,
                       "Invalid tile dimensions %dx%d\n",
@@ -32,6 +32,7 @@
 #include "libavutil/intreadwrite.h"
 #include "libavutil/log.h"
 #include "libavutil/avassert.h"
+#include "avcodec.h"
 #include "mathops.h"
 #include "vlc.h"

@@ -428,7 +429,7 @@ static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,
    int buffer_size;
    int ret = 0;

-    if (bit_size >= INT_MAX - 7 || bit_size < 0 || !buffer) {
+    if (bit_size >= INT_MAX - FFMAX(7, AV_INPUT_BUFFER_PADDING_SIZE*8) || bit_size < 0 || !buffer) {
        bit_size    = 0;
        buffer      = NULL;
        ret         = AVERROR_INVALIDDATA;
@@ -550,6 +551,7 @@ static inline const uint8_t *align_get_bits(GetBitContext *s)
 * @param max_depth is the number of times bits bits must be read to completely
 *                  read the longest vlc code
 *                  = (max_vlc_length + bits - 1) / bits
+ * @returns the code parsed or -1 if no vlc matches
 */
 static av_always_inline int get_vlc2(GetBitContext *s, VLC_TYPE (*table)[2],
                                     int bits, int max_depth)
@@ -1735,7 +1735,7 @@ decode_cabac_residual_internal(const H264Context *h, H264SliceContext *sl,
 \
            if( coeff_abs >= 15 ) { \
                int j = 0; \
-                while (get_cabac_bypass(CC) && j < 30) { \
+                while (get_cabac_bypass(CC) && j < 16+7) { \
                    j++; \
                } \
 \
@@ -1111,6 +1111,7 @@ decode_intra_mb:
            else                sl->qscale -= max_qp+1;
            if (((unsigned)sl->qscale) > max_qp){
                av_log(h->avctx, AV_LOG_ERROR, "dquant out of range (%d) at %d %d\n", dquant, sl->mb_x, sl->mb_y);
+                sl->qscale = max_qp;
                return -1;
            }
        }
@@ -82,8 +82,11 @@ int ff_h264_pred_weight_table(GetBitContext *gb, const SPS *sps,
                        pwt->chroma_weight[i][list][j][0] = get_se_golomb(gb);
                        pwt->chroma_weight[i][list][j][1] = get_se_golomb(gb);
                        if ((int8_t)pwt->chroma_weight[i][list][j][0] != pwt->chroma_weight[i][list][j][0] ||
-                            (int8_t)pwt->chroma_weight[i][list][j][1] != pwt->chroma_weight[i][list][j][1])
+                            (int8_t)pwt->chroma_weight[i][list][j][1] != pwt->chroma_weight[i][list][j][1]) {
+                            pwt->chroma_weight[i][list][j][0] = chroma_def;
+                            pwt->chroma_weight[i][list][j][1] = 0;
                            goto out_range_weight;
+                        }
                        if (pwt->chroma_weight[i][list][j][0] != chroma_def ||
                            pwt->chroma_weight[i][list][j][1] != 0) {
                            pwt->use_weight_chroma        = 1;
@@ -1297,7 +1297,7 @@ static int h264_select_output_frame(H264Context *h)
    }
    out_of_order = MAX_DELAYED_PIC_COUNT - i;
    if(   cur->f->pict_type == AV_PICTURE_TYPE_B
-       || (h->last_pocs[MAX_DELAYED_PIC_COUNT-2] > INT_MIN && h->last_pocs[MAX_DELAYED_PIC_COUNT-1] - h->last_pocs[MAX_DELAYED_PIC_COUNT-2] > 2))
+       || (h->last_pocs[MAX_DELAYED_PIC_COUNT-2] > INT_MIN && h->last_pocs[MAX_DELAYED_PIC_COUNT-1] - (int64_t)h->last_pocs[MAX_DELAYED_PIC_COUNT-2] > 2))
        out_of_order = FFMAX(out_of_order, 1);
    if (out_of_order == MAX_DELAYED_PIC_COUNT) {
        av_log(h->avctx, AV_LOG_VERBOSE, "Invalid POC %d<%d\n", cur->poc, h->last_pocs[0]);
@@ -1552,6 +1552,12 @@ static int h264_field_start(H264Context *h, const H264SliceContext *sl,
                 * one except for reference purposes. */
                h->first_field = 1;
                h->cur_pic_ptr = NULL;
+            } else if (h->cur_pic_ptr->reference & DELAYED_PIC_REF) {
+                /* This frame was already output, we cannot draw into it
+                 * anymore.
+                 */
+                h->first_field = 1;
+                h->cur_pic_ptr = NULL;
            } else {
                /* Second field in complementary pair */
                h->first_field = 0;
@@ -35,10 +35,10 @@ static void FUNCC(ff_h264_add_pixels4)(uint8_t *_dst, int16_t *_src, int stride)
    stride /= sizeof(pixel);

    for (i = 0; i < 4; i++) {
-        dst[0] += src[0];
-        dst[1] += src[1];
-        dst[2] += src[2];
-        dst[3] += src[3];
+        dst[0] += (unsigned)src[0];
+        dst[1] += (unsigned)src[1];
+        dst[2] += (unsigned)src[2];
+        dst[3] += (unsigned)src[3];

        dst += stride;
        src += 4;
@@ -55,14 +55,14 @@ static void FUNCC(ff_h264_add_pixels8)(uint8_t *_dst, int16_t *_src, int stride)
    stride /= sizeof(pixel);

    for (i = 0; i < 8; i++) {
-        dst[0] += src[0];
-        dst[1] += src[1];
-        dst[2] += src[2];
-        dst[3] += src[3];
-        dst[4] += src[4];
-        dst[5] += src[5];
-        dst[6] += src[6];
-        dst[7] += src[7];
+        dst[0] += (unsigned)src[0];
+        dst[1] += (unsigned)src[1];
+        dst[2] += (unsigned)src[2];
+        dst[3] += (unsigned)src[3];
+        dst[4] += (unsigned)src[4];
+        dst[5] += (unsigned)src[5];
+        dst[6] += (unsigned)src[6];
+        dst[7] += (unsigned)src[7];

        dst += stride;
        src += 8;
@@ -979,16 +979,19 @@ static av_always_inline int coeff_abs_level_remaining_decode(HEVCContext *s, int

    while (prefix < CABAC_MAX_BIN && get_cabac_bypass(&s->HEVClc->cc))
        prefix++;
-    if (prefix == CABAC_MAX_BIN) {
-        av_log(s->avctx, AV_LOG_ERROR, "CABAC_MAX_BIN : %d\n", prefix);
-        return 0;
-    }
+
    if (prefix < 3) {
        for (i = 0; i < rc_rice_param; i++)
            suffix = (suffix << 1) | get_cabac_bypass(&s->HEVClc->cc);
        last_coeff_abs_level_remaining = (prefix << rc_rice_param) + suffix;
    } else {
        int prefix_minus3 = prefix - 3;
+
+        if (prefix == CABAC_MAX_BIN || prefix_minus3 + rc_rice_param >= 31) {
+            av_log(s->avctx, AV_LOG_ERROR, "CABAC_MAX_BIN : %d\n", prefix);
+            return 0;
+        }
+
        for (i = 0; i < prefix_minus3 + rc_rice_param; i++)
            suffix = (suffix << 1) | get_cabac_bypass(&s->HEVClc->cc);
        last_coeff_abs_level_remaining = (((1 << prefix_minus3) + 3 - 1)
@@ -891,7 +891,7 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id,
        return AVERROR_INVALIDDATA;
    }

-    skip_bits1(gb); // temporal_id_nesting_flag
+    sps->temporal_id_nesting_flag = get_bits(gb, 1);

    if ((ret = parse_ptl(gb, avctx, &sps->ptl, sps->max_sub_layers)) < 0)
        return ret;
@@ -954,6 +954,7 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id,
               sps->bit_depth, bit_depth_chroma);
        return AVERROR_INVALIDDATA;
    }
+    sps->bit_depth_chroma = bit_depth_chroma;

    ret = map_pixel_format(avctx, sps);
    if (ret < 0)
@@ -1329,6 +1330,11 @@ static int pps_range_extensions(GetBitContext *gb, AVCodecContext *avctx,
    pps->log2_sao_offset_scale_luma = get_ue_golomb_long(gb);
    pps->log2_sao_offset_scale_chroma = get_ue_golomb_long(gb);

+    if (   pps->log2_sao_offset_scale_luma   > FFMAX(sps->bit_depth        - 10, 0)
+        || pps->log2_sao_offset_scale_chroma > FFMAX(sps->bit_depth_chroma - 10, 0)
+    )
+        return AVERROR_INVALIDDATA;
+
    return(0);
 }

@@ -151,6 +151,7 @@ typedef struct HEVCSPS {
    HEVCWindow pic_conf_win;

    int bit_depth;
+    int bit_depth_chroma;
    int pixel_shift;
    enum AVPixelFormat pix_fmt;

@@ -163,6 +164,7 @@ typedef struct HEVCSPS {
        int num_reorder_pics;
        int max_latency_increase;
    } temporal_layer[HEVC_MAX_SUB_LAYERS];
+    uint8_t temporal_id_nesting_flag;

    VUI vui;
    PTL ptl;
@@ -149,12 +149,18 @@ static int pred_weight_table(HEVCContext *s, GetBitContext *gb)
    int luma_log2_weight_denom;

    luma_log2_weight_denom = get_ue_golomb_long(gb);
-    if (luma_log2_weight_denom < 0 || luma_log2_weight_denom > 7)
+    if (luma_log2_weight_denom < 0 || luma_log2_weight_denom > 7) {
        av_log(s->avctx, AV_LOG_ERROR, "luma_log2_weight_denom %d is invalid\n", luma_log2_weight_denom);
+        return AVERROR_INVALIDDATA;
+    }
    s->sh.luma_log2_weight_denom = av_clip_uintp2(luma_log2_weight_denom, 3);
    if (s->ps.sps->chroma_format_idc != 0) {
-        int delta = get_se_golomb(gb);
-        s->sh.chroma_log2_weight_denom = av_clip_uintp2(s->sh.luma_log2_weight_denom + delta, 3);
+        int64_t chroma_log2_weight_denom = luma_log2_weight_denom + (int64_t)get_se_golomb(gb);
+        if (chroma_log2_weight_denom < 0 || chroma_log2_weight_denom > 7) {
+            av_log(s->avctx, AV_LOG_ERROR, "chroma_log2_weight_denom %"PRId64" is invalid\n", chroma_log2_weight_denom);
+            return AVERROR_INVALIDDATA;
+        }
+        s->sh.chroma_log2_weight_denom = chroma_log2_weight_denom;
    }

    for (i = 0; i < s->sh.nb_refs[L0]; i++) {
@@ -919,6 +919,9 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
    AVFrame *const p = data;
    int table_size = 0, ret;

+    if (buf_size < (width * height + 7)/8)
+        return AVERROR_INVALIDDATA;
+
    av_fast_padded_malloc(&s->bitstream_buffer,
                   &s->bitstream_buffer_size,
                   buf_size);
@@ -69,10 +69,14 @@ enum AVPixelFormat avcodec_find_best_pix_fmt_of_list(const enum AVPixelFormat *p
    int i;

    enum AVPixelFormat best = AV_PIX_FMT_NONE;
+    int loss;

-    for(i=0; pix_fmt_list[i] != AV_PIX_FMT_NONE; i++)
-        best = avcodec_find_best_pix_fmt_of_2(best, pix_fmt_list[i], src_pix_fmt, has_alpha, loss_ptr);
+    for (i=0; pix_fmt_list[i] != AV_PIX_FMT_NONE; i++) {
+        loss = *loss_ptr;
+        best = avcodec_find_best_pix_fmt_of_2(best, pix_fmt_list[i], src_pix_fmt, has_alpha, &loss);
+    }

+    *loss_ptr = loss;
    return best;
 }

@@ -324,6 +324,7 @@ static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx)
    ctx->frame_type      = get_bits(&ctx->gb, 3);
    if (ctx->frame_type >= 5) {
        av_log(avctx, AV_LOG_ERROR, "Invalid frame type: %d \n", ctx->frame_type);
+        ctx->frame_type = FRAMETYPE_INTRA;
        return AVERROR_INVALIDDATA;
    }

@@ -543,6 +543,9 @@ int ff_jpeg2000_init_component(Jpeg2000Component *comp,
        if (!reslevel->band)
            return AVERROR(ENOMEM);

+        if (reslevel->num_precincts_x * (uint64_t)reslevel->num_precincts_y * reslevel->nbands > avctx->max_pixels / sizeof(*reslevel->band->prec))
+            return AVERROR(ENOMEM);
+
        for (bandno = 0; bandno < reslevel->nbands; bandno++, gbandno++) {
            ret = init_band(avctx, reslevel,
                            comp, codsty, qntsty,
@@ -282,7 +282,7 @@ static int get_siz(Jpeg2000DecoderContext *s)
        avpriv_request_sample(s->avctx, "Support for image offsets");
        return AVERROR_PATCHWELCOME;
    }
-    if (av_image_check_size(s->width, s->height, 0, s->avctx)) {
+    if (av_image_check_size2(s->width, s->height, s->avctx->max_pixels, AV_PIX_FMT_NONE, 0, s->avctx)) {
        avpriv_request_sample(s->avctx, "Large Dimensions");
        return AVERROR_PATCHWELCOME;
    }
@@ -64,9 +64,9 @@ static void ict_int(void *_src0, void *_src1, void *_src2, int csize)
    int i;

    for (i = 0; i < csize; i++) {
-        i0 = *src0 + *src2 + (((26345 * *src2) + (1 << 15)) >> 16);
+        i0 = *src0 + *src2 + ((int)((26345U * *src2) + (1 << 15)) >> 16);
        i1 = *src0 - ((int)(((unsigned)i_ict_params[1] * *src1) + (1 << 15)) >> 16)
-                   - (((i_ict_params[2] * *src2) + (1 << 15)) >> 16);
+                   - ((int)(((unsigned)i_ict_params[2] * *src2) + (1 << 15)) >> 16);
        i2 = *src0 + (2 * *src1) + ((int)((-14942U * *src1) + (1 << 15)) >> 16);
        *src0++ = i0;
        *src1++ = i1;
@@ -305,22 +305,22 @@ static void dwt_encode97_int(DWTContext *s, int *t)
        t[i] = (t[i] + ((1<<I_PRESHIFT)>>1)) >> I_PRESHIFT;
 }

-static void sr_1d53(int *p, int i0, int i1)
+static void sr_1d53(unsigned *p, int i0, int i1)
 {
    int i;

    if (i1 <= i0 + 1) {
        if (i0 == 1)
-            p[1] >>= 1;
+            p[1] = (int)p[1] >> 1;
        return;
    }

    extend53(p, i0, i1);

    for (i = (i0 >> 1); i < (i1 >> 1) + 1; i++)
-        p[2 * i] -= (p[2 * i - 1] + p[2 * i + 1] + 2) >> 2;
+        p[2 * i] -= (int)(p[2 * i - 1] + p[2 * i + 1] + 2) >> 2;
    for (i = (i0 >> 1); i < (i1 >> 1); i++)
-        p[2 * i + 1] += (p[2 * i] + p[2 * i + 2]) >> 1;
+        p[2 * i + 1] += (int)(p[2 * i] + p[2 * i + 2]) >> 1;
 }

 static void dwt_decode53(DWTContext *s, int *t)
@@ -126,7 +126,10 @@ static av_cold int libopus_decode_close(AVCodecContext *avc)
 {
    struct libopus_context *opus = avc->priv_data;

-    opus_multistream_decoder_destroy(opus->dec);
+    if (opus->dec) {
+        opus_multistream_decoder_destroy(opus->dec);
+        opus->dec = NULL;
+    }
    return 0;
 }

@@ -200,6 +203,7 @@ AVCodec ff_libopus_decoder = {
    .decode         = libopus_decode,
    .flush          = libopus_flush,
    .capabilities   = AV_CODEC_CAP_DR1,
+    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
    .sample_fmts    = (const enum AVSampleFormat[]){ AV_SAMPLE_FMT_FLT,
                                                     AV_SAMPLE_FMT_S16,
                                                     AV_SAMPLE_FMT_NONE },
@@ -309,6 +309,8 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
    av_log(s->avctx, AV_LOG_DEBUG, "sof0: picture: %dx%d\n", width, height);
    if (av_image_check_size(width, height, 0, s->avctx))
        return AVERROR_INVALIDDATA;
+    if (s->buf_size && (width + 7) / 8 * ((height + 7) / 8) > s->buf_size * 4LL)
+        return AVERROR_INVALIDDATA;

    nb_components = get_bits(&s->gb, 8);
    if (nb_components <= 0 ||
@@ -696,7 +698,7 @@ static int decode_block(MJpegDecodeContext *s, int16_t *block, int component,
        av_log(s->avctx, AV_LOG_ERROR, "error dc\n");
        return AVERROR_INVALIDDATA;
    }
-    val = val * quant_matrix[0] + s->last_dc[component];
+    val = val * (unsigned)quant_matrix[0] + s->last_dc[component];
    val = av_clip_int16(val);
    s->last_dc[component] = val;
    block[0] = val;
@@ -2091,6 +2093,8 @@ int ff_mjpeg_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
    int ret = 0;
    int is16bit;

+    s->buf_size = buf_size;
+
    av_dict_free(&s->exif_metadata);
    av_freep(&s->stereo3d);
    s->adobe_transform = -1;
@@ -45,6 +45,7 @@ typedef struct MJpegDecodeContext {
    AVClass *class;
    AVCodecContext *avctx;
    GetBitContext gb;
+    int buf_size;

    int start_code; /* current start code */
    int buffer_size;
@@ -299,6 +299,14 @@ static int decode_styl(const uint8_t *tsmb, MovTextContext *m, AVPacket *avpkt)
        m->s_temp->style_start = AV_RB16(tsmb);
        tsmb += 2;
        m->s_temp->style_end = AV_RB16(tsmb);
+
+        if (   m->s_temp->style_end < m->s_temp->style_start
+            || (m->count_s && m->s_temp->style_start < m->s[m->count_s - 1]->style_end)) {
+            av_freep(&m->s_temp);
+            mov_text_cleanup(m);
+            return AVERROR(ENOMEM);
+        }
+
        tsmb += 2;
        m->s_temp->style_fontID = AV_RB16(tsmb);
        tsmb += 2;
@@ -1983,6 +1983,8 @@ static int mpeg_decode_slice(MpegEncContext *s, int mb_y,
                    s->mv[0][0][1] = s->last_mv[0][0][1];
                    s->mv[1][0][0] = s->last_mv[1][0][0];
                    s->mv[1][0][1] = s->last_mv[1][0][1];
+                    s->field_select[0][0] = (s->picture_structure - 1) & 1;
+                    s->field_select[1][0] = (s->picture_structure - 1) & 1;
                }
            }
        }
@@ -460,7 +460,7 @@ int ff_mpeg4_decode_video_packet_header(Mpeg4DecContext *ctx)
    }

    mb_num = get_bits(&s->gb, mb_num_bits);
-    if (mb_num >= s->mb_num) {
+    if (mb_num >= s->mb_num || !mb_num) {
        av_log(s->avctx, AV_LOG_ERROR,
               "illegal mb_num in video packet (%d %d) \n", mb_num, s->mb_num);
        return -1;
@@ -1251,10 +1251,12 @@ not_coded:
 */
 static int mpeg4_decode_partitioned_mb(MpegEncContext *s, int16_t block[6][64])
 {
-    Mpeg4DecContext *ctx = (Mpeg4DecContext *)s;
+    Mpeg4DecContext *ctx = s->avctx->priv_data;
    int cbp, mb_type;
    const int xy = s->mb_x + s->mb_y * s->mb_stride;

+    av_assert2(s == (void*)ctx);
+
    mb_type = s->current_picture.mb_type[xy];
    cbp     = s->cbp_table[xy];

@@ -1336,12 +1338,13 @@ static int mpeg4_decode_partitioned_mb(MpegEncContext *s, int16_t block[6][64])

 static int mpeg4_decode_mb(MpegEncContext *s, int16_t block[6][64])
 {
-    Mpeg4DecContext *ctx = (Mpeg4DecContext *)s;
+    Mpeg4DecContext *ctx = s->avctx->priv_data;
    int cbpc, cbpy, i, cbp, pred_x, pred_y, mx, my, dquant;
    int16_t *mot_val;
    static const int8_t quant_tab[4] = { -1, -2, 1, 2 };
    const int xy = s->mb_x + s->mb_y * s->mb_stride;

+    av_assert2(s ==  (void*)ctx);
    av_assert2(s->h263_pred);

    if (s->pict_type == AV_PICTURE_TYPE_P ||
@@ -2667,8 +2670,8 @@ int ff_mpeg4_decode_picture_header(Mpeg4DecContext *ctx, GetBitContext *gb)

        if (startcode >= 0x120 && startcode <= 0x12F) {
            if (vol) {
-                av_log(s->avctx, AV_LOG_ERROR, "Multiple VOL headers");
-                return AVERROR_INVALIDDATA;
+                av_log(s->avctx, AV_LOG_WARNING, "Ignoring multiple VOL headers\n");
+                continue;
            }
            vol++;
            if ((ret = decode_vol_header(ctx, gb)) < 0)
@@ -161,6 +161,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
    int orig_size      = buf_size;
    int keyframe, ret;
    int size_change = 0;
+    int minsize = 0;
    int result, init_frame = !avctx->frame_number;
    enum {
        NUV_UNCOMPRESSED  = '0',
@@ -198,6 +199,9 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
    case NUV_RTJPEG_IN_LZO:
    case NUV_RTJPEG:
        keyframe = !buf[2];
+        if (c->width < 16 || c->height < 16) {
+            return AVERROR_INVALIDDATA;
+        }
        break;
    case NUV_COPY_LAST:
        keyframe = 0;
@@ -206,6 +210,16 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
        keyframe = 1;
        break;
    }
+    switch (comptype) {
+    case NUV_UNCOMPRESSED:
+        minsize = c->width * c->height * 3 / 2;
+        break;
+    case NUV_RTJPEG:
+        minsize = c->width/16 * (c->height/16) * 6;
+        break;
+    }
+    if (buf_size < minsize / 4)
+        return AVERROR_INVALIDDATA;
 retry:
    // Skip the rest of the frame header.
    buf       = &buf[12];
@@ -1281,12 +1281,9 @@ av_cold int ff_nvenc_encode_close(AVCodecContext *avctx)
    av_fifo_freep(&ctx->output_surface_queue);

    if (ctx->surfaces && avctx->pix_fmt == AV_PIX_FMT_CUDA) {
-        for (i = 0; i < ctx->nb_surfaces; ++i) {
-            if (ctx->surfaces[i].input_surface) {
-                 p_nvenc->nvEncUnmapInputResource(ctx->nvencoder, ctx->surfaces[i].in_map.mappedResource);
-            }
-        }
        for (i = 0; i < ctx->nb_registered_frames; i++) {
+            if (ctx->registered_frames[i].mapped)
+                p_nvenc->nvEncUnmapInputResource(ctx->nvencoder, ctx->registered_frames[i].in_map.mappedResource);
            if (ctx->registered_frames[i].regptr)
                p_nvenc->nvEncUnregisterResource(ctx->nvencoder, ctx->registered_frames[i].regptr);
        }
@@ -1416,6 +1413,7 @@ static int nvenc_find_free_reg_resource(AVCodecContext *avctx)
    NvencContext *ctx = avctx->priv_data;
    NvencDynLoadFunctions *dl_fn = &ctx->nvenc_dload_funcs;
    NV_ENCODE_API_FUNCTION_LIST *p_nvenc = &dl_fn->nvenc_funcs;
+    NVENCSTATUS nv_status;

    int i;

@@ -1423,8 +1421,10 @@ static int nvenc_find_free_reg_resource(AVCodecContext *avctx)
        for (i = 0; i < ctx->nb_registered_frames; i++) {
            if (!ctx->registered_frames[i].mapped) {
                if (ctx->registered_frames[i].regptr) {
-                    p_nvenc->nvEncUnregisterResource(ctx->nvencoder,
-                                                ctx->registered_frames[i].regptr);
+                    nv_status = p_nvenc->nvEncUnregisterResource(ctx->nvencoder, ctx->registered_frames[i].regptr);
+                    if (nv_status != NV_ENC_SUCCESS)
+                        return nvenc_print_error(avctx, nv_status, "Failed unregistering unused input resource");
+                    ctx->registered_frames[i].ptr = 0;
                    ctx->registered_frames[i].regptr = NULL;
                }
                return i;
@@ -1503,19 +1503,23 @@ static int nvenc_upload_frame(AVCodecContext *avctx, const AVFrame *frame,
        if (res < 0)
            return res;

-        nvenc_frame->in_map.version = NV_ENC_MAP_INPUT_RESOURCE_VER;
-        nvenc_frame->in_map.registeredResource = ctx->registered_frames[reg_idx].regptr;
-        nv_status = p_nvenc->nvEncMapInputResource(ctx->nvencoder, &nvenc_frame->in_map);
-        if (nv_status != NV_ENC_SUCCESS) {
-            av_frame_unref(nvenc_frame->in_ref);
-            return nvenc_print_error(avctx, nv_status, "Error mapping an input resource");
+        if (!ctx->registered_frames[reg_idx].mapped) {
+            ctx->registered_frames[reg_idx].in_map.version = NV_ENC_MAP_INPUT_RESOURCE_VER;
+            ctx->registered_frames[reg_idx].in_map.registeredResource = ctx->registered_frames[reg_idx].regptr;
+            nv_status = p_nvenc->nvEncMapInputResource(ctx->nvencoder, &ctx->registered_frames[reg_idx].in_map);
+            if (nv_status != NV_ENC_SUCCESS) {
+                av_frame_unref(nvenc_frame->in_ref);
+                return nvenc_print_error(avctx, nv_status, "Error mapping an input resource");
+            }
        }

-        ctx->registered_frames[reg_idx].mapped = 1;
+        ctx->registered_frames[reg_idx].mapped += 1;
+
        nvenc_frame->reg_idx                   = reg_idx;
-        nvenc_frame->input_surface             = nvenc_frame->in_map.mappedResource;
-        nvenc_frame->format                    = nvenc_frame->in_map.mappedBufferFmt;
+        nvenc_frame->input_surface             = ctx->registered_frames[reg_idx].in_map.mappedResource;
+        nvenc_frame->format                    = ctx->registered_frames[reg_idx].in_map.mappedBufferFmt;
        nvenc_frame->pitch                     = frame->linesize[0];
+
        return 0;
    } else {
        NV_ENC_LOCK_INPUT_BUFFER lockBufferParams = { 0 };
@@ -1660,14 +1664,33 @@ static int process_output_surface(AVCodecContext *avctx, AVPacket *pkt, NvencSur
    memcpy(pkt->data, lock_params.bitstreamBufferPtr, lock_params.bitstreamSizeInBytes);

    nv_status = p_nvenc->nvEncUnlockBitstream(ctx->nvencoder, tmpoutsurf->output_surface);
-    if (nv_status != NV_ENC_SUCCESS)
-        nvenc_print_error(avctx, nv_status, "Failed unlocking bitstream buffer, expect the gates of mordor to open");
+    if (nv_status != NV_ENC_SUCCESS) {
+        res = nvenc_print_error(avctx, nv_status, "Failed unlocking bitstream buffer, expect the gates of mordor to open");
+        goto error;
+    }


    if (avctx->pix_fmt == AV_PIX_FMT_CUDA) {
-        p_nvenc->nvEncUnmapInputResource(ctx->nvencoder, tmpoutsurf->in_map.mappedResource);
+        ctx->registered_frames[tmpoutsurf->reg_idx].mapped -= 1;
+        if (ctx->registered_frames[tmpoutsurf->reg_idx].mapped == 0) {
+            nv_status = p_nvenc->nvEncUnmapInputResource(ctx->nvencoder, ctx->registered_frames[tmpoutsurf->reg_idx].in_map.mappedResource);
+            if (nv_status != NV_ENC_SUCCESS) {
+                res = nvenc_print_error(avctx, nv_status, "Failed unmapping input resource");
+                goto error;
+            }
+            nv_status = p_nvenc->nvEncUnregisterResource(ctx->nvencoder, ctx->registered_frames[tmpoutsurf->reg_idx].regptr);
+            if (nv_status != NV_ENC_SUCCESS) {
+                res = nvenc_print_error(avctx, nv_status, "Failed unregistering input resource");
+                goto error;
+            }
+            ctx->registered_frames[tmpoutsurf->reg_idx].ptr = 0;
+            ctx->registered_frames[tmpoutsurf->reg_idx].regptr = NULL;
+        } else if (ctx->registered_frames[tmpoutsurf->reg_idx].mapped < 0) {
+            res = AVERROR_BUG;
+            goto error;
+        }
+
        av_frame_unref(tmpoutsurf->in_ref);
-        ctx->registered_frames[tmpoutsurf->reg_idx].mapped = 0;

        tmpoutsurf->input_surface = NULL;
    }
@@ -35,7 +35,6 @@ typedef struct NvencSurface
 {
    NV_ENC_INPUT_PTR input_surface;
    AVFrame *in_ref;
-    NV_ENC_MAP_INPUT_RESOURCE in_map;
    int reg_idx;
    int width;
    int height;
@@ -118,6 +117,7 @@ typedef struct NvencContext
        CUdeviceptr ptr;
        NV_ENC_REGISTERED_PTR regptr;
        int mapped;
+        NV_ENC_MAP_INPUT_RESOURCE in_map;
    } registered_frames[MAX_REGISTERED_FRAMES];
    int nb_registered_frames;

@@ -43,6 +43,7 @@ static const uint8_t *parse_opus_ts_header(const uint8_t *start, int *payload_le
    const uint8_t *buf = start + 1;
    int start_trim_flag, end_trim_flag, control_extension_flag, control_extension_length;
    uint8_t flags;
+    uint64_t payload_len_tmp;

    GetByteContext gb;
    bytestream2_init(&gb, buf, buf_len);
@@ -52,11 +53,11 @@ static const uint8_t *parse_opus_ts_header(const uint8_t *start, int *payload_le
    end_trim_flag          = (flags >> 3) & 1;
    control_extension_flag = (flags >> 2) & 1;

-    *payload_len = 0;
+    payload_len_tmp = *payload_len = 0;
    while (bytestream2_peek_byte(&gb) == 0xff)
-        *payload_len += bytestream2_get_byte(&gb);
+        payload_len_tmp += bytestream2_get_byte(&gb);

-    *payload_len += bytestream2_get_byte(&gb);
+    payload_len_tmp += bytestream2_get_byte(&gb);

    if (start_trim_flag)
        bytestream2_skip(&gb, 2);
@@ -67,6 +68,11 @@ static const uint8_t *parse_opus_ts_header(const uint8_t *start, int *payload_le
        bytestream2_skip(&gb, control_extension_length);
    }

+    if (bytestream2_tell(&gb) + payload_len_tmp > buf_len)
+        return NULL;
+
+    *payload_len = payload_len_tmp;
+
    return buf + bytestream2_tell(&gb);
 }

@@ -104,6 +110,10 @@ static int opus_find_frame_end(AVCodecParserContext *ctx, AVCodecContext *avctx,
            state = (state << 8) | payload[i];
            if ((state & OPUS_TS_MASK) == OPUS_TS_HEADER) {
                payload = parse_opus_ts_header(payload, &payload_len, buf_size - i);
+                if (!payload) {
+                    av_log(avctx, AV_LOG_ERROR, "Error parsing Ogg TS header.\n");
+                    return AVERROR_INVALIDDATA;
+                }
                *header_len = payload - buf;
                start_found = 1;
                break;
@@ -78,6 +78,7 @@ static av_cold int paf_video_init(AVCodecContext *avctx)
 {
    PAFVideoDecContext *c = avctx->priv_data;
    int i;
+    int ret;

    c->width  = avctx->width;
    c->height = avctx->height;
@@ -90,6 +91,9 @@ static av_cold int paf_video_init(AVCodecContext *avctx)
    }

    avctx->pix_fmt = AV_PIX_FMT_PAL8;
+    ret = av_image_check_size2(avctx->width, FFALIGN(avctx->height, 256), avctx->max_pixels, avctx->pix_fmt, 0, avctx);
+    if (ret < 0)
+        return ret;

    c->pic = av_frame_alloc();
    if (!c->pic)
@@ -1585,7 +1585,7 @@ int ff_rv34_decode_update_thread_context(AVCodecContext *dst, const AVCodecConte

    // Do no call ff_mpeg_update_thread_context on a partially initialized
    // decoder context.
-    if (!s1->linesize)
+    if (!s1->context_initialized)
        return 0;

    return ff_mpeg_update_thread_context(dst, src);
@@ -1733,6 +1733,8 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
            if ((err = rv34_decoder_realloc(r)) < 0)
                return err;
        }
+        if (faulty_b)
+            return AVERROR_INVALIDDATA;
        s->pict_type = si.type ? si.type : AV_PICTURE_TYPE_I;
        if (ff_mpv_frame_start(s, s->avctx) < 0)
            return -1;
@@ -1783,8 +1785,6 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
               "multithreading mode (start MB is %d).\n", si.start);
        return AVERROR_INVALIDDATA;
    }
-    if (faulty_b)
-        return AVERROR_INVALIDDATA;

    for(i = 0; i < slice_count; i++){
        int offset  = get_slice_offset(avctx, slices_hdr, i  , slice_count, buf_size);
@@ -679,6 +679,8 @@ static int decompress_p(AVCodecContext *avctx,
                                return AVERROR_INVALIDDATA;

                            if (bx == 0) {
+                                if (by < 2)
+                                    return AVERROR_INVALIDDATA;
                                z = backstep;
                            } else {
                                z = 0;
@@ -708,6 +710,8 @@ static int decompress_p(AVCodecContext *avctx,
                                return AVERROR_INVALIDDATA;

                            if (bx == 0) {
+                                if (by < 2)
+                                    return AVERROR_INVALIDDATA;
                                z = backstep;
                            } else {
                                z = 0;
@@ -438,6 +438,10 @@ static int smc_decode_frame(AVCodecContext *avctx,
    int pal_size;
    const uint8_t *pal = av_packet_get_side_data(avpkt, AV_PKT_DATA_PALETTE, &pal_size);
    int ret;
+    int total_blocks = ((s->avctx->width + 3) / 4) * ((s->avctx->height + 3) / 4);
+
+    if (total_blocks / 1024 > avpkt->size)
+        return AVERROR_INVALIDDATA;

    bytestream2_init(&s->gb, buf, buf_size);

@@ -363,9 +363,10 @@ static int decode_header(SnowContext *s){
                int htaps, i, sum=0;
                Plane *p= &s->plane[plane_index];
                p->diag_mc= get_rac(&s->c, s->header_state);
-                htaps= get_symbol(&s->c, s->header_state, 0)*2 + 2;
-                if((unsigned)htaps >= HTAPS_MAX || htaps==0)
+                htaps= get_symbol(&s->c, s->header_state, 0);
+                if((unsigned)htaps >= HTAPS_MAX/2 - 1)
                    return AVERROR_INVALIDDATA;
+                htaps = htaps*2 + 2;
                p->htaps= htaps;
                for(i= htaps/2; i; i--){
                    p->hcoeff[i]= get_symbol(&s->c, s->header_state, 0) * (1-2*(i&1));
@@ -35,6 +35,7 @@
 #define av_freep(p) while(0)
 #define AVCODEC_AVCODEC_H
 #define AVCODEC_INTERNAL_H
+#define AV_INPUT_BUFFER_PADDING_SIZE 64 // the value does not matter for this
 #include "tableprint.h"
 #include "get_bits.h"
 #include "mathtables.c"
@@ -63,6 +63,7 @@ typedef struct TM2Context {
    AVFrame *pic;

    GetBitContext gb;
+    int error;
    BswapDSPContext bdsp;

    uint8_t *buffer;
@@ -398,6 +399,7 @@ static inline int GET_TOK(TM2Context *ctx,int type)
 {
    if (ctx->tok_ptrs[type] >= ctx->tok_lens[type]) {
        av_log(ctx->avctx, AV_LOG_ERROR, "Read token from stream %i out of bounds (%i>=%i)\n", type, ctx->tok_ptrs[type], ctx->tok_lens[type]);
+        ctx->error = 1;
        return 0;
    }
    if (type <= TM2_MOT) {
@@ -441,8 +443,8 @@ static inline int GET_TOK(TM2Context *ctx,int type)

 /* recalculate last and delta values for next blocks */
 #define TM2_RECALC_BLOCK(CHR, stride, last, CD) {\
-    CD[0] = CHR[1] - last[1];\
-    CD[1] = (int)CHR[stride + 1] - (int)CHR[1];\
+    CD[0] = (unsigned)CHR[         1] - (unsigned)last[1];\
+    CD[1] = (unsigned)CHR[stride + 1] - (unsigned) CHR[1];\
    last[0] = (int)CHR[stride + 0];\
    last[1] = (int)CHR[stride + 1];}

@@ -809,6 +811,8 @@ static int tm2_decode_blocks(TM2Context *ctx, AVFrame *p)
            default:
                av_log(ctx->avctx, AV_LOG_ERROR, "Skipping unknown block type %i\n", type);
            }
+            if (ctx->error)
+                return AVERROR_INVALIDDATA;
        }
    }

@@ -889,6 +893,8 @@ static int decode_frame(AVCodecContext *avctx,
    int offset           = TM2_HEADER_SIZE;
    int i, t, ret;

+    l->error = 0;
+
    av_fast_padded_malloc(&l->buffer, &l->buffer_size, buf_size);
    if (!l->buffer) {
        av_log(avctx, AV_LOG_ERROR, "Cannot allocate temporary buffer\n");
@@ -116,6 +116,9 @@ static int truemotion2rt_decode_frame(AVCodecContext *avctx, void *data,
    if (ret < 0)
        return ret;

+    if (avctx->width / s->hscale * avctx->height * s->delta_size > avpkt->size * 8LL * 4)
+        return AVERROR_INVALIDDATA;
+
    ret = init_get_bits8(gb, avpkt->data + ret, avpkt->size - ret);
    if (ret < 0)
        return ret;
@@ -50,6 +50,8 @@ static av_cold int ulti_decode_init(AVCodecContext *avctx)
    s->width = avctx->width;
    s->height = avctx->height;
    s->blocks = (s->width / 8) * (s->height / 8);
+    if (s->blocks == 0)
+        return AVERROR_INVALIDDATA;
    avctx->pix_fmt = AV_PIX_FMT_YUV410P;
    s->ulti_codebook = ulti_codebook;

@@ -418,7 +418,10 @@ void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height,

    *width  = FFALIGN(*width, w_align);
    *height = FFALIGN(*height, h_align);
-    if (s->codec_id == AV_CODEC_ID_H264 || s->lowres) {
+    if (s->codec_id == AV_CODEC_ID_H264 || s->lowres ||
+        s->codec_id == AV_CODEC_ID_VP5  || s->codec_id == AV_CODEC_ID_VP6 ||
+        s->codec_id == AV_CODEC_ID_VP6F || s->codec_id == AV_CODEC_ID_VP6A
+    ) {
        // some of the optimized chroma MC reads one line too much
        // which is also done in mpeg decoders with lowres > 0
        *height += 2;
@@ -1270,7 +1273,7 @@ int attribute_align_arg avcodec_open2(AVCodecContext *avctx, const AVCodec *code
    if (ret < 0)
        return ret;

-    avctx->internal = av_mallocz(sizeof(AVCodecInternal));
+    avctx->internal = av_mallocz(sizeof(*avctx->internal));
    if (!avctx->internal) {
        ret = AVERROR(ENOMEM);
        goto end;
@@ -2795,7 +2798,7 @@ void avsubtitle_free(AVSubtitle *sub)

    av_freep(&sub->rects);

-    memset(sub, 0, sizeof(AVSubtitle));
+    memset(sub, 0, sizeof(*sub));
 }

 static int do_decode(AVCodecContext *avctx, AVPacket *pkt)
@@ -28,6 +28,7 @@
 #include <stdlib.h>

 #include "libavutil/intreadwrite.h"
+#include "libavutil/pixdesc.h"
 #include "avcodec.h"
 #include "bswapdsp.h"
 #include "bytestream.h"
@@ -638,7 +639,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
            for (j = 0; j < c->slices; j++) {
                slice_end   = bytestream2_get_le32u(&gb);
                if (slice_end < 0 || slice_end < slice_start ||
-                    bytestream2_get_bytes_left(&gb) < slice_end) {
+                    bytestream2_get_bytes_left(&gb) < slice_end + 1024LL) {
                    av_log(avctx, AV_LOG_ERROR, "Incorrect slice size\n");
                    return AVERROR_INVALIDDATA;
                }
@@ -824,43 +825,13 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
 static av_cold int decode_init(AVCodecContext *avctx)
 {
    UtvideoContext * const c = avctx->priv_data;
+    int h_shift, v_shift;

    c->avctx = avctx;

    ff_bswapdsp_init(&c->bdsp);
    ff_llviddsp_init(&c->llviddsp);

-    if (avctx->extradata_size >= 16) {
-        av_log(avctx, AV_LOG_DEBUG, "Encoder version %d.%d.%d.%d\n",
-               avctx->extradata[3], avctx->extradata[2],
-               avctx->extradata[1], avctx->extradata[0]);
-        av_log(avctx, AV_LOG_DEBUG, "Original format %"PRIX32"\n",
-               AV_RB32(avctx->extradata + 4));
-        c->frame_info_size = AV_RL32(avctx->extradata + 8);
-        c->flags           = AV_RL32(avctx->extradata + 12);
-
-        if (c->frame_info_size != 4)
-            avpriv_request_sample(avctx, "Frame info not 4 bytes");
-        av_log(avctx, AV_LOG_DEBUG, "Encoding parameters %08"PRIX32"\n", c->flags);
-        c->slices      = (c->flags >> 24) + 1;
-        c->compression = c->flags & 1;
-        c->interlaced  = c->flags & 0x800;
-    } else if (avctx->extradata_size == 8) {
-        av_log(avctx, AV_LOG_DEBUG, "Encoder version %d.%d.%d.%d\n",
-               avctx->extradata[3], avctx->extradata[2],
-               avctx->extradata[1], avctx->extradata[0]);
-        av_log(avctx, AV_LOG_DEBUG, "Original format %"PRIX32"\n",
-               AV_RB32(avctx->extradata + 4));
-        c->interlaced  = 0;
-        c->pro         = 1;
-        c->frame_info_size = 4;
-    } else {
-        av_log(avctx, AV_LOG_ERROR,
-               "Insufficient extradata size %d, should be at least 16\n",
-               avctx->extradata_size);
-        return AVERROR_INVALIDDATA;
-    }
-
    c->slice_bits_size = 0;

    switch (avctx->codec_tag) {
@@ -889,14 +860,17 @@ static av_cold int decode_init(AVCodecContext *avctx)
        break;
    case MKTAG('U', 'Q', 'Y', '2'):
        c->planes      = 3;
+        c->pro         = 1;
        avctx->pix_fmt = AV_PIX_FMT_YUV422P10;
        break;
    case MKTAG('U', 'Q', 'R', 'G'):
        c->planes      = 3;
+        c->pro         = 1;
        avctx->pix_fmt = AV_PIX_FMT_GBRP10;
        break;
    case MKTAG('U', 'Q', 'R', 'A'):
        c->planes      = 4;
+        c->pro         = 1;
        avctx->pix_fmt = AV_PIX_FMT_GBRAP10;
        break;
    case MKTAG('U', 'L', 'H', '0'):
@@ -920,6 +894,43 @@ static av_cold int decode_init(AVCodecContext *avctx)
        return AVERROR_INVALIDDATA;
    }

+    av_pix_fmt_get_chroma_sub_sample(avctx->pix_fmt, &h_shift, &v_shift);
+    if ((avctx->width  & ((1<<h_shift)-1)) ||
+        (avctx->height & ((1<<v_shift)-1))) {
+        avpriv_request_sample(avctx, "Odd dimensions");
+        return AVERROR_PATCHWELCOME;
+    }
+
+    if (!c->pro && avctx->extradata_size >= 16) {
+        av_log(avctx, AV_LOG_DEBUG, "Encoder version %d.%d.%d.%d\n",
+               avctx->extradata[3], avctx->extradata[2],
+               avctx->extradata[1], avctx->extradata[0]);
+        av_log(avctx, AV_LOG_DEBUG, "Original format %"PRIX32"\n",
+               AV_RB32(avctx->extradata + 4));
+        c->frame_info_size = AV_RL32(avctx->extradata + 8);
+        c->flags           = AV_RL32(avctx->extradata + 12);
+
+        if (c->frame_info_size != 4)
+            avpriv_request_sample(avctx, "Frame info not 4 bytes");
+        av_log(avctx, AV_LOG_DEBUG, "Encoding parameters %08"PRIX32"\n", c->flags);
+        c->slices      = (c->flags >> 24) + 1;
+        c->compression = c->flags & 1;
+        c->interlaced  = c->flags & 0x800;
+    } else if (c->pro && avctx->extradata_size == 8) {
+        av_log(avctx, AV_LOG_DEBUG, "Encoder version %d.%d.%d.%d\n",
+               avctx->extradata[3], avctx->extradata[2],
+               avctx->extradata[1], avctx->extradata[0]);
+        av_log(avctx, AV_LOG_DEBUG, "Original format %"PRIX32"\n",
+               AV_RB32(avctx->extradata + 4));
+        c->interlaced  = 0;
+        c->frame_info_size = 4;
+    } else {
+        av_log(avctx, AV_LOG_ERROR,
+               "Insufficient extradata size %d, should be at least 16\n",
+               avctx->extradata_size);
+        return AVERROR_INVALIDDATA;
+    }
+
    return 0;
 }

@@ -951,9 +951,11 @@ static int unpack_vlcs(Vp3DecodeContext *s, GetBitContext *gb,
    Vp3Fragment *all_fragments = s->all_fragments;
    VLC_TYPE(*vlc_table)[2] = table->table;

-    if (num_coeffs < 0)
+    if (num_coeffs < 0) {
        av_log(s->avctx, AV_LOG_ERROR,
               "Invalid number of coefficients at level %d\n", coeff_index);
+        return AVERROR_INVALIDDATA;
+    }

    if (eob_run > num_coeffs) {
        coeff_i      =
@@ -978,6 +980,9 @@ static int unpack_vlcs(Vp3DecodeContext *s, GetBitContext *gb,
            if (eob_run_get_bits[token])
                eob_run += get_bits(gb, eob_run_get_bits[token]);

+            if (!eob_run)
+                eob_run = INT_MAX;
+
            // record only the number of blocks ended in this plane,
            // any spill will be recorded in the next plane.
            if (eob_run > num_coeffs - coeff_i) {
@@ -606,6 +606,8 @@ static int vp7_decode_frame_header(VP8Context *s, const uint8_t *buf, int buf_si
            s->fade_present = vp8_rac_get(c);
    }

+    if (c->end <= c->buffer && c->bits >= 0)
+        return AVERROR_INVALIDDATA;
    /* E. Fading information for previous frame */
    if (s->fade_present && vp8_rac_get(c)) {
        if ((ret = vp7_fade_frame(s ,c)) < 0)
@@ -480,7 +480,7 @@ static inline int wv_unpack_stereo(WavpackFrameContext *s, GetBitContext *gb,
        }

        if (type == AV_SAMPLE_FMT_S16P) {
-            if (FFABS(L) + (unsigned)FFABS(R) > (1<<19)) {
+            if (FFABS((int64_t)L) + FFABS((int64_t)R) > (1<<19)) {
                av_log(s->avctx, AV_LOG_ERROR, "sample %d %d too large\n", L, R);
                return AVERROR_INVALIDDATA;
            }
@@ -1148,6 +1148,7 @@ static void save_bits(WmallDecodeCtx *s, GetBitContext* gb, int len,
    if (len <= 0 || buflen > s->max_frame_size) {
        avpriv_request_sample(s->avctx, "Too small input buffer");
        s->packet_loss = 1;
+        s->num_saved_bits = 0;
        return;
    }

@@ -1255,7 +1256,9 @@ static int decode_packet(AVCodecContext *avctx, void *data, int *got_frame_ptr,
            (frame_size = show_bits(gb, s->log2_frame_size)) &&
            frame_size <= remaining_bits(s, gb)) {
            save_bits(s, gb, frame_size, 0);
-            s->packet_done = !decode_frame(s);
+
+            if (!s->packet_loss)
+                s->packet_done = !decode_frame(s);
        } else if (!s->len_prefix
                   && s->num_saved_bits > get_bits_count(&s->gb)) {
            /* when the frames do not have a length prefix, we don't know the
@@ -573,7 +573,8 @@ static int export(AVFilterContext *ctx, StreamContext *sc, int input)
        /* error already handled */
        av_assert0(av_get_frame_filename(filename, sizeof(filename), sic->filename, input) == 0);
    } else {
-        strcpy(filename, sic->filename);
+        if (av_strlcpy(filename, sic->filename, sizeof(filename)) >= sizeof(filename))
+            return AVERROR(EINVAL);
    }
    if (sic->format == FORMAT_XML) {
        return xml_export(ctx, sc, filename);
@@ -27,6 +27,7 @@

 #include <stdio.h>

+#include "libavutil/avassert.h"
 #include "libavutil/imgutils.h"
 #include "libavutil/internal.h"
 #include "libavutil/intreadwrite.h"
@@ -54,6 +55,7 @@ enum TransposeDir {
 typedef struct TransContext {
    const AVClass *class;
    int hsub, vsub;
+    int planes;
    int pixsteps[4];

    int passthrough;    ///< PassthroughType, landscape passthrough mode enabled
@@ -106,6 +108,10 @@ static int config_props_output(AVFilterLink *outlink)

    s->hsub = desc_in->log2_chroma_w;
    s->vsub = desc_in->log2_chroma_h;
+    s->planes = av_pix_fmt_count_planes(outlink->format);
+
+    av_assert0(desc_in->nb_components == desc_out->nb_components);
+

    av_image_fill_max_pixsteps(s->pixsteps, NULL, desc_out);

@@ -148,7 +154,7 @@ static int filter_slice(AVFilterContext *ctx, void *arg, int jobnr,
    AVFrame *in = td->in;
    int plane;

-    for (plane = 0; out->data[plane]; plane++) {
+    for (plane = 0; plane < s->planes; plane++) {
        int hsub    = plane == 1 || plane == 2 ? s->hsub : 0;
        int vsub    = plane == 1 || plane == 2 ? s->vsub : 0;
        int pixstep = s->pixsteps[plane];
@@ -670,7 +670,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
            st->start_time = 0;
            avio_rl32(pb); /* buffer size */
            avio_rl32(pb); /* quality */
-            if (ast->cum_len*ast->scale/ast->rate > 3600) {
+            if (ast->cum_len > 3600LL * ast->rate / ast->scale) {
                av_log(s, AV_LOG_ERROR, "crazy start time, iam scared, giving up\n");
                ast->cum_len = 0;
            }
@@ -669,6 +669,8 @@ static uint8_t *nal_unit_extract_rbsp(const uint8_t *src, uint32_t src_len,
    while (i < src_len)
        dst[len++] = src[i++];

+    memset(dst + len, 0, AV_INPUT_BUFFER_PADDING_SIZE);
+
    *dst_len = len;
    return dst;
 }
@@ -103,7 +103,7 @@ static av_cold int libssh_authentication(LIBSSHContext *libssh, const char *user
        }
    }

-    if (!authorized && (auth_methods & SSH_AUTH_METHOD_PASSWORD)) {
+    if (!authorized && password && (auth_methods & SSH_AUTH_METHOD_PASSWORD)) {
        if (ssh_userauth_password(libssh->session, NULL, password) == SSH_AUTH_SUCCESS) {
            av_log(libssh, AV_LOG_DEBUG, "Authentication successful with password.\n");
            authorized = 1;
@@ -212,6 +212,7 @@ static int lrc_read_header(AVFormatContext *s)
    }
    ff_subtitles_queue_finalize(s, &lrc->q);
    ff_metadata_conv_ctx(s, NULL, ff_lrc_metadata_conv);
+    av_bprint_finalize(&line, NULL);
    return 0;
 }

@@ -2071,8 +2071,16 @@ static int matroska_parse_tracks(AVFormatContext *s)
        }

        if (track->type == MATROSKA_TRACK_TYPE_VIDEO) {
-            if (!track->default_duration && track->video.frame_rate > 0)
-                track->default_duration = 1000000000 / track->video.frame_rate;
+            if (!track->default_duration && track->video.frame_rate > 0) {
+                double default_duration = 1000000000 / track->video.frame_rate;
+                if (default_duration > UINT64_MAX || default_duration < 0) {
+                    av_log(matroska->ctx, AV_LOG_WARNING,
+                         "Invalid frame rate %e. Cannot calculate default duration.\n",
+                         track->video.frame_rate);
+                } else {
+                    track->default_duration = default_duration;
+                }
+            }
            if (track->video.display_width == -1)
                track->video.display_width = track->video.pixel_width;
            if (track->video.display_height == -1)
@@ -2391,6 +2391,12 @@ static int mov_read_stsd(MOVContext *c, AVIOContext *pb, MOVAtom atom)

    return mov_finalize_stsd_codec(c, pb, st, sc);
 fail:
+    if (sc->extradata) {
+        int j;
+        for (j = 0; j < sc->stsd_count; j++)
+            av_freep(&sc->extradata[j]);
+    }
+
    av_freep(&sc->extradata);
    av_freep(&sc->extradata_size);
    return ret;
@@ -2433,6 +2439,21 @@ static int mov_read_stsc(MOVContext *c, AVIOContext *pb, MOVAtom atom)
    }

    sc->stsc_count = i;
+    for (i = sc->stsc_count - 1; i < UINT_MAX; i--) {
+        if ((i+1 < sc->stsc_count && sc->stsc_data[i].first >= sc->stsc_data[i+1].first) ||
+            (i > 0 && sc->stsc_data[i].first <= sc->stsc_data[i-1].first) ||
+            sc->stsc_data[i].first < 1 ||
+            sc->stsc_data[i].count < 1 ||
+            sc->stsc_data[i].id < 1) {
+            av_log(c->fc, AV_LOG_WARNING, "STSC entry %d is invalid (first=%d count=%d id=%d)\n", i, sc->stsc_data[i].first, sc->stsc_data[i].count, sc->stsc_data[i].id);
+            if (i+1 >= sc->stsc_count || sc->stsc_data[i+1].first < 2)
+                return AVERROR_INVALIDDATA;
+            // We replace this entry by the next valid
+            sc->stsc_data[i].first = sc->stsc_data[i+1].first - 1;
+            sc->stsc_data[i].count = sc->stsc_data[i+1].count;
+            sc->stsc_data[i].id    = sc->stsc_data[i+1].id;
+        }
+    }

    if (pb->eof_reached)
        return AVERROR_EOF;
@@ -2672,14 +2693,19 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
            && total_sample_count > 100
            && sample_duration/10 > duration / total_sample_count)
            sample_duration = duration / total_sample_count;
-        duration+=(int64_t)sample_duration*sample_count;
+        duration+=(int64_t)sample_duration*(uint64_t)sample_count;
        total_sample_count+=sample_count;
    }

    sc->stts_count = i;

-    sc->duration_for_fps  += duration;
-    sc->nb_frames_for_fps += total_sample_count;
+    if (duration > 0 &&
+        duration <= INT64_MAX - sc->duration_for_fps &&
+        total_sample_count <= INT64_MAX - sc->nb_frames_for_fps
+    ) {
+        sc->duration_for_fps  += duration;
+        sc->nb_frames_for_fps += total_sample_count;
+    }

    if (pb->eof_reached)
        return AVERROR_EOF;
@@ -2950,7 +2976,7 @@ static int64_t add_ctts_entry(MOVStts** ctts_data, unsigned int* ctts_count, uns
        FFMAX(min_size_needed, 2 * (*allocated_size)) :
        min_size_needed;

-    if((unsigned)(*ctts_count) + 1 >= UINT_MAX / sizeof(MOVStts))
+    if((unsigned)(*ctts_count) >= UINT_MAX / sizeof(MOVStts) - 1)
        return -1;

    ctts_buf_new = av_fast_realloc(*ctts_data, allocated_size, requested_size);
@@ -3732,6 +3758,11 @@ static int mov_read_trak(MOVContext *c, AVIOContext *pb, MOVAtom atom)
               st->index);
        return 0;
    }
+    if (sc->stsc_count && sc->stsc_data[ sc->stsc_count - 1 ].first > sc->chunk_count) {
+        av_log(c->fc, AV_LOG_ERROR, "stream %d, contradictionary STSC and STCO\n",
+               st->index);
+        return AVERROR_INVALIDDATA;
+    }

    fix_timescale(c, sc);

@@ -4340,8 +4371,13 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom)
        dts += sample_duration;
        offset += sample_size;
        sc->data_size += sample_size;
-        sc->duration_for_fps += sample_duration;
-        sc->nb_frames_for_fps ++;
+
+        if (sample_duration <= INT64_MAX - sc->duration_for_fps &&
+            1 <= INT64_MAX - sc->nb_frames_for_fps
+        ) {
+            sc->duration_for_fps += sample_duration;
+            sc->nb_frames_for_fps ++;
+        }
    }

    if (pb->eof_reached)
@@ -128,7 +128,10 @@ static int ogg_restore(AVFormatContext *s)
    ogg->state = ost->next;

        for (i = 0; i < ogg->nstreams; i++) {
-            av_freep(&ogg->streams[i].buf);
+            struct ogg_stream *stream = &ogg->streams[i];
+            av_freep(&stream->buf);
+            av_freep(&stream->new_metadata);
+
            if (i >= ost->nstreams || !ost->streams[i].private) {
                free_stream(s, i);
            }
@@ -218,6 +218,7 @@ static int daala_packet(AVFormatContext *s, int idx)
    int seg, duration = 1;
    struct ogg *ogg = s->priv_data;
    struct ogg_stream *os = ogg->streams + idx;
+    int64_t pts;

    /*
     * first packet handling: here we parse the duration of each packet in the
@@ -230,7 +231,10 @@ static int daala_packet(AVFormatContext *s, int idx)
            if (os->segments[seg] < 255)
                duration++;

-        os->lastpts = os->lastdts = daala_gptopts(s, idx, os->granule, NULL) - duration;
+        pts = daala_gptopts(s, idx, os->granule, NULL);
+        if (pts != AV_NOPTS_VALUE)
+            pts -= duration;
+        os->lastpts = os->lastdts = pts;
        if(s->streams[idx]->start_time == AV_NOPTS_VALUE) {
            s->streams[idx]->start_time = os->lastpts;
            if (s->streams[idx]->duration != AV_NOPTS_VALUE)
@@ -177,11 +177,14 @@ ogm_packet(AVFormatContext *s, int idx)
        os->pflags |= AV_PKT_FLAG_KEY;

    lb = ((*p & 2) << 1) | ((*p >> 6) & 3);
+    if (os->psize < lb + 1)
+        return AVERROR_INVALIDDATA;
+
    os->pstart += lb + 1;
    os->psize -= lb + 1;

    while (lb--)
-        os->pduration += p[lb+1] << (lb*8);
+        os->pduration += (uint64_t)p[lb+1] << (lb*8);

    return 0;
 }
@@ -181,6 +181,7 @@ static int theora_packet(AVFormatContext *s, int idx)

    if ((!os->lastpts || os->lastpts == AV_NOPTS_VALUE) && !(os->flags & OGG_FLAG_EOS)) {
        int seg;
+        int64_t pts;

        duration = 1;
        for (seg = os->segp; seg < os->nsegs; seg++) {
@@ -188,7 +189,10 @@ static int theora_packet(AVFormatContext *s, int idx)
                duration ++;
        }

-        os->lastpts = os->lastdts   = theora_gptopts(s, idx, os->granule, NULL) - duration;
+        pts = theora_gptopts(s, idx, os->granule, NULL);
+        if (pts != AV_NOPTS_VALUE)
+            pts -= duration;
+        os->lastpts = os->lastdts = pts;
        if(s->streams[idx]->start_time == AV_NOPTS_VALUE) {
            s->streams[idx]->start_time = os->lastpts;
            if (s->streams[idx]->duration > 0)
@@ -230,6 +230,10 @@ static int fixup_vorbis_headers(AVFormatContext *as,

    len = priv->len[0] + priv->len[1] + priv->len[2];
    buf_len = len + len / 255 + 64;
+
+    if (*buf)
+        return AVERROR_INVALIDDATA;
+
    ptr = *buf = av_realloc(NULL, buf_len);
    if (!ptr)
        return AVERROR(ENOMEM);
@@ -1090,6 +1090,7 @@ static void update_initial_timestamps(AVFormatContext *s, int stream_index,
    if (st->first_dts != AV_NOPTS_VALUE ||
        dts           == AV_NOPTS_VALUE ||
        st->cur_dts   == AV_NOPTS_VALUE ||
+        st->cur_dts < INT_MIN + RELATIVE_TS_BASE ||
        is_relative(dts))
        return;

@@ -1732,10 +1733,10 @@ int av_read_frame(AVFormatContext *s, AVPacket *pkt)

            if (next_pkt->dts != AV_NOPTS_VALUE) {
                int wrap_bits = s->streams[next_pkt->stream_index]->pts_wrap_bits;
-                av_assert2(wrap_bits <= 64);
                // last dts seen for this stream. if any of packets following
                // current one had no dts, we will set this to AV_NOPTS_VALUE.
                int64_t last_dts = next_pkt->dts;
+                av_assert2(wrap_bits <= 64);
                while (pktl && next_pkt->pts == AV_NOPTS_VALUE) {
                    if (pktl->pkt.stream_index == next_pkt->stream_index &&
                        av_compare_mod(next_pkt->dts, pktl->pkt.dts, 2ULL << (wrap_bits - 1)) < 0) {
@@ -2608,7 +2609,7 @@ static void update_stream_timings(AVFormatContext *ic)
    else if (start_time > start_time_text)
        av_log(ic, AV_LOG_VERBOSE, "Ignoring outlier non primary stream starttime %f\n", start_time_text / (float)AV_TIME_BASE);

-    if (end_time == INT64_MIN || (end_time < end_time_text && end_time_text - end_time < AV_TIME_BASE)) {
+    if (end_time == INT64_MIN || (end_time < end_time_text && end_time_text - (uint64_t)end_time < AV_TIME_BASE)) {
        end_time = end_time_text;
    } else if (end_time < end_time_text) {
        av_log(ic, AV_LOG_VERBOSE, "Ignoring outlier non primary stream endtime %f\n", end_time_text / (float)AV_TIME_BASE);
@@ -3622,7 +3623,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
            if (st->info->fps_last_dts != AV_NOPTS_VALUE &&
                st->info->fps_last_dts_idx > st->info->fps_first_dts_idx &&
                (pkt->dts - st->info->fps_last_dts) / 1000 >
-                (st->info->fps_last_dts     - st->info->fps_first_dts) /
+                (st->info->fps_last_dts     - (uint64_t)st->info->fps_first_dts) /
                (st->info->fps_last_dts_idx - st->info->fps_first_dts_idx)) {
                av_log(ic, AV_LOG_WARNING,
                       "DTS discontinuity in stream %d: packet %d with DTS "
@@ -158,7 +158,7 @@ static av_always_inline av_const int64_t av_clip64_c(int64_t a, int64_t amin, in
 */
 static av_always_inline av_const uint8_t av_clip_uint8_c(int a)
 {
-    if (a&(~0xFF)) return (-a)>>31;
+    if (a&(~0xFF)) return (~a)>>31;
    else           return a;
 }

@@ -180,7 +180,7 @@ static av_always_inline av_const int8_t av_clip_int8_c(int a)
 */
 static av_always_inline av_const uint16_t av_clip_uint16_c(int a)
 {
-    if (a&(~0xFFFF)) return (-a)>>31;
+    if (a&(~0xFFFF)) return (~a)>>31;
    else             return a;
 }

@@ -69,8 +69,10 @@ int swr_set_matrix(struct SwrContext *s, const double *matrix, int stride)
        return AVERROR(EINVAL);
    memset(s->matrix, 0, sizeof(s->matrix));
    memset(s->matrix_flt, 0, sizeof(s->matrix_flt));
-    nb_in  = av_get_channel_layout_nb_channels(s->user_in_ch_layout);
-    nb_out = av_get_channel_layout_nb_channels(s->user_out_ch_layout);
+    nb_in = (s->user_in_ch_count > 0) ? s->user_in_ch_count :
+        av_get_channel_layout_nb_channels(s->user_in_ch_layout);
+    nb_out = (s->user_out_ch_count > 0) ? s->user_out_ch_count :
+        av_get_channel_layout_nb_channels(s->user_out_ch_layout);
    for (out = 0; out < nb_out; out++) {
        for (in = 0; in < nb_in; in++)
            s->matrix_flt[out][in] = s->matrix[out][in] = matrix[in];
@@ -678,7 +678,7 @@ static int swr_convert_internal(struct SwrContext *s, AudioData *out, int out_co
                            s->mix_2_1_simd(conv_src->ch[ch], preout->ch[ch], s->dither.noise.ch[ch] + s->dither.noise.bps * s->dither.noise_pos, s->native_simd_one, 0, 0, len1);
                    if(out_count != len1)
                        for(ch=0; ch<preout->ch_count; ch++)
-                            s->mix_2_1_f(conv_src->ch[ch] + off, preout->ch[ch] + off, s->dither.noise.ch[ch] + s->dither.noise.bps * s->dither.noise_pos + off + len1, s->native_one, 0, 0, out_count - len1);
+                            s->mix_2_1_f(conv_src->ch[ch] + off, preout->ch[ch] + off, s->dither.noise.ch[ch] + s->dither.noise.bps * s->dither.noise_pos + off, s->native_one, 0, 0, out_count - len1);
                } else {
                    for(ch=0; ch<preout->ch_count; ch++)
                        s->mix_2_1_f(conv_src->ch[ch], preout->ch[ch], s->dither.noise.ch[ch] + s->dither.noise.bps * s->dither.noise_pos, s->native_one, 0, 0, out_count);
@@ -3,354 +3,354 @@
 #codec_id 0: rawvideo
 #dimensions 0: 352x288
 #sar 0: 12/11
-0,          0,          0,        1,   152064, 0xd23ffc59
+0,          0,          0,        1,   152064, 0x8f9d00c1
 0,          1,          1,        1,   152064, 0x899fb8b1
-0,          2,          2,        1,   152064, 0x5958d070
+0,          2,          2,        1,   152064, 0x7225cb39
 0,          3,          3,        1,   152064, 0xf2becd8f
-0,          4,          4,        1,   152064, 0xb47bbed7
+0,          4,          4,        1,   152064, 0xd56bc556
 0,          5,          5,        1,   152064, 0x7ca54f36
-0,          6,          6,        1,   152064, 0x02389610
+0,          6,          6,        1,   152064, 0x06d7805c
 0,          7,          7,        1,   152064, 0x469f3f87
-0,          8,          8,        1,   152064, 0x935a780e
+0,          8,          8,        1,   152064, 0xdb2f57d5
 0,          9,          9,        1,   152064, 0x3876c20c
-0,         10,         10,        1,   152064, 0x49df265f
+0,         10,         10,        1,   152064, 0x5b670e79
 0,         11,         11,        1,   152064, 0xdfe420e0
-0,         12,         12,        1,   152064, 0x6e34a0c4
+0,         12,         12,        1,   152064, 0x17578222
 0,         13,         13,        1,   152064, 0x47e1cb26
-0,         14,         14,        1,   152064, 0x68e74188
+0,         14,         14,        1,   152064, 0x168e35d6
 0,         15,         15,        1,   152064, 0xe9d34b4e
-0,         16,         16,        1,   152064, 0xa8665e1a
+0,         16,         16,        1,   152064, 0x5e395308
 0,         17,         17,        1,   152064, 0x88e3b39f
-0,         18,         18,        1,   152064, 0x1c1ab2c3
+0,         18,         18,        1,   152064, 0x6b099c51
 0,         19,         19,        1,   152064, 0xb1a24ddf
-0,         20,         20,        1,   152064, 0x030d5afc
+0,         20,         20,        1,   152064, 0xcea840fc
 0,         21,         21,        1,   152064, 0x98306d64
-0,         22,         22,        1,   152064, 0x5ce0548d
+0,         22,         22,        1,   152064, 0xb05354d3
 0,         23,         23,        1,   152064, 0xacac26f3
-0,         24,         24,        1,   152064, 0xf167f698
+0,         24,         24,        1,   152064, 0xbccdf14b
 0,         25,         25,        1,   152064, 0xd9398539
-0,         26,         26,        1,   152064, 0xd7aec2c4
+0,         26,         26,        1,   152064, 0x07aec13a
 0,         27,         27,        1,   152064, 0xa6ef9440
-0,         28,         28,        1,   152064, 0xc289b278
+0,         28,         28,        1,   152064, 0x0e7ab64e
 0,         29,         29,        1,   152064, 0x3796939d
-0,         30,         30,        1,   152064, 0x48c09366
+0,         30,         30,        1,   152064, 0xcc219365
 0,         31,         31,        1,   152064, 0xf4cc815a
-0,         32,         32,        1,   152064, 0x1c63cdc2
+0,         32,         32,        1,   152064, 0x8b91c622
 0,         33,         33,        1,   152064, 0xd3a8ad8e
-0,         34,         34,        1,   152064, 0x70f94bc0
+0,         34,         34,        1,   152064, 0x658e498f
 0,         35,         35,        1,   152064, 0xf9c115ea
-0,         36,         36,        1,   152064, 0x44a2f607
+0,         36,         36,        1,   152064, 0xb639f8d2
 0,         37,         37,        1,   152064, 0x7e9eaa64
-0,         38,         38,        1,   152064, 0x37b86b68
+0,         38,         38,        1,   152064, 0x8a546bcf
 0,         39,         39,        1,   152064, 0x59d22dd4
-0,         40,         40,        1,   152064, 0x5d0d0e8d
+0,         40,         40,        1,   152064, 0x80a10edc
 0,         41,         41,        1,   152064, 0x5c97d4a1
-0,         42,         42,        1,   152064, 0xd44ef54d
+0,         42,         42,        1,   152064, 0x4f1bf025
 0,         43,         43,        1,   152064, 0x42721789
-0,         44,         44,        1,   152064, 0x27597277
+0,         44,         44,        1,   152064, 0x39e6700d
 0,         45,         45,        1,   152064, 0xdf4af8b4
-0,         46,         46,        1,   152064, 0x5df7390c
+0,         46,         46,        1,   152064, 0xacf839bb
 0,         47,         47,        1,   152064, 0xbebfbf7c
-0,         48,         48,        1,   152064, 0x753959bb
+0,         48,         48,        1,   152064, 0x09c7630d
 0,         49,         49,        1,   152064, 0x3331ab18
-0,         50,         50,        1,   152064, 0xec4a0f33
+0,         50,         50,        1,   152064, 0xae0f0f28
 0,         51,         51,        1,   152064, 0xbb085737
-0,         52,         52,        1,   152064, 0x3938abf4
+0,         52,         52,        1,   152064, 0x1e23ad39
 0,         53,         53,        1,   152064, 0x18d46683
-0,         54,         54,        1,   152064, 0xb12ace0c
+0,         54,         54,        1,   152064, 0x4eadd0a0
 0,         55,         55,        1,   152064, 0x09b13430
-0,         56,         56,        1,   152064, 0x85bd5e88
+0,         56,         56,        1,   152064, 0x240a607b
 0,         57,         57,        1,   152064, 0xec0f8a67
-0,         58,         58,        1,   152064, 0x51a4fc74
+0,         58,         58,        1,   152064, 0x6c37fc08
 0,         59,         59,        1,   152064, 0xded4cda7
-0,         60,         60,        1,   152064, 0xb69412a9
+0,         60,         60,        1,   152064, 0xc5df1477
 0,         61,         61,        1,   152064, 0x3c9de6f9
-0,         62,         62,        1,   152064, 0x223fcc41
+0,         62,         62,        1,   152064, 0xefd1cdbd
 0,         63,         63,        1,   152064, 0x5df7b89c
-0,         64,         64,        1,   152064, 0x1e58b37a
+0,         64,         64,        1,   152064, 0x1b04af5f
 0,         65,         65,        1,   152064, 0xbbff2c09
-0,         66,         66,        1,   152064, 0x4e0f4d4a
+0,         66,         66,        1,   152064, 0x23b04553
 0,         67,         67,        1,   152064, 0x3d99caa3
-0,         68,         68,        1,   152064, 0xcc329c2f
+0,         68,         68,        1,   152064, 0x35139bf8
 0,         69,         69,        1,   152064, 0x49207c0a
-0,         70,         70,        1,   152064, 0x489f2d50
+0,         70,         70,        1,   152064, 0xa78e2efa
 0,         71,         71,        1,   152064, 0x5a50b0df
-0,         72,         72,        1,   152064, 0x509eb79e
+0,         72,         72,        1,   152064, 0x3255b306
 0,         73,         73,        1,   152064, 0x60622c61
 0,         74,         74,        1,   152064, 0x8c8cde9f
 0,         75,         75,        1,   152064, 0xe8c0bb6c
-0,         76,         76,        1,   152064, 0xb03581b6
+0,         76,         76,        1,   152064, 0xbc698473
 0,         77,         77,        1,   152064, 0x398525c2
 0,         78,         78,        1,   152064, 0x87983ab0
 0,         79,         79,        1,   152064, 0x032af6b5
-0,         80,         80,        1,   152064, 0x7434baa4
+0,         80,         80,        1,   152064, 0x4878bb11
 0,         81,         81,        1,   152064, 0xff5dd044
-0,         82,         82,        1,   152064, 0x45b2bb36
+0,         82,         82,        1,   152064, 0xe675bfe0
 0,         83,         83,        1,   152064, 0x1af29008
 0,         84,         84,        1,   152064, 0x07aa8975
 0,         85,         85,        1,   152064, 0x17957756
 0,         86,         86,        1,   152064, 0x48b5825e
 0,         87,         87,        1,   152064, 0x169d70bc
-0,         88,         88,        1,   152064, 0x803b30c6
+0,         88,         88,        1,   152064, 0x326730c8
 0,         89,         89,        1,   152064, 0x6158c971
-0,         90,         90,        1,   152064, 0xb126e53e
+0,         90,         90,        1,   152064, 0x1035e3ee
 0,         91,         91,        1,   152064, 0xef49ba53
-0,         92,         92,        1,   152064, 0xfcfd7f17
+0,         92,         92,        1,   152064, 0x261081fa
 0,         93,         93,        1,   152064, 0x5280779e
-0,         94,         94,        1,   152064, 0x638d6f48
+0,         94,         94,        1,   152064, 0x8a6d6df3
 0,         95,         95,        1,   152064, 0xdb0f1ed5
-0,         96,         96,        1,   152064, 0x2cb959b0
+0,         96,         96,        1,   152064, 0x5162570a
 0,         97,         97,        1,   152064, 0x0841547c
-0,         98,         98,        1,   152064, 0x412a555b
+0,         98,         98,        1,   152064, 0xf0694fcd
 0,         99,         99,        1,   152064, 0xfe525057
-0,        100,        100,        1,   152064, 0xa8cf0cbc
+0,        100,        100,        1,   152064, 0xb4ec0c96
 0,        101,        101,        1,   152064, 0xbf2dcaee
-0,        102,        102,        1,   152064, 0x636cc494
+0,        102,        102,        1,   152064, 0x7860c418
 0,        103,        103,        1,   152064, 0xc9e288bc
-0,        104,        104,        1,   152064, 0xe77f4d03
+0,        104,        104,        1,   152064, 0xb0514dc3
 0,        105,        105,        1,   152064, 0x722a4bd0
-0,        106,        106,        1,   152064, 0x5271f5ef
+0,        106,        106,        1,   152064, 0x5277f52d
 0,        107,        107,        1,   152064, 0x05208e75
-0,        108,        108,        1,   152064, 0xb8845f88
+0,        108,        108,        1,   152064, 0x0b596089
 0,        109,        109,        1,   152064, 0x47aa117c
-0,        110,        110,        1,   152064, 0xe695fe27
+0,        110,        110,        1,   152064, 0x12edfe8b
 0,        111,        111,        1,   152064, 0x2e50f864
-0,        112,        112,        1,   152064, 0x52d2b719
+0,        112,        112,        1,   152064, 0x4cedb882
 0,        113,        113,        1,   152064, 0xdbf48285
-0,        114,        114,        1,   152064, 0xe0b2ba93
+0,        114,        114,        1,   152064, 0x9071b0e6
 0,        115,        115,        1,   152064, 0x1c85a5ce
 0,        116,        116,        1,   152064, 0x8ef9a8e8
 0,        117,        117,        1,   152064, 0x41e8ae26
 0,        118,        118,        1,   152064, 0x3328d571
 0,        119,        119,        1,   152064, 0xce7d4da2
-0,        120,        120,        1,   152064, 0x7a6f7416
+0,        120,        120,        1,   152064, 0x032d7575
 0,        121,        121,        1,   152064, 0xb3fc65a6
-0,        122,        122,        1,   152064, 0xc5a261e9
+0,        122,        122,        1,   152064, 0xe5a266b4
 0,        123,        123,        1,   152064, 0x943c5925
-0,        124,        124,        1,   152064, 0x259180b2
+0,        124,        124,        1,   152064, 0xe6138024
 0,        125,        125,        1,   152064, 0x3acd4e1b
-0,        126,        126,        1,   152064, 0x692090b4
+0,        126,        126,        1,   152064, 0x9de7903e
 0,        127,        127,        1,   152064, 0xea1184d0
-0,        128,        128,        1,   152064, 0x3e0038d5
+0,        128,        128,        1,   152064, 0x9e323818
 0,        129,        129,        1,   152064, 0xf77872a2
-0,        130,        130,        1,   152064, 0xe4cb7bb5
+0,        130,        130,        1,   152064, 0x8f7c75c7
 0,        131,        131,        1,   152064, 0x9d6d2623
-0,        132,        132,        1,   152064, 0xb9056247
+0,        132,        132,        1,   152064, 0x3d8e62ab
 0,        133,        133,        1,   152064, 0xcd8b3dc5
-0,        134,        134,        1,   152064, 0x13ea1b6d
+0,        134,        134,        1,   152064, 0x57681ebc
 0,        135,        135,        1,   152064, 0x764f3233
-0,        136,        136,        1,   152064, 0x54c00ba8
+0,        136,        136,        1,   152064, 0x8c8b0a4b
 0,        137,        137,        1,   152064, 0x2d9aedac
-0,        138,        138,        1,   152064, 0x1af00532
+0,        138,        138,        1,   152064, 0x0afe03ae
 0,        139,        139,        1,   152064, 0xcecae31b
 0,        140,        140,        1,   152064, 0x0e6ea17f
 0,        141,        141,        1,   152064, 0x66b0b8c4
-0,        142,        142,        1,   152064, 0x0ee879bb
+0,        142,        142,        1,   152064, 0xd44f7976
 0,        143,        143,        1,   152064, 0xf7f029cc
-0,        144,        144,        1,   152064, 0xdd5d08d6
+0,        144,        144,        1,   152064, 0xada307a9
 0,        145,        145,        1,   152064, 0x936ae367
-0,        146,        146,        1,   152064, 0xf0f4aba0
+0,        146,        146,        1,   152064, 0xa019ad8a
 0,        147,        147,        1,   152064, 0x5233a9e7
-0,        148,        148,        1,   152064, 0x02af732b
+0,        148,        148,        1,   152064, 0x6fd5737f
 0,        149,        149,        1,   152064, 0xb2eb2476
-0,        150,        150,        1,   152064, 0x998732b4
+0,        150,        150,        1,   152064, 0x36a53280
 0,        151,        151,        1,   152064, 0xf025230f
-0,        152,        152,        1,   152064, 0x474f3b12
+0,        152,        152,        1,   152064, 0x48373a3e
 0,        153,        153,        1,   152064, 0xe4e950e2
-0,        154,        154,        1,   152064, 0xa3f87fb3
+0,        154,        154,        1,   152064, 0x63d37fc4
 0,        155,        155,        1,   152064, 0x1e465fda
-0,        156,        156,        1,   152064, 0x9e8caab2
+0,        156,        156,        1,   152064, 0xc47ea97e
 0,        157,        157,        1,   152064, 0x0224aca7
-0,        158,        158,        1,   152064, 0x24fcec49
+0,        158,        158,        1,   152064, 0x909dedcc
 0,        159,        159,        1,   152064, 0x1c1df7ea
-0,        160,        160,        1,   152064, 0xc466f68f
+0,        160,        160,        1,   152064, 0x5e43f7f1
 0,        161,        161,        1,   152064, 0xdb11d8fa
-0,        162,        162,        1,   152064, 0xa0f61157
+0,        162,        162,        1,   152064, 0xa66710f5
 0,        163,        163,        1,   152064, 0x352013b0
-0,        164,        164,        1,   152064, 0xc14243c7
+0,        164,        164,        1,   152064, 0xc8e745f1
 0,        165,        165,        1,   152064, 0xb18b6810
-0,        166,        166,        1,   152064, 0x040942e6
+0,        166,        166,        1,   152064, 0xb1c243e2
 0,        167,        167,        1,   152064, 0x6fe129f9
-0,        168,        168,        1,   152064, 0xc3d64c5f
+0,        168,        168,        1,   152064, 0x92814bde
 0,        169,        169,        1,   152064, 0x50954752
-0,        170,        170,        1,   152064, 0xa4d24c64
+0,        170,        170,        1,   152064, 0x48634df3
 0,        171,        171,        1,   152064, 0x3af254c0
 0,        172,        172,        1,   152064, 0x6fde4801
 0,        173,        173,        1,   152064, 0xf8fe19b4
-0,        174,        174,        1,   152064, 0x97b34958
+0,        174,        174,        1,   152064, 0x57004906
 0,        175,        175,        1,   152064, 0x916e2ff4
-0,        176,        176,        1,   152064, 0x60c528e2
+0,        176,        176,        1,   152064, 0xbc0d28f0
 0,        177,        177,        1,   152064, 0x4522435e
 0,        178,        178,        1,   152064, 0x861f5d1b
 0,        179,        179,        1,   152064, 0x42c3bf28
-0,        180,        180,        1,   152064, 0x9772db11
+0,        180,        180,        1,   152064, 0xbd6adb19
 0,        181,        181,        1,   152064, 0x0692f5b8
-0,        182,        182,        1,   152064, 0xb06b4aed
+0,        182,        182,        1,   152064, 0x1e1e4bfb
 0,        183,        183,        1,   152064, 0xdc852986
-0,        184,        184,        1,   152064, 0xa7a025fb
+0,        184,        184,        1,   152064, 0x61c5259e
 0,        185,        185,        1,   152064, 0xe28f365a
-0,        186,        186,        1,   152064, 0xcbf3830e
+0,        186,        186,        1,   152064, 0x19388308
 0,        187,        187,        1,   152064, 0x043bace9
-0,        188,        188,        1,   152064, 0x5dd0b5df
+0,        188,        188,        1,   152064, 0x4bebb678
 0,        189,        189,        1,   152064, 0x6bd6d112
-0,        190,        190,        1,   152064, 0xa585ceb6
+0,        190,        190,        1,   152064, 0x3c9dc401
 0,        191,        191,        1,   152064, 0x91e7556a
-0,        192,        192,        1,   152064, 0x8f2a0404
+0,        192,        192,        1,   152064, 0xae60f7e7
 0,        193,        193,        1,   152064, 0x14066893
-0,        194,        194,        1,   152064, 0x8f715862
+0,        194,        194,        1,   152064, 0x7f5a5f0a
 0,        195,        195,        1,   152064, 0xb1063958
-0,        196,        196,        1,   152064, 0x014c40f0
+0,        196,        196,        1,   152064, 0xadf13b9f
 0,        197,        197,        1,   152064, 0x7ddcf94d
-0,        198,        198,        1,   152064, 0x25473a22
+0,        198,        198,        1,   152064, 0x91393730
 0,        199,        199,        1,   152064, 0xcd150536
-0,        200,        200,        1,   152064, 0x2d24d974
+0,        200,        200,        1,   152064, 0x52e0d7bd
 0,        201,        201,        1,   152064, 0x9130b2ce
-0,        202,        202,        1,   152064, 0x9450a62a
+0,        202,        202,        1,   152064, 0xa07fa62a
 0,        203,        203,        1,   152064, 0x7da258cd
-0,        204,        204,        1,   152064, 0x6c2770de
+0,        204,        204,        1,   152064, 0x984071a6
 0,        205,        205,        1,   152064, 0xd5fa731a
-0,        206,        206,        1,   152064, 0x93757c14
+0,        206,        206,        1,   152064, 0x593d7910
 0,        207,        207,        1,   152064, 0x4b754c71
 0,        208,        208,        1,   152064, 0x51544841
 0,        209,        209,        1,   152064, 0xf466910e
-0,        210,        210,        1,   152064, 0xe818c675
+0,        210,        210,        1,   152064, 0x6535c9c4
 0,        211,        211,        1,   152064, 0x6d45b6d8
-0,        212,        212,        1,   152064, 0xa3de9aec
+0,        212,        212,        1,   152064, 0xe77998a2
 0,        213,        213,        1,   152064, 0x56023275
-0,        214,        214,        1,   152064, 0xa1af21cb
+0,        214,        214,        1,   152064, 0x779b20cc
 0,        215,        215,        1,   152064, 0x1ff1b05e
-0,        216,        216,        1,   152064, 0x142ecbdb
+0,        216,        216,        1,   152064, 0xb9e2c3f0
 0,        217,        217,        1,   152064, 0xdfc6d541
-0,        218,        218,        1,   152064, 0x8d8f7a4c
+0,        218,        218,        1,   152064, 0x301a7948
 0,        219,        219,        1,   152064, 0x03d611ca
-0,        220,        220,        1,   152064, 0x999e6d3f
+0,        220,        220,        1,   152064, 0xe9426f2a
 0,        221,        221,        1,   152064, 0x304c95df
-0,        222,        222,        1,   152064, 0xbdcff306
+0,        222,        222,        1,   152064, 0x60e7f924
 0,        223,        223,        1,   152064, 0x6408670c
-0,        224,        224,        1,   152064, 0xa6d4d038
+0,        224,        224,        1,   152064, 0xbf09ca74
 0,        225,        225,        1,   152064, 0xf2d13572
-0,        226,        226,        1,   152064, 0x2fa8b357
+0,        226,        226,        1,   152064, 0x90ccb47d
 0,        227,        227,        1,   152064, 0x24bbd269
-0,        228,        228,        1,   152064, 0x23dd31f2
+0,        228,        228,        1,   152064, 0x7ae333dd
 0,        229,        229,        1,   152064, 0x90913fe2
-0,        230,        230,        1,   152064, 0x855efbca
+0,        230,        230,        1,   152064, 0xc994007c
 0,        231,        231,        1,   152064, 0x45a123c0
-0,        232,        232,        1,   152064, 0xec465cb2
+0,        232,        232,        1,   152064, 0xa0335bbf
 0,        233,        233,        1,   152064, 0x3e79c4e9
-0,        234,        234,        1,   152064, 0xaeac4476
+0,        234,        234,        1,   152064, 0x05cf4479
 0,        235,        235,        1,   152064, 0x2146392c
-0,        236,        236,        1,   152064, 0x7a186239
+0,        236,        236,        1,   152064, 0x68ac5d0a
 0,        237,        237,        1,   152064, 0x9d26fed8
-0,        238,        238,        1,   152064, 0x88f090ba
+0,        238,        238,        1,   152064, 0x047c9082
 0,        239,        239,        1,   152064, 0x518bd9f8
-0,        240,        240,        1,   152064, 0x70013bdd
+0,        240,        240,        1,   152064, 0xfbd03b16
 0,        241,        241,        1,   152064, 0x5317601a
-0,        242,        242,        1,   152064, 0x97e91795
+0,        242,        242,        1,   152064, 0x450118c5
 0,        243,        243,        1,   152064, 0x1058915b
-0,        244,        244,        1,   152064, 0x3549ffeb
+0,        244,        244,        1,   152064, 0x0a4a000a
 0,        245,        245,        1,   152064, 0xa277707d
-0,        246,        246,        1,   152064, 0xdcb6287d
+0,        246,        246,        1,   152064, 0xc7cb29b2
 0,        247,        247,        1,   152064, 0x371344fc
-0,        248,        248,        1,   152064, 0xb7ea75c7
+0,        248,        248,        1,   152064, 0xbc9375a9
 0,        249,        249,        1,   152064, 0x70c2fa2f
-0,        250,        250,        1,   152064, 0x8dbec050
+0,        250,        250,        1,   152064, 0x41fbc057
 0,        251,        251,        1,   152064, 0xc21a77fe
-0,        252,        252,        1,   152064, 0xf7c7678e
+0,        252,        252,        1,   152064, 0x51e06384
 0,        253,        253,        1,   152064, 0xbee83fcb
-0,        254,        254,        1,   152064, 0x6627efd7
+0,        254,        254,        1,   152064, 0xce2befdf
 0,        255,        255,        1,   152064, 0x4f139865
-0,        256,        256,        1,   152064, 0x76fa5435
+0,        256,        256,        1,   152064, 0x4e0f5372
 0,        257,        257,        1,   152064, 0xf0701fd6
-0,        258,        258,        1,   152064, 0x153e3763
+0,        258,        258,        1,   152064, 0x746c35f4
 0,        259,        259,        1,   152064, 0xf5211469
-0,        260,        260,        1,   152064, 0xc19d24b8
+0,        260,        260,        1,   152064, 0xae8f1c2f
 0,        261,        261,        1,   152064, 0xc2483a75
-0,        262,        262,        1,   152064, 0x67a149ee
+0,        262,        262,        1,   152064, 0x2da24ae6
 0,        263,        263,        1,   152064, 0x86f70e3a
-0,        264,        264,        1,   152064, 0x281b166b
+0,        264,        264,        1,   152064, 0x52b8172a
 0,        265,        265,        1,   152064, 0xca810f3b
-0,        266,        266,        1,   152064, 0x91c90741
+0,        266,        266,        1,   152064, 0x6d9504c4
 0,        267,        267,        1,   152064, 0x4edcfbfa
-0,        268,        268,        1,   152064, 0x0ca40c66
+0,        268,        268,        1,   152064, 0x292c0bfd
 0,        269,        269,        1,   152064, 0xee998e3d
 0,        270,        270,        1,   152064, 0xe4b6c1b2
 0,        271,        271,        1,   152064, 0xbbe0a4cc
-0,        272,        272,        1,   152064, 0xd080bcfd
+0,        272,        272,        1,   152064, 0xcd88bcf2
 0,        273,        273,        1,   152064, 0x365df7c5
-0,        274,        274,        1,   152064, 0x934f071f
+0,        274,        274,        1,   152064, 0x01cd06a4
 0,        275,        275,        1,   152064, 0xcfaefeef
-0,        276,        276,        1,   152064, 0xedd8263e
+0,        276,        276,        1,   152064, 0xe615289d
 0,        277,        277,        1,   152064, 0x1d5243de
-0,        278,        278,        1,   152064, 0xc0d87e50
+0,        278,        278,        1,   152064, 0x7c397dfe
 0,        279,        279,        1,   152064, 0xe25845b1
-0,        280,        280,        1,   152064, 0x47006123
+0,        280,        280,        1,   152064, 0x2d6a60a8
 0,        281,        281,        1,   152064, 0xf1926203
-0,        282,        282,        1,   152064, 0x494b8b9c
+0,        282,        282,        1,   152064, 0x634a88c9
 0,        283,        283,        1,   152064, 0xc50aa1b7
-0,        284,        284,        1,   152064, 0xb82da5e2
+0,        284,        284,        1,   152064, 0x972fa713
 0,        285,        285,        1,   152064, 0xa11cd0f6
-0,        286,        286,        1,   152064, 0x7ebff98d
+0,        286,        286,        1,   152064, 0xbff8f90e
 0,        287,        287,        1,   152064, 0x00902e76
-0,        288,        288,        1,   152064, 0xdee41ea2
+0,        288,        288,        1,   152064, 0x5cf31cb1
 0,        289,        289,        1,   152064, 0x2b026058
-0,        290,        290,        1,   152064, 0xce81051f
+0,        290,        290,        1,   152064, 0x258002cc
 0,        291,        291,        1,   152064, 0x0d708815
-0,        292,        292,        1,   152064, 0xd7719e35
+0,        292,        292,        1,   152064, 0xe3809ce0
 0,        293,        293,        1,   152064, 0xf0239467
-0,        294,        294,        1,   152064, 0x466d98b4
+0,        294,        294,        1,   152064, 0x6e71916a
 0,        295,        295,        1,   152064, 0xc1fb36e1
-0,        296,        296,        1,   152064, 0x26bc139e
+0,        296,        296,        1,   152064, 0xd47f07c9
 0,        297,        297,        1,   152064, 0x7fd111ea
-0,        298,        298,        1,   152064, 0xa39737cb
+0,        298,        298,        1,   152064, 0xc4023a80
 0,        299,        299,        1,   152064, 0x8f5851ba
-0,        300,        300,        1,   152064, 0xa971f6e2
+0,        300,        300,        1,   152064, 0x9982f47b
 0,        301,        301,        1,   152064, 0x0e5f6f80
-0,        302,        302,        1,   152064, 0xdb8b5e06
+0,        302,        302,        1,   152064, 0x49925e53
 0,        303,        303,        1,   152064, 0xf6006bcc
-0,        304,        304,        1,   152064, 0x060cd1a6
+0,        304,        304,        1,   152064, 0xd4b5d0f7
 0,        305,        305,        1,   152064, 0x419ef0a4
-0,        306,        306,        1,   152064, 0xe79f0b93
+0,        306,        306,        1,   152064, 0x4e610934
 0,        307,        307,        1,   152064, 0x1919e999
-0,        308,        308,        1,   152064, 0xacb715bc
+0,        308,        308,        1,   152064, 0x3a750d80
 0,        309,        309,        1,   152064, 0x16616075
-0,        310,        310,        1,   152064, 0x09aa4f10
+0,        310,        310,        1,   152064, 0x3284519f
 0,        311,        311,        1,   152064, 0x976cdd70
-0,        312,        312,        1,   152064, 0x4811dc21
+0,        312,        312,        1,   152064, 0x4ec5d1e3
 0,        313,        313,        1,   152064, 0x30d31172
-0,        314,        314,        1,   152064, 0x2db60b70
+0,        314,        314,        1,   152064, 0xe33609b5
 0,        315,        315,        1,   152064, 0x5377bb89
-0,        316,        316,        1,   152064, 0x6c20cab3
+0,        316,        316,        1,   152064, 0x5479cd3d
 0,        317,        317,        1,   152064, 0x964dad60
-0,        318,        318,        1,   152064, 0x514df2c3
+0,        318,        318,        1,   152064, 0x3a7deaf4
 0,        319,        319,        1,   152064, 0xced22332
-0,        320,        320,        1,   152064, 0x1c64bc82
+0,        320,        320,        1,   152064, 0x3b36b53f
 0,        321,        321,        1,   152064, 0x10c38662
-0,        322,        322,        1,   152064, 0xe6c7ff46
+0,        322,        322,        1,   152064, 0x45d4fceb
 0,        323,        323,        1,   152064, 0x359da948
-0,        324,        324,        1,   152064, 0x5a9458ee
+0,        324,        324,        1,   152064, 0x60625190
 0,        325,        325,        1,   152064, 0x1cda9888
-0,        326,        326,        1,   152064, 0xbd081682
+0,        326,        326,        1,   152064, 0x77ad1d8c
 0,        327,        327,        1,   152064, 0x20f1510f
-0,        328,        328,        1,   152064, 0x6bc261a9
+0,        328,        328,        1,   152064, 0xd11d52c6
 0,        329,        329,        1,   152064, 0x9f0e5797
-0,        330,        330,        1,   152064, 0xd14ca712
+0,        330,        330,        1,   152064, 0x174ca55b
 0,        331,        331,        1,   152064, 0x8df79054
-0,        332,        332,        1,   152064, 0x34efa950
+0,        332,        332,        1,   152064, 0x3844a495
 0,        333,        333,        1,   152064, 0x268d9d12
-0,        334,        334,        1,   152064, 0xad91b2ed
+0,        334,        334,        1,   152064, 0xf672b44f
 0,        335,        335,        1,   152064, 0xe0ac87cf
-0,        336,        336,        1,   152064, 0xba4cfd8e
+0,        336,        336,        1,   152064, 0xbc99fd7d
 0,        337,        337,        1,   152064, 0x876ef9e3
-0,        338,        338,        1,   152064, 0x45ab6684
+0,        338,        338,        1,   152064, 0xef8066f7
 0,        339,        339,        1,   152064, 0x72a99564
-0,        340,        340,        1,   152064, 0xdfc8be01
+0,        340,        340,        1,   152064, 0x5921c088
 0,        341,        341,        1,   152064, 0x3a6b9e74
-0,        342,        342,        1,   152064, 0xca1be9c6
+0,        342,        342,        1,   152064, 0xfb03e9b5
 0,        343,        343,        1,   152064, 0xc351bfc6
-0,        344,        344,        1,   152064, 0xef30c978
+0,        344,        344,        1,   152064, 0x2faec717
 0,        345,        345,        1,   152064, 0x062fc6f3
-0,        346,        346,        1,   152064, 0x8731a9ec
+0,        346,        346,        1,   152064, 0xede7a97f
 0,        347,        347,        1,   152064, 0x19874144
 0,        348,        348,        1,   152064, 0x929650eb
 0,        349,        349,        1,   152064, 0x082557a1
-0,        350,        350,        1,   152064, 0xb80510ae
+0,        350,        350,        1,   152064, 0x2b25104b
@@ -1 +1 @@
 .3.6
 .3.7