Changelog: update

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
avcodec/vp3: Error out on invalid num_coeffs in unpack_vlcs()
2018-02-11 22:30:54 +01:00 · 2018-02-11 19:41:43 +01:00 · 2018-02-11 19:41:43 +01:00 · 2018-02-11 19:41:43 +01:00 · 2018-02-11 19:41:43 +01:00 · 2018-02-11 19:41:43 +01:00
57 changed files with 570 additions and 340 deletions
@@ -1,6 +1,67 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.

+version 3.4.2:
+- avcodec/vp3: Error out on invalid num_coeffs in unpack_vlcs()
+- avcodec/mpeg4videodec: Ignore multiple VOL headers
+- avcodec/vp3: Check eob_run
+- avcodec/pafvideo: Check allocated frame size
+- avcodec/scpr: Fix reading a pixel before the first
+- avcodec/mpeg2dec: Fix field selection for skipped macroblocks
+- avcodec/huffyuvdec: Check input buffer size
+- avcodec/utvideodec: Fix bytes left check in decode_frame()
+- avcodec/wavpack: Fix integer overflow in FFABS
+- avcodec/aacsbr_fixed: Fix overflows in rounding in sbr_hf_assemble()
+- avcodec/exr: Fix memleaks in decode_header()
+- avcodec/mediacodecdec: use ff_hevc_ps_uninit()
+- avcodec/hevc_parser: use ff_hevc_uninit_parameter_sets()
+- avcodec/hevcdec: use ff_hevc_uninit_parameter_sets()
+- avcodec/hevc_ps: add a function to uninitialize parameter set buffers
+- avcodec/dirac_dwt: Fix several integer overflows
+- avcodec/indeo5: Do not leave frame_type set to an invalid value
+- avcodec/hevc_ps: Check log2_sao_offset_scale_*
+- avcodec/mpeg4videodec: Avoid possibly aliasing violating casts
+- avcodec/get_bits: Document the return code of get_vlc2()
+- avcodec/mpeg4videodec: Check mb_num also against 0
+- avfilter/vf_transpose: Fix used plane count.
+- avcodec/hevc_cabac: Check prefix so as to avoid invalid shifts in coeff_abs_level_remaining_decode()
+- avcodec/mjpegdec: Fix integer overflow in DC dequantization
+- avcodec/dxtory: Fix bits left checks
+- avcodec/hevc_cabac: Move prefix check in coeff_abs_level_remaining_decode() down
+- avcodec/truemotion2: Fix integer overflow in TM2_RECALC_BLOCK()
+- avcodec/snowdec: Fix integer overflow before htaps check
+- avcodec/ulti: Check number of blocks at init
+- avcodec/wavpack: Fix integer overflows in wv_unpack_stereo / mono
+- avcodec/jpeg2000: Check sum of sizes of band->prec before allocating
+- avcodec/ac3dec_fixed: Fix integer overflow in scale_coefs()
+- avformat/lrcdec: Fix memory leak in lrc_read_header()
+- avformat/matroskadec: Fix float-cast-overflow undefined behavior in matroska_parse_tracks()
+- lavfi/deinterlace_vaapi: fix can't show full option information.
+- configure:version 3.4.1: bump year
+- avcodec/utils: Avoid hardcoding duplicated types in sizeof()
+- avcodec/arm/sbrdsp_neon: Use a free register instead of putting 2 things in one
+- avcodec/h264addpx_template: Fixes integer overflows
+- avcodec/dirac_dwt: Fix overflows in COMPOSE_HAARiH0/COMPOSE_HAARiL0
+- avcodec/diracdec: Fix integer overflow with quant
+- avcodec/opus_parser: Check payload_len in parse_opus_ts_header()
+- avcodec/jpeg2000dsp: Fix integer overflows in ict_int()
+- avcodec/h264_slice: Do not attempt to render into frames already output
+- avcodec/dnxhddec: Check dc vlc
+- avcodec/exr: Check buf_size more completely
+- avcodec/flacdec: Fix overflow in multiplication in decode_subframe_fixed()
+- avcodec/hevcdsp_template: Fix Invalid shifts in put_hevc_qpel_bi_w_h() and put_hevc_qpel_bi_w_w()
+- avcodec/flacdec: avoid undefined shift
+- avcodec/hevcdsp_template.c: Fix undefined shift in FUNC(dequant)
+- avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD97iH0() and COMPOSE_DD137iL0()
+- avcodec/hevc_cabac: Fix integer overflow in ff_hevc_cu_qp_delta_abs()
+- tests/audiomatch: Add missing return code at the end of main()
+- avcodec/hevc_sei: Fix integer overflows in decode_nal_sei_message()
+- avcodec/hevcdsp_template: Fix undefined shift in put_hevc_qpel_bi_w_hv()
+- avcodec/h264_parse: Treat escaped and unescaped decoding error equal in decode_extradata_ps_mp4()
+- avcodec/vp9: mark frame as finished on decode_tiles() failure
+- libavfilter/af_dcshift.c: Fixed repeated spelling error
+- avfilter/formats: fix wrong function name in error message
+
 version 3.4.1:
 - avcodec/vp9_superframe_split_bsf: Fix integer overflow in frame_size/total_size checks
 - avcodec/amrwbdec: Fix division by 0 in voice_factor()
@@ -1 +1 @@
-3.4.1
+3.4.2
@@ -7000,7 +7000,7 @@ cat > $TMPH <<EOF
 #define FFMPEG_CONFIG_H
 #define FFMPEG_CONFIGURATION "$(c_escape $FFMPEG_CONFIGURATION)"
 #define FFMPEG_LICENSE "$(c_escape $license)"
-#define CONFIG_THIS_YEAR 2017
+#define CONFIG_THIS_YEAR 2018
 #define FFMPEG_DATADIR "$(eval c_escape $datadir)"
 #define AVCONV_DATADIR "$(eval c_escape $datadir)"
 #define CC_IDENT "$(c_escape ${cc_ident:-Unknown compiler})"
@@ -38,7 +38,7 @@ PROJECT_NAME           = FFmpeg
 # could be handy for archiving the generated documentation or if some version
 # control system is used.

-PROJECT_NUMBER         = 3.4.1
+PROJECT_NUMBER         = 3.4.2

 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
@@ -568,7 +568,8 @@ static void sbr_hf_assemble(int Y1[38][64][2],
                int A = (1-((indexsine+(kx & 1))&2));
                int B = (A^(-idx)) + idx;
                int *out = &Y1[i][kx][idx];
-                int shift, round;
+                int shift;
+                unsigned round;

                SoftFloat *in  = sbr->s_m[e];
                for (m = 0; m+1 < m_max; m+=2) {
@@ -581,12 +582,12 @@ static void sbr_hf_assemble(int Y1[38][64][2],
                    }
                    if (shift < 32) {
                        round = 1 << (shift-1);
-                        out[2*m  ] += (in[m  ].mant * A + round) >> shift;
+                        out[2*m  ] += (int)(in[m  ].mant * A + round) >> shift;
                    }

                    if (shift2 < 32) {
                        round = 1 << (shift2-1);
-                        out[2*m+2] += (in[m+1].mant * B + round) >> shift2;
+                        out[2*m+2] += (int)(in[m+1].mant * B + round) >> shift2;
                    }
                }
                if(m_max&1)
@@ -597,7 +598,7 @@ static void sbr_hf_assemble(int Y1[38][64][2],
                        return;
                    } else if (shift < 32) {
                        round = 1 << (shift-1);
-                        out[2*m  ] += (in[m  ].mant * A + round) >> shift;
+                        out[2*m  ] += (int)(in[m  ].mant * A + round) >> shift;
                    }
                }
            }
@@ -287,7 +287,7 @@ endfunc
        zip1            v4.4S, v4.4S, v4.4S
        fmla            v6.4S, v1.4S, v3.4S
        fmla            v2.4S, v5.4S, v4.4S
-        fcmeq           v7.4S, v3.4S, #0.0
+        fcmeq           v7.4S, v3.4S, #0
        bif             v2.16B, v6.16B, v7.16B
        st1             {v2.4S}, [x0], #16
        subs            x5, x5, #2
@@ -64,8 +64,8 @@ static void scale_coefs (
    int dynrng,
    int len)
 {
-    int i, shift, round;
-    unsigned mul;
+    int i, shift;
+    unsigned mul, round;
    int temp, temp1, temp2, temp3, temp4, temp5, temp6, temp7;

    mul = (dynrng & 0x1f) + 0x20;
@@ -336,11 +336,11 @@ function ff_sbr_hf_apply_noise_0_neon, export=1
        vld1.32         {d0},     [r0,:64]
        vld1.32         {d6},     [lr,:64]
        vld1.32         {d2[]},   [r1,:32]!
-        vld1.32         {d3[]},   [r2,:32]!
+        vld1.32         {d18[]},  [r2,:32]!
        vceq.f32        d4,  d2,  #0
        veor            d2,  d2,  d3
        vmov            d1,  d0
-        vmla.f32        d0,  d6,  d3
+        vmla.f32        d0,  d6,  d18
        vadd.f32        s2,  s2,  s4
        vbif            d0,  d1,  d4
        vst1.32         {d0},     [r0,:64]!
@@ -93,22 +93,22 @@ void ff_spatial_idwt_slice2(DWTContext *d, int y);

 // shared stuff for simd optimizations
 #define COMPOSE_53iL0(b0, b1, b2)\
-    (b1 - ((int)(b0 + (unsigned)(b2) + 2) >> 2))
+    (b1 - (unsigned)((int)(b0 + (unsigned)(b2) + 2) >> 2))

 #define COMPOSE_DIRAC53iH0(b0, b1, b2)\
-    (b1 + ((int)(b0 + (unsigned)(b2) + 1) >> 1))
+    (b1 + (unsigned)((int)(b0 + (unsigned)(b2) + 1) >> 1))

 #define COMPOSE_DD97iH0(b0, b1, b2, b3, b4)\
-    (b2 + ((int)(-b0 + 9U*b1 + 9U*b3 - b4 + 8) >> 4))
+    (int)(((unsigned)(b2) + ((int)(-b0 + 9U*b1 + 9U*b3 - b4 + 8) >> 4)))

 #define COMPOSE_DD137iL0(b0, b1, b2, b3, b4)\
-    (b2 - ((int)(-b0 + 9U*b1 + 9U*b3 - b4 + 16) >> 5))
+    (int)(((unsigned)(b2) - ((int)(-b0 + 9U*b1 + 9U*b3 - b4 + 16) >> 5)))

 #define COMPOSE_HAARiL0(b0, b1)\
-    (b0 - ((b1 + 1) >> 1))
+    ((int)(b0 - (unsigned)((int)(b1 + 1U) >> 1)))

 #define COMPOSE_HAARiH0(b0, b1)\
-    (b0 + b1)
+    ((int)(b0 + (unsigned)(b1)))

 #define COMPOSE_FIDELITYiL0(b0, b1, b2, b3, b4, b5, b6, b7, b8)\
    ((unsigned)b4 - ((int)(-8*(b0+(unsigned)b8) + 21*(b1+(unsigned)b7) - 46*(b2+(unsigned)b6) + 161*(b3+(unsigned)b5) + 128) >> 8))
@@ -49,7 +49,7 @@ static void RENAME(vertical_compose53iL0)(uint8_t *_b0, uint8_t *_b1, uint8_t *_
    TYPE *b1 = (TYPE *)_b1;
    TYPE *b2 = (TYPE *)_b2;
    for (i = 0; i < width; i++)
-        b1[i] -= (int)(b0[i] + (unsigned)b2[i] + 2) >> 2;
+        b1[i] -= (unsigned)((int)(b0[i] + (unsigned)b2[i] + 2) >> 2);
 }

 static av_always_inline void RENAME(interleave)(TYPE *dst, TYPE *src0, TYPE *src1, int w2,
@@ -508,16 +508,16 @@ static inline void codeblock(DiracContext *s, SubBand *b,
    }

    if (s->codeblock_mode && !(s->old_delta_quant && blockcnt_one)) {
-        int quant = b->quant;
+        int quant;
        if (is_arith)
-            quant += dirac_get_arith_int(c, CTX_DELTA_Q_F, CTX_DELTA_Q_DATA);
+            quant = dirac_get_arith_int(c, CTX_DELTA_Q_F, CTX_DELTA_Q_DATA);
        else
-            quant += dirac_get_se_golomb(gb);
-        if (quant < 0) {
+            quant = dirac_get_se_golomb(gb);
+        if (quant > INT_MAX - b->quant || b->quant + quant < 0) {
            av_log(s->avctx, AV_LOG_ERROR, "Invalid quant\n");
            return;
        }
-        b->quant = quant;
+        b->quant += quant;
    }

    if (b->quant > (DIRAC_MAX_QUANT_INDEX - 1)) {
@@ -381,6 +381,10 @@ static av_always_inline int dnxhd_decode_dct_block(const DNXHDContext *ctx,

    UPDATE_CACHE(bs, &row->gb);
    GET_VLC(len, bs, &row->gb, ctx->dc_vlc.table, DNXHD_DC_VLC_BITS, 1);
+    if (len < 0) {
+        ret = len;
+        goto error;
+    }
    if (len) {
        level = GET_CACHE(bs, &row->gb);
        LAST_SKIP_BITS(bs, &row->gb, len);
@@ -434,7 +438,7 @@ static av_always_inline int dnxhd_decode_dct_block(const DNXHDContext *ctx,
        GET_VLC(index1, bs, &row->gb, ctx->ac_vlc.table,
                DNXHD_VLC_BITS, 2);
    }
-
+error:
    CLOSE_READER(bs, &row->gb);
    return ret;
 }
@@ -326,7 +326,7 @@ static int dx2_decode_slice_5x5(GetBitContext *gb, AVFrame *frame,
    int stride   = frame->linesize[0];
    uint8_t *dst = frame->data[0] + stride * line;

-    for (y = 0; y < left && get_bits_left(gb) > 16; y++) {
+    for (y = 0; y < left && get_bits_left(gb) > 6 * width; y++) {
        for (x = 0; x < width; x++) {
            b = decode_sym_565(gb, lru[0], 5);
            g = decode_sym_565(gb, lru[1], is_565 ? 6 : 5);
@@ -392,7 +392,7 @@ static int dx2_decode_slice_rgb(GetBitContext *gb, AVFrame *frame,
    int stride   = frame->linesize[0];
    uint8_t *dst = frame->data[0] + stride * line;

-    for (y = 0; y < left && get_bits_left(gb) > 16; y++) {
+    for (y = 0; y < left && get_bits_left(gb) > 6 * width; y++) {
        for (x = 0; x < width; x++) {
            dst[x * 3 + 0] = decode_sym(gb, lru[0]);
            dst[x * 3 + 1] = decode_sym(gb, lru[1]);
@@ -437,7 +437,7 @@ static int dx2_decode_slice_410(GetBitContext *gb, AVFrame *frame,
    uint8_t *U  = frame->data[1] + (ustride >> 2) * line;
    uint8_t *V  = frame->data[2] + (vstride >> 2) * line;

-    for (y = 0; y < left - 3 && get_bits_left(gb) > 16; y += 4) {
+    for (y = 0; y < left - 3 && get_bits_left(gb) > 9 * width; y += 4) {
        for (x = 0; x < width; x += 4) {
            for (j = 0; j < 4; j++)
                for (i = 0; i < 4; i++)
@@ -481,7 +481,7 @@ static int dx2_decode_slice_420(GetBitContext *gb, AVFrame *frame,
    uint8_t *V  = frame->data[2] + (vstride >> 1) * line;


-    for (y = 0; y < left - 1 && get_bits_left(gb) > 16; y += 2) {
+    for (y = 0; y < left - 1 && get_bits_left(gb) > 6 * width; y += 2) {
        for (x = 0; x < width; x += 2) {
            Y[x + 0 + 0 * ystride] = decode_sym(gb, lru[0]);
            Y[x + 1 + 0 * ystride] = decode_sym(gb, lru[0]);
@@ -524,7 +524,7 @@ static int dx2_decode_slice_444(GetBitContext *gb, AVFrame *frame,
    uint8_t *U  = frame->data[1] + ustride * line;
    uint8_t *V  = frame->data[2] + vstride * line;

-    for (y = 0; y < left && get_bits_left(gb) > 16; y++) {
+    for (y = 0; y < left && get_bits_left(gb) > 6 * width; y++) {
        for (x = 0; x < width; x++) {
            Y[x] = decode_sym(gb, lru[0]);
            U[x] = decode_sym(gb, lru[1]) ^ 0x80;
@@ -1051,7 +1051,7 @@ static int decode_block(AVCodecContext *avctx, void *tdata,
    line_offset = AV_RL64(s->gb.buffer + jobnr * 8);

    if (s->is_tile) {
-        if (line_offset > buf_size - 20)
+        if (buf_size < 20 || line_offset > buf_size - 20)
            return AVERROR_INVALIDDATA;

        src  = buf + line_offset + 20;
@@ -1062,7 +1062,7 @@ static int decode_block(AVCodecContext *avctx, void *tdata,
        tile_level_y = AV_RL32(src - 8);

        data_size = AV_RL32(src - 4);
-        if (data_size <= 0 || data_size > buf_size)
+        if (data_size <= 0 || data_size > buf_size - line_offset - 20)
            return AVERROR_INVALIDDATA;

        if (tile_level_x || tile_level_y) { /* tile level, is not the full res level */
@@ -1095,7 +1095,7 @@ static int decode_block(AVCodecContext *avctx, void *tdata,
        td->channel_line_size = td->xsize * s->current_channel_offset;/* uncompress size of one line */
        uncompressed_size = td->channel_line_size * (uint64_t)td->ysize;/* uncompress size of the block */
    } else {
-        if (line_offset > buf_size - 8)
+        if (buf_size < 8 || line_offset > buf_size - 8)
            return AVERROR_INVALIDDATA;

        src  = buf + line_offset + 8;
@@ -1105,7 +1105,7 @@ static int decode_block(AVCodecContext *avctx, void *tdata,
            return AVERROR_INVALIDDATA;

        data_size = AV_RL32(src - 4);
-        if (data_size <= 0 || data_size > buf_size)
+        if (data_size <= 0 || data_size > buf_size - line_offset - 8)
            return AVERROR_INVALIDDATA;

        td->ysize          = FFMIN(s->scan_lines_per_block, s->ymax - line + 1); /* s->ydelta - line ?? */
@@ -1306,6 +1306,7 @@ static int decode_header(EXRContext *s, AVFrame *frame)
    AVDictionary *metadata = NULL;
    int magic_number, version, i, flags, sar = 0;
    int layer_match = 0;
+    int ret;

    s->current_channel_offset = 0;
    s->xmin               = ~0;
@@ -1364,8 +1365,10 @@ static int decode_header(EXRContext *s, AVFrame *frame)
        if ((var_size = check_header_variable(s, "channels",
                                              "chlist", 38)) >= 0) {
            GetByteContext ch_gb;
-            if (!var_size)
-                return AVERROR_INVALIDDATA;
+            if (!var_size) {
+                ret = AVERROR_INVALIDDATA;
+                goto fail;
+            }

            bytestream2_init(&ch_gb, s->gb.buffer, var_size);

@@ -1424,14 +1427,16 @@ static int decode_header(EXRContext *s, AVFrame *frame)

                if (bytestream2_get_bytes_left(&ch_gb) < 4) {
                    av_log(s->avctx, AV_LOG_ERROR, "Incomplete header.\n");
-                    return AVERROR_INVALIDDATA;
+                    ret = AVERROR_INVALIDDATA;
+                    goto fail;
                }

                current_pixel_type = bytestream2_get_le32(&ch_gb);
                if (current_pixel_type >= EXR_UNKNOWN) {
                    avpriv_report_missing_feature(s->avctx, "Pixel type %d",
                                                  current_pixel_type);
-                    return AVERROR_PATCHWELCOME;
+                    ret = AVERROR_PATCHWELCOME;
+                    goto fail;
                }

                bytestream2_skip(&ch_gb, 4);
@@ -1442,7 +1447,8 @@ static int decode_header(EXRContext *s, AVFrame *frame)
                    avpriv_report_missing_feature(s->avctx,
                                                  "Subsampling %dx%d",
                                                  xsub, ysub);
-                    return AVERROR_PATCHWELCOME;
+                    ret = AVERROR_PATCHWELCOME;
+                    goto fail;
                }

                if (channel_index >= 0 && s->channel_offsets[channel_index] == -1) { /* channel has not been previously assigned */
@@ -1450,7 +1456,8 @@ static int decode_header(EXRContext *s, AVFrame *frame)
                        s->pixel_type != current_pixel_type) {
                        av_log(s->avctx, AV_LOG_ERROR,
                               "RGB channels not of the same depth.\n");
-                        return AVERROR_INVALIDDATA;
+                        ret = AVERROR_INVALIDDATA;
+                        goto fail;
                    }
                    s->pixel_type                     = current_pixel_type;
                    s->channel_offsets[channel_index] = s->current_channel_offset;
@@ -1458,8 +1465,10 @@ static int decode_header(EXRContext *s, AVFrame *frame)

                s->channels = av_realloc(s->channels,
                                         ++s->nb_channels * sizeof(EXRChannel));
-                if (!s->channels)
-                    return AVERROR(ENOMEM);
+                if (!s->channels) {
+                    ret = AVERROR(ENOMEM);
+                    goto fail;
+                }
                channel             = &s->channels[s->nb_channels - 1];
                channel->pixel_type = current_pixel_type;
                channel->xsub       = xsub;
@@ -1484,7 +1493,8 @@ static int decode_header(EXRContext *s, AVFrame *frame)
                        av_log(s->avctx, AV_LOG_ERROR, "Missing green channel.\n");
                    if (s->channel_offsets[2] < 0)
                        av_log(s->avctx, AV_LOG_ERROR, "Missing blue channel.\n");
-                    return AVERROR_INVALIDDATA;
+                    ret = AVERROR_INVALIDDATA;
+                    goto fail;
                }
            }

@@ -1493,8 +1503,10 @@ static int decode_header(EXRContext *s, AVFrame *frame)
            continue;
        } else if ((var_size = check_header_variable(s, "dataWindow", "box2i",
                                                     31)) >= 0) {
-            if (!var_size)
-                return AVERROR_INVALIDDATA;
+            if (!var_size) {
+                ret = AVERROR_INVALIDDATA;
+                goto fail;
+            }

            s->xmin   = bytestream2_get_le32(&s->gb);
            s->ymin   = bytestream2_get_le32(&s->gb);
@@ -1506,8 +1518,10 @@ static int decode_header(EXRContext *s, AVFrame *frame)
            continue;
        } else if ((var_size = check_header_variable(s, "displayWindow",
                                                     "box2i", 34)) >= 0) {
-            if (!var_size)
-                return AVERROR_INVALIDDATA;
+            if (!var_size) {
+                ret = AVERROR_INVALIDDATA;
+                goto fail;
+            }

            bytestream2_skip(&s->gb, 8);
            s->w = bytestream2_get_le32(&s->gb) + 1;
@@ -1517,29 +1531,36 @@ static int decode_header(EXRContext *s, AVFrame *frame)
        } else if ((var_size = check_header_variable(s, "lineOrder",
                                                     "lineOrder", 25)) >= 0) {
            int line_order;
-            if (!var_size)
-                return AVERROR_INVALIDDATA;
+            if (!var_size) {
+                ret = AVERROR_INVALIDDATA;
+                goto fail;
+            }

            line_order = bytestream2_get_byte(&s->gb);
            av_log(s->avctx, AV_LOG_DEBUG, "line order: %d.\n", line_order);
            if (line_order > 2) {
                av_log(s->avctx, AV_LOG_ERROR, "Unknown line order.\n");
-                return AVERROR_INVALIDDATA;
+                ret = AVERROR_INVALIDDATA;
+                goto fail;
            }

            continue;
        } else if ((var_size = check_header_variable(s, "pixelAspectRatio",
                                                     "float", 31)) >= 0) {
-            if (!var_size)
-                return AVERROR_INVALIDDATA;
+            if (!var_size) {
+                ret = AVERROR_INVALIDDATA;
+                goto fail;
+            }

            sar = bytestream2_get_le32(&s->gb);

            continue;
        } else if ((var_size = check_header_variable(s, "compression",
                                                     "compression", 29)) >= 0) {
-            if (!var_size)
-                return AVERROR_INVALIDDATA;
+            if (!var_size) {
+                ret = AVERROR_INVALIDDATA;
+                goto fail;
+            }

            if (s->compression == EXR_UNKN)
                s->compression = bytestream2_get_byte(&s->gb);
@@ -1566,13 +1587,15 @@ static int decode_header(EXRContext *s, AVFrame *frame)
            if (s->tile_attr.level_mode >= EXR_TILE_LEVEL_UNKNOWN){
                avpriv_report_missing_feature(s->avctx, "Tile level mode %d",
                                              s->tile_attr.level_mode);
-                return AVERROR_PATCHWELCOME;
+                ret = AVERROR_PATCHWELCOME;
+                goto fail;
            }

            if (s->tile_attr.level_round >= EXR_TILE_ROUND_UNKNOWN) {
                avpriv_report_missing_feature(s->avctx, "Tile level round %d",
                                              s->tile_attr.level_round);
-                return AVERROR_PATCHWELCOME;
+                ret = AVERROR_PATCHWELCOME;
+                goto fail;
            }

            continue;
@@ -1589,7 +1612,8 @@ static int decode_header(EXRContext *s, AVFrame *frame)
        // Check if there are enough bytes for a header
        if (bytestream2_get_bytes_left(&s->gb) <= 9) {
            av_log(s->avctx, AV_LOG_ERROR, "Incomplete header\n");
-            return AVERROR_INVALIDDATA;
+            ret = AVERROR_INVALIDDATA;
+            goto fail;
        }

        // Process unknown variables
@@ -1604,19 +1628,22 @@ static int decode_header(EXRContext *s, AVFrame *frame)

    if (s->compression == EXR_UNKN) {
        av_log(s->avctx, AV_LOG_ERROR, "Missing compression attribute.\n");
-        return AVERROR_INVALIDDATA;
+        ret = AVERROR_INVALIDDATA;
+        goto fail;
    }

    if (s->is_tile) {
        if (s->tile_attr.xSize < 1 || s->tile_attr.ySize < 1) {
            av_log(s->avctx, AV_LOG_ERROR, "Invalid tile attribute.\n");
-            return AVERROR_INVALIDDATA;
+            ret = AVERROR_INVALIDDATA;
+            goto fail;
        }
    }

    if (bytestream2_get_bytes_left(&s->gb) <= 0) {
        av_log(s->avctx, AV_LOG_ERROR, "Incomplete frame.\n");
-        return AVERROR_INVALIDDATA;
+        ret = AVERROR_INVALIDDATA;
+        goto fail;
    }

    frame->metadata = metadata;
@@ -1624,6 +1651,9 @@ static int decode_header(EXRContext *s, AVFrame *frame)
    // aaand we are done
    bytestream2_skip(&s->gb, 1);
    return 0;
+fail:
+    av_dict_free(&metadata);
+    return ret;
 }

 static int decode_frame(AVCodecContext *avctx, void *data,
@@ -298,7 +298,7 @@ static int decode_subframe_fixed(FLACContext *s, int32_t *decoded,
    if (pred_order > 2)
        c = b - decoded[pred_order-2] + decoded[pred_order-3];
    if (pred_order > 3)
-        d = c - decoded[pred_order-2] + 2*decoded[pred_order-3] - decoded[pred_order-4];
+        d = c - decoded[pred_order-2] + 2U*decoded[pred_order-3] - decoded[pred_order-4];

    switch (pred_order) {
    case 0:
@@ -456,7 +456,7 @@ static inline int decode_subframe(FLACContext *s, int channel)
        return AVERROR_INVALIDDATA;
    }

-    if (wasted) {
+    if (wasted && wasted < 32) {
        int i;
        for (i = 0; i < s->blocksize; i++)
            decoded[i] = (unsigned)decoded[i] << wasted;
@@ -550,6 +550,7 @@ static inline const uint8_t *align_get_bits(GetBitContext *s)
 * @param max_depth is the number of times bits bits must be read to completely
 *                  read the longest vlc code
 *                  = (max_vlc_length + bits - 1) / bits
+ * @returns the code parsed or -1 if no vlc matches
 */
 static av_always_inline int get_vlc2(GetBitContext *s, VLC_TYPE (*table)[2],
                                     int bits, int max_depth)
@@ -425,10 +425,9 @@ static int decode_extradata_ps_mp4(const uint8_t *buf, int buf_size, H264ParamSe
        escaped_buf_size = bytestream2_tell_p(&pbc);
        AV_WB16(escaped_buf, escaped_buf_size - 2);

-        ret = decode_extradata_ps(escaped_buf, escaped_buf_size, ps, 1, logctx);
+        (void)decode_extradata_ps(escaped_buf, escaped_buf_size, ps, 1, logctx);
+        // lorex.mp4 decodes ok even with extradata decoding failing
        av_freep(&escaped_buf);
-        if (ret < 0)
-            return ret;
    }

    return 0;
@@ -1577,6 +1577,12 @@ static int h264_field_start(H264Context *h, const H264SliceContext *sl,
                 * one except for reference purposes. */
                h->first_field = 1;
                h->cur_pic_ptr = NULL;
+            } else if (h->cur_pic_ptr->reference & DELAYED_PIC_REF) {
+                /* This frame was already output, we cannot draw into it
+                 * anymore.
+                 */
+                h->first_field = 1;
+                h->cur_pic_ptr = NULL;
            } else {
                /* Second field in complementary pair */
                h->first_field = 0;
@@ -35,10 +35,10 @@ static void FUNCC(ff_h264_add_pixels4)(uint8_t *_dst, int16_t *_src, int stride)
    stride /= sizeof(pixel);

    for (i = 0; i < 4; i++) {
-        dst[0] += src[0];
-        dst[1] += src[1];
-        dst[2] += src[2];
-        dst[3] += src[3];
+        dst[0] += (unsigned)src[0];
+        dst[1] += (unsigned)src[1];
+        dst[2] += (unsigned)src[2];
+        dst[3] += (unsigned)src[3];

        dst += stride;
        src += 4;
@@ -55,14 +55,14 @@ static void FUNCC(ff_h264_add_pixels8)(uint8_t *_dst, int16_t *_src, int stride)
    stride /= sizeof(pixel);

    for (i = 0; i < 8; i++) {
-        dst[0] += src[0];
-        dst[1] += src[1];
-        dst[2] += src[2];
-        dst[3] += src[3];
-        dst[4] += src[4];
-        dst[5] += src[5];
-        dst[6] += src[6];
-        dst[7] += src[7];
+        dst[0] += (unsigned)src[0];
+        dst[1] += (unsigned)src[1];
+        dst[2] += (unsigned)src[2];
+        dst[3] += (unsigned)src[3];
+        dst[4] += (unsigned)src[4];
+        dst[5] += (unsigned)src[5];
+        dst[6] += (unsigned)src[6];
+        dst[7] += (unsigned)src[7];

        dst += stride;
        src += 8;
@@ -646,8 +646,10 @@ int ff_hevc_cu_qp_delta_abs(HEVCContext *s)
            suffix_val += 1 << k;
            k++;
        }
-        if (k == CABAC_MAX_BIN)
+        if (k == CABAC_MAX_BIN) {
            av_log(s->avctx, AV_LOG_ERROR, "CABAC_MAX_BIN : %d\n", k);
+            return AVERROR_INVALIDDATA;
+        }

        while (k--)
            suffix_val += get_cabac_bypass(&s->HEVClc->cc) << k;
@@ -988,16 +990,19 @@ static av_always_inline int coeff_abs_level_remaining_decode(HEVCContext *s, int

    while (prefix < CABAC_MAX_BIN && get_cabac_bypass(&s->HEVClc->cc))
        prefix++;
-    if (prefix == CABAC_MAX_BIN) {
-        av_log(s->avctx, AV_LOG_ERROR, "CABAC_MAX_BIN : %d\n", prefix);
-        return 0;
-    }
+
    if (prefix < 3) {
        for (i = 0; i < rc_rice_param; i++)
            suffix = (suffix << 1) | get_cabac_bypass(&s->HEVClc->cc);
        last_coeff_abs_level_remaining = (prefix << rc_rice_param) + suffix;
    } else {
        int prefix_minus3 = prefix - 3;
+
+        if (prefix == CABAC_MAX_BIN || prefix_minus3 + rc_rice_param >= 31) {
+            av_log(s->avctx, AV_LOG_ERROR, "CABAC_MAX_BIN : %d\n", prefix);
+            return 0;
+        }
+
        for (i = 0; i < prefix_minus3 + rc_rice_param; i++)
            suffix = (suffix << 1) | get_cabac_bypass(&s->HEVClc->cc);
        last_coeff_abs_level_remaining = (((1 << prefix_minus3) + 3 - 1)
@@ -359,17 +359,8 @@ static int hevc_split(AVCodecContext *avctx, const uint8_t *buf, int buf_size)
 static void hevc_parser_close(AVCodecParserContext *s)
 {
    HEVCParserContext *ctx = s->priv_data;
-    int i;
-
-    for (i = 0; i < FF_ARRAY_ELEMS(ctx->ps.vps_list); i++)
-        av_buffer_unref(&ctx->ps.vps_list[i]);
-    for (i = 0; i < FF_ARRAY_ELEMS(ctx->ps.sps_list); i++)
-        av_buffer_unref(&ctx->ps.sps_list[i]);
-    for (i = 0; i < FF_ARRAY_ELEMS(ctx->ps.pps_list); i++)
-        av_buffer_unref(&ctx->ps.pps_list[i]);
-
-    ctx->ps.sps = NULL;

+    ff_hevc_ps_uninit(&ctx->ps);
    ff_h2645_packet_uninit(&ctx->pkt);
    ff_hevc_reset_sei(&ctx->sei);

@@ -1324,6 +1324,11 @@ static int pps_range_extensions(GetBitContext *gb, AVCodecContext *avctx,
    pps->log2_sao_offset_scale_luma = get_ue_golomb_long(gb);
    pps->log2_sao_offset_scale_chroma = get_ue_golomb_long(gb);

+    if (   pps->log2_sao_offset_scale_luma   > FFMAX(sps->bit_depth        - 10, 0)
+        || pps->log2_sao_offset_scale_chroma > FFMAX(sps->bit_depth_chroma - 10, 0)
+    )
+        return AVERROR_INVALIDDATA;
+
    return(0);
 }

@@ -1704,6 +1709,22 @@ err:
    return ret;
 }

+void ff_hevc_ps_uninit(HEVCParamSets *ps)
+{
+    int i;
+
+    for (i = 0; i < FF_ARRAY_ELEMS(ps->vps_list); i++)
+        av_buffer_unref(&ps->vps_list[i]);
+    for (i = 0; i < FF_ARRAY_ELEMS(ps->sps_list); i++)
+        av_buffer_unref(&ps->sps_list[i]);
+    for (i = 0; i < FF_ARRAY_ELEMS(ps->pps_list); i++)
+        av_buffer_unref(&ps->pps_list[i]);
+
+    ps->sps = NULL;
+    ps->pps = NULL;
+    ps->vps = NULL;
+}
+
 int ff_hevc_compute_poc(const HEVCSPS *sps, int pocTid0, int poc_lsb, int nal_unit_type)
 {
    int max_poc_lsb  = 1 << sps->log2_max_poc_lsb;
@@ -421,6 +421,8 @@ int ff_hevc_decode_nal_sps(GetBitContext *gb, AVCodecContext *avctx,
 int ff_hevc_decode_nal_pps(GetBitContext *gb, AVCodecContext *avctx,
                           HEVCParamSets *ps);

+void ff_hevc_ps_uninit(HEVCParamSets *ps);
+
 int ff_hevc_decode_short_term_rps(GetBitContext *gb, AVCodecContext *avctx,
                                  ShortTermRPS *rps, const HEVCSPS *sps, int is_slice_header);

@@ -324,11 +324,15 @@ static int decode_nal_sei_message(GetBitContext *gb, HEVCSEIContext *s,
    av_log(logctx, AV_LOG_DEBUG, "Decoding SEI\n");

    while (byte == 0xFF) {
+        if (get_bits_left(gb) < 16 || payload_type > INT_MAX - 255)
+            return AVERROR_INVALIDDATA;
        byte          = get_bits(gb, 8);
        payload_type += byte;
    }
    byte = 0xFF;
    while (byte == 0xFF) {
+        if (get_bits_left(gb) < 8 + 8LL*payload_size)
+            return AVERROR_INVALIDDATA;
        byte          = get_bits(gb, 8);
        payload_size += byte;
    }
@@ -3215,15 +3215,7 @@ static av_cold int hevc_decode_free(AVCodecContext *avctx)
        av_frame_free(&s->DPB[i].frame);
    }

-    for (i = 0; i < FF_ARRAY_ELEMS(s->ps.vps_list); i++)
-        av_buffer_unref(&s->ps.vps_list[i]);
-    for (i = 0; i < FF_ARRAY_ELEMS(s->ps.sps_list); i++)
-        av_buffer_unref(&s->ps.sps_list[i]);
-    for (i = 0; i < FF_ARRAY_ELEMS(s->ps.pps_list); i++)
-        av_buffer_unref(&s->ps.pps_list[i]);
-    s->ps.sps = NULL;
-    s->ps.pps = NULL;
-    s->ps.vps = NULL;
+    ff_hevc_ps_uninit(&s->ps);

    av_freep(&s->sh.entry_point_offset);
    av_freep(&s->sh.offset);
@@ -121,7 +121,7 @@ static void FUNC(dequant)(int16_t *coeffs, int16_t log2_size)
    } else {
        for (y = 0; y < size; y++) {
            for (x = 0; x < size; x++) {
-                *coeffs = *coeffs << -shift;
+                *coeffs = *(uint16_t*)coeffs << -shift;
                coeffs++;
            }
        }
@@ -915,7 +915,7 @@ static void FUNC(put_hevc_qpel_bi_w_h)(uint8_t *_dst, ptrdiff_t _dststride, uint
    for (y = 0; y < height; y++) {
        for (x = 0; x < width; x++)
            dst[x] = av_clip_pixel(((QPEL_FILTER(src, 1) >> (BIT_DEPTH - 8)) * wx1 + src2[x] * wx0 +
-                                    ((ox0 + ox1 + 1) << log2Wd)) >> (log2Wd + 1));
+                                    ((ox0 + ox1 + 1) * (1 << log2Wd))) >> (log2Wd + 1));
        src  += srcstride;
        dst  += dststride;
        src2 += MAX_PB_SIZE;
@@ -970,7 +970,7 @@ static void FUNC(put_hevc_qpel_bi_w_v)(uint8_t *_dst, ptrdiff_t _dststride, uint
    for (y = 0; y < height; y++) {
        for (x = 0; x < width; x++)
            dst[x] = av_clip_pixel(((QPEL_FILTER(src, srcstride) >> (BIT_DEPTH - 8)) * wx1 + src2[x] * wx0 +
-                                    ((ox0 + ox1 + 1) << log2Wd)) >> (log2Wd + 1));
+                                    ((ox0 + ox1 + 1) * (1 << log2Wd))) >> (log2Wd + 1));
        src  += srcstride;
        dst  += dststride;
        src2 += MAX_PB_SIZE;
@@ -1051,7 +1051,7 @@ static void FUNC(put_hevc_qpel_bi_w_hv)(uint8_t *_dst, ptrdiff_t _dststride, uin
    for (y = 0; y < height; y++) {
        for (x = 0; x < width; x++)
            dst[x] = av_clip_pixel(((QPEL_FILTER(tmp, MAX_PB_SIZE) >> 6) * wx1 + src2[x] * wx0 +
-                                    ((ox0 + ox1 + 1) << log2Wd)) >> (log2Wd + 1));
+                                    ((ox0 + ox1 + 1) * (1 << log2Wd))) >> (log2Wd + 1));
        tmp  += MAX_PB_SIZE;
        dst  += dststride;
        src2 += MAX_PB_SIZE;
@@ -919,6 +919,9 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
    AVFrame *const p = data;
    int table_size = 0, ret;

+    if (buf_size < (width * height + 7)/8)
+        return AVERROR_INVALIDDATA;
+
    av_fast_padded_malloc(&s->bitstream_buffer,
                   &s->bitstream_buffer_size,
                   buf_size);
@@ -324,6 +324,7 @@ static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx)
    ctx->frame_type      = get_bits(&ctx->gb, 3);
    if (ctx->frame_type >= 5) {
        av_log(avctx, AV_LOG_ERROR, "Invalid frame type: %d \n", ctx->frame_type);
+        ctx->frame_type = FRAMETYPE_INTRA;
        return AVERROR_INVALIDDATA;
    }

@@ -543,6 +543,9 @@ int ff_jpeg2000_init_component(Jpeg2000Component *comp,
        if (!reslevel->band)
            return AVERROR(ENOMEM);

+        if (reslevel->num_precincts_x * (uint64_t)reslevel->num_precincts_y * reslevel->nbands > avctx->max_pixels / sizeof(*reslevel->band->prec))
+            return AVERROR(ENOMEM);
+
        for (bandno = 0; bandno < reslevel->nbands; bandno++, gbandno++) {
            ret = init_band(avctx, reslevel,
                            comp, codsty, qntsty,
@@ -64,9 +64,9 @@ static void ict_int(void *_src0, void *_src1, void *_src2, int csize)
    int i;

    for (i = 0; i < csize; i++) {
-        i0 = *src0 + *src2 + (((26345 * *src2) + (1 << 15)) >> 16);
+        i0 = *src0 + *src2 + ((int)((26345U * *src2) + (1 << 15)) >> 16);
        i1 = *src0 - ((int)(((unsigned)i_ict_params[1] * *src1) + (1 << 15)) >> 16)
-                   - (((i_ict_params[2] * *src2) + (1 << 15)) >> 16);
+                   - ((int)(((unsigned)i_ict_params[2] * *src2) + (1 << 15)) >> 16);
        i2 = *src0 + (2 * *src1) + ((int)((-14942U * *src1) + (1 << 15)) >> 16);
        *src0++ = i0;
        *src1++ = i1;
@@ -272,6 +272,7 @@ static int X264_frame(AVCodecContext *ctx, AVPacket *pkt, const AVFrame *frame,
                      int *got_packet)
 {
    X264Context *x4 = ctx->priv_data;
+    const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(ctx->pix_fmt);
    x264_nal_t *nal;
    int nnal, i, ret;
    x264_picture_t pic_out = {0};
@@ -279,7 +280,7 @@ static int X264_frame(AVCodecContext *ctx, AVPacket *pkt, const AVFrame *frame,

    x264_picture_init( &x4->pic );
    x4->pic.img.i_csp   = x4->params.i_csp;
-    if (x264_bit_depth > 8)
+    if (desc->comp[0].depth > 8)
        x4->pic.img.i_csp |= X264_CSP_HIGH_DEPTH;
    x4->pic.img.i_plane = avfmt2_num_planes(ctx->pix_fmt);

@@ -739,6 +740,9 @@ FF_ENABLE_DEPRECATION_WARNINGS

    x4->params.i_width          = avctx->width;
    x4->params.i_height         = avctx->height;
+#if X264_BUILD >= 153
+    x4->params.i_bitdepth       = av_pix_fmt_desc_get(avctx->pix_fmt)->comp[0].depth;
+#endif
    av_reduce(&sw, &sh, avctx->sample_aspect_ratio.num, avctx->sample_aspect_ratio.den, 4096);
    x4->params.vui.i_sar_width  = sw;
    x4->params.vui.i_sar_height = sh;
@@ -852,6 +856,24 @@ FF_ENABLE_DEPRECATION_WARNINGS
    return 0;
 }

+static const enum AVPixelFormat pix_fmts[] = {
+    AV_PIX_FMT_YUV420P,
+    AV_PIX_FMT_YUVJ420P,
+    AV_PIX_FMT_YUV422P,
+    AV_PIX_FMT_YUVJ422P,
+    AV_PIX_FMT_YUV444P,
+    AV_PIX_FMT_YUVJ444P,
+    AV_PIX_FMT_YUV420P10,
+    AV_PIX_FMT_YUV422P10,
+    AV_PIX_FMT_YUV444P10,
+    AV_PIX_FMT_NV12,
+    AV_PIX_FMT_NV16,
+    AV_PIX_FMT_NV20,
+#ifdef X264_CSP_NV21
+    AV_PIX_FMT_NV21,
+#endif
+    AV_PIX_FMT_NONE
+};
 static const enum AVPixelFormat pix_fmts_8bit[] = {
    AV_PIX_FMT_YUV420P,
    AV_PIX_FMT_YUVJ420P,
@@ -889,12 +911,16 @@ static const enum AVPixelFormat pix_fmts_8bit_rgb[] = {

 static av_cold void X264_init_static(AVCodec *codec)
 {
+#if X264_BUILD < 153
    if (x264_bit_depth == 8)
        codec->pix_fmts = pix_fmts_8bit;
    else if (x264_bit_depth == 9)
        codec->pix_fmts = pix_fmts_9bit;
    else if (x264_bit_depth == 10)
        codec->pix_fmts = pix_fmts_10bit;
+#else
+    codec->pix_fmts = pix_fmts;
+#endif
 }

 #define OFFSET(x) offsetof(X264Context, x)
@@ -256,6 +256,8 @@ static int hevc_set_extradata(AVCodecContext *avctx, FFAMediaFormat *format)
    }

 done:
+    ff_hevc_ps_uninit(&ps);
+
    av_freep(&vps_data);
    av_freep(&sps_data);
    av_freep(&pps_data);
@@ -715,7 +715,7 @@ static int decode_block(MJpegDecodeContext *s, int16_t *block, int component,
        av_log(s->avctx, AV_LOG_ERROR, "error dc\n");
        return AVERROR_INVALIDDATA;
    }
-    val = val * quant_matrix[0] + s->last_dc[component];
+    val = val * (unsigned)quant_matrix[0] + s->last_dc[component];
    val = av_clip_int16(val);
    s->last_dc[component] = val;
    block[0] = val;
@@ -1984,6 +1984,8 @@ static int mpeg_decode_slice(MpegEncContext *s, int mb_y,
                    s->mv[0][0][1] = s->last_mv[0][0][1];
                    s->mv[1][0][0] = s->last_mv[1][0][0];
                    s->mv[1][0][1] = s->last_mv[1][0][1];
+                    s->field_select[0][0] = (s->picture_structure - 1) & 1;
+                    s->field_select[1][0] = (s->picture_structure - 1) & 1;
                }
            }
        }
@@ -460,7 +460,7 @@ int ff_mpeg4_decode_video_packet_header(Mpeg4DecContext *ctx)
    }

    mb_num = get_bits(&s->gb, mb_num_bits);
-    if (mb_num >= s->mb_num) {
+    if (mb_num >= s->mb_num || !mb_num) {
        av_log(s->avctx, AV_LOG_ERROR,
               "illegal mb_num in video packet (%d %d) \n", mb_num, s->mb_num);
        return -1;
@@ -1251,10 +1251,12 @@ not_coded:
 */
 static int mpeg4_decode_partitioned_mb(MpegEncContext *s, int16_t block[6][64])
 {
-    Mpeg4DecContext *ctx = (Mpeg4DecContext *)s;
+    Mpeg4DecContext *ctx = s->avctx->priv_data;
    int cbp, mb_type;
    const int xy = s->mb_x + s->mb_y * s->mb_stride;

+    av_assert2(s == (void*)ctx);
+
    mb_type = s->current_picture.mb_type[xy];
    cbp     = s->cbp_table[xy];

@@ -1336,12 +1338,13 @@ static int mpeg4_decode_partitioned_mb(MpegEncContext *s, int16_t block[6][64])

 static int mpeg4_decode_mb(MpegEncContext *s, int16_t block[6][64])
 {
-    Mpeg4DecContext *ctx = (Mpeg4DecContext *)s;
+    Mpeg4DecContext *ctx = s->avctx->priv_data;
    int cbpc, cbpy, i, cbp, pred_x, pred_y, mx, my, dquant;
    int16_t *mot_val;
    static const int8_t quant_tab[4] = { -1, -2, 1, 2 };
    const int xy = s->mb_x + s->mb_y * s->mb_stride;

+    av_assert2(s ==  (void*)ctx);
    av_assert2(s->h263_pred);

    if (s->pict_type == AV_PICTURE_TYPE_P ||
@@ -2667,8 +2670,8 @@ int ff_mpeg4_decode_picture_header(Mpeg4DecContext *ctx, GetBitContext *gb)

        if (startcode >= 0x120 && startcode <= 0x12F) {
            if (vol) {
-                av_log(s->avctx, AV_LOG_ERROR, "Multiple VOL headers");
-                return AVERROR_INVALIDDATA;
+                av_log(s->avctx, AV_LOG_WARNING, "Ignoring multiple VOL headers\n");
+                continue;
            }
            vol++;
            if ((ret = decode_vol_header(ctx, gb)) < 0)
@@ -1352,12 +1352,9 @@ av_cold int ff_nvenc_encode_close(AVCodecContext *avctx)
    av_fifo_freep(&ctx->unused_surface_queue);

    if (ctx->surfaces && avctx->pix_fmt == AV_PIX_FMT_CUDA) {
-        for (i = 0; i < ctx->nb_surfaces; ++i) {
-            if (ctx->surfaces[i].input_surface) {
-                 p_nvenc->nvEncUnmapInputResource(ctx->nvencoder, ctx->surfaces[i].in_map.mappedResource);
-            }
-        }
        for (i = 0; i < ctx->nb_registered_frames; i++) {
+            if (ctx->registered_frames[i].mapped)
+                p_nvenc->nvEncUnmapInputResource(ctx->nvencoder, ctx->registered_frames[i].in_map.mappedResource);
            if (ctx->registered_frames[i].regptr)
                p_nvenc->nvEncUnregisterResource(ctx->nvencoder, ctx->registered_frames[i].regptr);
        }
@@ -1485,6 +1482,7 @@ static int nvenc_find_free_reg_resource(AVCodecContext *avctx)
    NvencContext *ctx = avctx->priv_data;
    NvencDynLoadFunctions *dl_fn = &ctx->nvenc_dload_funcs;
    NV_ENCODE_API_FUNCTION_LIST *p_nvenc = &dl_fn->nvenc_funcs;
+    NVENCSTATUS nv_status;

    int i;

@@ -1492,8 +1490,10 @@ static int nvenc_find_free_reg_resource(AVCodecContext *avctx)
        for (i = 0; i < ctx->nb_registered_frames; i++) {
            if (!ctx->registered_frames[i].mapped) {
                if (ctx->registered_frames[i].regptr) {
-                    p_nvenc->nvEncUnregisterResource(ctx->nvencoder,
-                                                ctx->registered_frames[i].regptr);
+                    nv_status = p_nvenc->nvEncUnregisterResource(ctx->nvencoder, ctx->registered_frames[i].regptr);
+                    if (nv_status != NV_ENC_SUCCESS)
+                        return nvenc_print_error(avctx, nv_status, "Failed unregistering unused input resource");
+                    ctx->registered_frames[i].ptr = 0;
                    ctx->registered_frames[i].regptr = NULL;
                }
                return i;
@@ -1572,19 +1572,23 @@ static int nvenc_upload_frame(AVCodecContext *avctx, const AVFrame *frame,
        if (res < 0)
            return res;

-        nvenc_frame->in_map.version = NV_ENC_MAP_INPUT_RESOURCE_VER;
-        nvenc_frame->in_map.registeredResource = ctx->registered_frames[reg_idx].regptr;
-        nv_status = p_nvenc->nvEncMapInputResource(ctx->nvencoder, &nvenc_frame->in_map);
-        if (nv_status != NV_ENC_SUCCESS) {
-            av_frame_unref(nvenc_frame->in_ref);
-            return nvenc_print_error(avctx, nv_status, "Error mapping an input resource");
+        if (!ctx->registered_frames[reg_idx].mapped) {
+            ctx->registered_frames[reg_idx].in_map.version = NV_ENC_MAP_INPUT_RESOURCE_VER;
+            ctx->registered_frames[reg_idx].in_map.registeredResource = ctx->registered_frames[reg_idx].regptr;
+            nv_status = p_nvenc->nvEncMapInputResource(ctx->nvencoder, &ctx->registered_frames[reg_idx].in_map);
+            if (nv_status != NV_ENC_SUCCESS) {
+                av_frame_unref(nvenc_frame->in_ref);
+                return nvenc_print_error(avctx, nv_status, "Error mapping an input resource");
+            }
        }

-        ctx->registered_frames[reg_idx].mapped = 1;
+        ctx->registered_frames[reg_idx].mapped += 1;
+
        nvenc_frame->reg_idx                   = reg_idx;
-        nvenc_frame->input_surface             = nvenc_frame->in_map.mappedResource;
-        nvenc_frame->format                    = nvenc_frame->in_map.mappedBufferFmt;
+        nvenc_frame->input_surface             = ctx->registered_frames[reg_idx].in_map.mappedResource;
+        nvenc_frame->format                    = ctx->registered_frames[reg_idx].in_map.mappedBufferFmt;
        nvenc_frame->pitch                     = frame->linesize[0];
+
        return 0;
    } else {
        NV_ENC_LOCK_INPUT_BUFFER lockBufferParams = { 0 };
@@ -1729,14 +1733,33 @@ static int process_output_surface(AVCodecContext *avctx, AVPacket *pkt, NvencSur
    memcpy(pkt->data, lock_params.bitstreamBufferPtr, lock_params.bitstreamSizeInBytes);

    nv_status = p_nvenc->nvEncUnlockBitstream(ctx->nvencoder, tmpoutsurf->output_surface);
-    if (nv_status != NV_ENC_SUCCESS)
-        nvenc_print_error(avctx, nv_status, "Failed unlocking bitstream buffer, expect the gates of mordor to open");
+    if (nv_status != NV_ENC_SUCCESS) {
+        res = nvenc_print_error(avctx, nv_status, "Failed unlocking bitstream buffer, expect the gates of mordor to open");
+        goto error;
+    }


    if (avctx->pix_fmt == AV_PIX_FMT_CUDA) {
-        p_nvenc->nvEncUnmapInputResource(ctx->nvencoder, tmpoutsurf->in_map.mappedResource);
+        ctx->registered_frames[tmpoutsurf->reg_idx].mapped -= 1;
+        if (ctx->registered_frames[tmpoutsurf->reg_idx].mapped == 0) {
+            nv_status = p_nvenc->nvEncUnmapInputResource(ctx->nvencoder, ctx->registered_frames[tmpoutsurf->reg_idx].in_map.mappedResource);
+            if (nv_status != NV_ENC_SUCCESS) {
+                res = nvenc_print_error(avctx, nv_status, "Failed unmapping input resource");
+                goto error;
+            }
+            nv_status = p_nvenc->nvEncUnregisterResource(ctx->nvencoder, ctx->registered_frames[tmpoutsurf->reg_idx].regptr);
+            if (nv_status != NV_ENC_SUCCESS) {
+                res = nvenc_print_error(avctx, nv_status, "Failed unregistering input resource");
+                goto error;
+            }
+            ctx->registered_frames[tmpoutsurf->reg_idx].ptr = 0;
+            ctx->registered_frames[tmpoutsurf->reg_idx].regptr = NULL;
+        } else if (ctx->registered_frames[tmpoutsurf->reg_idx].mapped < 0) {
+            res = AVERROR_BUG;
+            goto error;
+        }
+
        av_frame_unref(tmpoutsurf->in_ref);
-        ctx->registered_frames[tmpoutsurf->reg_idx].mapped = 0;

        tmpoutsurf->input_surface = NULL;
    }
@@ -37,7 +37,6 @@ typedef struct NvencSurface
 {
    NV_ENC_INPUT_PTR input_surface;
    AVFrame *in_ref;
-    NV_ENC_MAP_INPUT_RESOURCE in_map;
    int reg_idx;
    int width;
    int height;
@@ -122,6 +121,7 @@ typedef struct NvencContext
        CUdeviceptr ptr;
        NV_ENC_REGISTERED_PTR regptr;
        int mapped;
+        NV_ENC_MAP_INPUT_RESOURCE in_map;
    } registered_frames[MAX_REGISTERED_FRAMES];
    int nb_registered_frames;

@@ -43,6 +43,7 @@ static const uint8_t *parse_opus_ts_header(const uint8_t *start, int *payload_le
    const uint8_t *buf = start + 1;
    int start_trim_flag, end_trim_flag, control_extension_flag, control_extension_length;
    uint8_t flags;
+    uint64_t payload_len_tmp;

    GetByteContext gb;
    bytestream2_init(&gb, buf, buf_len);
@@ -52,11 +53,11 @@ static const uint8_t *parse_opus_ts_header(const uint8_t *start, int *payload_le
    end_trim_flag          = (flags >> 3) & 1;
    control_extension_flag = (flags >> 2) & 1;

-    *payload_len = 0;
+    payload_len_tmp = *payload_len = 0;
    while (bytestream2_peek_byte(&gb) == 0xff)
-        *payload_len += bytestream2_get_byte(&gb);
+        payload_len_tmp += bytestream2_get_byte(&gb);

-    *payload_len += bytestream2_get_byte(&gb);
+    payload_len_tmp += bytestream2_get_byte(&gb);

    if (start_trim_flag)
        bytestream2_skip(&gb, 2);
@@ -67,6 +68,11 @@ static const uint8_t *parse_opus_ts_header(const uint8_t *start, int *payload_le
        bytestream2_skip(&gb, control_extension_length);
    }

+    if (bytestream2_tell(&gb) + payload_len_tmp > buf_len)
+        return NULL;
+
+    *payload_len = payload_len_tmp;
+
    return buf + bytestream2_tell(&gb);
 }

@@ -104,6 +110,10 @@ static int opus_find_frame_end(AVCodecParserContext *ctx, AVCodecContext *avctx,
            state = (state << 8) | payload[i];
            if ((state & OPUS_TS_MASK) == OPUS_TS_HEADER) {
                payload = parse_opus_ts_header(payload, &payload_len, buf_size - i);
+                if (!payload) {
+                    av_log(avctx, AV_LOG_ERROR, "Error parsing Ogg TS header.\n");
+                    return AVERROR_INVALIDDATA;
+                }
                *header_len = payload - buf;
                start_found = 1;
                break;
@@ -78,6 +78,7 @@ static av_cold int paf_video_init(AVCodecContext *avctx)
 {
    PAFVideoDecContext *c = avctx->priv_data;
    int i;
+    int ret;

    c->width  = avctx->width;
    c->height = avctx->height;
@@ -90,6 +91,9 @@ static av_cold int paf_video_init(AVCodecContext *avctx)
    }

    avctx->pix_fmt = AV_PIX_FMT_PAL8;
+    ret = av_image_check_size2(avctx->width, FFALIGN(avctx->height, 256), avctx->max_pixels, avctx->pix_fmt, 0, avctx);
+    if (ret < 0)
+        return ret;

    c->pic = av_frame_alloc();
    if (!c->pic)
@@ -681,6 +681,8 @@ static int decompress_p(AVCodecContext *avctx,
                                return AVERROR_INVALIDDATA;

                            if (bx == 0) {
+                                if (by < 2)
+                                    return AVERROR_INVALIDDATA;
                                z = backstep;
                            } else {
                                z = 0;
@@ -710,6 +712,8 @@ static int decompress_p(AVCodecContext *avctx,
                                return AVERROR_INVALIDDATA;

                            if (bx == 0) {
+                                if (by < 2)
+                                    return AVERROR_INVALIDDATA;
                                z = backstep;
                            } else {
                                z = 0;
@@ -363,9 +363,10 @@ static int decode_header(SnowContext *s){
                int htaps, i, sum=0;
                Plane *p= &s->plane[plane_index];
                p->diag_mc= get_rac(&s->c, s->header_state);
-                htaps= get_symbol(&s->c, s->header_state, 0)*2 + 2;
-                if((unsigned)htaps >= HTAPS_MAX || htaps==0)
+                htaps= get_symbol(&s->c, s->header_state, 0);
+                if((unsigned)htaps >= HTAPS_MAX/2 - 1)
                    return AVERROR_INVALIDDATA;
+                htaps = htaps*2 + 2;
                p->htaps= htaps;
                for(i= htaps/2; i; i--){
                    p->hcoeff[i]= get_symbol(&s->c, s->header_state, 0) * (1-2*(i&1));
@@ -441,8 +441,8 @@ static inline int GET_TOK(TM2Context *ctx,int type)

 /* recalculate last and delta values for next blocks */
 #define TM2_RECALC_BLOCK(CHR, stride, last, CD) {\
-    CD[0] = CHR[1] - last[1];\
-    CD[1] = (int)CHR[stride + 1] - (int)CHR[1];\
+    CD[0] = (unsigned)CHR[         1] - (unsigned)last[1];\
+    CD[1] = (unsigned)CHR[stride + 1] - (unsigned) CHR[1];\
    last[0] = (int)CHR[stride + 0];\
    last[1] = (int)CHR[stride + 1];}

@@ -50,6 +50,8 @@ static av_cold int ulti_decode_init(AVCodecContext *avctx)
    s->width = avctx->width;
    s->height = avctx->height;
    s->blocks = (s->width / 8) * (s->height / 8);
+    if (s->blocks == 0)
+        return AVERROR_INVALIDDATA;
    avctx->pix_fmt = AV_PIX_FMT_YUV410P;
    s->ulti_codebook = ulti_codebook;

@@ -655,7 +655,7 @@ int attribute_align_arg avcodec_open2(AVCodecContext *avctx, const AVCodec *code
    if (ret < 0)
        return ret;

-    avctx->internal = av_mallocz(sizeof(AVCodecInternal));
+    avctx->internal = av_mallocz(sizeof(*avctx->internal));
    if (!avctx->internal) {
        ret = AVERROR(ENOMEM);
        goto end;
@@ -1157,7 +1157,7 @@ void avsubtitle_free(AVSubtitle *sub)

    av_freep(&sub->rects);

-    memset(sub, 0, sizeof(AVSubtitle));
+    memset(sub, 0, sizeof(*sub));
 }

 av_cold int avcodec_close(AVCodecContext *avctx)
@@ -561,7 +561,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
            for (j = 0; j < c->slices; j++) {
                slice_end   = bytestream2_get_le32u(&gb);
                if (slice_end < 0 || slice_end < slice_start ||
-                    bytestream2_get_bytes_left(&gb) < slice_end) {
+                    bytestream2_get_bytes_left(&gb) < slice_end + 1024LL) {
                    av_log(avctx, AV_LOG_ERROR, "Incorrect slice size\n");
                    return AVERROR_INVALIDDATA;
                }
@@ -951,9 +951,11 @@ static int unpack_vlcs(Vp3DecodeContext *s, GetBitContext *gb,
    Vp3Fragment *all_fragments = s->all_fragments;
    VLC_TYPE(*vlc_table)[2] = table->table;

-    if (num_coeffs < 0)
+    if (num_coeffs < 0) {
        av_log(s->avctx, AV_LOG_ERROR,
               "Invalid number of coefficients at level %d\n", coeff_index);
+        return AVERROR_INVALIDDATA;
+    }

    if (eob_run > num_coeffs) {
        coeff_i      =
@@ -978,6 +980,9 @@ static int unpack_vlcs(Vp3DecodeContext *s, GetBitContext *gb,
            if (eob_run_get_bits[token])
                eob_run += get_bits(gb, eob_run_get_bits[token]);

+            if (!eob_run)
+                eob_run = INT_MAX;
+
            // record only the number of blocks ended in this plane,
            // any spill will be recorded in the next plane.
            if (eob_run > num_coeffs - coeff_i) {
@@ -1634,8 +1634,10 @@ FF_ENABLE_DEPRECATION_WARNINGS
 #endif
        {
            ret = decode_tiles(avctx, data, size);
-            if (ret < 0)
+            if (ret < 0) {
+                ff_thread_report_progress(&s->s.frames[CUR_FRAME].tf, INT_MAX, 0);
                return ret;
+            }
        }

        // Sum all counts fields into td[0].counts for tile threading
@@ -433,8 +433,8 @@ static inline int wv_unpack_stereo(WavpackFrameContext *s, GetBitContext *gb,
                    L2 = L + ((s->decorr[i].weightA * (int64_t)A + 512) >> 10);
                    R2 = R + ((s->decorr[i].weightB * (int64_t)B + 512) >> 10);
                } else {
-                    L2 = L + ((int)(s->decorr[i].weightA * (unsigned)A + 512) >> 10);
-                    R2 = R + ((int)(s->decorr[i].weightB * (unsigned)B + 512) >> 10);
+                    L2 = L + (unsigned)((int)(s->decorr[i].weightA * (unsigned)A + 512) >> 10);
+                    R2 = R + (unsigned)((int)(s->decorr[i].weightB * (unsigned)B + 512) >> 10);
                }
                if (A && L)
                    s->decorr[i].weightA -= ((((L ^ A) >> 30) & 2) - 1) * s->decorr[i].delta;
@@ -446,7 +446,7 @@ static inline int wv_unpack_stereo(WavpackFrameContext *s, GetBitContext *gb,
                if (type != AV_SAMPLE_FMT_S16P)
                    L2 = L + ((s->decorr[i].weightA * (int64_t)s->decorr[i].samplesA[0] + 512) >> 10);
                else
-                    L2 = L + ((int)(s->decorr[i].weightA * (unsigned)s->decorr[i].samplesA[0] + 512) >> 10);
+                    L2 = L + (unsigned)((int)(s->decorr[i].weightA * (unsigned)s->decorr[i].samplesA[0] + 512) >> 10);
                UPDATE_WEIGHT_CLIP(s->decorr[i].weightA, s->decorr[i].delta, s->decorr[i].samplesA[0], L);
                L = L2;
                if (type != AV_SAMPLE_FMT_S16P)
@@ -460,7 +460,7 @@ static inline int wv_unpack_stereo(WavpackFrameContext *s, GetBitContext *gb,
                if (type != AV_SAMPLE_FMT_S16P)
                    R2 = R + ((s->decorr[i].weightB * (int64_t)s->decorr[i].samplesB[0] + 512) >> 10);
                else
-                    R2 = R + ((int)(s->decorr[i].weightB * (unsigned)s->decorr[i].samplesB[0] + 512) >> 10);
+                    R2 = R + (unsigned)((int)(s->decorr[i].weightB * (unsigned)s->decorr[i].samplesB[0] + 512) >> 10);
                UPDATE_WEIGHT_CLIP(s->decorr[i].weightB, s->decorr[i].delta, s->decorr[i].samplesB[0], R);
                R = R2;

@@ -472,7 +472,7 @@ static inline int wv_unpack_stereo(WavpackFrameContext *s, GetBitContext *gb,
                if (type != AV_SAMPLE_FMT_S16P)
                    L2 = L + ((s->decorr[i].weightA * (int64_t)R2 + 512) >> 10);
                else
-                    L2 = L + ((int)(s->decorr[i].weightA * (unsigned)R2 + 512) >> 10);
+                    L2 = L + (unsigned)((int)(s->decorr[i].weightA * (unsigned)R2 + 512) >> 10);
                UPDATE_WEIGHT_CLIP(s->decorr[i].weightA, s->decorr[i].delta, R2, L);
                L                        = L2;
                s->decorr[i].samplesB[0] = L;
@@ -480,7 +480,7 @@ static inline int wv_unpack_stereo(WavpackFrameContext *s, GetBitContext *gb,
        }

        if (type == AV_SAMPLE_FMT_S16P) {
-            if (FFABS(L) + (unsigned)FFABS(R) > (1<<19)) {
+            if (FFABS((int64_t)L) + FFABS((int64_t)R) > (1<<19)) {
                av_log(s->avctx, AV_LOG_ERROR, "sample %d %d too large\n", L, R);
                return AVERROR_INVALIDDATA;
            }
@@ -554,7 +554,7 @@ static inline int wv_unpack_mono(WavpackFrameContext *s, GetBitContext *gb,
            if (type != AV_SAMPLE_FMT_S16P)
                S = T + ((s->decorr[i].weightA * (int64_t)A + 512) >> 10);
            else
-                S = T + ((int)(s->decorr[i].weightA * (unsigned)A + 512) >> 10);
+                S = T + (unsigned)((int)(s->decorr[i].weightA * (unsigned)A + 512) >> 10);
            if (A && T)
                s->decorr[i].weightA -= ((((T ^ A) >> 30) & 2) - 1) * s->decorr[i].delta;
            s->decorr[i].samplesA[j] = T = S;
@@ -28,7 +28,7 @@
 typedef struct DCShiftContext {
    const AVClass *class;
    double dcshift;
-    double limiterthreshhold;
+    double limiterthreshold;
    double limitergain;
 } DCShiftContext;

@@ -47,7 +47,7 @@ static av_cold int init(AVFilterContext *ctx)
 {
    DCShiftContext *s = ctx->priv;

-    s->limiterthreshhold = INT32_MAX * (1.0 - (fabs(s->dcshift) - s->limitergain));
+    s->limiterthreshold = INT32_MAX * (1.0 - (fabs(s->dcshift) - s->limitergain));

    return 0;
 }
@@ -111,14 +111,14 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)

                d = src[j];

-                if (d > s->limiterthreshhold && dcshift > 0) {
-                    d = (d - s->limiterthreshhold) * s->limitergain /
-                             (INT32_MAX - s->limiterthreshhold) +
-                             s->limiterthreshhold + dcshift;
-                } else if (d < -s->limiterthreshhold && dcshift < 0) {
-                    d = (d + s->limiterthreshhold) * s->limitergain /
-                             (INT32_MAX - s->limiterthreshhold) -
-                             s->limiterthreshhold + dcshift;
+                if (d > s->limiterthreshold && dcshift > 0) {
+                    d = (d - s->limiterthreshold) * s->limitergain /
+                             (INT32_MAX - s->limiterthreshold) +
+                             s->limiterthreshold + dcshift;
+                } else if (d < -s->limiterthreshold && dcshift < 0) {
+                    d = (d + s->limiterthreshold) * s->limitergain /
+                             (INT32_MAX - s->limiterthreshold) -
+                             s->limiterthreshold + dcshift;
                } else {
                    d = dcshift * INT32_MAX + d;
                }
@@ -72,7 +72,7 @@ do {
            for (j = 0; j < b->nb; j++)                                         \
                if (a->fmts[i] == b->fmts[j]) {                                 \
                    if(k >= FFMIN(a->nb, b->nb)){                               \
-                        av_log(NULL, AV_LOG_ERROR, "Duplicate formats in avfilter_merge_formats() detected\n"); \
+                        av_log(NULL, AV_LOG_ERROR, "Duplicate formats in %s detected\n", __FUNCTION__); \
                        av_free(ret->fmts);                                     \
                        av_free(ret);                                           \
                        return NULL;                                            \
@@ -615,22 +615,22 @@ static const AVOption deint_vaapi_options[] = {
      OFFSET(mode), AV_OPT_TYPE_INT, { .i64 = VAProcDeinterlacingNone },
      VAProcDeinterlacingNone, VAProcDeinterlacingCount - 1, FLAGS, "mode" },
    { "default", "Use the highest-numbered (and therefore possibly most advanced) deinterlacing algorithm",
-      0, AV_OPT_TYPE_CONST, { .i64 = VAProcDeinterlacingNone }, .unit = "mode" },
+      0, AV_OPT_TYPE_CONST, { .i64 = VAProcDeinterlacingNone }, 0, 0, FLAGS, "mode" },
    { "bob", "Use the bob deinterlacing algorithm",
-      0, AV_OPT_TYPE_CONST, { .i64 = VAProcDeinterlacingBob }, .unit = "mode" },
+      0, AV_OPT_TYPE_CONST, { .i64 = VAProcDeinterlacingBob }, 0, 0, FLAGS, "mode" },
    { "weave", "Use the weave deinterlacing algorithm",
-      0, AV_OPT_TYPE_CONST, { .i64 = VAProcDeinterlacingWeave }, .unit = "mode" },
+      0, AV_OPT_TYPE_CONST, { .i64 = VAProcDeinterlacingWeave }, 0, 0, FLAGS,  "mode" },
    { "motion_adaptive", "Use the motion adaptive deinterlacing algorithm",
-      0, AV_OPT_TYPE_CONST, { .i64 = VAProcDeinterlacingMotionAdaptive }, .unit = "mode" },
+      0, AV_OPT_TYPE_CONST, { .i64 = VAProcDeinterlacingMotionAdaptive }, 0, 0, FLAGS, "mode" },
    { "motion_compensated", "Use the motion compensated deinterlacing algorithm",
-      0, AV_OPT_TYPE_CONST, { .i64 = VAProcDeinterlacingMotionCompensated }, .unit = "mode" },
+      0, AV_OPT_TYPE_CONST, { .i64 = VAProcDeinterlacingMotionCompensated }, 0, 0, FLAGS, "mode" },

    { "rate", "Generate output at frame rate or field rate",
      OFFSET(field_rate), AV_OPT_TYPE_INT, { .i64 = 1 }, 1, 2, FLAGS, "rate" },
    { "frame", "Output at frame rate (one frame of output for each field-pair)",
-      0, AV_OPT_TYPE_CONST, { .i64 = 1 }, .unit = "rate" },
+      0, AV_OPT_TYPE_CONST, { .i64 = 1 }, 0, 0, FLAGS, "rate" },
    { "field", "Output at field rate (one frame of output for each field)",
-      0, AV_OPT_TYPE_CONST, { .i64 = 2 }, .unit = "rate" },
+      0, AV_OPT_TYPE_CONST, { .i64 = 2 }, 0, 0, FLAGS, "rate" },

    { "auto", "Only deinterlace fields, passing frames through unchanged",
      OFFSET(auto_enable), AV_OPT_TYPE_INT, { .i64 = 0 }, 0, 1, FLAGS },
@@ -27,6 +27,7 @@

 #include <stdio.h>

+#include "libavutil/avassert.h"
 #include "libavutil/imgutils.h"
 #include "libavutil/internal.h"
 #include "libavutil/intreadwrite.h"
@@ -54,6 +55,7 @@ enum TransposeDir {
 typedef struct TransContext {
    const AVClass *class;
    int hsub, vsub;
+    int planes;
    int pixsteps[4];

    int passthrough;    ///< PassthroughType, landscape passthrough mode enabled
@@ -215,6 +217,10 @@ static int config_props_output(AVFilterLink *outlink)

    s->hsub = desc_in->log2_chroma_w;
    s->vsub = desc_in->log2_chroma_h;
+    s->planes = av_pix_fmt_count_planes(outlink->format);
+
+    av_assert0(desc_in->nb_components == desc_out->nb_components);
+

    av_image_fill_max_pixsteps(s->pixsteps, NULL, desc_out);

@@ -272,7 +278,7 @@ static int filter_slice(AVFilterContext *ctx, void *arg, int jobnr,
    AVFrame *in = td->in;
    int plane;

-    for (plane = 0; out->data[plane]; plane++) {
+    for (plane = 0; plane < s->planes; plane++) {
        int hsub    = plane == 1 || plane == 2 ? s->hsub : 0;
        int vsub    = plane == 1 || plane == 2 ? s->vsub : 0;
        int pixstep = s->pixsteps[plane];
@@ -212,6 +212,7 @@ static int lrc_read_header(AVFormatContext *s)
    }
    ff_subtitles_queue_finalize(s, &lrc->q);
    ff_metadata_conv_ctx(s, NULL, ff_lrc_metadata_conv);
+    av_bprint_finalize(&line, NULL);
    return 0;
 }

@@ -2089,8 +2089,16 @@ static int matroska_parse_tracks(AVFormatContext *s)
        }

        if (track->type == MATROSKA_TRACK_TYPE_VIDEO) {
-            if (!track->default_duration && track->video.frame_rate > 0)
-                track->default_duration = 1000000000 / track->video.frame_rate;
+            if (!track->default_duration && track->video.frame_rate > 0) {
+                double default_duration = 1000000000 / track->video.frame_rate;
+                if (default_duration > UINT64_MAX || default_duration < 0) {
+                    av_log(matroska->ctx, AV_LOG_WARNING,
+                         "Invalid frame rate %e. Cannot calculate default duration.\n",
+                         track->video.frame_rate);
+                } else {
+                    track->default_duration = default_duration;
+                }
+            }
            if (track->video.display_width == -1)
                track->video.display_width = track->video.pixel_width;
            if (track->video.display_height == -1)
@@ -485,7 +485,12 @@ static int dxva2_device_create9ex(AVHWDeviceContext *ctx, UINT adapter)
    if (FAILED(hr))
        return AVERROR_UNKNOWN;

-    IDirect3D9Ex_GetAdapterDisplayModeEx(d3d9ex, adapter, &modeex, NULL);
+    modeex.Size = sizeof(D3DDISPLAYMODEEX);
+    hr = IDirect3D9Ex_GetAdapterDisplayModeEx(d3d9ex, adapter, &modeex, NULL);
+    if (FAILED(hr)) {
+        IDirect3D9Ex_Release(d3d9ex);
+        return AVERROR_UNKNOWN;
+    }

    d3dpp.BackBufferFormat = modeex.Format;

@@ -107,4 +107,6 @@ int main(int argc, char **argv){
        }
    }
    printf("presig: %d postsig:%d c:%7.4f lenerr:%d\n", bestpos, datlen - siglen - bestpos, bestc / sigamp, datlen - siglen);
+
+    return 0;
 }
@@ -3,354 +3,354 @@
 #codec_id 0: rawvideo
 #dimensions 0: 352x288
 #sar 0: 12/11
-0,          0,          0,        1,   152064, 0xd23ffc59
+0,          0,          0,        1,   152064, 0x8f9d00c1
 0,          1,          1,        1,   152064, 0x899fb8b1
-0,          2,          2,        1,   152064, 0x5958d070
+0,          2,          2,        1,   152064, 0x7225cb39
 0,          3,          3,        1,   152064, 0xf2becd8f
-0,          4,          4,        1,   152064, 0xb47bbed7
+0,          4,          4,        1,   152064, 0xd56bc556
 0,          5,          5,        1,   152064, 0x7ca54f36
-0,          6,          6,        1,   152064, 0x02389610
+0,          6,          6,        1,   152064, 0x06d7805c
 0,          7,          7,        1,   152064, 0x469f3f87
-0,          8,          8,        1,   152064, 0x935a780e
+0,          8,          8,        1,   152064, 0xdb2f57d5
 0,          9,          9,        1,   152064, 0x3876c20c
-0,         10,         10,        1,   152064, 0x49df265f
+0,         10,         10,        1,   152064, 0x5b670e79
 0,         11,         11,        1,   152064, 0xdfe420e0
-0,         12,         12,        1,   152064, 0x6e34a0c4
+0,         12,         12,        1,   152064, 0x17578222
 0,         13,         13,        1,   152064, 0x47e1cb26
-0,         14,         14,        1,   152064, 0x68e74188
+0,         14,         14,        1,   152064, 0x168e35d6
 0,         15,         15,        1,   152064, 0xe9d34b4e
-0,         16,         16,        1,   152064, 0xa8665e1a
+0,         16,         16,        1,   152064, 0x5e395308
 0,         17,         17,        1,   152064, 0x88e3b39f
-0,         18,         18,        1,   152064, 0x1c1ab2c3
+0,         18,         18,        1,   152064, 0x6b099c51
 0,         19,         19,        1,   152064, 0xb1a24ddf
-0,         20,         20,        1,   152064, 0x030d5afc
+0,         20,         20,        1,   152064, 0xcea840fc
 0,         21,         21,        1,   152064, 0x98306d64
-0,         22,         22,        1,   152064, 0x5ce0548d
+0,         22,         22,        1,   152064, 0xb05354d3
 0,         23,         23,        1,   152064, 0xacac26f3
-0,         24,         24,        1,   152064, 0xf167f698
+0,         24,         24,        1,   152064, 0xbccdf14b
 0,         25,         25,        1,   152064, 0xd9398539
-0,         26,         26,        1,   152064, 0xd7aec2c4
+0,         26,         26,        1,   152064, 0x07aec13a
 0,         27,         27,        1,   152064, 0xa6ef9440
-0,         28,         28,        1,   152064, 0xc289b278
+0,         28,         28,        1,   152064, 0x0e7ab64e
 0,         29,         29,        1,   152064, 0x3796939d
-0,         30,         30,        1,   152064, 0x48c09366
+0,         30,         30,        1,   152064, 0xcc219365
 0,         31,         31,        1,   152064, 0xf4cc815a
-0,         32,         32,        1,   152064, 0x1c63cdc2
+0,         32,         32,        1,   152064, 0x8b91c622
 0,         33,         33,        1,   152064, 0xd3a8ad8e
-0,         34,         34,        1,   152064, 0x70f94bc0
+0,         34,         34,        1,   152064, 0x658e498f
 0,         35,         35,        1,   152064, 0xf9c115ea
-0,         36,         36,        1,   152064, 0x44a2f607
+0,         36,         36,        1,   152064, 0xb639f8d2
 0,         37,         37,        1,   152064, 0x7e9eaa64
-0,         38,         38,        1,   152064, 0x37b86b68
+0,         38,         38,        1,   152064, 0x8a546bcf
 0,         39,         39,        1,   152064, 0x59d22dd4
-0,         40,         40,        1,   152064, 0x5d0d0e8d
+0,         40,         40,        1,   152064, 0x80a10edc
 0,         41,         41,        1,   152064, 0x5c97d4a1
-0,         42,         42,        1,   152064, 0xd44ef54d
+0,         42,         42,        1,   152064, 0x4f1bf025
 0,         43,         43,        1,   152064, 0x42721789
-0,         44,         44,        1,   152064, 0x27597277
+0,         44,         44,        1,   152064, 0x39e6700d
 0,         45,         45,        1,   152064, 0xdf4af8b4
-0,         46,         46,        1,   152064, 0x5df7390c
+0,         46,         46,        1,   152064, 0xacf839bb
 0,         47,         47,        1,   152064, 0xbebfbf7c
-0,         48,         48,        1,   152064, 0x753959bb
+0,         48,         48,        1,   152064, 0x09c7630d
 0,         49,         49,        1,   152064, 0x3331ab18
-0,         50,         50,        1,   152064, 0xec4a0f33
+0,         50,         50,        1,   152064, 0xae0f0f28
 0,         51,         51,        1,   152064, 0xbb085737
-0,         52,         52,        1,   152064, 0x3938abf4
+0,         52,         52,        1,   152064, 0x1e23ad39
 0,         53,         53,        1,   152064, 0x18d46683
-0,         54,         54,        1,   152064, 0xb12ace0c
+0,         54,         54,        1,   152064, 0x4eadd0a0
 0,         55,         55,        1,   152064, 0x09b13430
-0,         56,         56,        1,   152064, 0x85bd5e88
+0,         56,         56,        1,   152064, 0x240a607b
 0,         57,         57,        1,   152064, 0xec0f8a67
-0,         58,         58,        1,   152064, 0x51a4fc74
+0,         58,         58,        1,   152064, 0x6c37fc08
 0,         59,         59,        1,   152064, 0xded4cda7
-0,         60,         60,        1,   152064, 0xb69412a9
+0,         60,         60,        1,   152064, 0xc5df1477
 0,         61,         61,        1,   152064, 0x3c9de6f9
-0,         62,         62,        1,   152064, 0x223fcc41
+0,         62,         62,        1,   152064, 0xefd1cdbd
 0,         63,         63,        1,   152064, 0x5df7b89c
-0,         64,         64,        1,   152064, 0x1e58b37a
+0,         64,         64,        1,   152064, 0x1b04af5f
 0,         65,         65,        1,   152064, 0xbbff2c09
-0,         66,         66,        1,   152064, 0x4e0f4d4a
+0,         66,         66,        1,   152064, 0x23b04553
 0,         67,         67,        1,   152064, 0x3d99caa3
-0,         68,         68,        1,   152064, 0xcc329c2f
+0,         68,         68,        1,   152064, 0x35139bf8
 0,         69,         69,        1,   152064, 0x49207c0a
-0,         70,         70,        1,   152064, 0x489f2d50
+0,         70,         70,        1,   152064, 0xa78e2efa
 0,         71,         71,        1,   152064, 0x5a50b0df
-0,         72,         72,        1,   152064, 0x509eb79e
+0,         72,         72,        1,   152064, 0x3255b306
 0,         73,         73,        1,   152064, 0x60622c61
 0,         74,         74,        1,   152064, 0x8c8cde9f
 0,         75,         75,        1,   152064, 0xe8c0bb6c
-0,         76,         76,        1,   152064, 0xb03581b6
+0,         76,         76,        1,   152064, 0xbc698473
 0,         77,         77,        1,   152064, 0x398525c2
 0,         78,         78,        1,   152064, 0x87983ab0
 0,         79,         79,        1,   152064, 0x032af6b5
-0,         80,         80,        1,   152064, 0x7434baa4
+0,         80,         80,        1,   152064, 0x4878bb11
 0,         81,         81,        1,   152064, 0xff5dd044
-0,         82,         82,        1,   152064, 0x45b2bb36
+0,         82,         82,        1,   152064, 0xe675bfe0
 0,         83,         83,        1,   152064, 0x1af29008
 0,         84,         84,        1,   152064, 0x07aa8975
 0,         85,         85,        1,   152064, 0x17957756
 0,         86,         86,        1,   152064, 0x48b5825e
 0,         87,         87,        1,   152064, 0x169d70bc
-0,         88,         88,        1,   152064, 0x803b30c6
+0,         88,         88,        1,   152064, 0x326730c8
 0,         89,         89,        1,   152064, 0x6158c971
-0,         90,         90,        1,   152064, 0xb126e53e
+0,         90,         90,        1,   152064, 0x1035e3ee
 0,         91,         91,        1,   152064, 0xef49ba53
-0,         92,         92,        1,   152064, 0xfcfd7f17
+0,         92,         92,        1,   152064, 0x261081fa
 0,         93,         93,        1,   152064, 0x5280779e
-0,         94,         94,        1,   152064, 0x638d6f48
+0,         94,         94,        1,   152064, 0x8a6d6df3
 0,         95,         95,        1,   152064, 0xdb0f1ed5
-0,         96,         96,        1,   152064, 0x2cb959b0
+0,         96,         96,        1,   152064, 0x5162570a
 0,         97,         97,        1,   152064, 0x0841547c
-0,         98,         98,        1,   152064, 0x412a555b
+0,         98,         98,        1,   152064, 0xf0694fcd
 0,         99,         99,        1,   152064, 0xfe525057
-0,        100,        100,        1,   152064, 0xa8cf0cbc
+0,        100,        100,        1,   152064, 0xb4ec0c96
 0,        101,        101,        1,   152064, 0xbf2dcaee
-0,        102,        102,        1,   152064, 0x636cc494
+0,        102,        102,        1,   152064, 0x7860c418
 0,        103,        103,        1,   152064, 0xc9e288bc
-0,        104,        104,        1,   152064, 0xe77f4d03
+0,        104,        104,        1,   152064, 0xb0514dc3
 0,        105,        105,        1,   152064, 0x722a4bd0
-0,        106,        106,        1,   152064, 0x5271f5ef
+0,        106,        106,        1,   152064, 0x5277f52d
 0,        107,        107,        1,   152064, 0x05208e75
-0,        108,        108,        1,   152064, 0xb8845f88
+0,        108,        108,        1,   152064, 0x0b596089
 0,        109,        109,        1,   152064, 0x47aa117c
-0,        110,        110,        1,   152064, 0xe695fe27
+0,        110,        110,        1,   152064, 0x12edfe8b
 0,        111,        111,        1,   152064, 0x2e50f864
-0,        112,        112,        1,   152064, 0x52d2b719
+0,        112,        112,        1,   152064, 0x4cedb882
 0,        113,        113,        1,   152064, 0xdbf48285
-0,        114,        114,        1,   152064, 0xe0b2ba93
+0,        114,        114,        1,   152064, 0x9071b0e6
 0,        115,        115,        1,   152064, 0x1c85a5ce
 0,        116,        116,        1,   152064, 0x8ef9a8e8
 0,        117,        117,        1,   152064, 0x41e8ae26
 0,        118,        118,        1,   152064, 0x3328d571
 0,        119,        119,        1,   152064, 0xce7d4da2
-0,        120,        120,        1,   152064, 0x7a6f7416
+0,        120,        120,        1,   152064, 0x032d7575
 0,        121,        121,        1,   152064, 0xb3fc65a6
-0,        122,        122,        1,   152064, 0xc5a261e9
+0,        122,        122,        1,   152064, 0xe5a266b4
 0,        123,        123,        1,   152064, 0x943c5925
-0,        124,        124,        1,   152064, 0x259180b2
+0,        124,        124,        1,   152064, 0xe6138024
 0,        125,        125,        1,   152064, 0x3acd4e1b
-0,        126,        126,        1,   152064, 0x692090b4
+0,        126,        126,        1,   152064, 0x9de7903e
 0,        127,        127,        1,   152064, 0xea1184d0
-0,        128,        128,        1,   152064, 0x3e0038d5
+0,        128,        128,        1,   152064, 0x9e323818
 0,        129,        129,        1,   152064, 0xf77872a2
-0,        130,        130,        1,   152064, 0xe4cb7bb5
+0,        130,        130,        1,   152064, 0x8f7c75c7
 0,        131,        131,        1,   152064, 0x9d6d2623
-0,        132,        132,        1,   152064, 0xb9056247
+0,        132,        132,        1,   152064, 0x3d8e62ab
 0,        133,        133,        1,   152064, 0xcd8b3dc5
-0,        134,        134,        1,   152064, 0x13ea1b6d
+0,        134,        134,        1,   152064, 0x57681ebc
 0,        135,        135,        1,   152064, 0x764f3233
-0,        136,        136,        1,   152064, 0x54c00ba8
+0,        136,        136,        1,   152064, 0x8c8b0a4b
 0,        137,        137,        1,   152064, 0x2d9aedac
-0,        138,        138,        1,   152064, 0x1af00532
+0,        138,        138,        1,   152064, 0x0afe03ae
 0,        139,        139,        1,   152064, 0xcecae31b
 0,        140,        140,        1,   152064, 0x0e6ea17f
 0,        141,        141,        1,   152064, 0x66b0b8c4
-0,        142,        142,        1,   152064, 0x0ee879bb
+0,        142,        142,        1,   152064, 0xd44f7976
 0,        143,        143,        1,   152064, 0xf7f029cc
-0,        144,        144,        1,   152064, 0xdd5d08d6
+0,        144,        144,        1,   152064, 0xada307a9
 0,        145,        145,        1,   152064, 0x936ae367
-0,        146,        146,        1,   152064, 0xf0f4aba0
+0,        146,        146,        1,   152064, 0xa019ad8a
 0,        147,        147,        1,   152064, 0x5233a9e7
-0,        148,        148,        1,   152064, 0x02af732b
+0,        148,        148,        1,   152064, 0x6fd5737f
 0,        149,        149,        1,   152064, 0xb2eb2476
-0,        150,        150,        1,   152064, 0x998732b4
+0,        150,        150,        1,   152064, 0x36a53280
 0,        151,        151,        1,   152064, 0xf025230f
-0,        152,        152,        1,   152064, 0x474f3b12
+0,        152,        152,        1,   152064, 0x48373a3e
 0,        153,        153,        1,   152064, 0xe4e950e2
-0,        154,        154,        1,   152064, 0xa3f87fb3
+0,        154,        154,        1,   152064, 0x63d37fc4
 0,        155,        155,        1,   152064, 0x1e465fda
-0,        156,        156,        1,   152064, 0x9e8caab2
+0,        156,        156,        1,   152064, 0xc47ea97e
 0,        157,        157,        1,   152064, 0x0224aca7
-0,        158,        158,        1,   152064, 0x24fcec49
+0,        158,        158,        1,   152064, 0x909dedcc
 0,        159,        159,        1,   152064, 0x1c1df7ea
-0,        160,        160,        1,   152064, 0xc466f68f
+0,        160,        160,        1,   152064, 0x5e43f7f1
 0,        161,        161,        1,   152064, 0xdb11d8fa
-0,        162,        162,        1,   152064, 0xa0f61157
+0,        162,        162,        1,   152064, 0xa66710f5
 0,        163,        163,        1,   152064, 0x352013b0
-0,        164,        164,        1,   152064, 0xc14243c7
+0,        164,        164,        1,   152064, 0xc8e745f1
 0,        165,        165,        1,   152064, 0xb18b6810
-0,        166,        166,        1,   152064, 0x040942e6
+0,        166,        166,        1,   152064, 0xb1c243e2
 0,        167,        167,        1,   152064, 0x6fe129f9
-0,        168,        168,        1,   152064, 0xc3d64c5f
+0,        168,        168,        1,   152064, 0x92814bde
 0,        169,        169,        1,   152064, 0x50954752
-0,        170,        170,        1,   152064, 0xa4d24c64
+0,        170,        170,        1,   152064, 0x48634df3
 0,        171,        171,        1,   152064, 0x3af254c0
 0,        172,        172,        1,   152064, 0x6fde4801
 0,        173,        173,        1,   152064, 0xf8fe19b4
-0,        174,        174,        1,   152064, 0x97b34958
+0,        174,        174,        1,   152064, 0x57004906
 0,        175,        175,        1,   152064, 0x916e2ff4
-0,        176,        176,        1,   152064, 0x60c528e2
+0,        176,        176,        1,   152064, 0xbc0d28f0
 0,        177,        177,        1,   152064, 0x4522435e
 0,        178,        178,        1,   152064, 0x861f5d1b
 0,        179,        179,        1,   152064, 0x42c3bf28
-0,        180,        180,        1,   152064, 0x9772db11
+0,        180,        180,        1,   152064, 0xbd6adb19
 0,        181,        181,        1,   152064, 0x0692f5b8
-0,        182,        182,        1,   152064, 0xb06b4aed
+0,        182,        182,        1,   152064, 0x1e1e4bfb
 0,        183,        183,        1,   152064, 0xdc852986
-0,        184,        184,        1,   152064, 0xa7a025fb
+0,        184,        184,        1,   152064, 0x61c5259e
 0,        185,        185,        1,   152064, 0xe28f365a
-0,        186,        186,        1,   152064, 0xcbf3830e
+0,        186,        186,        1,   152064, 0x19388308
 0,        187,        187,        1,   152064, 0x043bace9
-0,        188,        188,        1,   152064, 0x5dd0b5df
+0,        188,        188,        1,   152064, 0x4bebb678
 0,        189,        189,        1,   152064, 0x6bd6d112
-0,        190,        190,        1,   152064, 0xa585ceb6
+0,        190,        190,        1,   152064, 0x3c9dc401
 0,        191,        191,        1,   152064, 0x91e7556a
-0,        192,        192,        1,   152064, 0x8f2a0404
+0,        192,        192,        1,   152064, 0xae60f7e7
 0,        193,        193,        1,   152064, 0x14066893
-0,        194,        194,        1,   152064, 0x8f715862
+0,        194,        194,        1,   152064, 0x7f5a5f0a
 0,        195,        195,        1,   152064, 0xb1063958
-0,        196,        196,        1,   152064, 0x014c40f0
+0,        196,        196,        1,   152064, 0xadf13b9f
 0,        197,        197,        1,   152064, 0x7ddcf94d
-0,        198,        198,        1,   152064, 0x25473a22
+0,        198,        198,        1,   152064, 0x91393730
 0,        199,        199,        1,   152064, 0xcd150536
-0,        200,        200,        1,   152064, 0x2d24d974
+0,        200,        200,        1,   152064, 0x52e0d7bd
 0,        201,        201,        1,   152064, 0x9130b2ce
-0,        202,        202,        1,   152064, 0x9450a62a
+0,        202,        202,        1,   152064, 0xa07fa62a
 0,        203,        203,        1,   152064, 0x7da258cd
-0,        204,        204,        1,   152064, 0x6c2770de
+0,        204,        204,        1,   152064, 0x984071a6
 0,        205,        205,        1,   152064, 0xd5fa731a
-0,        206,        206,        1,   152064, 0x93757c14
+0,        206,        206,        1,   152064, 0x593d7910
 0,        207,        207,        1,   152064, 0x4b754c71
 0,        208,        208,        1,   152064, 0x51544841
 0,        209,        209,        1,   152064, 0xf466910e
-0,        210,        210,        1,   152064, 0xe818c675
+0,        210,        210,        1,   152064, 0x6535c9c4
 0,        211,        211,        1,   152064, 0x6d45b6d8
-0,        212,        212,        1,   152064, 0xa3de9aec
+0,        212,        212,        1,   152064, 0xe77998a2
 0,        213,        213,        1,   152064, 0x56023275
-0,        214,        214,        1,   152064, 0xa1af21cb
+0,        214,        214,        1,   152064, 0x779b20cc
 0,        215,        215,        1,   152064, 0x1ff1b05e
-0,        216,        216,        1,   152064, 0x142ecbdb
+0,        216,        216,        1,   152064, 0xb9e2c3f0
 0,        217,        217,        1,   152064, 0xdfc6d541
-0,        218,        218,        1,   152064, 0x8d8f7a4c
+0,        218,        218,        1,   152064, 0x301a7948
 0,        219,        219,        1,   152064, 0x03d611ca
-0,        220,        220,        1,   152064, 0x999e6d3f
+0,        220,        220,        1,   152064, 0xe9426f2a
 0,        221,        221,        1,   152064, 0x304c95df
-0,        222,        222,        1,   152064, 0xbdcff306
+0,        222,        222,        1,   152064, 0x60e7f924
 0,        223,        223,        1,   152064, 0x6408670c
-0,        224,        224,        1,   152064, 0xa6d4d038
+0,        224,        224,        1,   152064, 0xbf09ca74
 0,        225,        225,        1,   152064, 0xf2d13572
-0,        226,        226,        1,   152064, 0x2fa8b357
+0,        226,        226,        1,   152064, 0x90ccb47d
 0,        227,        227,        1,   152064, 0x24bbd269
-0,        228,        228,        1,   152064, 0x23dd31f2
+0,        228,        228,        1,   152064, 0x7ae333dd
 0,        229,        229,        1,   152064, 0x90913fe2
-0,        230,        230,        1,   152064, 0x855efbca
+0,        230,        230,        1,   152064, 0xc994007c
 0,        231,        231,        1,   152064, 0x45a123c0
-0,        232,        232,        1,   152064, 0xec465cb2
+0,        232,        232,        1,   152064, 0xa0335bbf
 0,        233,        233,        1,   152064, 0x3e79c4e9
-0,        234,        234,        1,   152064, 0xaeac4476
+0,        234,        234,        1,   152064, 0x05cf4479
 0,        235,        235,        1,   152064, 0x2146392c
-0,        236,        236,        1,   152064, 0x7a186239
+0,        236,        236,        1,   152064, 0x68ac5d0a
 0,        237,        237,        1,   152064, 0x9d26fed8
-0,        238,        238,        1,   152064, 0x88f090ba
+0,        238,        238,        1,   152064, 0x047c9082
 0,        239,        239,        1,   152064, 0x518bd9f8
-0,        240,        240,        1,   152064, 0x70013bdd
+0,        240,        240,        1,   152064, 0xfbd03b16
 0,        241,        241,        1,   152064, 0x5317601a
-0,        242,        242,        1,   152064, 0x97e91795
+0,        242,        242,        1,   152064, 0x450118c5
 0,        243,        243,        1,   152064, 0x1058915b
-0,        244,        244,        1,   152064, 0x3549ffeb
+0,        244,        244,        1,   152064, 0x0a4a000a
 0,        245,        245,        1,   152064, 0xa277707d
-0,        246,        246,        1,   152064, 0xdcb6287d
+0,        246,        246,        1,   152064, 0xc7cb29b2
 0,        247,        247,        1,   152064, 0x371344fc
-0,        248,        248,        1,   152064, 0xb7ea75c7
+0,        248,        248,        1,   152064, 0xbc9375a9
 0,        249,        249,        1,   152064, 0x70c2fa2f
-0,        250,        250,        1,   152064, 0x8dbec050
+0,        250,        250,        1,   152064, 0x41fbc057
 0,        251,        251,        1,   152064, 0xc21a77fe
-0,        252,        252,        1,   152064, 0xf7c7678e
+0,        252,        252,        1,   152064, 0x51e06384
 0,        253,        253,        1,   152064, 0xbee83fcb
-0,        254,        254,        1,   152064, 0x6627efd7
+0,        254,        254,        1,   152064, 0xce2befdf
 0,        255,        255,        1,   152064, 0x4f139865
-0,        256,        256,        1,   152064, 0x76fa5435
+0,        256,        256,        1,   152064, 0x4e0f5372
 0,        257,        257,        1,   152064, 0xf0701fd6
-0,        258,        258,        1,   152064, 0x153e3763
+0,        258,        258,        1,   152064, 0x746c35f4
 0,        259,        259,        1,   152064, 0xf5211469
-0,        260,        260,        1,   152064, 0xc19d24b8
+0,        260,        260,        1,   152064, 0xae8f1c2f
 0,        261,        261,        1,   152064, 0xc2483a75
-0,        262,        262,        1,   152064, 0x67a149ee
+0,        262,        262,        1,   152064, 0x2da24ae6
 0,        263,        263,        1,   152064, 0x86f70e3a
-0,        264,        264,        1,   152064, 0x281b166b
+0,        264,        264,        1,   152064, 0x52b8172a
 0,        265,        265,        1,   152064, 0xca810f3b
-0,        266,        266,        1,   152064, 0x91c90741
+0,        266,        266,        1,   152064, 0x6d9504c4
 0,        267,        267,        1,   152064, 0x4edcfbfa
-0,        268,        268,        1,   152064, 0x0ca40c66
+0,        268,        268,        1,   152064, 0x292c0bfd
 0,        269,        269,        1,   152064, 0xee998e3d
 0,        270,        270,        1,   152064, 0xe4b6c1b2
 0,        271,        271,        1,   152064, 0xbbe0a4cc
-0,        272,        272,        1,   152064, 0xd080bcfd
+0,        272,        272,        1,   152064, 0xcd88bcf2
 0,        273,        273,        1,   152064, 0x365df7c5
-0,        274,        274,        1,   152064, 0x934f071f
+0,        274,        274,        1,   152064, 0x01cd06a4
 0,        275,        275,        1,   152064, 0xcfaefeef
-0,        276,        276,        1,   152064, 0xedd8263e
+0,        276,        276,        1,   152064, 0xe615289d
 0,        277,        277,        1,   152064, 0x1d5243de
-0,        278,        278,        1,   152064, 0xc0d87e50
+0,        278,        278,        1,   152064, 0x7c397dfe
 0,        279,        279,        1,   152064, 0xe25845b1
-0,        280,        280,        1,   152064, 0x47006123
+0,        280,        280,        1,   152064, 0x2d6a60a8
 0,        281,        281,        1,   152064, 0xf1926203
-0,        282,        282,        1,   152064, 0x494b8b9c
+0,        282,        282,        1,   152064, 0x634a88c9
 0,        283,        283,        1,   152064, 0xc50aa1b7
-0,        284,        284,        1,   152064, 0xb82da5e2
+0,        284,        284,        1,   152064, 0x972fa713
 0,        285,        285,        1,   152064, 0xa11cd0f6
-0,        286,        286,        1,   152064, 0x7ebff98d
+0,        286,        286,        1,   152064, 0xbff8f90e
 0,        287,        287,        1,   152064, 0x00902e76
-0,        288,        288,        1,   152064, 0xdee41ea2
+0,        288,        288,        1,   152064, 0x5cf31cb1
 0,        289,        289,        1,   152064, 0x2b026058
-0,        290,        290,        1,   152064, 0xce81051f
+0,        290,        290,        1,   152064, 0x258002cc
 0,        291,        291,        1,   152064, 0x0d708815
-0,        292,        292,        1,   152064, 0xd7719e35
+0,        292,        292,        1,   152064, 0xe3809ce0
 0,        293,        293,        1,   152064, 0xf0239467
-0,        294,        294,        1,   152064, 0x466d98b4
+0,        294,        294,        1,   152064, 0x6e71916a
 0,        295,        295,        1,   152064, 0xc1fb36e1
-0,        296,        296,        1,   152064, 0x26bc139e
+0,        296,        296,        1,   152064, 0xd47f07c9
 0,        297,        297,        1,   152064, 0x7fd111ea
-0,        298,        298,        1,   152064, 0xa39737cb
+0,        298,        298,        1,   152064, 0xc4023a80
 0,        299,        299,        1,   152064, 0x8f5851ba
-0,        300,        300,        1,   152064, 0xa971f6e2
+0,        300,        300,        1,   152064, 0x9982f47b
 0,        301,        301,        1,   152064, 0x0e5f6f80
-0,        302,        302,        1,   152064, 0xdb8b5e06
+0,        302,        302,        1,   152064, 0x49925e53
 0,        303,        303,        1,   152064, 0xf6006bcc
-0,        304,        304,        1,   152064, 0x060cd1a6
+0,        304,        304,        1,   152064, 0xd4b5d0f7
 0,        305,        305,        1,   152064, 0x419ef0a4
-0,        306,        306,        1,   152064, 0xe79f0b93
+0,        306,        306,        1,   152064, 0x4e610934
 0,        307,        307,        1,   152064, 0x1919e999
-0,        308,        308,        1,   152064, 0xacb715bc
+0,        308,        308,        1,   152064, 0x3a750d80
 0,        309,        309,        1,   152064, 0x16616075
-0,        310,        310,        1,   152064, 0x09aa4f10
+0,        310,        310,        1,   152064, 0x3284519f
 0,        311,        311,        1,   152064, 0x976cdd70
-0,        312,        312,        1,   152064, 0x4811dc21
+0,        312,        312,        1,   152064, 0x4ec5d1e3
 0,        313,        313,        1,   152064, 0x30d31172
-0,        314,        314,        1,   152064, 0x2db60b70
+0,        314,        314,        1,   152064, 0xe33609b5
 0,        315,        315,        1,   152064, 0x5377bb89
-0,        316,        316,        1,   152064, 0x6c20cab3
+0,        316,        316,        1,   152064, 0x5479cd3d
 0,        317,        317,        1,   152064, 0x964dad60
-0,        318,        318,        1,   152064, 0x514df2c3
+0,        318,        318,        1,   152064, 0x3a7deaf4
 0,        319,        319,        1,   152064, 0xced22332
-0,        320,        320,        1,   152064, 0x1c64bc82
+0,        320,        320,        1,   152064, 0x3b36b53f
 0,        321,        321,        1,   152064, 0x10c38662
-0,        322,        322,        1,   152064, 0xe6c7ff46
+0,        322,        322,        1,   152064, 0x45d4fceb
 0,        323,        323,        1,   152064, 0x359da948
-0,        324,        324,        1,   152064, 0x5a9458ee
+0,        324,        324,        1,   152064, 0x60625190
 0,        325,        325,        1,   152064, 0x1cda9888
-0,        326,        326,        1,   152064, 0xbd081682
+0,        326,        326,        1,   152064, 0x77ad1d8c
 0,        327,        327,        1,   152064, 0x20f1510f
-0,        328,        328,        1,   152064, 0x6bc261a9
+0,        328,        328,        1,   152064, 0xd11d52c6
 0,        329,        329,        1,   152064, 0x9f0e5797
-0,        330,        330,        1,   152064, 0xd14ca712
+0,        330,        330,        1,   152064, 0x174ca55b
 0,        331,        331,        1,   152064, 0x8df79054
-0,        332,        332,        1,   152064, 0x34efa950
+0,        332,        332,        1,   152064, 0x3844a495
 0,        333,        333,        1,   152064, 0x268d9d12
-0,        334,        334,        1,   152064, 0xad91b2ed
+0,        334,        334,        1,   152064, 0xf672b44f
 0,        335,        335,        1,   152064, 0xe0ac87cf
-0,        336,        336,        1,   152064, 0xba4cfd8e
+0,        336,        336,        1,   152064, 0xbc99fd7d
 0,        337,        337,        1,   152064, 0x876ef9e3
-0,        338,        338,        1,   152064, 0x45ab6684
+0,        338,        338,        1,   152064, 0xef8066f7
 0,        339,        339,        1,   152064, 0x72a99564
-0,        340,        340,        1,   152064, 0xdfc8be01
+0,        340,        340,        1,   152064, 0x5921c088
 0,        341,        341,        1,   152064, 0x3a6b9e74
-0,        342,        342,        1,   152064, 0xca1be9c6
+0,        342,        342,        1,   152064, 0xfb03e9b5
 0,        343,        343,        1,   152064, 0xc351bfc6
-0,        344,        344,        1,   152064, 0xef30c978
+0,        344,        344,        1,   152064, 0x2faec717
 0,        345,        345,        1,   152064, 0x062fc6f3
-0,        346,        346,        1,   152064, 0x8731a9ec
+0,        346,        346,        1,   152064, 0xede7a97f
 0,        347,        347,        1,   152064, 0x19874144
 0,        348,        348,        1,   152064, 0x929650eb
 0,        349,        349,        1,   152064, 0x082557a1
-0,        350,        350,        1,   152064, 0xb80510ae
+0,        350,        350,        1,   152064, 0x2b25104b
@@ -1 +1 @@
 .4.1
 .4.2