Bump minor version for master after 4.1 branchpoint

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-02 00:53:07 +01:00
301 changed files with 1333 additions and 4041 deletions
@@ -1,556 +1,6 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.

-version 4.1.5:
- Changelog: Fix formating for 4.1.4
- avcodec/cbs_av1: avoid reading trailing bits when obu type is OBU_TILE_LIST
- avcodec/av1_parser: skip frames with spatial_id > 0
- cbs_h264: Fix missing inferred colour description fields
- avcodec/cbs_av1: keep separate reference frame state for reading and writing
- avcodec/cbs_av1: fix reading reference order hint in skip_mode_params()
- configure: bump year
- avcodec/pgssubdec: Free subtitle on error
- avcodec/ffwavesynth: Fix undefined overflow in wavesynth_synth_sample()
- avcodec/cook: Use 3 stage VLC decoding for channel_coupling
- avcodec/wmalosslessdec: Fixes undefined overflow in dequantization in decode_subframe()
- avcodec/sonic: Check e in get_symbol()
- avcodec/twinvqdec: Correct overflow in block align check
- avcodec/vc1dec: Fix "return -1" cases
- avcodec/vc1dec: Free sprite_output_frame on error
- avcodec/atrac9dec: Clamp band_ext_data to max that can be read if skipped.
- avcodec/wmadec: Keep track of exponent initialization per channel
- avcodec/iff: Check that video_size is large enough for the read parameters
- avcodec/cbs_vp9: Check data_size
- avcodec/cbs_vp9: Check index_size
- avcodec/adpcm: Clip predictor for APC
- avcodec/targa: Check colors vs. available space
- avcodec/dstdec: Use get_ur_golomb_jpegls()
- avcodec/wmavoice: Check remaining input in parse_packet_header()
- avcodec/wmalosslessdec: Fix 2 overflows in mclms
- avcodec/wmaprodec: Fixes integer overflow with 32bit samples
- avcodec/adpcm: Fix invalid shift in xa_decode()
- avcodec/wmalosslessdec: Fix several integer issues
- avcodec/wmalosslessdec: Check that padding bits is not more than sample bits
- avcodec/iff: Skip overflowing runs in decode_delta_d()
- avcodec/pnm: Check that the header is not truncated
- avcodec/mp3_header_decompress_bsf: Check sample_rate_index
- avcodec/cbs_av1_syntax_template: Check num_y_points
- avcodec/cbs_av1: fix array size for ar_coeffs_cb_plus_128 and ar_coeffs_cr_plus_128
- avformat/rmdec: Initialize and sanity check offset in ivr_read_header()
- avcodec/apedec: Fix 2 integer overflows
- avformat/id3v2: Fix double-free on error
- avcodec/wmaprodec: Set packet_loss when we error out on a sanity check
- avcodec/wmaprodec: Check offset
- avcodec/truemotion2: Fix 2 integer overflows in tm2_low_res_block()
- avcodec/wmaprodec: Check if the channel sum of all internal contexts match the external
- avcodec/atrac9dec: Check q_unit_cnt more completely before using it to access at9_tab_band_ext_group
- avcodec/fitsdec: Use lrint()
- avcodec/g729dec: require buf_size to be non 0
- avcodec/alac: Fix integer overflow in lpc_prediction() with sign
- avcodec/wmaprodec: Fix buflen computation in save_bits()
- avcodec/vc1_block: Fix integer overflow in AC rescaling in vc1_decode_i_block_adv()
- avcodec/vmdaudio: Check chunk counts to avoid integer overflow
- avformat/mxfdec: Clear metadata_sets_count in mxf_read_close()
- avcodec/nuv: Use ff_set_dimensions()
- avcodec/ffwavesynth: Fix integer overflow with pink_ts_cur/next
- avcodec/ralf: Fix integer overflows with the filter coefficient in decode_channel()
- avcodec/g729dec: Use 64bit and clip in scalar product
- avcodec/mxpegdec: Check for multiple SOF
- avcodec/nuv: Move comptype check up
- avcodec/wmavoice: Fix integer overflow in synth_frame()
- avcodec/rawdec: Check bits_per_coded_sample more pedantically for 16bit cases
- avutil/lfg: Correct index increment type to avoid undefined behavior
- avcodec/cngdec: Remove AV_CODEC_CAP_DELAY
- avcodec/iff: Move index use after check in decodeplane8()
- avcodec/atrac3: Check for huge block aligns
- avcodec/ralf: use multiply instead of shift to avoid undefined behavior in decode_block()
- avcodec/wmadec: Require previous exponents for reuse
- avcodec/vc1_block: Fix undefined behavior in ac prediction rescaling
- avcodec/qdm2: The smallest header seems to have 2 bytes so treat 1 as invalid
- avcodec/apedec: Fixes integer overflow of res+*data in do_apply_filter()
- avcodec/sonic: Fix integer overflow in predictor_calc_error()
- avcodec/atrac9dec: Check precision_fine/coarse
- avformat/mp3dec: Check that the frame fits within the probe buffer
- avcodec/wmaprodec: get frame during frame decode
- avcodec/interplayacm: Fix overflow of last unused value
- avcodec/adpcm: Fix undefined behavior with negative predictions in IMA OKI
- avcodec/cook: Move up and extend block_align check
- avcodec/sbcdec: Fix integer overflows in sbc_synthesize_four()
- avcodec/twinvq: Check block_align
- avcodec/cook: Enlarge gain table
- avcodec/cook: Check samples_per_channel earlier
- avcodec/atrac3plus: Check split point in fill mode 3
- avcodec/wmavoice: Check sample_rate
- avcodec/xsubdec: fix overflow in alpha handling
- avcodec/iff: Check available space before entering loop in decode_long_vertical_delta2() / decode_long_vertical_delta()
- avcodec/apedec: Fix integer overflow in filter_3800()
- avutil/lfg: Document the AVLFG struct
- avcodec/ffv1dec: Use a different error message for the slice level CRC
- avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830()
- avcodec/dstdec: Check that AC probabilities are within range
- avcodec/dstdec: Check read_table() for failure
- avcodec/snowenc: Set mb_num to avoid ratecontrol floating point divisions by 0.0
- avcodec/snowenc: Fix 2 undefined shifts
- avformat/nutenc: Do not pass NULL to memcmp() in get_needed_flags()
- avcodec/aptx: Check the number of channels
- avcodec/aacdec_template: Check samplerate
- avcodec/truemotion2: Fix several integer overflows in tm2_low_res_block()
- avcodec/utils: Check block_align
- avcodec/wmalosslessdec: Fix some integer anomalies
- avcodec/adpcm: Fix invalid shifts in ADPCM DTK
- avcodec/apedec: Only clear the needed buffer space, instead of all
- avcodec/libvorbisdec: Fix insufficient input checks leading to out of array reads
- avcodec/g723_1dec: fix invalid shift with negative sid_gain
- avcodec/vp5: Check render_x/y
- avcodec/qdrw: Check input for header/skiped space before get_buffer()
- avcodec/ralf: Skip initializing unused filter variables
- avcodec/takdec: Fix overflow with large sample rates
- avcodec/atrac9dec: Set channels
- avcodec/alsdec: Check that input space for header exists in read_diff_float_data()
- avformat/pjsdec: Check duration for overflow
- avcodec/ptx: Check that the input contains at least one line
- avcodec/alac: Fix integer overflow in LPC
- avcodec/smacker: Fix integer overflows in pred[] in smka_decode_frame()
- avcodec/aliaspixdec: Check input size against minimal picture size
- avcodec/ffwavesynth: Fix integer overflows in pink noise addition
- avcodec/vc1_block: Fixes integer overflow in vc1_decode_i_block_adv()
- avcodec/wmalosslessdec: Check block_align
- avcodec/g729postfilter: Fix left shift of negative value
- avcodec/binkaudio: Check sample rate
- avcodec/sbcdec: Fix integer overflows in sbc_synthesize_eight()
- avcodec/adpcm: Check initial predictor for ADPCM_IMA_EA_EACS
- avcodec/g723_1dec: Fix overflow in shift
- avcodec/apedec: Fix integer overflow in predictor_update_3930()
- avcodec/g729postfilter: Fix undefined intermediate pointers
- avcodec/g729postfilter: Fix undefined shifts
- avcodec/lsp: Fix undefined shifts in lsp2poly()
- avcodec/adpcm: Fix left shifts in AV_CODEC_ID_ADPCM_EA
- avformat/shortendec: Check k in probe
- avfilter/vf_geq: Use av_clipd() instead of av_clipf()
- avcodec/wmaprodec: Check that the streams channels do not exceed the overall channels
- avcodec/qdmc: Check input space in qdmc_get_vlc()
- avcodec/pcm: Check bits_per_coded_sample
- avcodec/exr: Allow duplicate use of channel indexes
- avcodec/fitsdec: Fail on 0 naxisn
- avcodec/dxv: Subtract 12 earlier in dxv_decompress_cocg()
- libavcodec/dxv: Remove redundant seek
- avcodec/ituh263dec: Check input for minimal frame size
- avcodec/truemotion1: Check that the input has enough space for a minimal index_stream
- avformat/mpsubdec: Clear queue on error
- avcodec/sunrast: Check that the input is large enough for the maximally compressed image
- avcodec/sunrast: Check for availability of maplength before allocating image
- avformat/subtitles: Check nb_subs in ff_subtitles_queue_finalize()
- avcodec/vc1_block: Fix invalid left shift in vc1_decode_p_mb()
- avcodec/wmaprodec: Check if there is a stream
- avcodec/g2meet: Check for end of input in jpg_decode_block()
- avcodec/g2meet: Check if adjusted pixel was on the stack
- avformat/electronicarts: If no packet has been read at the end do not treat it as if theres a packet
- avcodec/dxv: Check op_offset in dxv_decompress_yo()
- avcodec/utils: Check sample_rate before opening the decoder
- avcodec/aptx: Fix multiple shift anomalies
- avcodec/fitsdec: fix use of uninitialised values
- avcodec/motionpixels: Mark 2 functions as always_inline
- avcodec/ituh263dec: Make the condition for the studio slice start code match between ff_h263_resync() and ff_mpeg4_decode_studio_slice_header()
- avcodec/ralf: Fix integer overflow in decode_channel()
- vcodec/vc1: compute rangex/y only for P/B frames
- avcodec/vc1_pred: Fix invalid shifts in scaleforopp()
- avcodec/vc1_block: Fix invalid shift with rangeredfrm
- avcodec/vc1: Check for excessive resolution
- avcodec/vc1: check REFDIST
- avcodec/apedec: Fix several integer overflows in predictor_update_filter() and do_apply_filter()
- avcodec/hevc_cabac: Tighten the limit on k in ff_hevc_cu_qp_delta_abs()
- avcodec/4xm: Check index in decode_i_block() also in the path where its not used.
- avcodec/loco: Check for end of input in the first line
- avcodec/atrac3: Check block_align
- avcodec/alsdec: Avoid dereferencing context pointer in inner interleave loop
- avcodec/fitsdec: Prevent division by 0 with huge data_max
- avcodec/dstdec: Fix integer overflow in samples_per_frame computation
- avcodec/g729_parser: Check block_size
- avcodec/sbcdec: Initialize number of channels
- avcodec/utils: Optimize ff_color_frame() using memcpy()
- avcodec/aacdec: Check if we run out of input in read_stream_mux_config()
- avcodec/utils: Use av_memcpy_backptr() in ff_color_frame()
- avcodec/smacker: Fix integer overflow in signed int multiply in SMK_BLK_FILL
- avcodec/alac: Fix invalid shifts in 20/24 bps
- avcodec/alac: fix undefined behavior with INT_MIN in lpc_prediction()
- avcodec/ffwavesynth: Fix integer overflow in timestamps
- avcodec/dxv: Check op_offset in both directions
- avcodec/adpcm: Check number of channels for MTAF
- avcodec/sunrast: Fix indention
- avcodec/sunrast: Fix return type for "unsupported (compression) type"
- avcodec/utils: Check channels fully earlier
- avformat/mov: Check for EOF in mov_read_meta()
- avcodec/hevcdec: Fix memleak of a53_caption
- avformat/cdxl: Fix integer overflow in intermediate
- avcodec/hevcdec: repeat character in skiped
- avcodec/gdv: Replace assert() checking bitstream by if()
- libavcodec/utils: Free threads on init failure
- avcodec/htmlsubtitles: Avoid locale dependant isdigit()
- avcodec/alsdec: Check k from being outside what our implementation can handle
- avcodec/takdec: Fix integer overflow in decorrelate()
- avcodec/aacps: Fix integer overflows in hybrid_synthesis()
- avcodec/mpeg4videodec: Fix integer overflow in mpeg4_decode_studio_block()
- avcodec/vp56rac: delay signaling an error on truncated input
- avcodec/qdm2: Check frame size
- avcodec/vc1_pred: Fix refdist in scaleforopp()
- avcodec/vorbisdec: fix FASTDIV usage for vr_type == 2
- avcodec/iff: Check for overlap in cmap_read_palette()
- avcodec/apedec: Fix 32bit int overflow in do_apply_filter()
- avcodec/ralf: fix undefined shift in extend_code()
- avcodec/ralf: fix undefined shift
- avcodec/bgmc: Check input space in ff_bgmc_decode_init()
- avcodec/truemotion2: Fix multiple integer overflows in tm2_null_res_block()
- avcodec/vc1_block: Check the return code from vc1_decode_p_block()
- avcodec/vc1dec: Require res_sprite for wmv3images
- avcodec/vc1_block: Check for double escapes
- avcodec/vorbisdec: Check get_vlc2() failure
- avcodec/tta: Fix integer overflow in prediction
- avcodec/vb: Check input packet size to be large enough to contain flags
- avcodec/cavsdec: Limit the number of access units per packet to 2
- avcodec/atrac9dec: Check block_align
- avcodec/alac: Check for bps of 0
- avcodec/alac: Fix multiple integer overflows in lpc_prediction()
- avcodec/rl2: set dimensions
- avcodec/aacdec: Add FF_CODEC_CAP_INIT_CLEANUP
- avcodec/idcinvideo: Add 320x240 default maximum resolution
- avformat/realtextdec: free queue on error
- avcodec/vp5/6/8: use vpX_rac_is_end()
- avcodec/alsdec: Fix integer overflow in decode_var_block_data()
- avcodec/alsdec: Limit maximum channels to 512
- avcodec/anm: Check input size for a frame with just a stop code
- avcodec/flicvideo: Optimize and Simplify FLI_COPY in flic_decode_frame_24BPP() by using bytestream2_get_buffer()
- avcodec/loco: Check left column value
- avcodec/ffwavesynth: Fixes invalid shift with pink noise seeking
- avcodec/ffwavesynth: Fix integer overflow for some corner case values
- avcodec/indeo2: Check remaining input more often
- avcodec/diracdec: Check that slices are fewer than pixels
- avcodec/vp56: Consider the alpha start as end of the prior header
- avcodec/4xm: Check for end of input in decode_p_block()
- avcodec/hevcdec: Check delta_luma_weight_l0/1
- avcodec/hnm4video: Optimize postprocess_current_frame()
- avcodec/hevc_refs: Optimize 16bit generate_missing_ref()
- avcodec/scpr: Use av_memcpy_backptr() in type 17 and 33
- avcodec/dds: Use ff_set_dimensions()
- avcodec/mpc8: Fix 32bit mask/enum
- avcodec/alsdec: Fix integer overflows of raw_samples in decode_var_block_data()
- avcodec/alsdec: Fix integer overflow of raw_samples in decode_blocks()
- avcodec/alsdec: fix mantisse shift
- avcodec/vc1_block: Fix invalid shifts in vc1_decode_i_blocks()
- avcodec/vc1_block: fix invalid shift in vc1_decode_p_mb()
- avcodec/aacdec_template: fix integer overflow in imdct_and_windowing()
- libavcodec/iff: Use unsigned to avoid undefined behaviour
- avcodec/alsdec: Check for block_length <= 0 in read_var_block_data()
- avcodec/vqavideo: Set video size
- avcodec/sanm: Check extradata_size before allocations
- avcodec/mss1: check for overread and forward errors
- avcodec/loco: Check for end of input in pixel decode
- avcodec/dirac_parser: Fix overflow in dts
- avcodec/ralf: Fix undefined pointer in decode_channel()
- avcodec/ralf: Fix integer overflow in apply_lpc()
- avcodec/vorbisdec: Implement vr->classifications = 1
- avcodec/vorbisdec: Check parameters in vorbis_floor0_decode() before divide
- avformat/realtextdec: Check for duplicate extradata in realtext_read_header()
- avcodec/cbs_av1_syntax_template: Check ref_frame_idx before use
- avcodec/apedec: Fix 2 signed overflows
- avcodec/mss3: Check for the rac stream being invalid in rac_normalize()
- avcodec/vc1_block: Check get_vlc2() return before use
- avcodec/apedec: Do not partially clear data array
- avcodec/atrac9dec: Check grad_range[1] more tightly
- avcodec/hnm4video: Forward errors of decode_interframe_v4()
- avcodec/clearvideo: fix invalid shift in tile size check
- avcodec/vp3: Check that theora is theora
- avcodec/vc1_pred: Fix invalid shift in scaleforsame()
- avcodec/vc1_block: Fix integer overflow in ff_vc1_pred_dc()
- avcodec/truemotion2: Fix several integer overflows in tm2_motion_block()
- avcodec/apedec: make left/right unsigned to avoid undefined behavior
- avcodec/apedec: Fix multiple integer overflows and undefined behaviorin filter_3800()
- avformat/mpc: deallocate frames array on errors
- avcodec/eatqi: Check for minimum frame size
- avcodec/eatgv: Check remaining size after the keyframe header
- avcodec/assdec: undefined use of memcpy()
- avcodec/brenderpix: Check input size before allocating image
- lafv/wavdec: Fail bext parsing on incomplete reads
- avcodec/utils: fix leak of subtitle_header on error path
- avcodec/utils: Check close before calling it
- tools/target_dec_fuzzer: Free parser in case of avcodec_open2() failure
- avcodec/vorbisdec: Check vlc for floor0 dec vector offset
- avcodec/vorbisdec: amplitude bits can be more than 25 bits
- avutil/softfloat_ieee754: Fix odd bit position for exponent and sign in av_bits2sf_ieee754()
- avcodec/apedec: Fix various integer overflows
- avcodec/apedec: Fix multiple integer overflows in predictor_update_filter()
- avcodec/alsdec: fix undefined shift in multiply()
- avcodec/alsdec: Fix 2 integer overflows
- avcodec/flicvideo: Make line_packets int
- avcodec/dvbsubdec: Use ff_set_dimensions()
- avcodec/ffwavesynth: Check if there is enough extradata before allocation
- avcodec/ffwavesynth: More correct cast in wavesynth_seek()
- avcodec/ffwavesynth: Check sample rate before use
- avcodec/dnxhd_parser: Fix parser when input does not have nicely sized packets
- avcodec/dnxhd_parser: remove unneeded code
- avformat/utils: Check rfps_duration_sum for overflow
- avcodec/h264_refs: Also check reference in ff_h264_build_ref_list()
- avcodec/atrac9dec: Check conditions before apply_band_extension() to avoid out of array read in initialization of unused variables
- avcodec/parser: Check next index validity in ff_combine_frame()
- avcodec/ivi: Ask for samples with odd tiles
- avformat/xmv: Make bitrate 64bit
- avcodec/pngdec: Check that previous_picture has same w/h/format
- avcodec/huffyuv: remove gray8a (the format is listed but not supported by the implementation)
- avcodec/mpc8: Fixes invalid shift in mpc8_decode_frame()
- avcodec/utils, avcodec_open2: close codec on failure
- avformat/rpl: Replace strcpy with av_strlcpy
- avcodec/amfnec: allocate packets using av_new_packet()
- avcodec/nvenc: make sure newly allocated packets are refcounted
- lavc/mpeg4audio: add chan_config check to avoid indeterminate channels
- aformat/movenc: add missing padding to output track extradata
- avcodec/nvenc: add driver version info for latest SDKs
- avcodec/bsf: check that AVBSFInternal was allocated before dereferencing it
- lavf/rawenc: Only accept the appropriate stream type for raw muxers.
- lavc/tableprint_vlc: Remove avpriv_request_sample() from included files.
- avcodec/h263dec: fix hwaccel decoding
- avutil/mem: Fix invalid use of av_alloc_size
- cbs_h2645: Fix infinite loop in more_rbsp_data
- avformat/aacdec: resync to the next adts frame on invalid data instead of aborting
- avformat/aacdec: factorize the adts frame resync code
- cbs_mpeg2: Fix storage type for frame_centre_*_offset
- cbs_mpeg2: Improve checks for invalid values
- avcodec/cbs_mpeg2: fix leak of extra_information_slice buffer in cbs_mpeg2_read_slice_header()
- lavc/cbs: Do not use format specifier "z" on Windows.
- lavc/cbs_vp9: Make variable prob unsigned.
- avcodec/cbs_h264: fix storage type for time_offset in Pic Timing SEI
- avcodec/cbs_h2645: add helper macros for signed values
- avcodec/cbs: add helper functions and macros to read and write signed values
- cbs_h264: Fix handling of auxiliary pictures
-
-version 4.1.4:
- avcodec/ilbcdec: Simplify use of unsigned and fix more undefined overflows
- avcodec/golomb: Correct the doxy about get_ue_golomb() and errors
- avformat/utils: Check timebase before use in estimate_timings()
- avcodec/hq_hqa: Use ff_set_dimensions()
- avcodec/rv10: Fix integer overflow in aspect ratio compare
- avcodec/4xm: Fix signed integer overflows in idct()
- avcodec/qdm2: Check checksum_size for 0
- avcodec/qdm2: error out of qdm2_fft_decode_tones() before entering endless loop
- avcodec/qdm2: Do not read out of array in fix_coding_method_array()
- avcodec/svq3: Use ff_set_dimension()
- avcodec/iff: Check ham vs bpp
- avcodec/ffwavesynth: use uint32_t to compute difference, it is enough
- avcodec/ffwavesynth: Simplify lcg_seek(), avoid negative case
- avcodec/ffwavesynth: Fix backward lcg_seek()
- avcodec/flicvideo: Fix off by 1 error in flic_decode_frame_24BPP()
- avcodec/vc1_block: Check for vlc error in vc1_decode_ac_coeff()
- avcodec/alac: Check lpc_quant
- avcodec/dxv: Initialize tex_funct to NULL
- avcodec/alsdec: Add FF_CODEC_CAP_INIT_CLEANUP
- avcodec/alsdec: Fix integer overflow with buffer number
- avcodec/alsdec: Fixes signed integer overflow in LSB addition
- avcodec/alsdec: Check opt_order / sb_length in ra_block handling
- avcodec/alsdec: Fix integer overflow with shifting samples
- avcodec/alsdec: Fix undefined behavior in decode_rice()
- avcodec/alsdec: Fixes invalid shifts in read_var_block_data() and INTERLEAVE_OUTPUT()
- avcodec/hevc_ps: Change num_tile_rows/columns checks to sps->ctb_height/weight
- avcodec/hevc_ps: Fix integer overflow with num_tile_rows and num_tile_columns
- avcodec/apedec: Add k < 24 check to the only k++ case which lacks such a check
- avformat/aviobuf: Delay buffer downsizing until asserts are met
- avcodec/fitsdec: Check data_min/max
- avcodec/m101: Fix off be 2 error
- avcodec/qdm2: Move fft_order check up
- avcodec/libvorbisdec: Check extradata size
- avformat/vqf: Check header_size
- avcodec/atrac9dec: Check q_unit_cnt in parse_band_ext()
- avcodec/atrac9dec: Check that the reused block has succeeded initilization
- avcodec/utils: Check bits_per_coded_sample
- avcodec/videodsp_template: Fix overflow of addition
- avcodec/alsdec: Fix invalid shift in multiply()
- avcodec/ffwavesynth: Check ts_end - ts_start for overflow
- avcodec/vc1dsp: Avoid undefined shifts in vc1_v_s_overlap_c / vc1_h_s_overlap_c
- avcodec/tta: Fix undefined shift
- avcodec/qdmc: Fix integer overflows in PRNG
- avcodec/bintext: Check font height
- avcodec/binkdsp: Fix integer overflows in idct
- avcodec/bink: Fix integer overflow in unquantize_dct_coeffs()
- avcodec/motionpixels: Check for vlc error in mp_get_vlc()
- avcodec/loco: Limit lossy parameter so it is sane and does not overflow
- avformat/mov: Set fragment.found_tfhd only after TFHD has been parsed
- avcodec/xpmdec: Do not use context dimensions as temporary variables
- avcodec/fitsdec: Fix division by 0 in size check
- avcodec/aacpsdsp_template: Fix integer overflow in ps_hybrid_analysis_c()
- avcodec/truemotion2: Fix integer overflow in last loop in tm2_update_block()
- avcodec/iff: finetune the palette size check in the mask case
- avcodec/iff: Fix mask_buf / mask_palbuf leak
- avformat/icodec: Free ico->images on error paths
- avformat/wsddec: Fix undefined shift
- avcodec/fmvc: Check if header fields are available before allocating the image
- avcodec/bink: Reorder operations in init to avoid memleak on error
- avformat/wtvdec: Avoid (32bit signed) sectors
- avcodec/bitstream: Check for more conflicting codes in build_table()
- avcodec/bitstream: Check for integer code truncation in build_table()
- avformat/sbgdec: Fixes integer overflow in str_to_time() with hours
- avformat/vpk: Check offset for validity
- avformat/vpk: Fix integer overflow in samples_per_block computation
- avcodec/mjpegdec: Check for non ls PAL8
- avcodec/interplayvideo: check decoding_map_size with video_data_size
- avcodec/h264_parse: Use 64bit for expectedpoc and expected_delta_per_poc_cycle
- avcodec/mss4: Check input size against skip bits
- avcodec/dxv: Check op_offset in dxv_decompress_cocg()
- avcodec/diracdec: Fix integer overflow in global_mv()
- avcodec/vmnc: Check available space against chunks before reget_buffer()
- avcodec/aacdec_template: skip apply_tns() if max_sfb is 0 (from previous header decode failure)
- avcodec/aacdec_fixed: Handle more extreem cases in noise_scale()
- avcodec/aacdec_template: Merge 3 #ifs related to noise handling
- avcodec/aacdec_fixed: ssign seems always -1 in noise_scale(), simplify
- avformat/mp3enc: Avoid SEEK_END as it is unsupported
- avcodec/truemotion2: Fix several integer overflows in tm2_update_block()
- avformat/webm_chunk: Specify expected argument length of get_chunk_filename()
- avformat/webm_chunk: Check header filename length
- avcodec/cpia: Check input size also against linesizes and EOL
- swscale/tests/swscale: Lengthen pixfmt name buffer to 21 bytes
- libswcale: Fix possible string overflow in test.
- avcodec/hq_hqa: Check available space before reading slice offsets
- lavf/webm_chunk: Respect buffer size
- avcodec/fits: Check bitpix
- avcodec/jvdec: Use ff_get_buffer() when the content is not reused
- avcodec/truemotion2: Fix 2 integer overflows in tm2_update_block()
- avcodec/gdv: Check input palette size before rescale()
- avcodec/jpeg2000: Check stepsize before using it
- avcodec/aacdec_fixed: Fix undefined shift in noise_scale()
- avutil/avstring: Fix bug and undefined behavior in av_strncasecmp()
- avformat/mov: Skip stsd adjustment without chunks
- avformat/aadec: Check for scanf() failure
- avcodec/ccaption_dec: Add a blank like at the end to avoid rollup reading from outside
- avcodec/ivi: Move buffer/block end check to caller of ivi_dc_transform()
- avcodec/diracdec: Use 64bit in intermediate of global motion vector field generation
- avcodec/truemotion2: Fix integer overflow in tm2_decode_blocks()
- movsub_bsf: Fix mov2textsub regression
- lavc/libaomenc: Add a maximum constraint of 64 encoder threads.
- avformat/aacdec: fix demuxing of small frames
- avcodec/cuviddec: improve progressive frame detection
- avformat/matroskaenc: fix leak on error
- avformat/av1: Initialize padding in ff_isom_write_av1c
- avcodec/cbs_av1: fix parsing spatial_id
-
-version 4.1.3:
- avcodec/rscc: Check that the to be uncompressed input is large enough
- avformat/movenc: free eac3 private data only when closing the stream
- avcodec/hevcdec: Avoid only partly skiping duplicate first slices
- lavc/bmp: Avoid a heap buffer overwrite for 1bpp input.
- avcodec/mpegpicture: Check size of edge_emu_buffer
- avformat/mov: Fix potential integer overflow in entry check in mov_read_trun()
- avcodec/truemotion2: Fix integer overflow in tm2_null_res_block()
- avcodec/cbs_av1: fix range of values for Mastering Display Color Volume Metadata OBUs
- avcodec/av1_parser: don't abort parsing the first frame if extradata parsing fails
-
-version 4.1.2:
- avcodec/dfa: Check the chunk header is not truncated
- avcodec/clearvideo: Check remaining data in P frames
- avcodec/hevcdec: decode at most one slice reporting being the first in the picture
- avcodec/dvbsubdec: Check object position
- avcodec/cdgraphics: Use ff_set_dimensions()
- avformat/gdv: Check fps
- configure: use vpx_codec_vp8_dx/cx for libvpx-vp8 checking
- configure: add missing pthreads extralibs dependency for libvpx-vp9
- avcodec/mpeg4videodec: Check idx in mpeg4_decode_studio_block()
- avcodec/dxv: Correct integer overflow in get_opcodes()
- avcodec/scpr: Fix use of uninitialized variable
- avcodec/qpeg: Limit copy in qpeg_decode_intra() to the available bytes
- avcodec/aic: Check remaining bits in aic_decode_coeffs()
- avcodec/gdv: Check for truncated tags in decompress_5()
- avcodec/bethsoftvideo: Check block_type
- avcodec/jpeg2000dwt: Fix integer overflow in dwt_decode97_int()
- avcodec/error_resilience: Use a symmetric check for skipping MV estimation
- avcodec/mlpdec: Insuffient typo
- avcodec/zmbv: obtain frame later
- avcodec/jvdec: Check available input space before decode8x8()
- avcodec/h264_direct: Fix overflow in POC comparission
- avformat/webmdashenc: Check id in adaption_sets
- avformat/http: Fix Out-of-Bounds access in process_line()
- avformat/ftp: Fix Out-of-Bounds Access and Information Leak in ftp.c:393
- avcodec/htmlsubtitles: Fixes denial of service due to use of sscanf in inner loop for handling braces
- avcodec/htmlsubtitles: Fixes denial of service due to use of sscanf in inner loop for tag scaning
- avformat/matroskadec: Do not leak queued packets on sync errors
- avcodec/mpeg4videodec: Clear interlaced_dct for studio profile
- avformat/mov: Do not use reference stream in mov_read_sidx() if there is no reference stream
- avcodec/sbrdsp_fixed.c: remove input value limit for sbr_sum_square_c()
- avcodec/prores_ks: Fix luma quantization if q >= MAX_STORED_Q
- avformat/mov: fix hang while seek on a kind of fragmented mp4
- avformat/async: fix assertion condition when draining buffer
- avcodec/cbs_av1: don't call cbs_av1_read_trailing_bits() when no bits remain in the OBU
-
-version 4.1.1:
- avformat/mov: validate chunk_count vs stsc_data
- avformat/mov: require tfhd to begin parsing trun
- avcodec/pgssubdec: Check for duplicate display segments
- avformat/rtsp: Check number of streams in sdp_parse_line()
- avformat/rtsp: Clear reply in every iteration in ff_rtsp_connect()
- avcodec/rasc: Move ff_get_buffer() after frame checks
- avcodec/rasc: Check uncompressed dlta size
- avcodec/fic: Check that there is input left in fic_decode_block()
- avcodec/ilbcdec: Fix undefined integer overflow lsf2poly()
- avcodec/ilbcdec: Fix integer overflow in construct_vector()
- avcodec/prosumer: Error out if decompress() stops reading data
- avcodec/tiff: Check for 12bit gray fax
- avutil/imgutils: Optimize memset_bytes() by using av_memcpy_backptr()
- avutil/mem: Optimize fill32() by unrolling and using 64bit
- configure: bump year
- avcodec/tests/rangecoder: initialize array to avoid valgrind warning
- avcodec/gdv: Optimize and factorize scaling loops
- avcodec/h264_slice: Fix integer overflow in implicit_weight_table()
- avcodec/exr: set layer_match in all branches
- avcodec/exr: Check for duplicate channel index
- avfilter/vf_tonemap_opencl: Make static tables const
- doc/indevs: fix upto typo
- avcodec/4xm: Fix returned error codes
- avformat/libopenmpt: Fix successfull typo
- avcodec/v4l2_m2m: fix cant typo
- avcodec/mjpegbdec: Fix some misplaced {} and spaces
- avformat/wvdec: detect and error out on WavPack DSD files
- avcodec/mips: Fix failed case: hevc-conformance-AMP_A_Samsung_* when enable msa
- avcodec/fic: Fail on invalid slice size/off
- avcodec/ilbcdec: fix integer overflow in energy
- postproc/postprocess_template: remove FF_REG_sp from clobber list
- postproc/postprocess_template: Avoid using %4 for the threshold compare
- libavformat/mov: Fix NULL-dereference read for some encrypted content.
- avcodec/rpza: Check that there is enough data for all the blocks
- avcodec/rpza: Move frame allocation to a later point
- avcodec/avcodec: Document the data type for AV_PKT_DATA_MPEGTS_STREAM_ID
- avformat/mpegts: Fix side data type for stream id
- tests/fate/filter-video: increase fuzz for fate-filter-refcmp-psnr-rgb
- avcodec/mjpegdec: Fix indention of ljpeg_decode_yuv_scan()
- lavf/id3v2: fail read_apic on EOF reading mimetype
- avcodec/rasc: Check that the number of moves is less than or equal the number of pixels
- avformat/nutenc: Document trailer index assert better
- lavf/mov: ensure only one tkhd per trak
- avcodec/clearvideo: Check remaining input bits in P macro block loop
- avcodec/rasc: Check input space before reading chunk
- avcodec/dxv: Check that there is enough data to decompress
- avcodec/ppc/hevcdsp: Fix build failures with powerpc-linux-gnu-gcc-4.8 with --disable-optimizations
- avcodec/msvideo1: Check for too small dimensions
- avcodec/wmv2dec: Skip I frame if its smaller than 1/8 of the minimal size
- avcodec/msmpeg4dec: Skip frame if its smaller than 1/8 of the minimal size
- avcodec/truemotion2rt: Fix rounding in input size check
- avcodec/diracdec: Check component quant
- avcodec/tiff: Limit filtering to decoded data
- avcodec/truemotion2: fix integer overflows in tm2_low_chroma()
- avcodec/pngdec: Check compression method
- fftools/ffmpeg: Repair reinit_filter feature
- avcodec/shorten: Fix integer overflow with offset
- avcodec/imm4: Use ff_set_dimensions()
- h264_redundant_pps: Fix logging context
- avfilter/af_asetnsamples: fix last frame props
- cbs_av1: Fix reading of overlong uvlc codes
- avcodec/cbs_av1: fix parsing delta_frame_id_minus1
- avfilter/vf_overlay: fix filtering with negative y
- avformat/movenc: get number of written bytes from bitstream writer
- avformat/movenc: fix size calculation in mov_write_eac3_tag()
- avfilter/vf_overlay: fix crash with negative y
- avcodec/mpeg_er: fix clearing chroma blocks for 422 and 444
- avfilter/af_afade: fix duration maximum
- avfilter/vf_fade: fix start/duration max value
- avcodec/cbs_av1: fix parsing signed integer values
- avcodec/cbs_av1: fix storage size for segmentation_params feature_value fields
- configure: Add missing xlib dependency for VAAPI X11 code
- avcodec/hevcdec: fix non-ref frame judgement
-
-
 version 4.1:
 - deblock filter
 - tmix filter
@@ -592,7 +42,6 @@ version 4.1:
 - xstack filter
 - pcm vidc decoder and encoder
 - (a)graphmonitor filter
- yadif_cuda filter


 version 4.0:
@@ -1 +1 @@
-4.1.5
+4.0.git
@@ -1,15 +0,0 @@
-
-              ┌─────────────────────────────────────────────┐
-              │ RELEASE NOTES for FFmpeg 4.1 "al-Khwarizmi" │
-              └─────────────────────────────────────────────┘
-
-   The FFmpeg Project proudly presents FFmpeg 4.1 "al-Khwarizmi", about 6
-   months after the release of FFmpeg 4.0.
-
-   A complete Changelog is available at the root of the project, and the
-   complete Git history on https://git.ffmpeg.org/gitweb/ffmpeg.git
-
-   We hope you will like this release as much as we enjoyed working on it, and
-   as usual, if you have any questions about it, or any FFmpeg related topic,
-   feel free to join us on the #ffmpeg IRC channel (on irc.freenode.net) or ask
-   on the mailing-lists.
@@ -2812,7 +2812,6 @@ d3d11va_deps="dxva_h ID3D11VideoDecoder ID3D11VideoContext"
 dxva2_deps="dxva2api_h DXVA2_ConfigPictureDecode ole32 user32"
 ffnvcodec_deps_any="libdl LoadLibrary"
 nvdec_deps="ffnvcodec"
-vaapi_x11_deps="xlib"
 videotoolbox_hwaccel_deps="videotoolbox pthreads"
 videotoolbox_hwaccel_extralibs="-framework QuartzCore"
 xvmc_deps="X11_extensions_XvMClib_h"
@@ -2958,7 +2957,6 @@ h264_rkmpp_decoder_deps="rkmpp"
 h264_rkmpp_decoder_select="h264_mp4toannexb_bsf"
 h264_vaapi_encoder_select="cbs_h264 vaapi_encode"
 h264_v4l2m2m_decoder_deps="v4l2_m2m h264_v4l2_m2m"
-h264_v4l2m2m_decoder_select="h264_mp4toannexb_bsf"
 h264_v4l2m2m_encoder_deps="v4l2_m2m h264_v4l2_m2m"
 hevc_amf_encoder_deps="amf"
 hevc_cuvid_decoder_deps="cuvid"
@@ -2973,7 +2971,6 @@ hevc_rkmpp_decoder_select="hevc_mp4toannexb_bsf"
 hevc_vaapi_encoder_deps="VAEncPictureParameterBufferHEVC"
 hevc_vaapi_encoder_select="cbs_h265 vaapi_encode"
 hevc_v4l2m2m_decoder_deps="v4l2_m2m hevc_v4l2_m2m"
-hevc_v4l2m2m_decoder_select="hevc_mp4toannexb_bsf"
 hevc_v4l2m2m_encoder_deps="v4l2_m2m hevc_v4l2_m2m"
 mjpeg_cuvid_decoder_deps="cuvid"
 mjpeg_qsv_encoder_deps="libmfx"
@@ -3183,7 +3180,6 @@ image2_alias_pix_demuxer_select="image2_demuxer"
 image2_brender_pix_demuxer_select="image2_demuxer"
 ipod_muxer_select="mov_muxer"
 ismv_muxer_select="mov_muxer"
-ivf_muxer_select="av1_metadata_bsf vp9_superframe_bsf"
 matroska_audio_muxer_select="matroska_muxer"
 matroska_demuxer_select="iso_media riffdec"
 matroska_demuxer_suggest="bzlib lzo zlib"
@@ -3485,7 +3481,6 @@ zscale_filter_deps="libzimg const_nan"
 scale_vaapi_filter_deps="vaapi"
 vpp_qsv_filter_deps="libmfx"
 vpp_qsv_filter_select="qsvvpp"
-yadif_cuda_filter_deps="cuda_sdk"

 # examples
 avio_dir_cmd_deps="avformat avutil"
@@ -6152,21 +6147,21 @@ enabled libvorbis         && require_pkg_config libvorbis vorbis vorbis/codec.h
 enabled libvpx            && {
    enabled libvpx_vp8_decoder && {
        check_pkg_config libvpx_vp8_decoder "vpx >= 1.4.0" "vpx/vpx_decoder.h vpx/vp8dx.h" vpx_codec_vp8_dx ||
-            check_lib libvpx_vp8_decoder "vpx/vpx_decoder.h vpx/vp8dx.h" "vpx_codec_vp8_dx VPX_IMG_FMT_HIGHBITDEPTH" "-lvpx $libm_extralibs $pthreads_extralibs" ||
+            check_lib libvpx_vp8_decoder "vpx/vpx_decoder.h vpx/vp8dx.h" "vpx_codec_dec_init_ver VPX_IMG_FMT_HIGHBITDEPTH" -lvpx ||
                die "ERROR: libvpx decoder version must be >=1.4.0";
    }
    enabled libvpx_vp8_encoder && {
        check_pkg_config libvpx_vp8_encoder "vpx >= 1.4.0" "vpx/vpx_encoder.h vpx/vp8cx.h" vpx_codec_vp8_cx ||
-            check_lib libvpx_vp8_encoder "vpx/vpx_encoder.h vpx/vp8cx.h" "vpx_codec_vp8_cx VPX_IMG_FMT_HIGHBITDEPTH" "-lvpx $libm_extralibs $pthreads_extralibs" ||
+            check_lib libvpx_vp8_encoder "vpx/vpx_encoder.h vpx/vp8cx.h" "vpx_codec_enc_init_ver VPX_IMG_FMT_HIGHBITDEPTH" -lvpx ||
                die "ERROR: libvpx encoder version must be >=1.4.0";
    }
    enabled libvpx_vp9_decoder && {
        check_pkg_config libvpx_vp9_decoder "vpx >= 1.4.0" "vpx/vpx_decoder.h vpx/vp8dx.h" vpx_codec_vp9_dx ||
-            check_lib libvpx_vp9_decoder "vpx/vpx_decoder.h vpx/vp8dx.h" "vpx_codec_vp9_dx VPX_IMG_FMT_HIGHBITDEPTH" "-lvpx $libm_extralibs $pthreads_extralibs"
+            check_lib libvpx_vp9_decoder "vpx/vpx_decoder.h vpx/vp8dx.h" "vpx_codec_vp9_dx VPX_IMG_FMT_HIGHBITDEPTH" "-lvpx $libm_extralibs"
    }
    enabled libvpx_vp9_encoder && {
        check_pkg_config libvpx_vp9_encoder "vpx >= 1.4.0" "vpx/vpx_encoder.h vpx/vp8cx.h" vpx_codec_vp9_cx ||
-            check_lib libvpx_vp9_encoder "vpx/vpx_encoder.h vpx/vp8cx.h" "vpx_codec_vp9_cx VPX_IMG_FMT_HIGHBITDEPTH" "-lvpx $libm_extralibs $pthreads_extralibs"
+            check_lib libvpx_vp9_encoder "vpx/vpx_encoder.h vpx/vp8cx.h" "vpx_codec_vp9_cx VPX_IMG_FMT_HIGHBITDEPTH" "-lvpx $libm_extralibs"
    }
    if disabled_all libvpx_vp8_decoder libvpx_vp9_decoder libvpx_vp8_encoder libvpx_vp9_encoder; then
        die "libvpx enabled but no supported decoders found"
@@ -7243,7 +7238,7 @@ cat > $TMPH <<EOF
 #define FFMPEG_CONFIG_H
 #define FFMPEG_CONFIGURATION "$(c_escape $FFMPEG_CONFIGURATION)"
 #define FFMPEG_LICENSE "$(c_escape $license)"
-#define CONFIG_THIS_YEAR 2020
+#define CONFIG_THIS_YEAR 2018
 #define FFMPEG_DATADIR "$(eval c_escape $datadir)"
 #define AVCONV_DATADIR "$(eval c_escape $datadir)"
 #define CC_IDENT "$(c_escape ${cc_ident:-Unknown compiler})"
@@ -38,7 +38,7 @@ PROJECT_NAME           = FFmpeg
 # could be handy for archiving the generated documentation or if some version
 # control system is used.

-PROJECT_NUMBER         = 4.1.5
+PROJECT_NUMBER         =

 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
@@ -17943,64 +17943,6 @@ filter").
 It accepts the following parameters:


-@table @option
-
-@item mode
-The interlacing mode to adopt. It accepts one of the following values:
-
-@table @option
-@item 0, send_frame
-Output one frame for each frame.
-@item 1, send_field
-Output one frame for each field.
-@item 2, send_frame_nospatial
-Like @code{send_frame}, but it skips the spatial interlacing check.
-@item 3, send_field_nospatial
-Like @code{send_field}, but it skips the spatial interlacing check.
-@end table
-
-The default value is @code{send_frame}.
-
-@item parity
-The picture field parity assumed for the input interlaced video. It accepts one
-of the following values:
-
-@table @option
-@item 0, tff
-Assume the top field is first.
-@item 1, bff
-Assume the bottom field is first.
-@item -1, auto
-Enable automatic detection of field parity.
-@end table
-
-The default value is @code{auto}.
-If the interlacing is unknown or the decoder does not export this information,
-top field first will be assumed.
-
-@item deint
-Specify which frames to deinterlace. Accept one of the following
-values:
-
-@table @option
-@item 0, all
-Deinterlace all frames.
-@item 1, interlaced
-Only deinterlace frames marked as interlaced.
-@end table
-
-The default value is @code{all}.
-@end table
-
-@section yadif_cuda
-
-Deinterlace the input video using the @ref{yadif} algorithm, but implemented
-in CUDA so that it can work as part of a GPU accelerated pipeline with nvdec
-and/or nvenc.
-
-It accepts the following parameters:
-
-
@table @option

@item mode
@@ -374,7 +374,7 @@ Defaults to @option{false}.
@item timestamp_align
 Capture start time alignment in seconds. If set to nonzero, input frames are
 dropped till the system timestamp aligns with configured value.
-Alignment difference of up to one frame duration is tolerated.
+Alignment difference of upto one frame duration is tolerated.
 This is useful for maintaining input synchronization across N different
 hardware devices deployed for 'N-way' redundancy. The system time of different
 hardware devices should be synchronized with protocols such as NTP or PTP,
@@ -2139,6 +2139,9 @@ static int ifilter_send_frame(InputFilter *ifilter, AVFrame *frame)

    /* determine if the parameters for this input changed */
    need_reinit = ifilter->format != frame->format;
+    if (!!ifilter->hw_frames_ctx != !!frame->hw_frames_ctx ||
+        (ifilter->hw_frames_ctx && ifilter->hw_frames_ctx->data != frame->hw_frames_ctx->data))
+        need_reinit = 1;

    switch (ifilter->ist->st->codecpar->codec_type) {
    case AVMEDIA_TYPE_AUDIO:
@@ -2152,13 +2155,6 @@ static int ifilter_send_frame(InputFilter *ifilter, AVFrame *frame)
        break;
    }

-    if (!ifilter->ist->reinit_filters && fg->graph)
-        need_reinit = 0;
-
-    if (!!ifilter->hw_frames_ctx != !!frame->hw_frames_ctx ||
-        (ifilter->hw_frames_ctx && ifilter->hw_frames_ctx->data != frame->hw_frames_ctx->data))
-        need_reinit = 1;
-
    if (need_reinit) {
        ret = ifilter_parameters_from_frame(ifilter, frame);
        if (ret < 0)
@@ -158,7 +158,7 @@ typedef struct FourXContext {
 #define FIX_1_847759065 121095
 #define FIX_2_613125930 171254

-#define MULTIPLY(var, const) ((int)((var) * (unsigned)(const)) >> 16)
+#define MULTIPLY(var, const) (((var) * (const)) >> 16)

 static void idct(int16_t block[64])
 {
@@ -351,8 +351,6 @@ static int decode_p_block(FourXContext *f, uint16_t *dst, const uint16_t *src,
    index = size2index[log2h][log2w];
    av_assert0(index >= 0);

-    if (get_bits_left(&f->gb) < 1)
-        return AVERROR_INVALIDDATA;
    h     = 1 << log2h;
    code  = get_vlc2(&f->gb, block_type_vlc[1 - (f->version > 1)][index].table,
                     BLOCK_TYPE_VLC_BITS, 1);
@@ -500,7 +498,7 @@ static int decode_i_block(FourXContext *f, int16_t *block)

    if (get_bits_left(&f->gb) < 2){
        av_log(f->avctx, AV_LOG_ERROR, "%d bits left before decode_i_block()\n", get_bits_left(&f->gb));
-        return AVERROR_INVALIDDATA;
+        return -1;
    }

    /* DC coef */
@@ -525,10 +523,6 @@ static int decode_i_block(FourXContext *f, int16_t *block)
            break;
        if (code == 0xf0) {
            i += 16;
-            if (i >= 64) {
-                av_log(f->avctx, AV_LOG_ERROR, "run %d overflow\n", i);
-                return 0;
-            }
        } else {
            if (code & 0xf) {
                level = get_xbits(&f->gb, code & 0xf);
@@ -738,7 +732,7 @@ static int decode_i2_frame(FourXContext *f, const uint8_t *buf, int length)
        for (x = 0; x < width; x += 16) {
            unsigned int color[4] = { 0 }, bits;
            if (buf_end - buf < 8)
-                return AVERROR_INVALIDDATA;
+                return -1;
            // warning following is purely guessed ...
            color[0] = bytestream2_get_le16u(&g3);
            color[1] = bytestream2_get_le16u(&g3);
@@ -411,8 +411,6 @@ static int read_stream_mux_config(struct LATMContext *latmctx,
            } else {
                int esc;
                do {
-                    if (get_bits_left(gb) < 9)
-                        return AVERROR_INVALIDDATA;
                    esc = get_bits(gb, 1);
                    skip_bits(gb, 8);
                } while (esc);
@@ -563,7 +561,7 @@ AVCodec ff_aac_decoder = {
        AV_SAMPLE_FMT_FLTP, AV_SAMPLE_FMT_NONE
    },
    .capabilities    = AV_CODEC_CAP_CHANNEL_CONF | AV_CODEC_CAP_DR1,
-    .caps_internal   = FF_CODEC_CAP_INIT_THREADSAFE | FF_CODEC_CAP_INIT_CLEANUP,
+    .caps_internal   = FF_CODEC_CAP_INIT_THREADSAFE,
    .channel_layouts = aac_channel_layout,
    .flush = flush,
    .priv_class      = &aac_decoder_class,
@@ -588,7 +586,7 @@ AVCodec ff_aac_latm_decoder = {
        AV_SAMPLE_FMT_FLTP, AV_SAMPLE_FMT_NONE
    },
    .capabilities    = AV_CODEC_CAP_CHANNEL_CONF | AV_CODEC_CAP_DR1,
-    .caps_internal   = FF_CODEC_CAP_INIT_THREADSAFE | FF_CODEC_CAP_INIT_CLEANUP,
+    .caps_internal   = FF_CODEC_CAP_INIT_THREADSAFE,
    .channel_layouts = aac_channel_layout,
    .flush = flush,
    .profiles        = NULL_IF_CONFIG_SMALL(ff_aac_profiles),
@@ -195,12 +195,12 @@ static void subband_scale(int *dst, int *src, int scale, int offset, int len)

 static void noise_scale(int *coefs, int scale, int band_energy, int len)
 {
-    int s = -scale;
+    int ssign = scale < 0 ? -1 : 1;
+    int s = FFABS(scale);
    unsigned int round;
    int i, out, c = exp2tab[s & 3];
    int nlz = 0;

-    av_assert0(s >= 0);
    while (band_energy > 0x7fff) {
        band_energy >>= 1;
        nlz++;
@@ -216,20 +216,15 @@ static void noise_scale(int *coefs, int scale, int band_energy, int len)
        round = s ? 1 << (s-1) : 0;
        for (i=0; i<len; i++) {
            out = (int)(((int64_t)coefs[i] * c) >> 32);
-            coefs[i] = -((int)(out+round) >> s);
+            coefs[i] = ((int)(out+round) >> s) * ssign;
        }
    }
    else {
        s = s + 32;
-        if (s > 0) {
-            round = 1 << (s-1);
-            for (i=0; i<len; i++) {
-                out = (int)((int64_t)((int64_t)coefs[i] * c + round) >> s);
-                coefs[i] = -out;
-            }
-        } else {
-            for (i=0; i<len; i++)
-                coefs[i] = -(int64_t)coefs[i] * c * (1 << -s);
+        round = 1 << (s-1);
+        for (i=0; i<len; i++) {
+            out = (int)((int64_t)((int64_t)coefs[i] * c + round) >> s);
+            coefs[i] = out * ssign;
        }
    }
 }
@@ -1157,9 +1157,6 @@ static av_cold int aac_decode_init(AVCodecContext *avctx)
    AACContext *ac = avctx->priv_data;
    int ret;

-    if (avctx->sample_rate > 96000)
-        return AVERROR_INVALIDDATA;
-
    ret = ff_thread_once(&aac_table_init, &aac_static_table_init);
    if (ret != 0)
        return AVERROR_UNKNOWN;
@@ -1676,24 +1673,25 @@ static int decode_spectrum_and_dequant(AACContext *ac, INTFLOAT coef[1024],
                }
            } else if (cbt_m1 == NOISE_BT - 1) {
                for (group = 0; group < (AAC_SIGNE)g_len; group++, cfo+=128) {
+#if !USE_FIXED
+                    float scale;
+#endif /* !USE_FIXED */
                    INTFLOAT band_energy;
-#if USE_FIXED
+
                    for (k = 0; k < off_len; k++) {
                        ac->random_state  = lcg_random(ac->random_state);
+#if USE_FIXED
                        cfo[k] = ac->random_state >> 3;
+#else
+                        cfo[k] = ac->random_state;
+#endif /* USE_FIXED */
                    }

+#if USE_FIXED
                    band_energy = ac->fdsp->scalarproduct_fixed(cfo, cfo, off_len);
                    band_energy = fixed_sqrt(band_energy, 31);
                    noise_scale(cfo, sf[idx], band_energy, off_len);
 #else
-                    float scale;
-
-                    for (k = 0; k < off_len; k++) {
-                        ac->random_state  = lcg_random(ac->random_state);
-                        cfo[k] = ac->random_state;
-                    }
-
                    band_energy = ac->fdsp->scalarproduct_float(cfo, cfo, off_len);
                    scale = sf[idx] / sqrtf(band_energy);
                    ac->fdsp->vector_fmul_scalar(cfo, cfo, scale, off_len);
@@ -2495,9 +2493,6 @@ static void apply_tns(INTFLOAT coef_param[1024], TemporalNoiseShaping *tns,
    INTFLOAT tmp[TNS_MAX_ORDER+1];
    UINTFLOAT *coef = coef_param;

-    if(!mmm)
-        return;
-
    for (w = 0; w < ics->num_windows; w++) {
        bottom = ics->num_swb;
        for (filt = 0; filt < tns->n_filt[w]; filt++) {
@@ -2662,7 +2657,7 @@ static void imdct_and_windowing(AACContext *ac, SingleChannelElement *sce)
        ac->mdct.imdct_half(&ac->mdct, buf, in);
 #if USE_FIXED
        for (i=0; i<1024; i++)
-          buf[i] = (buf[i] + 4LL) >> 3;
+          buf[i] = (buf[i] + 4) >> 3;
 #endif /* USE_FIXED */
    }

@@ -414,33 +414,33 @@ static void hybrid_synthesis(PSDSPContext *dsp, INTFLOAT out[2][38][64],
            memset(out[0][n], 0, 5*sizeof(out[0][n][0]));
            memset(out[1][n], 0, 5*sizeof(out[1][n][0]));
            for (i = 0; i < 12; i++) {
-                out[0][n][0] += (UINTFLOAT)in[   i][n][0];
-                out[1][n][0] += (UINTFLOAT)in[   i][n][1];
+                out[0][n][0] += in[   i][n][0];
+                out[1][n][0] += in[   i][n][1];
            }
            for (i = 0; i < 8; i++) {
-                out[0][n][1] += (UINTFLOAT)in[12+i][n][0];
-                out[1][n][1] += (UINTFLOAT)in[12+i][n][1];
+                out[0][n][1] += in[12+i][n][0];
+                out[1][n][1] += in[12+i][n][1];
            }
            for (i = 0; i < 4; i++) {
-                out[0][n][2] += (UINTFLOAT)in[20+i][n][0];
-                out[1][n][2] += (UINTFLOAT)in[20+i][n][1];
-                out[0][n][3] += (UINTFLOAT)in[24+i][n][0];
-                out[1][n][3] += (UINTFLOAT)in[24+i][n][1];
-                out[0][n][4] += (UINTFLOAT)in[28+i][n][0];
-                out[1][n][4] += (UINTFLOAT)in[28+i][n][1];
+                out[0][n][2] += in[20+i][n][0];
+                out[1][n][2] += in[20+i][n][1];
+                out[0][n][3] += in[24+i][n][0];
+                out[1][n][3] += in[24+i][n][1];
+                out[0][n][4] += in[28+i][n][0];
+                out[1][n][4] += in[28+i][n][1];
            }
        }
        dsp->hybrid_synthesis_deint(out, in + 27, 5, len);
    } else {
        for (n = 0; n < len; n++) {
-            out[0][n][0] = (UINTFLOAT)in[0][n][0] + in[1][n][0] + in[2][n][0] +
-                           (UINTFLOAT)in[3][n][0] + in[4][n][0] + in[5][n][0];
-            out[1][n][0] = (UINTFLOAT)in[0][n][1] + in[1][n][1] + in[2][n][1] +
-                           (UINTFLOAT)in[3][n][1] + in[4][n][1] + in[5][n][1];
-            out[0][n][1] = (UINTFLOAT)in[6][n][0] + in[7][n][0];
-            out[1][n][1] = (UINTFLOAT)in[6][n][1] + in[7][n][1];
-            out[0][n][2] = (UINTFLOAT)in[8][n][0] + in[9][n][0];
-            out[1][n][2] = (UINTFLOAT)in[8][n][1] + in[9][n][1];
+            out[0][n][0] = in[0][n][0] + in[1][n][0] + in[2][n][0] +
+                           in[3][n][0] + in[4][n][0] + in[5][n][0];
+            out[1][n][0] = in[0][n][1] + in[1][n][1] + in[2][n][1] +
+                           in[3][n][1] + in[4][n][1] + in[5][n][1];
+            out[0][n][1] = in[6][n][0] + in[7][n][0];
+            out[1][n][1] = in[6][n][1] + in[7][n][1];
+            out[0][n][2] = in[8][n][0] + in[9][n][0];
+            out[1][n][2] = in[8][n][1] + in[9][n][1];
        }
        dsp->hybrid_synthesis_deint(out, in + 7, 3, len);
    }
@@ -54,10 +54,10 @@ static void ps_hybrid_analysis_c(INTFLOAT (*out)[2], INTFLOAT (*in)[2],
        INT64FLOAT sum_im = (INT64FLOAT)filter[i][6][0] * in[6][1];

        for (j = 0; j < 6; j++) {
-            INT64FLOAT in0_re = in[j][0];
-            INT64FLOAT in0_im = in[j][1];
-            INT64FLOAT in1_re = in[12-j][0];
-            INT64FLOAT in1_im = in[12-j][1];
+            INTFLOAT in0_re = in[j][0];
+            INTFLOAT in0_im = in[j][1];
+            INTFLOAT in1_re = in[12-j][0];
+            INTFLOAT in1_im = in[12-j][1];
            sum_re += (INT64FLOAT)filter[i][j][0] * (in0_re + in1_re) -
                      (INT64FLOAT)filter[i][j][1] * (in0_im - in1_im);
            sum_im += (INT64FLOAT)filter[i][j][0] * (in0_im + in1_im) +
@@ -110,10 +110,6 @@ static av_cold int adpcm_decode_init(AVCodecContext * avctx)
    case AV_CODEC_ID_ADPCM_MTAF:
        min_channels = 2;
        max_channels = 8;
-        if (avctx->channels & 1) {
-            avpriv_request_sample(avctx, "channel count %d\n", avctx->channels);
-            return AVERROR_PATCHWELCOME;
-        }
        break;
    case AV_CODEC_ID_ADPCM_PSX:
        max_channels = 8;
@@ -139,8 +135,8 @@ static av_cold int adpcm_decode_init(AVCodecContext * avctx)
        break;
    case AV_CODEC_ID_ADPCM_IMA_APC:
        if (avctx->extradata && avctx->extradata_size >= 8) {
-            c->status[0].predictor = av_clip_intp2(AV_RL32(avctx->extradata    ), 18);
-            c->status[1].predictor = av_clip_intp2(AV_RL32(avctx->extradata + 4), 18);
+            c->status[0].predictor = AV_RL32(avctx->extradata);
+            c->status[1].predictor = AV_RL32(avctx->extradata + 4);
        }
        break;
    case AV_CODEC_ID_ADPCM_IMA_WS:
@@ -293,7 +289,7 @@ static inline int16_t adpcm_ima_oki_expand_nibble(ADPCMChannelStatus *c, int nib
    c->predictor = av_clip_intp2(predictor, 11);
    c->step_index = step_index;

-    return c->predictor * 16;
+    return c->predictor << 4;
 }

 static inline int16_t adpcm_ct_expand_nibble(ADPCMChannelStatus *c, int8_t nibble)
@@ -392,7 +388,7 @@ static int xa_decode(AVCodecContext *avctx, int16_t *out0, int16_t *out1,
            d = in[16+i+j*4];

            t = sign_extend(d, 4);
-            s = t*(1<<shift) + ((s_1*f0 + s_2*f1+32)>>6);
+            s = ( t<<shift ) + ((s_1*f0 + s_2*f1+32)>>6);
            s_2 = s_1;
            s_1 = av_clip_int16(s);
            out0[j] = s_1;
@@ -419,7 +415,7 @@ static int xa_decode(AVCodecContext *avctx, int16_t *out0, int16_t *out1,
            d = in[16+i+j*4];

            t = sign_extend(d >> 4, 4);
-            s = t*(1<<shift) + ((s_1*f0 + s_2*f1+32)>>6);
+            s = ( t<<shift ) + ((s_1*f0 + s_2*f1+32)>>6);
            s_2 = s_1;
            s_1 = av_clip_int16(s);
            out1[j] = s_1;
@@ -1145,11 +1141,8 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
                return AVERROR_INVALIDDATA;
            }
        }
-        for (i=0; i<=st; i++) {
+        for (i=0; i<=st; i++)
            c->status[i].predictor  = bytestream2_get_le32u(&gb);
-            if (FFABS(c->status[i].predictor) > (1<<16))
-                return AVERROR_INVALIDDATA;
-        }

        for (n = nb_samples >> (1 - st); n > 0; n--) {
            int byte   = bytestream2_get_byteu(&gb);
@@ -1297,10 +1290,10 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,

                    for (count2=0; count2<28; count2++) {
                        if (count2 & 1)
-                            next_sample = (unsigned)sign_extend(byte,    4) << shift;
+                            next_sample = sign_extend(byte,    4) << shift;
                        else {
                            byte = bytestream2_get_byte(&gb);
-                            next_sample = (unsigned)sign_extend(byte >> 4, 4) << shift;
+                            next_sample = sign_extend(byte >> 4, 4) << shift;
                        }

                        next_sample += (current_sample  * coeff1) +
@@ -1637,7 +1630,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
                    else
                        sampledat = sign_extend(byte >> 4, 4);

-                    sampledat = ((sampledat * (1 << 12)) >> (header & 0xf)) * (1 << 6) + prev;
+                    sampledat = (((sampledat << 12) >> (header & 0xf)) << 6) + prev;
                    *samples++ = av_clip_int16(sampledat >> 6);
                    c->status[channel].sample2 = c->status[channel].sample1;
                    c->status[channel].sample1 = sampledat;
@@ -208,9 +208,6 @@ static int aic_decode_coeffs(GetBitContext *gb, int16_t *dst,
    int mb, idx;
    unsigned val;

-    if (get_bits_left(gb) < 5)
-        return AVERROR_INVALIDDATA;
-
    has_skips  = get_bits1(gb);
    coeff_type = get_bits1(gb);
    coeff_bits = get_bits(gb, 3);
@@ -171,12 +171,12 @@ static inline int sign_only(int v)
    return v ? FFSIGN(v) : 0;
 }

-static void lpc_prediction(int32_t *error_buffer, uint32_t *buffer_out,
+static void lpc_prediction(int32_t *error_buffer, int32_t *buffer_out,
                           int nb_samples, int bps, int16_t *lpc_coefs,
                           int lpc_order, int lpc_quant)
 {
    int i;
-    uint32_t *pred = buffer_out;
+    int32_t *pred = buffer_out;

    /* first sample always copies */
    *buffer_out = *error_buffer;
@@ -208,26 +208,26 @@ static void lpc_prediction(int32_t *error_buffer, uint32_t *buffer_out,
    for (; i < nb_samples; i++) {
        int j;
        int val = 0;
-        unsigned error_val = error_buffer[i];
+        int error_val = error_buffer[i];
        int error_sign;
        int d = *pred++;

        /* LPC prediction */
        for (j = 0; j < lpc_order; j++)
            val += (pred[j] - d) * lpc_coefs[j];
-        val = (val + (1LL << (lpc_quant - 1))) >> lpc_quant;
+        val = (val + (1 << (lpc_quant - 1))) >> lpc_quant;
        val += d + error_val;
        buffer_out[i] = sign_extend(val, bps);

        /* adapt LPC coefficients */
        error_sign = sign_only(error_val);
        if (error_sign) {
-            for (j = 0; j < lpc_order && (int)(error_val * error_sign) > 0; j++) {
+            for (j = 0; j < lpc_order && error_val * error_sign > 0; j++) {
                int sign;
                val  = d - pred[j];
                sign = sign_only(val) * error_sign;
                lpc_coefs[j] -= sign;
-                val *= (unsigned)sign;
+                val *= sign;
                error_val -= (val >> lpc_quant) * (j + 1);
            }
        }
@@ -250,12 +250,10 @@ static int decode_element(AVCodecContext *avctx, AVFrame *frame, int ch_index,

    alac->extra_bits = get_bits(&alac->gb, 2) << 3;
    bps = alac->sample_size - alac->extra_bits + channels - 1;
-    if (bps > 32) {
+    if (bps > 32U) {
        avpriv_report_missing_feature(avctx, "bps %d", bps);
        return AVERROR_PATCHWELCOME;
    }
-    if (bps < 1)
-        return AVERROR_INVALIDDATA;

    /* whether the frame is compressed */
    is_compressed = !get_bits1(&alac->gb);
@@ -308,7 +306,7 @@ static int decode_element(AVCodecContext *avctx, AVFrame *frame, int ch_index,
            rice_history_mult[ch] = get_bits(&alac->gb, 3);
            lpc_order[ch]         = get_bits(&alac->gb, 5);

-            if (lpc_order[ch] >= alac->max_samples_per_frame || !lpc_quant[ch])
+            if (lpc_order[ch] >= alac->max_samples_per_frame)
                return AVERROR_INVALIDDATA;

            /* read the predictor table */
@@ -397,13 +395,13 @@ static int decode_element(AVCodecContext *avctx, AVFrame *frame, int ch_index,
    case 20: {
        for (ch = 0; ch < channels; ch++) {
            for (i = 0; i < alac->nb_samples; i++)
-                alac->output_samples_buffer[ch][i] *= 1 << 12;
+                alac->output_samples_buffer[ch][i] <<= 12;
        }}
        break;
    case 24: {
        for (ch = 0; ch < channels; ch++) {
            for (i = 0; i < alac->nb_samples; i++)
-                alac->output_samples_buffer[ch][i] *= 1 << 8;
+                alac->output_samples_buffer[ch][i] <<= 8;
        }}
        break;
    }
@@ -62,9 +62,6 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
    if (ret < 0)
        return ret;

-    if (bytestream2_get_bytes_left(&gb) < width*height / 255)
-        return AVERROR_INVALIDDATA;
-
    ret = ff_get_buffer(avctx, f, 0);
    if (ret < 0)
        return ret;
@@ -348,11 +348,6 @@ static av_cold int read_specific_config(ALSDecContext *ctx)
    if (als_id != MKBETAG('A','L','S','\0'))
        return AVERROR_INVALIDDATA;

-    if (avctx->channels > FF_SANE_NB_CHANNELS) {
-        avpriv_request_sample(avctx, "Huge number of channels\n");
-        return AVERROR_PATCHWELCOME;
-    }
-
    ctx->cur_frame_length = sconf->frame_length;

    // read channel config
@@ -492,7 +487,7 @@ static void parse_bs_info(const uint32_t bs_info, unsigned int n,
 static int32_t decode_rice(GetBitContext *gb, unsigned int k)
 {
    int max = get_bits_left(gb) - k;
-    unsigned q = get_unary(gb, 0, max);
+    int q   = get_unary(gb, 0, max);
    int r   = k ? get_bits1(gb) : !(q & 1);

    if (k > 1) {
@@ -512,7 +507,7 @@ static void parcor_to_lpc(unsigned int k, const int32_t *par, int32_t *cof)
    int i, j;

    for (i = 0, j = k - 1; i < j; i++, j--) {
-        unsigned tmp1 = ((MUL64(par[k], cof[j]) + (1 << 19)) >> 20);
+        int tmp1 = ((MUL64(par[k], cof[j]) + (1 << 19)) >> 20);
        cof[j]  += ((MUL64(par[k], cof[i]) + (1 << 19)) >> 20);
        cof[i]  += tmp1;
    }
@@ -662,7 +657,7 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)

    // do not continue in case of a damaged stream since
    // block_length must be evenly divisible by sub_blocks
-    if (bd->block_length & (sub_blocks - 1) || bd->block_length <= 0) {
+    if (bd->block_length & (sub_blocks - 1)) {
        av_log(avctx, AV_LOG_WARNING,
               "Block length is not evenly divisible by the number of subblocks.\n");
        return AVERROR_INVALIDDATA;
@@ -772,8 +767,8 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
        if (*bd->use_ltp) {
            int r, c;

-            bd->ltp_gain[0]   = decode_rice(gb, 1) * 8;
-            bd->ltp_gain[1]   = decode_rice(gb, 2) * 8;
+            bd->ltp_gain[0]   = decode_rice(gb, 1) << 3;
+            bd->ltp_gain[1]   = decode_rice(gb, 2) << 3;

            r                 = get_unary(gb, 0, 4);
            c                 = get_bits(gb, 2);
@@ -784,8 +779,8 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)

            bd->ltp_gain[2]   = ltp_gain_values[r][c];

-            bd->ltp_gain[3]   = decode_rice(gb, 2) * 8;
-            bd->ltp_gain[4]   = decode_rice(gb, 1) * 8;
+            bd->ltp_gain[3]   = decode_rice(gb, 2) << 3;
+            bd->ltp_gain[4]   = decode_rice(gb, 1) << 3;

            *bd->ltp_lag      = get_bits(gb, ctx->ltp_lag_length);
            *bd->ltp_lag     += FFMAX(4, opt_order + 1);
@@ -794,20 +789,14 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)

    // read first value and residuals in case of a random access block
    if (bd->ra_block) {
-        start = FFMIN(opt_order, 3);
-        av_assert0(sb_length <= sconf->frame_length);
-        if (sb_length <= start) {
-            // opt_order or sb_length may be corrupted, either way this is unsupported and not well defined in the specification
-            av_log(avctx, AV_LOG_ERROR, "Sub block length smaller or equal start\n");
-            return AVERROR_PATCHWELCOME;
-        }
-
        if (opt_order)
            bd->raw_samples[0] = decode_rice(gb, avctx->bits_per_raw_sample - 4);
        if (opt_order > 1)
            bd->raw_samples[1] = decode_rice(gb, FFMIN(s[0] + 3, ctx->s_max));
        if (opt_order > 2)
            bd->raw_samples[2] = decode_rice(gb, FFMIN(s[0] + 1, ctx->s_max));
+
+        start = FFMIN(opt_order, 3);
    }

    // read all residuals
@@ -821,9 +810,7 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
        unsigned int low;
        unsigned int value;

-        int ret = ff_bgmc_decode_init(gb, &high, &low, &value);
-        if (ret < 0)
-            return ret;
+        ff_bgmc_decode_init(gb, &high, &low, &value);

        current_res = bd->raw_samples + start;

@@ -833,9 +820,6 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
            k    [sb] = s[sb] > b ? s[sb] - b : 0;
            delta[sb] = 5 - s[sb] + k[sb];

-            if (k[sb] >= 32)
-                return AVERROR_INVALIDDATA;
-
            ff_bgmc_decode(gb, sb_len, current_res,
                        delta[sb], sx[sb], &high, &low, &value, ctx->bgmc_lut, ctx->bgmc_lut_status);

@@ -877,7 +861,7 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
                    res >>= 1;

                    if (cur_k) {
-                        res  *= 1U << cur_k;
+                        res  *= 1 << cur_k;
                        res  |= get_bits_long(gb, cur_k);
                    }
                }
@@ -928,7 +912,7 @@ static int decode_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
            y = 1 << 6;

            for (base = begin; base < end; base++, tab++)
-                y += (uint64_t)MUL64(bd->ltp_gain[tab], raw_samples[base]);
+                y += MUL64(bd->ltp_gain[tab], raw_samples[base]);

            raw_samples[ltp_smp] += y >> 7;
        }
@@ -940,7 +924,7 @@ static int decode_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
            y = 1 << 19;

            for (sb = 0; sb < smp; sb++)
-                y += (uint64_t)MUL64(lpc_cof[sb], raw_samples[-(sb + 1)]);
+                y += MUL64(lpc_cof[sb], raw_samples[-(sb + 1)]);

            *raw_samples++ -= y >> 20;
            parcor_to_lpc(smp, quant_cof, lpc_cof);
@@ -956,7 +940,7 @@ static int decode_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)

        // reconstruct difference signal for prediction (joint-stereo)
        if (bd->js_blocks && bd->raw_other) {
-            uint32_t *left, *right;
+            int32_t *left, *right;

            if (bd->raw_other > raw_samples) {  // D = R - L
                left  = raw_samples;
@@ -990,7 +974,7 @@ static int decode_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
        y = 1 << 19;

        for (sb = -opt_order; sb < 0; sb++)
-            y += (uint64_t)MUL64(lpc_cof[sb], raw_samples[sb]);
+            y += MUL64(lpc_cof[sb], raw_samples[sb]);

        *raw_samples -= y >> 20;
    }
@@ -1049,7 +1033,7 @@ static int decode_block(ALSDecContext *ctx, ALSBlockData *bd)

    if (*bd->shift_lsbs)
        for (smp = 0; smp < bd->block_length; smp++)
-            bd->raw_samples[smp] = (unsigned)bd->raw_samples[smp] << *bd->shift_lsbs;
+            bd->raw_samples[smp] <<= *bd->shift_lsbs;

    return 0;
 }
@@ -1185,10 +1169,10 @@ static int decode_blocks(ALSDecContext *ctx, unsigned int ra_frame,
                av_log(ctx->avctx, AV_LOG_WARNING, "Invalid channel pair.\n");

            for (s = 0; s < div_blocks[b]; s++)
-                bd[0].raw_samples[s] = bd[1].raw_samples[s] - (unsigned)bd[0].raw_samples[s];
+                bd[0].raw_samples[s] = bd[1].raw_samples[s] - bd[0].raw_samples[s];
        } else if (bd[1].js_blocks) {
            for (s = 0; s < div_blocks[b]; s++)
-                bd[1].raw_samples[s] = bd[1].raw_samples[s] + (unsigned)bd[0].raw_samples[s];
+                bd[1].raw_samples[s] = bd[1].raw_samples[s] + bd[0].raw_samples[s];
        }

        offset  += div_blocks[b];
@@ -1395,9 +1379,6 @@ static SoftFloat_IEEE754 multiply(SoftFloat_IEEE754 a, SoftFloat_IEEE754 b) {
    mantissa_temp = (uint64_t)a.mant * (uint64_t)b.mant;
    mask_64       = (uint64_t)0x1 << 47;

-    if (!mantissa_temp)
-        return FLOAT_0;
-
    // Count the valid bit count
    while (!(mantissa_temp & mask_64) && mask_64) {
        bit_count--;
@@ -1414,11 +1395,7 @@ static SoftFloat_IEEE754 multiply(SoftFloat_IEEE754 a, SoftFloat_IEEE754 b) {
        }
    }

-    if (cutoff_bit_count >= 0) {
-        mantissa = (unsigned int)(mantissa_temp >> cutoff_bit_count);
-    } else {
-        mantissa = (unsigned int)(mantissa_temp <<-cutoff_bit_count);
-    }
+    mantissa = (unsigned int)(mantissa_temp >> cutoff_bit_count);

    // Need one more shift?
    if (mantissa & 0x01000000ul) {
@@ -1430,7 +1407,7 @@ static SoftFloat_IEEE754 multiply(SoftFloat_IEEE754 a, SoftFloat_IEEE754 b) {
        return_val = 0x80000000U;
    }

-    return_val |= ((unsigned)av_clip(a.exp + b.exp + bit_count - 47, -126, 127) << 23) & 0x7F800000;
+    return_val |= (a.exp + b.exp + bit_count - 47) << 23;
    return_val |= mantissa;
    return av_bits2sf_ieee754(return_val);
 }
@@ -1475,9 +1452,6 @@ static int read_diff_float_data(ALSDecContext *ctx, unsigned int ra_frame) {
        ff_mlz_flush_dict(ctx->mlz);
    }

-    if (avctx->channels * 8 > get_bits_left(gb))
-        return AVERROR_INVALIDDATA;
-
    for (c = 0; c < avctx->channels; ++c) {
        if (use_acf) {
            //acf_flag
@@ -1818,17 +1792,15 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame_ptr,
    #define INTERLEAVE_OUTPUT(bps)                                                   \
    {                                                                                \
        int##bps##_t *dest = (int##bps##_t*)frame->data[0];                          \
-        int channels = avctx->channels;                                              \
-        int32_t **raw_samples = ctx->raw_samples;                                    \
        shift = bps - ctx->avctx->bits_per_raw_sample;                               \
        if (!ctx->cs_switch) {                                                       \
            for (sample = 0; sample < ctx->cur_frame_length; sample++)               \
-                for (c = 0; c < channels; c++)                                       \
-                    *dest++ = raw_samples[c][sample] * (1U << shift);                \
+                for (c = 0; c < avctx->channels; c++)                                \
+                    *dest++ = ctx->raw_samples[c][sample] << shift;                  \
        } else {                                                                     \
            for (sample = 0; sample < ctx->cur_frame_length; sample++)               \
-                for (c = 0; c < channels; c++)                                       \
-                    *dest++ = raw_samples[sconf->chan_pos[c]][sample] * (1U << shift);\
+                for (c = 0; c < avctx->channels; c++)                                \
+                    *dest++ = ctx->raw_samples[sconf->chan_pos[c]][sample] << shift; \
        }                                                                            \
    }

@@ -2012,8 +1984,6 @@ static av_cold int decode_init(AVCodecContext *avctx)

    // allocate quantized parcor coefficient buffer
    num_buffers = sconf->mc_coding ? avctx->channels : 1;
-    if (num_buffers * (uint64_t)num_buffers > INT_MAX) // protect chan_data_buffer allocation
-        return AVERROR_INVALIDDATA;

    ctx->quant_cof        = av_malloc_array(num_buffers, sizeof(*ctx->quant_cof));
    ctx->lpc_cof          = av_malloc_array(num_buffers, sizeof(*ctx->lpc_cof));
@@ -2146,6 +2116,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
    return 0;

 fail:
+    decode_end(avctx);
    return ret;
 }

@@ -2171,5 +2142,4 @@ AVCodec ff_als_decoder = {
    .decode         = decode_frame,
    .flush          = flush,
    .capabilities   = AV_CODEC_CAP_SUBFRAMES | AV_CODEC_CAP_DR1,
-    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
 };
@@ -438,7 +438,7 @@ static int amf_copy_buffer(AVCodecContext *avctx, AVPacket *pkt, AMFBuffer *buff
    int64_t          timestamp = AV_NOPTS_VALUE;
    int64_t          size = buffer->pVtbl->GetSize(buffer);

-    if ((ret = av_new_packet(pkt, size)) < 0) {
+    if ((ret = ff_alloc_packet2(avctx, pkt, size, 0)) < 0) {
        return ret;
    }
    memcpy(pkt->data, buffer->pVtbl->GetNative(buffer), size);
@@ -119,9 +119,6 @@ static int decode_frame(AVCodecContext *avctx,
    uint8_t *dst, *dst_end;
    int count, ret;

-    if (buf_size < 7)
-        return AVERROR_INVALIDDATA;
-
    if ((ret = ff_reget_buffer(avctx, s->frame)) < 0)
        return ret;
    dst     = s->frame->data[0];
@@ -460,7 +460,7 @@ static inline void update_rice(APERice *rice, unsigned int x)

    if (rice->ksum < lim)
        rice->k--;
-    else if (rice->ksum >= (1 << (rice->k + 5)) && rice->k < 24)
+    else if (rice->ksum >= (1 << (rice->k + 5)))
        rice->k++;
 }

@@ -554,7 +554,7 @@ static inline int ape_decode_value_3990(APEContext *ctx, APERice *rice)
    overflow = range_get_symbol(ctx, counts_3980, counts_diff_3980);

    if (overflow == (MODEL_ELEMENTS - 1)) {
-        overflow  = (unsigned)range_decode_bits(ctx, 16) << 16;
+        overflow  = range_decode_bits(ctx, 16) << 16;
        overflow |= range_decode_bits(ctx, 16);
    }

@@ -589,7 +589,7 @@ static void decode_array_0000(APEContext *ctx, GetBitContext *gb,
                              int32_t *out, APERice *rice, int blockstodecode)
 {
    int i;
-    unsigned ksummax, ksummin;
+    int ksummax, ksummin;

    rice->ksum = 0;
    for (i = 0; i < FFMIN(blockstodecode, 5); i++) {
@@ -836,7 +836,7 @@ static av_always_inline int filter_fast_3320(APEPredictor *p,
    else
        p->coeffsA[filter][0]--;

-    p->filterA[filter] += (unsigned)p->lastA[filter];
+    p->filterA[filter] += p->lastA[filter];

    return p->filterA[filter];
 }
@@ -859,9 +859,9 @@ static av_always_inline int filter_3800(APEPredictor *p,
        return predictionA;
    }
    d2 =  p->buf[delayA];
-    d1 = (p->buf[delayA] - p->buf[delayA - 1]) * 2U;
-    d0 =  p->buf[delayA] + ((p->buf[delayA - 2] - p->buf[delayA - 1]) * 8U);
-    d3 =  p->buf[delayB] * 2U - p->buf[delayB - 1];
+    d1 = (p->buf[delayA] - p->buf[delayA - 1]) << 1;
+    d0 =  p->buf[delayA] + ((p->buf[delayA - 2] - p->buf[delayA - 1]) << 3);
+    d3 =  p->buf[delayB] * 2 - p->buf[delayB - 1];
    d4 =  p->buf[delayB];

    predictionA = d0 * p->coeffsA[filter][0] +
@@ -881,7 +881,7 @@ static av_always_inline int filter_3800(APEPredictor *p,
    p->coeffsB[filter][1] -= (((d4 >> 30) & 2) - 1) * sign;

    p->filterB[filter] = p->lastA[filter] + (predictionB >> shift);
-    p->filterA[filter] = p->filterB[filter] + (unsigned)((int)(p->filterA[filter] * 31U) >> 5);
+    p->filterA[filter] = p->filterB[filter] + ((p->filterA[filter] * 31) >> 5);

    return p->filterA[filter];
 }
@@ -902,7 +902,7 @@ static void long_filter_high_3800(int32_t *buffer, int order, int shift, int len
        dotprod = 0;
        sign = APESIGN(buffer[i]);
        for (j = 0; j < order; j++) {
-            dotprod += delay[j] * (unsigned)coeffs[j];
+            dotprod += delay[j] * coeffs[j];
            coeffs[j] += ((delay[j] >> 31) | 1) * sign;
        }
        buffer[i] -= dotprod >> shift;
@@ -916,8 +916,7 @@ static void long_filter_ehigh_3830(int32_t *buffer, int length)
 {
    int i, j;
    int32_t dotprod, sign;
-    int32_t delay[8] = { 0 };
-    uint32_t coeffs[8] = { 0 };
+    int32_t coeffs[8] = { 0 }, delay[8] = { 0 };

    for (i = 0; i < length; i++) {
        dotprod = 0;
@@ -1052,7 +1051,7 @@ static av_always_inline int predictor_update_3930(APEPredictor *p,
                  d3 * p->coeffsA[filter][3];

    p->lastA[filter] = decoded + (predictionA >> 9);
-    p->filterA[filter] = p->lastA[filter] + ((int)(p->filterA[filter] * 31U) >> 5);
+    p->filterA[filter] = p->lastA[filter] + ((p->filterA[filter] * 31) >> 5);

    sign = APESIGN(decoded);
    p->coeffsA[filter][0] += ((d0 < 0) * 2 - 1) * sign;
@@ -1122,7 +1121,7 @@ static av_always_inline int predictor_update_filter(APEPredictor *p,

    p->buf[delayA]     = p->lastA[filter];
    p->buf[adaptA]     = APESIGN(p->buf[delayA]);
-    p->buf[delayA - 1] = p->buf[delayA] - (unsigned)p->buf[delayA - 1];
+    p->buf[delayA - 1] = p->buf[delayA] - p->buf[delayA - 1];
    p->buf[adaptA - 1] = APESIGN(p->buf[delayA - 1]);

    predictionA = p->buf[delayA    ] * p->coeffsA[filter][0] +
@@ -1131,9 +1130,9 @@ static av_always_inline int predictor_update_filter(APEPredictor *p,
                  p->buf[delayA - 3] * p->coeffsA[filter][3];

    /*  Apply a scaled first-order filter compression */
-    p->buf[delayB]     = p->filterA[filter ^ 1] - ((int)(p->filterB[filter] * 31U) >> 5);
+    p->buf[delayB]     = p->filterA[filter ^ 1] - ((p->filterB[filter] * 31) >> 5);
    p->buf[adaptB]     = APESIGN(p->buf[delayB]);
-    p->buf[delayB - 1] = p->buf[delayB] - (unsigned)p->buf[delayB - 1];
+    p->buf[delayB - 1] = p->buf[delayB] - p->buf[delayB - 1];
    p->buf[adaptB - 1] = APESIGN(p->buf[delayB - 1]);
    p->filterB[filter] = p->filterA[filter ^ 1];

@@ -1143,8 +1142,8 @@ static av_always_inline int predictor_update_filter(APEPredictor *p,
                  p->buf[delayB - 3] * p->coeffsB[filter][3] +
                  p->buf[delayB - 4] * p->coeffsB[filter][4];

-    p->lastA[filter] = decoded + ((int)((unsigned)predictionA + (predictionB >> 1)) >> 10);
-    p->filterA[filter] = p->lastA[filter] + ((int)(p->filterA[filter] * 31U) >> 5);
+    p->lastA[filter] = decoded + ((predictionA + (predictionB >> 1)) >> 10);
+    p->filterA[filter] = p->lastA[filter] + ((p->filterA[filter] * 31) >> 5);

    sign = APESIGN(decoded);
    p->coeffsA[filter][0] += p->buf[adaptA    ] * sign;
@@ -1230,7 +1229,7 @@ static void predictor_decode_mono_3950(APEContext *ctx, int count)
            p->buf = p->historybuffer;
        }

-        p->filterA[0] = currentA + (unsigned)((int)(p->filterA[0] * 31U) >> 5);
+        p->filterA[0] = currentA + ((p->filterA[0] * 31) >> 5);
        *(decoded0++) = p->filterA[0];
    }

@@ -1267,8 +1266,8 @@ static void do_apply_filter(APEContext *ctx, int version, APEFilter *f,
                                                     f->delay - order,
                                                     f->adaptcoeffs - order,
                                                     order, APESIGN(*data));
-        res = (int)(res + (1U << (fracbits - 1))) >> fracbits;
-        res += (unsigned)*data;
+        res = (res + (1 << (fracbits - 1))) >> fracbits;
+        res += *data;
        *data++ = res;

        /* Update the output history */
@@ -1283,7 +1282,7 @@ static void do_apply_filter(APEContext *ctx, int version, APEFilter *f,
            /* Version 3.98 and later files */

            /* Update the adaption coefficients */
-            absres = res < 0 ? -(unsigned)res : res;
+            absres = FFABS(res);
            if (absres)
                *f->adaptcoeffs = APESIGN(res) *
                                  (8 << ((absres > f->avg * 3) + (absres > f->avg * 4 / 3)));
@@ -1298,7 +1297,7 @@ static void do_apply_filter(APEContext *ctx, int version, APEFilter *f,
            else
                *f->adaptcoeffs = 0;

-            f->avg += (int)(absres - (unsigned)f->avg) / 16;
+            f->avg += (absres - f->avg) / 16;

            f->adaptcoeffs[-1] >>= 1;
            f->adaptcoeffs[-2] >>= 1;
@@ -1377,7 +1376,7 @@ static void ape_unpack_mono(APEContext *ctx, int count)

 static void ape_unpack_stereo(APEContext *ctx, int count)
 {
-    unsigned left, right;
+    int32_t left, right;
    int32_t *decoded0 = ctx->decoded[0];
    int32_t *decoded1 = ctx->decoded[1];

@@ -1394,7 +1393,7 @@ static void ape_unpack_stereo(APEContext *ctx, int count)

    /* Decorrelate and scale to output depth */
    while (count--) {
-        left = *decoded1 - (unsigned)(*decoded0 / 2);
+        left = *decoded1 - (*decoded0 / 2);
        right = left + *decoded0;

        *(decoded0++) = left;
@@ -1452,8 +1451,7 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data,
        if (s->fileversion >= 3900) {
            if (offset > 3) {
                av_log(avctx, AV_LOG_ERROR, "Incorrect offset passed\n");
-                av_freep(&s->data);
-                s->data_size = 0;
+                s->data = NULL;
                return AVERROR_INVALIDDATA;
            }
            if (s->data_end - s->ptr < offset) {
@@ -1501,7 +1499,7 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data,
    av_fast_malloc(&s->decoded_buffer, &s->decoded_size, decoded_buffer_size);
    if (!s->decoded_buffer)
        return AVERROR(ENOMEM);
-    memset(s->decoded_buffer, 0, decoded_buffer_size);
+    memset(s->decoded_buffer, 0, s->decoded_size);
    s->decoded[0] = s->decoded_buffer;
    s->decoded[1] = s->decoded_buffer + FFALIGN(blockstodecode, 8);

@@ -480,7 +480,7 @@ static void aptx_update_codeword_history(Channel *channel)
    int32_t cw = ((channel->quantize[0].quantized_sample & 3) << 0) +
                 ((channel->quantize[1].quantized_sample & 2) << 1) +
                 ((channel->quantize[2].quantized_sample & 1) << 3);
-    channel->codeword_history = (cw << 8) + ((unsigned)channel->codeword_history << 4);
+    channel->codeword_history = (cw << 8) + (channel->codeword_history << 4);
 }

 static void aptx_generate_dither(Channel *channel)
@@ -492,9 +492,9 @@ static void aptx_generate_dither(Channel *channel)
    aptx_update_codeword_history(channel);

    m = (int64_t)5184443 * (channel->codeword_history >> 7);
-    d = (m * 4) + (m >> 22);
+    d = (m << 2) + (m >> 22);
    for (subband = 0; subband < NB_SUBBANDS; subband++)
-        channel->dither[subband] = (unsigned)d << (23 - 5*subband);
+        channel->dither[subband] = d << (23 - 5*subband);
    channel->dither_parity = (d >> 25) & 1;
 }

@@ -759,12 +759,12 @@ static void aptx_invert_quantization(InvertQuantize *invert_quantize,
    if (quantized_sample < 0)
        qr = -qr;

-    qr = rshift64_clip24((qr * (1LL<<32)) + MUL64(dither, tables->invert_quantize_dither_factors[idx]), 32);
+    qr = rshift64_clip24(((int64_t)qr<<32) + MUL64(dither, tables->invert_quantize_dither_factors[idx]), 32);
    invert_quantize->reconstructed_difference = MUL64(invert_quantize->quantization_factor, qr) >> 19;

    /* update factor_select */
    factor_select = 32620 * invert_quantize->factor_select;
-    factor_select = rshift32(factor_select + (tables->quantize_factor_select_offset[idx] * (1 << 15)), 15);
+    factor_select = rshift32(factor_select + (tables->quantize_factor_select_offset[idx] << 15), 15);
    invert_quantize->factor_select = av_clip(factor_select, 0, tables->factor_max);

    /* update quantization factor */
@@ -801,7 +801,7 @@ static void aptx_prediction_filtering(Prediction *prediction,
    prediction->previous_reconstructed_sample = reconstructed_sample;

    reconstructed_differences = aptx_reconstructed_differences_update(prediction, reconstructed_difference, order);
-    srd0 = FFDIFFSIGN(reconstructed_difference, 0) * (1 << 23);
+    srd0 = FFDIFFSIGN(reconstructed_difference, 0) << 23;
    for (i = 0; i < order; i++) {
        int32_t srd = FF_SIGNBIT(reconstructed_differences[-i-1]) | 1;
        prediction->d_weight[i] -= rshift32(prediction->d_weight[i] - srd*srd0, 8);
@@ -830,7 +830,7 @@ static void aptx_process_subband(InvertQuantize *invert_quantize,

    range = 0x100000;
    sw1 = rshift32(-same_sign[1] * prediction->s_weight[1], 1);
-    sw1 = (av_clip(sw1, -range, range) & ~0xF) * 16;
+    sw1 = (av_clip(sw1, -range, range) & ~0xF) << 4;

    range = 0x300000;
    weight[0] = 254 * prediction->s_weight[0] + 0x800000*same_sign[0] + sw1;
@@ -989,9 +989,6 @@ static av_cold int aptx_init(AVCodecContext *avctx)
    AptXContext *s = avctx->priv_data;
    int chan, subband;

-    if (avctx->channels != 2)
-        return AVERROR_INVALIDDATA;
-
    s->hd = avctx->codec->id == AV_CODEC_ID_APTX_HD;
    s->block_size = s->hd ? 6 : 4;

@@ -1047,7 +1044,7 @@ static int aptx_decode_frame(AVCodecContext *avctx, void *data,
        for (channel = 0; channel < NB_CHANNELS; channel++)
            for (sample = 0; sample < 4; sample++)
                AV_WN32A(&frame->data[channel][4*(opos+sample)],
-                         samples[channel][sample] * 256);
+                         samples[channel][sample] << 8);
    }

    *got_frame_ptr = 1;
@@ -31,8 +31,7 @@ static av_cold int ass_decode_init(AVCodecContext *avctx)
    avctx->subtitle_header = av_malloc(avctx->extradata_size + 1);
    if (!avctx->subtitle_header)
        return AVERROR(ENOMEM);
-    if (avctx->extradata_size)
-        memcpy(avctx->subtitle_header, avctx->extradata, avctx->extradata_size);
+    memcpy(avctx->subtitle_header, avctx->extradata, avctx->extradata_size);
    avctx->subtitle_header[avctx->extradata_size] = 0;
    avctx->subtitle_header_size = avctx->extradata_size;
    return 0;
@@ -964,7 +964,7 @@ static av_cold int atrac3_decode_init(AVCodecContext *avctx)
        return AVERROR_INVALIDDATA;
    }

-    if (avctx->block_align > 1024 || avctx->block_align <= 0)
+    if (avctx->block_align >= UINT_MAX / 2)
        return AVERROR(EINVAL);

    q->decoded_bytes_buffer = av_mallocz(FFALIGN(avctx->block_align, 4) +
@@ -456,10 +456,6 @@ static int decode_channel_wordlen(GetBitContext *gb, Atrac3pChanUnitCtx *ctx,
    } else if (chan->fill_mode == 3) {
        pos = ch_num ? chan->num_coded_vals + chan->split_point
                     : ctx->num_quant_units - chan->split_point;
-        if (pos > FF_ARRAY_ELEMS(chan->qu_wordlen)) {
-            av_log(avctx, AV_LOG_ERROR, "Split point beyond array\n");
-            pos = FF_ARRAY_ELEMS(chan->qu_wordlen);
-        }
        for (i = chan->num_coded_vals; i < pos; i++)
            chan->qu_wordlen[i] = 1;
    }
@@ -71,8 +71,6 @@ typedef struct ATRAC9BlockData {
    int cpe_base_channel;
    int is_signs[30];

-    int reuseable;
-
 } ATRAC9BlockData;

 typedef struct ATRAC9Context {
@@ -121,7 +119,7 @@ static inline int parse_gradient(ATRAC9Context *s, ATRAC9BlockData *b,
    }
    b->grad_boundary = get_bits(gb, 4);

-    if (grad_range[0] >= grad_range[1] || grad_range[1] > 31)
+    if (grad_range[0] >= grad_range[1] || grad_range[1] > 47)
        return AVERROR_INVALIDDATA;

    if (grad_value[0] > 31 || grad_value[1] > 31)
@@ -190,7 +188,7 @@ static inline void calc_precision(ATRAC9Context *s, ATRAC9BlockData *b,
    for (int i = 0; i < b->q_unit_cnt; i++) {
        c->precision_fine[i] = 0;
        if (c->precision_coarse[i] > 15) {
-            c->precision_fine[i] = FFMIN(c->precision_coarse[i], 30) - 15;
+            c->precision_fine[i] = c->precision_coarse[i] - 15;
            c->precision_coarse[i] = 15;
        }
    }
@@ -202,8 +200,6 @@ static inline int parse_band_ext(ATRAC9Context *s, ATRAC9BlockData *b,
    int ext_band = 0;

    if (b->has_band_ext) {
-        if (b->q_unit_cnt < 13 || b->q_unit_cnt > 20)
-            return AVERROR_INVALIDDATA;
        ext_band = at9_tab_band_ext_group[b->q_unit_cnt - 13][2];
        if (stereo) {
            b->channel[1].band_ext = get_bits(gb, 2);
@@ -226,18 +222,8 @@ static inline int parse_band_ext(ATRAC9Context *s, ATRAC9BlockData *b,
    b->channel[0].band_ext = get_bits(gb, 2);
    b->channel[0].band_ext = ext_band > 2 ? b->channel[0].band_ext : 4;

-    if (!get_bits(gb, 5)) {
-        for (int i = 0; i <= stereo; i++) {
-            ATRAC9ChannelData *c = &b->channel[i];
-            const int count = at9_tab_band_ext_cnt[c->band_ext][ext_band];
-            for (int j = 0; j < count; j++) {
-                int len = at9_tab_band_ext_lengths[c->band_ext][ext_band][j];
-                c->band_ext_data[j] = av_clip_uintp2_c(c->band_ext_data[j], len);
-            }
-        }
-
+    if (!get_bits(gb, 5))
        return 0;
-    }

    for (int i = 0; i <= stereo; i++) {
        ATRAC9ChannelData *c = &b->channel[i];
@@ -549,6 +535,9 @@ static inline void apply_band_extension(ATRAC9Context *s, ATRAC9BlockData *b,
        at9_q_unit_to_coeff_idx[g_units[3]],
    };

+    if (!b->has_band_ext || !b->has_band_ext_data)
+        return;
+
    for (int ch = 0; ch <= stereo; ch++) {
        ATRAC9ChannelData *c = &b->channel[ch];

@@ -679,7 +668,6 @@ static int atrac9_decode_block(ATRAC9Context *s, GetBitContext *gb,
    if (!reuse_params) {
        int stereo_band, ext_band;
        const int min_band_count = s->samplerate_idx > 7 ? 1 : 3;
-        b->reuseable = 0;
        b->band_count = get_bits(gb, 4) + min_band_count;
        b->q_unit_cnt = at9_tab_band_q_unit_map[b->band_count];

@@ -711,11 +699,6 @@ static int atrac9_decode_block(ATRAC9Context *s, GetBitContext *gb,
            }
            b->band_ext_q_unit = at9_tab_band_q_unit_map[ext_band];
        }
-        b->reuseable = 1;
-    }
-    if (!b->reuseable) {
-        av_log(s->avctx, AV_LOG_ERROR, "invalid block reused!\n");
-        return AVERROR_INVALIDDATA;
    }

    /* Calculate bit alloc gradient */
@@ -758,9 +741,7 @@ static int atrac9_decode_block(ATRAC9Context *s, GetBitContext *gb,

    apply_intensity_stereo(s, b, stereo);
    apply_scalefactors    (s, b, stereo);
-
-    if (b->has_band_ext && b->has_band_ext_data)
-        apply_band_extension  (s, b, stereo);
+    apply_band_extension  (s, b, stereo);

 imdct:
    for (int i = 0; i <= stereo; i++) {
@@ -852,11 +833,6 @@ static av_cold int atrac9_decode_init(AVCodecContext *avctx)

    av_lfg_init(&s->lfg, 0xFBADF00D);

-    if (avctx->block_align <= 0) {
-        av_log(avctx, AV_LOG_ERROR, "Invalid block align\n");
-        return AVERROR_INVALIDDATA;
-    }
-
    if (avctx->extradata_size != 12) {
        av_log(avctx, AV_LOG_ERROR, "Invalid extradata length!\n");
        return AVERROR_INVALIDDATA;
@@ -886,7 +862,6 @@ static av_cold int atrac9_decode_init(AVCodecContext *avctx)
    s->block_config = &at9_block_layout[block_config_idx];

    avctx->channel_layout = s->block_config->channel_layout;
-    avctx->channels       = av_get_channel_layout_nb_channels(avctx->channel_layout);
    avctx->sample_fmt     = AV_SAMPLE_FMT_FLTP;

    if (get_bits1(&gb)) {
@@ -68,7 +68,8 @@ static int av1_parser_parse(AVCodecParserContext *ctx,

        ret = ff_cbs_read(s->cbc, td, avctx->extradata, avctx->extradata_size);
        if (ret < 0) {
-            av_log(avctx, AV_LOG_WARNING, "Failed to parse extradata.\n");
+            av_log(avctx, AV_LOG_ERROR, "Failed to parse extradata.\n");
+            goto end;
        }

        ff_cbs_fragment_uninit(s->cbc, td);
@@ -100,9 +101,6 @@ static int av1_parser_parse(AVCodecParserContext *ctx,
        else
            continue;

-        if (obu->header.spatial_id > 0)
-            continue;
-
        if (frame->show_existing_frame) {
            AV1ReferenceFrameState *ref = &av1->ref[frame->frame_to_show_map_idx];

@@ -1321,7 +1321,7 @@ enum AVPacketSideDataType {
    AV_PKT_DATA_METADATA_UPDATE,

    /**
-     * MPEGTS stream ID as uint8_t, this is required to pass the stream ID
+     * MPEGTS stream ID, this is required to pass the stream ID
     * information from the demuxer to the corresponding muxer.
     */
    AV_PKT_DATA_MPEGTS_STREAM_ID,
@@ -109,11 +109,6 @@ static int bethsoftvid_decode_frame(AVCodecContext *avctx,
            if(yoffset >= avctx->height)
                return AVERROR_INVALIDDATA;
            dst += vid->frame->linesize[0] * yoffset;
-        case VIDEO_P_FRAME:
-        case VIDEO_I_FRAME:
-            break;
-        default:
-            return AVERROR_INVALIDDATA;
    }

    // main code
@@ -485,17 +485,12 @@ av_cold void ff_bgmc_end(uint8_t **cf_lut, int **cf_lut_status)


 /** Initialize decoding and reads the first value */
-int ff_bgmc_decode_init(GetBitContext *gb, unsigned int *h,
+void ff_bgmc_decode_init(GetBitContext *gb, unsigned int *h,
                         unsigned int *l, unsigned int *v)
 {
-    if (get_bits_left(gb) < VALUE_BITS)
-        return AVERROR_INVALIDDATA;
-
    *h = TOP_VALUE;
    *l = 0;
    *v = get_bits_long(gb, VALUE_BITS);
-
-    return 0;
 }


@@ -40,7 +40,7 @@ int ff_bgmc_init(AVCodecContext *avctx, uint8_t **cf_lut, int **cf_lut_status);
 void ff_bgmc_end(uint8_t **cf_lut, int **cf_lut_status);


-int ff_bgmc_decode_init(GetBitContext *gb,
+void ff_bgmc_decode_init(GetBitContext *gb,
                      unsigned int *h, unsigned int *l, unsigned int *v);


@@ -702,15 +702,15 @@ static int read_dct_coeffs(GetBitContext *gb, int32_t block[64],
    return quant_idx;
 }

-static void unquantize_dct_coeffs(int32_t block[64], const uint32_t quant[64],
+static void unquantize_dct_coeffs(int32_t block[64], const int32_t quant[64],
                                  int coef_count, int coef_idx[64],
                                  const uint8_t *scan)
 {
    int i;
-    block[0] = (int)(block[0] * quant[0]) >> 11;
+    block[0] = (block[0] * quant[0]) >> 11;
    for (i = 0; i < coef_count; i++) {
        int idx = coef_idx[i];
-        block[scan[idx]] = (int)(block[scan[idx]] * quant[idx]) >> 11;
+        block[scan[idx]] = (block[scan[idx]] * quant[idx]) >> 11;
    }
 }

@@ -1335,13 +1335,13 @@ static av_cold int decode_init(AVCodecContext *avctx)
    }
    c->avctx = avctx;

-    if ((ret = av_image_check_size(avctx->width, avctx->height, 0, avctx)) < 0)
-        return ret;
-
    c->last = av_frame_alloc();
    if (!c->last)
        return AVERROR(ENOMEM);

+    if ((ret = av_image_check_size(avctx->width, avctx->height, 0, avctx)) < 0)
+        return ret;
+
    avctx->pix_fmt = c->has_alpha ? AV_PIX_FMT_YUVA420P : AV_PIX_FMT_YUV420P;
    avctx->color_range = c->version == 'k' ? AVCOL_RANGE_JPEG : AVCOL_RANGE_MPEG;

@@ -95,8 +95,6 @@ static av_cold int decode_init(AVCodecContext *avctx)
    if (avctx->codec->id == AV_CODEC_ID_BINKAUDIO_RDFT) {
        // audio is already interleaved for the RDFT format variant
        avctx->sample_fmt = AV_SAMPLE_FMT_FLT;
-        if (sample_rate > INT_MAX / avctx->channels)
-            return AVERROR_INVALIDDATA;
        sample_rate  *= avctx->channels;
        s->channels = 1;
        if (!s->version_b)
@@ -33,22 +33,20 @@
 #define A3  3784
 #define A4 -5352

-#define MUL(X,Y) ((int)((unsigned)(X) * (Y)) >> 11)
-
 #define IDCT_TRANSFORM(dest,s0,s1,s2,s3,s4,s5,s6,s7,d0,d1,d2,d3,d4,d5,d6,d7,munge,src) {\
    const int a0 = (src)[s0] + (src)[s4]; \
    const int a1 = (src)[s0] - (src)[s4]; \
    const int a2 = (src)[s2] + (src)[s6]; \
-    const int a3 = MUL(A1, (src)[s2] - (src)[s6]); \
+    const int a3 = (A1*((src)[s2] - (src)[s6])) >> 11; \
    const int a4 = (src)[s5] + (src)[s3]; \
    const int a5 = (src)[s5] - (src)[s3]; \
    const int a6 = (src)[s1] + (src)[s7]; \
    const int a7 = (src)[s1] - (src)[s7]; \
    const int b0 = a4 + a6; \
-    const int b1 = MUL(A3, a5 + a7); \
-    const int b2 = MUL(A4, a5) - b0 + b1; \
-    const int b3 = MUL(A1, a6 - a4) - b2; \
-    const int b4 = MUL(A2, a7) + b3 - b1; \
+    const int b1 = (A3*(a5 + a7)) >> 11; \
+    const int b2 = ((A4*a5) >> 11) - b0 + b1; \
+    const int b3 = (A1*(a6 - a4) >> 11) - b2; \
+    const int b4 = ((A2*a7) >> 11) + b3 - b1; \
    (dest)[d0] = munge(a0+a2   +b0); \
    (dest)[d1] = munge(a1+a3-a2+b2); \
    (dest)[d2] = munge(a1-a3+a2+b3); \
@@ -63,10 +63,6 @@ static av_cold int decode_init(AVCodecContext *avctx)
            av_log(avctx, AV_LOG_ERROR, "not enough extradata\n");
            return AVERROR_INVALIDDATA;
        }
-        if (!s->font_height) {
-            av_log(avctx, AV_LOG_ERROR, "invalid font height\n");
-            return AVERROR_INVALIDDATA;
-        }
    } else {
        s->font_height = 8;
        s->flags = 0;
@@ -188,9 +188,8 @@ static int build_table(VLC *vlc, int table_nb_bits, int nb_codes,
            }
            for (k = 0; k < nb; k++) {
                int bits = table[j][1];
-                int oldsym  = table[j][0];
                ff_dlog(NULL, "%4x: code=%d n=%d\n", j, i, n);
-                if ((bits || oldsym) && (bits != n || oldsym != symbol)) {
+                if (bits != 0 && bits != n) {
                    av_log(NULL, AV_LOG_ERROR, "incorrect codes\n");
                    return AVERROR_INVALIDDATA;
                }
@@ -227,10 +226,6 @@ static int build_table(VLC *vlc, int table_nb_bits, int nb_codes,
            /* note: realloc has been done, so reload tables */
            table = (volatile VLC_TYPE (*)[2])&vlc->table[table_index];
            table[j][0] = index; //code
-            if (table[j][0] != index) {
-                avpriv_request_sample(NULL, "strange codes");
-                return AVERROR_PATCHWELCOME;
-            }
            i = k-1;
        }
    }
@@ -291,7 +291,7 @@ static int bmp_decode_frame(AVCodecContext *avctx,
        case 1:
            for (i = 0; i < avctx->height; i++) {
                int j;
-                for (j = 0; j < avctx->width >> 3; j++) {
+                for (j = 0; j < n; j++) {
                    ptr[j*8+0] =  buf[j] >> 7;
                    ptr[j*8+1] = (buf[j] >> 6) & 1;
                    ptr[j*8+2] = (buf[j] >> 5) & 1;
@@ -301,9 +301,6 @@ static int bmp_decode_frame(AVCodecContext *avctx,
                    ptr[j*8+6] = (buf[j] >> 1) & 1;
                    ptr[j*8+7] =  buf[j]       & 1;
                }
-                for (j = 0; j < (avctx->width & 7); j++) {
-                    ptr[avctx->width - (avctx->width & 7) + j] = buf[avctx->width >> 3] >> (7 - j) & 1;
-                }
                buf += n;
                ptr += linesize;
            }
@@ -204,10 +204,6 @@ static int pix_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
        avpriv_request_sample(avctx, "Format %d", hdr.format);
        return AVERROR_PATCHWELCOME;
    }
-    bytes_per_scanline = bytes_pp * hdr.width;
-
-    if (bytestream2_get_bytes_left(&gb) < hdr.height * bytes_per_scanline)
-        return AVERROR_INVALIDDATA;

    if ((ret = ff_set_dimensions(avctx, hdr.width, hdr.height)) < 0)
        return ret;
@@ -265,6 +261,7 @@ static int pix_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
    bytestream2_skip(&gb, 8);

    // read the image data to the buffer
+    bytes_per_scanline = bytes_pp * hdr.width;
    bytes_left = bytestream2_get_bytes_left(&gb);

    if (chunk_type != IMAGE_DATA_CHUNK || data_len != bytes_left ||
@@ -47,8 +47,7 @@ void av_bsf_free(AVBSFContext **pctx)

    av_opt_free(ctx);

-    if (ctx->internal)
-        av_packet_free(&ctx->internal->buffer_pkt);
+    av_packet_free(&ctx->internal->buffer_pkt);
    av_freep(&ctx->internal);
    av_freep(&ctx->priv_data);

@@ -591,21 +591,14 @@ static int decode_residual_block(AVSContext *h, GetBitContext *gb,
 }


-static inline int decode_residual_chroma(AVSContext *h)
+static inline void decode_residual_chroma(AVSContext *h)
 {
-    if (h->cbp & (1 << 4)) {
-        int ret = decode_residual_block(h, &h->gb, chroma_dec, 0,
+    if (h->cbp & (1 << 4))
+        decode_residual_block(h, &h->gb, chroma_dec, 0,
                              ff_cavs_chroma_qp[h->qp], h->cu, h->c_stride);
-        if (ret < 0)
-            return ret;
-    }
-    if (h->cbp & (1 << 5)) {
-        int ret = decode_residual_block(h, &h->gb, chroma_dec, 0,
+    if (h->cbp & (1 << 5))
+        decode_residual_block(h, &h->gb, chroma_dec, 0,
                              ff_cavs_chroma_qp[h->qp], h->cv, h->c_stride);
-        if (ret < 0)
-            return ret;
-    }
-    return 0;
 }

 static inline int decode_residual_inter(AVSContext *h)
@@ -656,7 +649,6 @@ static int decode_mb_i(AVSContext *h, int cbp_code)
    uint8_t top[18];
    uint8_t *left = NULL;
    uint8_t *d;
-    int ret;

    ff_cavs_init_mb(h);

@@ -700,11 +692,8 @@ static int decode_mb_i(AVSContext *h, int cbp_code)
        ff_cavs_load_intra_pred_luma(h, top, &left, block);
        h->intra_pred_l[h->pred_mode_Y[scan3x3[block]]]
            (d, top, left, h->l_stride);
-        if (h->cbp & (1<<block)) {
-            ret = decode_residual_block(h, gb, intra_dec, 1, h->qp, d, h->l_stride);
-            if (ret < 0)
-                return ret;
-        }
+        if (h->cbp & (1<<block))
+            decode_residual_block(h, gb, intra_dec, 1, h->qp, d, h->l_stride);
    }

    /* chroma intra prediction */
@@ -714,9 +703,7 @@ static int decode_mb_i(AVSContext *h, int cbp_code)
    h->intra_pred_c[pred_mode_uv](h->cv, &h->top_border_v[h->mbx * 10],
                                  h->left_border_v, h->c_stride);

-    ret = decode_residual_chroma(h);
-    if (ret < 0)
-        return ret;
+    decode_residual_chroma(h);
    ff_cavs_filter(h, I_8X8);
    set_mv_intra(h);
    return 0;
@@ -1215,7 +1202,6 @@ static int cavs_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
    int input_size, ret;
    const uint8_t *buf_end;
    const uint8_t *buf_ptr;
-    int frame_start = 0;

    if (buf_size == 0) {
        if (!h->low_delay && h->DPB[0].f->data[0]) {
@@ -1249,9 +1235,6 @@ static int cavs_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
                h->got_keyframe = 1;
            }
        case PIC_PB_START_CODE:
-            if (frame_start > 1)
-                return AVERROR_INVALIDDATA;
-            frame_start ++;
            if (*got_frame)
                av_frame_unref(data);
            *got_frame = 0;
@@ -502,85 +502,6 @@ int ff_cbs_write_unsigned(CodedBitstreamContext *ctx, PutBitContext *pbc,
    return 0;
 }

-int ff_cbs_read_signed(CodedBitstreamContext *ctx, GetBitContext *gbc,
-                       int width, const char *name,
-                       const int *subscripts, int32_t *write_to,
-                       int32_t range_min, int32_t range_max)
-{
-    int32_t value;
-    int position;
-
-    av_assert0(width > 0 && width <= 32);
-
-    if (get_bits_left(gbc) < width) {
-        av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid value at "
-               "%s: bitstream ended.\n", name);
-        return AVERROR_INVALIDDATA;
-    }
-
-    if (ctx->trace_enable)
-        position = get_bits_count(gbc);
-
-    value = get_sbits_long(gbc, width);
-
-    if (ctx->trace_enable) {
-        char bits[33];
-        int i;
-        for (i = 0; i < width; i++)
-            bits[i] = value & (1U << (width - i - 1)) ? '1' : '0';
-        bits[i] = 0;
-
-        ff_cbs_trace_syntax_element(ctx, position, name, subscripts,
-                                    bits, value);
-    }
-
-    if (value < range_min || value > range_max) {
-        av_log(ctx->log_ctx, AV_LOG_ERROR, "%s out of range: "
-               "%"PRId32", but must be in [%"PRId32",%"PRId32"].\n",
-               name, value, range_min, range_max);
-        return AVERROR_INVALIDDATA;
-    }
-
-    *write_to = value;
-    return 0;
-}
-
-int ff_cbs_write_signed(CodedBitstreamContext *ctx, PutBitContext *pbc,
-                        int width, const char *name,
-                        const int *subscripts, int32_t value,
-                        int32_t range_min, int32_t range_max)
-{
-    av_assert0(width > 0 && width <= 32);
-
-    if (value < range_min || value > range_max) {
-        av_log(ctx->log_ctx, AV_LOG_ERROR, "%s out of range: "
-               "%"PRId32", but must be in [%"PRId32",%"PRId32"].\n",
-               name, value, range_min, range_max);
-        return AVERROR_INVALIDDATA;
-    }
-
-    if (put_bits_left(pbc) < width)
-        return AVERROR(ENOSPC);
-
-    if (ctx->trace_enable) {
-        char bits[33];
-        int i;
-        for (i = 0; i < width; i++)
-            bits[i] = value & (1U << (width - i - 1)) ? '1' : '0';
-        bits[i] = 0;
-
-        ff_cbs_trace_syntax_element(ctx, put_bits_count(pbc),
-                                    name, subscripts, bits, value);
-    }
-
-    if (width < 32)
-        put_sbits(pbc, width, value);
-    else
-        put_bits32(pbc, value);
-
-    return 0;
-}
-

 int ff_cbs_alloc_unit_content(CodedBitstreamContext *ctx,
                              CodedBitstreamUnit *unit,
@@ -29,67 +29,45 @@ static int cbs_av1_read_uvlc(CodedBitstreamContext *ctx, GetBitContext *gbc,
                             const char *name, uint32_t *write_to,
                             uint32_t range_min, uint32_t range_max)
 {
-    uint32_t zeroes, bits_value, value;
-    int position;
+    uint32_t value;
+    int position, zeroes, i, j;
+    char bits[65];

    if (ctx->trace_enable)
        position = get_bits_count(gbc);

-    zeroes = 0;
+    zeroes = i = 0;
    while (1) {
-        if (get_bits_left(gbc) < 1) {
+        if (get_bits_left(gbc) < zeroes + 1) {
            av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid uvlc code at "
                   "%s: bitstream ended.\n", name);
            return AVERROR_INVALIDDATA;
        }

-        if (get_bits1(gbc))
+        if (get_bits1(gbc)) {
+            bits[i++] = '1';
            break;
-        ++zeroes;
+        } else {
+            bits[i++] = '0';
+            ++zeroes;
+        }
    }

    if (zeroes >= 32) {
        value = MAX_UINT_BITS(32);
    } else {
-        if (get_bits_left(gbc) < zeroes) {
-            av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid uvlc code at "
-                   "%s: bitstream ended.\n", name);
-            return AVERROR_INVALIDDATA;
-        }
+        value = get_bits_long(gbc, zeroes);

-        bits_value = get_bits_long(gbc, zeroes);
-        value = bits_value + (UINT32_C(1) << zeroes) - 1;
+        for (j = 0; j < zeroes; j++)
+            bits[i++] = (value >> (zeroes - j - 1) & 1) ? '1' : '0';
+
+        value += (1 << zeroes) - 1;
    }

    if (ctx->trace_enable) {
-        char bits[65];
-        int i, j, k;
-
-        if (zeroes >= 32) {
-            while (zeroes > 32) {
-                k = FFMIN(zeroes - 32, 32);
-                for (i = 0; i < k; i++)
-                    bits[i] = '0';
-                bits[i] = 0;
-                ff_cbs_trace_syntax_element(ctx, position, name,
-                                            NULL, bits, 0);
-                zeroes -= k;
-                position += k;
-            }
-        }
-
-        for (i = 0; i < zeroes; i++)
-            bits[i] = '0';
-        bits[i++] = '1';
-
-        if (zeroes < 32) {
-            for (j = 0; j < zeroes; j++)
-                bits[i++] = (bits_value >> (zeroes - j - 1) & 1) ? '1' : '0';
-        }
-
        bits[i] = 0;
-        ff_cbs_trace_syntax_element(ctx, position, name,
-                                    NULL, bits, value);
+        ff_cbs_trace_syntax_element(ctx, position, name, NULL,
+                                    bits, value);
    }

    if (value < range_min || value > range_max) {
@@ -211,26 +189,30 @@ static int cbs_av1_read_su(CodedBitstreamContext *ctx, GetBitContext *gbc,
                           int width, const char *name,
                           const int *subscripts, int32_t *write_to)
 {
-    int position;
+    uint32_t magnitude;
+    int position, sign;
    int32_t value;

    if (ctx->trace_enable)
        position = get_bits_count(gbc);

-    if (get_bits_left(gbc) < width) {
+    if (get_bits_left(gbc) < width + 1) {
        av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid signed value at "
               "%s: bitstream ended.\n", name);
        return AVERROR_INVALIDDATA;
    }

-    value = get_sbits(gbc, width);
+    magnitude = get_bits(gbc, width);
+    sign      = get_bits1(gbc);
+    value     = sign ? -(int32_t)magnitude : magnitude;

    if (ctx->trace_enable) {
        char bits[33];
        int i;
        for (i = 0; i < width; i++)
-            bits[i] = value & (1 << (width - i - 1)) ? '1' : '0';
-        bits[i] = 0;
+            bits[i] = magnitude >> (width - i - 1) & 1 ? '1' : '0';
+        bits[i] = sign ? '1' : '0';
+        bits[i + 1] = 0;

        ff_cbs_trace_syntax_element(ctx, position,
                                    name, subscripts, bits, value);
@@ -244,21 +226,29 @@ static int cbs_av1_write_su(CodedBitstreamContext *ctx, PutBitContext *pbc,
                            int width, const char *name,
                            const int *subscripts, int32_t value)
 {
-    if (put_bits_left(pbc) < width)
+    uint32_t magnitude;
+    int sign;
+
+    if (put_bits_left(pbc) < width + 1)
        return AVERROR(ENOSPC);

+    sign      = value < 0;
+    magnitude = sign ? -value : value;
+
    if (ctx->trace_enable) {
        char bits[33];
        int i;
        for (i = 0; i < width; i++)
-            bits[i] = value & (1 << (width - i - 1)) ? '1' : '0';
-        bits[i] = 0;
+            bits[i] = magnitude >> (width - i - 1) & 1 ? '1' : '0';
+        bits[i] = sign ? '1' : '0';
+        bits[i + 1] = 0;

        ff_cbs_trace_syntax_element(ctx, put_bits_count(pbc),
                                    name, subscripts, bits, value);
    }

-    put_sbits(pbc, width, value);
+    put_bits(pbc, width, magnitude);
+    put_bits(pbc, 1, sign);

    return 0;
 }
@@ -795,7 +785,7 @@ static int cbs_av1_split_fragment(CodedBitstreamContext *ctx,

    if (INT_MAX / 8 < size) {
        av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid fragment: "
-               "too large (%"SIZE_SPECIFIER" bytes).\n", size);
+               "too large (%zu bytes).\n", size);
        err = AVERROR_INVALIDDATA;
        goto fail;
    }
@@ -819,7 +809,7 @@ static int cbs_av1_split_fragment(CodedBitstreamContext *ctx,

        if (get_bits_left(&gbc) < 8) {
            av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid OBU: fragment "
-                   "too short (%"SIZE_SPECIFIER" bytes).\n", size);
+                   "too short (%zu bytes).\n", size);
            err = AVERROR_INVALIDDATA;
            goto fail;
        }
@@ -835,7 +825,7 @@ static int cbs_av1_split_fragment(CodedBitstreamContext *ctx,

        if (size < obu_length) {
            av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid OBU length: "
-                   "%"PRIu64", but only %"SIZE_SPECIFIER" bytes remaining in fragment.\n",
+                   "%"PRIu64", but only %zu bytes remaining in fragment.\n",
                   obu_length, size);
            err = AVERROR_INVALIDDATA;
            goto fail;
@@ -950,7 +940,7 @@ static int cbs_av1_read_unit(CodedBitstreamContext *ctx,
    } else {
        if (unit->data_size < 1 + obu->header.obu_extension_flag) {
            av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid OBU length: "
-                   "unit too short (%"SIZE_SPECIFIER").\n", unit->data_size);
+                   "unit too short (%zu).\n", unit->data_size);
            return AVERROR_INVALIDDATA;
        }
        obu->obu_size = unit->data_size - 1 - obu->header.obu_extension_flag;
@@ -960,7 +950,7 @@ static int cbs_av1_read_unit(CodedBitstreamContext *ctx,

    if (obu->header.obu_extension_flag) {
        priv->temporal_id = obu->header.temporal_id;
-        priv->spatial_id  = obu->header.spatial_id;
+        priv->spatial_id  = obu->header.temporal_id;

        if (obu->header.obu_type != AV1_OBU_SEQUENCE_HEADER &&
            obu->header.obu_type != AV1_OBU_TEMPORAL_DELIMITER &&
@@ -978,8 +968,6 @@ static int cbs_av1_read_unit(CodedBitstreamContext *ctx,
        priv->spatial_id  = 0;
    }

-    priv->ref = (AV1ReferenceFrameState *)&priv->read_ref;
-
    switch (obu->header.obu_type) {
    case AV1_OBU_SEQUENCE_HEADER:
        {
@@ -1008,10 +996,7 @@ static int cbs_av1_read_unit(CodedBitstreamContext *ctx,
    case AV1_OBU_REDUNDANT_FRAME_HEADER:
        {
            err = cbs_av1_read_frame_header_obu(ctx, &gbc,
-                                                &obu->obu.frame_header,
-                                                obu->header.obu_type ==
-                                                AV1_OBU_REDUNDANT_FRAME_HEADER,
-                                                unit->data_ref);
+                                                &obu->obu.frame_header);
            if (err < 0)
                return err;
        }
@@ -1031,8 +1016,7 @@ static int cbs_av1_read_unit(CodedBitstreamContext *ctx,
        break;
    case AV1_OBU_FRAME:
        {
-            err = cbs_av1_read_frame_obu(ctx, &gbc, &obu->obu.frame,
-                                         unit->data_ref);
+            err = cbs_av1_read_frame_obu(ctx, &gbc, &obu->obu.frame);
            if (err < 0)
                return err;

@@ -1072,14 +1056,9 @@ static int cbs_av1_read_unit(CodedBitstreamContext *ctx,

    if (obu->obu_size > 0 &&
        obu->header.obu_type != AV1_OBU_TILE_GROUP &&
-        obu->header.obu_type != AV1_OBU_TILE_LIST &&
        obu->header.obu_type != AV1_OBU_FRAME) {
-        int nb_bits = obu->obu_size * 8 + start_pos - end_pos;
-
-        if (nb_bits <= 0)
-            return AVERROR_INVALIDDATA;
-
-        err = cbs_av1_read_trailing_bits(ctx, &gbc, nb_bits);
+        err = cbs_av1_read_trailing_bits(ctx, &gbc,
+                                         obu->obu_size * 8 + start_pos - end_pos);
        if (err < 0)
            return err;
    }
@@ -1117,8 +1096,6 @@ static int cbs_av1_write_obu(CodedBitstreamContext *ctx,
    td = NULL;
    start_pos = put_bits_count(pbc);

-    priv->ref = (AV1ReferenceFrameState *)&priv->write_ref;
-
    switch (obu->header.obu_type) {
    case AV1_OBU_SEQUENCE_HEADER:
        {
@@ -1147,10 +1124,7 @@ static int cbs_av1_write_obu(CodedBitstreamContext *ctx,
    case AV1_OBU_REDUNDANT_FRAME_HEADER:
        {
            err = cbs_av1_write_frame_header_obu(ctx, pbc,
-                                                 &obu->obu.frame_header,
-                                                 obu->header.obu_type ==
-                                                 AV1_OBU_REDUNDANT_FRAME_HEADER,
-                                                 NULL);
+                                                 &obu->obu.frame_header);
            if (err < 0)
                return err;
        }
@@ -1167,7 +1141,7 @@ static int cbs_av1_write_obu(CodedBitstreamContext *ctx,
        break;
    case AV1_OBU_FRAME:
        {
-            err = cbs_av1_write_frame_obu(ctx, pbc, &obu->obu.frame, NULL);
+            err = cbs_av1_write_frame_obu(ctx, pbc, &obu->obu.frame);
            if (err < 0)
                return err;

@@ -1205,7 +1179,7 @@ static int cbs_av1_write_obu(CodedBitstreamContext *ctx,
        if (err < 0)
            return err;
        end_pos = put_bits_count(pbc);
-        obu->obu_size = header_size = (end_pos - start_pos + 7) / 8;
+        obu->obu_size = (end_pos - start_pos + 7) / 8;
    } else {
        // Empty OBU.
        obu->obu_size = 0;
@@ -1261,7 +1235,7 @@ static int cbs_av1_write_unit(CodedBitstreamContext *ctx,
        if (err < 0) {
            av_log(ctx->log_ctx, AV_LOG_ERROR, "Unable to allocate a "
                   "sufficiently large write buffer (last attempt "
-                   "%"SIZE_SPECIFIER" bytes).\n", priv->write_buffer_size);
+                   "%zu bytes).\n", priv->write_buffer_size);
            return err;
        }
    }
@@ -1328,7 +1302,6 @@ static void cbs_av1_close(CodedBitstreamContext *ctx)
    CodedBitstreamAV1Context *priv = ctx->priv_data;

    av_buffer_unref(&priv->sequence_header_ref);
-    av_buffer_unref(&priv->frame_header_ref);

    av_freep(&priv->write_buffer);
 }
@@ -87,8 +87,8 @@ typedef struct AV1RawSequenceHeader {
    uint8_t  seq_level_idx[AV1_MAX_OPERATING_POINTS];
    uint8_t  seq_tier[AV1_MAX_OPERATING_POINTS];
    uint8_t  decoder_model_present_for_this_op[AV1_MAX_OPERATING_POINTS];
-    uint32_t decoder_buffer_delay[AV1_MAX_OPERATING_POINTS];
-    uint32_t encoder_buffer_delay[AV1_MAX_OPERATING_POINTS];
+    uint8_t  decoder_buffer_delay[AV1_MAX_OPERATING_POINTS];
+    uint8_t  encoder_buffer_delay[AV1_MAX_OPERATING_POINTS];
    uint8_t  low_delay_mode_flag[AV1_MAX_OPERATING_POINTS];
    uint8_t  initial_display_delay_present_for_this_op[AV1_MAX_OPERATING_POINTS];
    uint8_t  initial_display_delay_minus_1[AV1_MAX_OPERATING_POINTS];
@@ -170,7 +170,7 @@ typedef struct AV1RawFrameHeader {
    uint8_t last_frame_idx;
    uint8_t golden_frame_idx;
    int8_t  ref_frame_idx[AV1_REFS_PER_FRAME];
-    uint32_t delta_frame_id_minus1[AV1_REFS_PER_FRAME];
+    uint8_t delta_frame_id_minus1;

    uint8_t allow_high_precision_mv;
    uint8_t is_filter_switchable;
@@ -210,7 +210,7 @@ typedef struct AV1RawFrameHeader {
    uint8_t segmentation_temporal_update;
    uint8_t segmentation_update_data;
    uint8_t feature_enabled[AV1_MAX_SEGMENTS][AV1_SEG_LVL_MAX];
-    int16_t feature_value[AV1_MAX_SEGMENTS][AV1_SEG_LVL_MAX];
+    uint8_t feature_value[AV1_MAX_SEGMENTS][AV1_SEG_LVL_MAX];

    uint8_t delta_q_present;
    uint8_t delta_q_res;
@@ -256,8 +256,8 @@ typedef struct AV1RawFrameHeader {
    uint8_t  update_grain;
    uint8_t  film_grain_params_ref_idx;
    uint8_t  num_y_points;
-    uint8_t  point_y_value[14];
-    uint8_t  point_y_scaling[14];
+    uint8_t  point_y_value[16];
+    uint8_t  point_y_scaling[16];
    uint8_t  chroma_scaling_from_luma;
    uint8_t  num_cb_points;
    uint8_t  point_cb_value[16];
@@ -268,8 +268,8 @@ typedef struct AV1RawFrameHeader {
    uint8_t  grain_scaling_minus_8;
    uint8_t  ar_coeff_lag;
    uint8_t  ar_coeffs_y_plus_128[24];
-    uint8_t  ar_coeffs_cb_plus_128[25];
-    uint8_t  ar_coeffs_cr_plus_128[25];
+    uint8_t  ar_coeffs_cb_plus_128[24];
+    uint8_t  ar_coeffs_cr_plus_128[24];
    uint8_t  ar_coeff_shift_minus_6;
    uint8_t  grain_scale_shift;
    uint8_t  cb_mult;
@@ -399,10 +399,7 @@ typedef struct CodedBitstreamAV1Context {
    AV1RawSequenceHeader *sequence_header;
    AVBufferRef          *sequence_header_ref;

-    int     seen_frame_header;
-    AVBufferRef *frame_header_ref;
-    uint8_t     *frame_header;
-    size_t       frame_header_size;
+    int seen_frame_header;

    int temporal_id;
    int spatial_id;
@@ -421,9 +418,7 @@ typedef struct CodedBitstreamAV1Context {
    int tile_cols;
    int tile_rows;

-    AV1ReferenceFrameState *ref;
-    AV1ReferenceFrameState read_ref[AV1_NUM_REF_FRAMES];
-    AV1ReferenceFrameState write_ref[AV1_NUM_REF_FRAMES];
+    AV1ReferenceFrameState ref[AV1_NUM_REF_FRAMES];

    // Write buffer.
    uint8_t *write_buffer;
@@ -419,17 +419,16 @@ static int FUNC(frame_size_with_refs)(CodedBitstreamContext *ctx, RWContext *rw,
    for (i = 0; i < AV1_REFS_PER_FRAME; i++) {
        flags(found_ref[i], 1, i);
        if (current->found_ref[i]) {
-            AV1ReferenceFrameState *ref;
+            AV1ReferenceFrameState *ref =
+                &priv->ref[current->ref_frame_idx[i]];

-            if (current->ref_frame_idx[i] < 0 ||
-                !priv->ref[current->ref_frame_idx[i]].valid) {
+            if (!ref->valid) {
                av_log(ctx->log_ctx, AV_LOG_ERROR,
                       "Missing reference frame needed for frame size "
                       "(ref = %d, ref_frame_idx = %d).\n",
                       i, current->ref_frame_idx[i]);
                return AVERROR_INVALIDDATA;
            }
-            ref = &priv->ref[current->ref_frame_idx[i]];

            priv->upscaled_width = ref->upscaled_width;
            priv->frame_width    = ref->frame_width;
@@ -882,7 +881,7 @@ static int FUNC(skip_mode_params)(CodedBitstreamContext *ctx, RWContext *rw,
        forward_idx  = -1;
        backward_idx = -1;
        for (i = 0; i < AV1_REFS_PER_FRAME; i++) {
-            ref_hint = priv->ref[current->ref_frame_idx[i]].order_hint;
+            ref_hint = priv->ref[i].order_hint;
            dist = cbs_av1_get_relative_dist(seq, ref_hint,
                                             current->order_hint);
            if (dist < 0) {
@@ -913,7 +912,7 @@ static int FUNC(skip_mode_params)(CodedBitstreamContext *ctx, RWContext *rw,

            second_forward_idx = -1;
            for (i = 0; i < AV1_REFS_PER_FRAME; i++) {
-                ref_hint = priv->ref[current->ref_frame_idx[i]].order_hint;
+                ref_hint = priv->ref[i].order_hint;
                if (cbs_av1_get_relative_dist(seq, ref_hint,
                                              forward_hint) < 0) {
                    if (second_forward_idx < 0 ||
@@ -1045,7 +1044,7 @@ static int FUNC(film_grain_params)(CodedBitstreamContext *ctx, RWContext *rw,
        return 0;
    }

-    fc(4, num_y_points, 0, 14);
+    fb(4, num_y_points);
    for (i = 0; i < current->num_y_points; i++) {
        fbs(8, point_y_value[i],   1, i);
        fbs(8, point_y_scaling[i], 1, i);
@@ -1324,8 +1323,8 @@ static int FUNC(uncompressed_header)(CodedBitstreamContext *ctx, RWContext *rw,
            if (!current->frame_refs_short_signaling)
                fbs(3, ref_frame_idx[i], 1, i);
            if (seq->frame_id_numbers_present_flag) {
-                fbs(seq->delta_frame_id_length_minus_2 + 2,
-                    delta_frame_id_minus1[i], 1, i);
+                fb(seq->delta_frame_id_length_minus_2 + 2,
+                   delta_frame_id_minus1);
            }
        }

@@ -1464,90 +1463,24 @@ static int FUNC(uncompressed_header)(CodedBitstreamContext *ctx, RWContext *rw,
 }

 static int FUNC(frame_header_obu)(CodedBitstreamContext *ctx, RWContext *rw,
-                                  AV1RawFrameHeader *current, int redundant,
-                                  AVBufferRef *rw_buffer_ref)
+                                  AV1RawFrameHeader *current)
 {
    CodedBitstreamAV1Context *priv = ctx->priv_data;
-    int start_pos, fh_bits, fh_bytes, err;
-    uint8_t *fh_start;
+    int err;
+
+    HEADER("Frame Header");

    if (priv->seen_frame_header) {
-        if (!redundant) {
-            av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid repeated "
-                   "frame header OBU.\n");
-            return AVERROR_INVALIDDATA;
-        } else {
-            GetBitContext fh;
-            size_t i, b;
-            uint32_t val;
-
-            HEADER("Redundant Frame Header");
-
-            av_assert0(priv->frame_header_ref && priv->frame_header);
-
-            init_get_bits(&fh, priv->frame_header,
-                          priv->frame_header_size);
-            for (i = 0; i < priv->frame_header_size; i += 8) {
-                b = FFMIN(priv->frame_header_size - i, 8);
-                val = get_bits(&fh, b);
-                xf(b, frame_header_copy[i],
-                   val, val, val, 1, i / 8);
-            }
-        }
+        // Nothing to do.
    } else {
-        if (redundant)
-            HEADER("Redundant Frame Header (used as Frame Header)");
-        else
-            HEADER("Frame Header");
-
        priv->seen_frame_header = 1;

-#ifdef READ
-        start_pos = get_bits_count(rw);
-#else
-        start_pos = put_bits_count(rw);
-#endif
-
        CHECK(FUNC(uncompressed_header)(ctx, rw, current));

        if (current->show_existing_frame) {
            priv->seen_frame_header = 0;
        } else {
            priv->seen_frame_header = 1;
-
-            av_buffer_unref(&priv->frame_header_ref);
-
-#ifdef READ
-            fh_bits  = get_bits_count(rw) - start_pos;
-            fh_start = (uint8_t*)rw->buffer + start_pos / 8;
-#else
-            // Need to flush the bitwriter so that we can copy its output,
-            // but use a copy so we don't affect the caller's structure.
-            {
-                PutBitContext tmp = *rw;
-                flush_put_bits(&tmp);
-            }
-
-            fh_bits  = put_bits_count(rw) - start_pos;
-            fh_start = rw->buf + start_pos / 8;
-#endif
-            fh_bytes = (fh_bits + 7) / 8;
-
-            priv->frame_header_size = fh_bits;
-
-            if (rw_buffer_ref) {
-                priv->frame_header_ref = av_buffer_ref(rw_buffer_ref);
-                if (!priv->frame_header_ref)
-                    return AVERROR(ENOMEM);
-                priv->frame_header = fh_start;
-            } else {
-                priv->frame_header_ref =
-                    av_buffer_alloc(fh_bytes + AV_INPUT_BUFFER_PADDING_SIZE);
-                if (!priv->frame_header_ref)
-                    return AVERROR(ENOMEM);
-                priv->frame_header = priv->frame_header_ref->data;
-                memcpy(priv->frame_header, fh_start, fh_bytes);
-            }
        }
    }

@@ -1591,13 +1524,11 @@ static int FUNC(tile_group_obu)(CodedBitstreamContext *ctx, RWContext *rw,
 }

 static int FUNC(frame_obu)(CodedBitstreamContext *ctx, RWContext *rw,
-                           AV1RawFrame *current,
-                           AVBufferRef *rw_buffer_ref)
+                           AV1RawFrame *current)
 {
    int err;

-    CHECK(FUNC(frame_header_obu)(ctx, rw, &current->header,
-                                 0, rw_buffer_ref));
+    CHECK(FUNC(frame_header_obu)(ctx, rw, &current->header));

    CHECK(FUNC(byte_alignment)(ctx, rw));

@@ -1638,18 +1569,15 @@ static int FUNC(metadata_hdr_mdcv)(CodedBitstreamContext *ctx, RWContext *rw,
    int err, i;

    for (i = 0; i < 3; i++) {
-        fbs(16, primary_chromaticity_x[i], 1, i);
-        fbs(16, primary_chromaticity_y[i], 1, i);
+        fcs(16, primary_chromaticity_x[i], 0, 50000, 1, i);
+        fcs(16, primary_chromaticity_y[i], 0, 50000, 1, i);
    }

-    fb(16, white_point_chromaticity_x);
-    fb(16, white_point_chromaticity_y);
+    fc(16, white_point_chromaticity_x, 0, 50000);
+    fc(16, white_point_chromaticity_y, 0, 50000);

    fc(32, luminance_max, 1, MAX_UINT_BITS(32));
-    // luminance_min must be lower than luminance_max. Convert luminance_max from
-    // 24.8 fixed point to 18.14 fixed point in order to compare them.
-    fc(32, luminance_min, 0, FFMIN(((uint64_t)current->luminance_max << 6) - 1,
-                                   MAX_UINT_BITS(32)));
+    fc(32, luminance_min, 0, current->luminance_max >> 6);

    return 0;
 }
@@ -253,7 +253,7 @@ typedef struct H264RawSEIPicTimestamp {
    uint8_t minutes_value;
    uint8_t hours_flag;
    uint8_t hours_value;
-    int32_t time_offset;
+    uint32_t time_offset;
 } H264RawSEIPicTimestamp;

 typedef struct H264RawSEIPicTiming {
@@ -255,8 +255,6 @@ static int cbs_write_se_golomb(CodedBitstreamContext *ctx, PutBitContext *pbc,
 #define flag(name) u(1, name, 0, 1)
 #define ue(name, range_min, range_max) \
        xue(name, current->name, range_min, range_max, 0)
-#define i(width, name, range_min, range_max) \
-        xi(width, name, current->name, range_min, range_max, 0)
 #define se(name, range_min, range_max) \
        xse(name, current->name, range_min, range_max, 0)

@@ -266,8 +264,6 @@ static int cbs_write_se_golomb(CodedBitstreamContext *ctx, PutBitContext *pbc,
        xu(1, name, current->name, 0, 1, subs, __VA_ARGS__)
 #define ues(name, range_min, range_max, subs, ...) \
        xue(name, current->name, range_min, range_max, subs, __VA_ARGS__)
-#define is(width, name, range_min, range_max, subs, ...) \
-        xi(width, name, current->name, range_min, range_max, subs, __VA_ARGS__)
 #define ses(name, range_min, range_max, subs, ...) \
        xse(name, current->name, range_min, range_max, subs, __VA_ARGS__)

@@ -295,13 +291,6 @@ static int cbs_write_se_golomb(CodedBitstreamContext *ctx, PutBitContext *pbc,
                                 &value, range_min, range_max)); \
        var = value; \
    } while (0)
-#define xi(width, name, var, range_min, range_max, subs, ...) do { \
-        int32_t value = range_min; \
-        CHECK(ff_cbs_read_signed(ctx, rw, width, #name, \
-                                 SUBSCRIPTS(subs, __VA_ARGS__), \
-                                 &value, range_min, range_max)); \
-        var = value; \
-    } while (0)
 #define xse(name, var, range_min, range_max, subs, ...) do { \
        int32_t value = range_min; \
        CHECK(cbs_read_se_golomb(ctx, rw, #name, \
@@ -320,11 +309,9 @@ static int cbs_h2645_read_more_rbsp_data(GetBitContext *gbc)
    int bits_left = get_bits_left(gbc);
    if (bits_left > 8)
        return 1;
-    if (bits_left == 0)
+    if (show_bits(gbc, bits_left) == 1 << (bits_left - 1))
        return 0;
-    if (show_bits(gbc, bits_left) & MAX_UINT_BITS(bits_left - 1))
-        return 1;
-    return 0;
+    return 1;
 }

 #define more_rbsp_data(var) ((var) = cbs_h2645_read_more_rbsp_data(rw))
@@ -351,7 +338,6 @@ static int cbs_h2645_read_more_rbsp_data(GetBitContext *gbc)
 #undef READWRITE
 #undef RWContext
 #undef xu
-#undef xi
 #undef xue
 #undef xse
 #undef infer
@@ -376,12 +362,6 @@ static int cbs_h2645_read_more_rbsp_data(GetBitContext *gbc)
                                  SUBSCRIPTS(subs, __VA_ARGS__), \
                                  value, range_min, range_max)); \
    } while (0)
-#define xi(width, name, var, range_min, range_max, subs, ...) do { \
-        int32_t value = var; \
-        CHECK(ff_cbs_write_signed(ctx, rw, width, #name, \
-                                  SUBSCRIPTS(subs, __VA_ARGS__), \
-                                  value, range_min, range_max)); \
-    } while (0)
 #define xse(name, var, range_min, range_max, subs, ...) do { \
        int32_t value = var; \
        CHECK(cbs_write_se_golomb(ctx, rw, #name, \
@@ -422,11 +402,9 @@ static int cbs_h2645_read_more_rbsp_data(GetBitContext *gbc)
 #undef READWRITE
 #undef RWContext
 #undef xu
-#undef xi
 #undef xue
 #undef xse
 #undef u
-#undef i
 #undef flag
 #undef ue
 #undef se
@@ -137,10 +137,6 @@ static int FUNC(vui_parameters)(CodedBitstreamContext *ctx, RWContext *rw,
            u(8, colour_primaries,         0, 255);
            u(8, transfer_characteristics, 0, 255);
            u(8, matrix_coefficients,      0, 255);
-        } else {
-            infer(colour_primaries,         2);
-            infer(transfer_characteristics, 2);
-            infer(matrix_coefficients,      2);
        }
    } else {
        infer(video_format,             5);
@@ -596,9 +592,8 @@ static int FUNC(sei_pic_timestamp)(CodedBitstreamContext *ctx, RWContext *rw,
        time_offset_length = 24;

    if (time_offset_length > 0)
-        i(time_offset_length, time_offset,
-          MIN_INT_BITS(time_offset_length),
-          MAX_INT_BITS(time_offset_length));
+        u(time_offset_length, time_offset,
+          0, MAX_UINT_BITS(time_offset_length));
    else
        infer(time_offset, 0);

@@ -1195,10 +1190,11 @@ static int FUNC(slice_header)(CodedBitstreamContext *ctx, RWContext *rw,
                   "in the same access unit.\n");
            return AVERROR_INVALIDDATA;
        }
-        idr_pic_flag = h264->last_slice_nal_unit_type == H264_NAL_IDR_SLICE;
    } else {
-        idr_pic_flag = current->nal_unit_header.nal_unit_type == H264_NAL_IDR_SLICE;
+        h264->last_slice_nal_unit_type =
+            current->nal_unit_header.nal_unit_type;
    }
+    idr_pic_flag = h264->last_slice_nal_unit_type == H264_NAL_IDR_SLICE;

    ue(first_mb_in_slice, 0, H264_MAX_MB_PIC_SIZE - 1);
    ue(slice_type, 0, 9);
@@ -1276,13 +1272,6 @@ static int FUNC(slice_header)(CodedBitstreamContext *ctx, RWContext *rw,

    if (pps->redundant_pic_cnt_present_flag)
        ue(redundant_pic_cnt, 0, 127);
-    else
-        infer(redundant_pic_cnt, 0);
-
-    if (current->nal_unit_header.nal_unit_type != H264_NAL_AUXILIARY_SLICE
-        && !current->redundant_pic_cnt)
-        h264->last_slice_nal_unit_type =
-            current->nal_unit_header.nal_unit_type;

    if (slice_type_b)
        flag(direct_spatial_mv_pred_flag);
@@ -81,28 +81,10 @@ int ff_cbs_write_unsigned(CodedBitstreamContext *ctx, PutBitContext *pbc,
                          const int *subscripts, uint32_t value,
                          uint32_t range_min, uint32_t range_max);

-int ff_cbs_read_signed(CodedBitstreamContext *ctx, GetBitContext *gbc,
-                       int width, const char *name,
-                       const int *subscripts, int32_t *write_to,
-                       int32_t range_min, int32_t range_max);
-
-int ff_cbs_write_signed(CodedBitstreamContext *ctx, PutBitContext *pbc,
-                        int width, const char *name,
-                        const int *subscripts, int32_t value,
-                        int32_t range_min, int32_t range_max);
-
-// The largest unsigned value representable in N bits, suitable for use as
+// The largest value representable in N bits, suitable for use as
 // range_max in the above functions.
 #define MAX_UINT_BITS(length) ((UINT64_C(1) << (length)) - 1)

-// The largest signed value representable in N bits, suitable for use as
-// range_max in the above functions.
-#define MAX_INT_BITS(length) ((INT64_C(1) << ((length) - 1)) - 1)
-
-// The smallest signed value representable in N bits, suitable for use as
-// range_min in the above functions.
-#define MIN_INT_BITS(length) (-(INT64_C(1) << ((length) - 1)))
-

 extern const CodedBitstreamType ff_cbs_type_av1;
 extern const CodedBitstreamType ff_cbs_type_h264;
@@ -41,35 +41,20 @@
 #define SUBSCRIPTS(subs, ...) (subs > 0 ? ((int[subs + 1]){ subs, __VA_ARGS__ }) : NULL)

 #define ui(width, name) \
-        xui(width, name, current->name, 0, MAX_UINT_BITS(width), 0)
-#define uir(width, name) \
-        xui(width, name, current->name, 1, MAX_UINT_BITS(width), 0)
+        xui(width, name, current->name, 0)
 #define uis(width, name, subs, ...) \
-        xui(width, name, current->name, 0, MAX_UINT_BITS(width), subs, __VA_ARGS__)
-#define uirs(width, name, subs, ...) \
-        xui(width, name, current->name, 1, MAX_UINT_BITS(width), subs, __VA_ARGS__)
-#define sis(width, name, subs, ...) \
-        xsi(width, name, current->name, subs, __VA_ARGS__)
+        xui(width, name, current->name, subs, __VA_ARGS__)


 #define READ
 #define READWRITE read
 #define RWContext GetBitContext

-#define xui(width, name, var, range_min, range_max, subs, ...) do { \
+#define xui(width, name, var, subs, ...) do { \
        uint32_t value = 0; \
        CHECK(ff_cbs_read_unsigned(ctx, rw, width, #name, \
                                   SUBSCRIPTS(subs, __VA_ARGS__), \
-                                   &value, range_min, range_max)); \
-        var = value; \
-    } while (0)
-
-#define xsi(width, name, var, subs, ...) do { \
-        int32_t value; \
-        CHECK(ff_cbs_read_signed(ctx, rw, width, #name, \
-                                 SUBSCRIPTS(subs, __VA_ARGS__), &value, \
-                                 MIN_INT_BITS(width), \
-                                 MAX_INT_BITS(width))); \
+                                   &value, 0, (1 << width) - 1)); \
        var = value; \
    } while (0)

@@ -88,7 +73,6 @@
 #undef READWRITE
 #undef RWContext
 #undef xui
-#undef xsi
 #undef marker_bit
 #undef nextbits

@@ -97,17 +81,10 @@
 #define READWRITE write
 #define RWContext PutBitContext

-#define xui(width, name, var, range_min, range_max, subs, ...) do { \
+#define xui(width, name, var, subs, ...) do { \
        CHECK(ff_cbs_write_unsigned(ctx, rw, width, #name, \
                                    SUBSCRIPTS(subs, __VA_ARGS__), \
-                                    var, range_min, range_max)); \
-    } while (0)
-
-#define xsi(width, name, var, subs, ...) do { \
-        CHECK(ff_cbs_write_signed(ctx, rw, width, #name, \
-                                  SUBSCRIPTS(subs, __VA_ARGS__), var, \
-                                  MIN_INT_BITS(width), \
-                                  MAX_INT_BITS(width))); \
+                                    var, 0, (1 << width) - 1)); \
    } while (0)

 #define marker_bit() do { \
@@ -122,7 +99,6 @@
 #undef READWRITE
 #undef RWContext
 #undef xui
-#undef xsi
 #undef marker_bit
 #undef nextbits

@@ -164,8 +164,8 @@ typedef struct MPEG2RawQuantMatrixExtension {
 } MPEG2RawQuantMatrixExtension;

 typedef struct MPEG2RawPictureDisplayExtension {
-    int16_t frame_centre_horizontal_offset[3];
-    int16_t frame_centre_vertical_offset[3];
+    uint16_t frame_centre_horizontal_offset[3];
+    uint16_t frame_centre_vertical_offset[3];
 } MPEG2RawPictureDisplayExtension;

 typedef struct MPEG2RawExtensionData {
@@ -26,14 +26,14 @@ static int FUNC(sequence_header)(CodedBitstreamContext *ctx, RWContext *rw,

    ui(8,  sequence_header_code);

-    uir(12, horizontal_size_value);
-    uir(12, vertical_size_value);
+    ui(12, horizontal_size_value);
+    ui(12, vertical_size_value);

    mpeg2->horizontal_size = current->horizontal_size_value;
    mpeg2->vertical_size   = current->vertical_size_value;

-    uir(4, aspect_ratio_information);
-    uir(4, frame_rate_code);
+    ui(4,  aspect_ratio_information);
+    ui(4,  frame_rate_code);
    ui(18, bit_rate_value);

    marker_bit();
@@ -44,13 +44,13 @@ static int FUNC(sequence_header)(CodedBitstreamContext *ctx, RWContext *rw,
    ui(1, load_intra_quantiser_matrix);
    if (current->load_intra_quantiser_matrix) {
        for (i = 0; i < 64; i++)
-            uirs(8, intra_quantiser_matrix[i], 1, i);
+            uis(8, intra_quantiser_matrix[i], 1, i);
    }

    ui(1, load_non_intra_quantiser_matrix);
    if (current->load_non_intra_quantiser_matrix) {
        for (i = 0; i < 64; i++)
-            uirs(8, non_intra_quantiser_matrix[i], 1, i);
+            uis(8, non_intra_quantiser_matrix[i], 1, i);
    }

    return 0;
@@ -79,7 +79,7 @@ static int FUNC(user_data)(CodedBitstreamContext *ctx, RWContext *rw,
 #endif

    for (k = 0; k < current->user_data_length; k++)
-        uis(8, user_data[k], 1, k);
+        xui(8, user_data, current->user_data[k], 0);

    return 0;
 }
@@ -125,25 +125,9 @@ static int FUNC(sequence_display_extension)(CodedBitstreamContext *ctx, RWContex

    ui(1, colour_description);
    if (current->colour_description) {
-#ifdef READ
-#define READ_AND_PATCH(name) do { \
-        ui(8, name); \
-        if (current->name == 0) { \
-            current->name = 2; \
-            av_log(ctx->log_ctx, AV_LOG_WARNING, "%s in a sequence display " \
-                   "extension had the invalid value 0. Setting it to 2 " \
-                   "(meaning unknown) instead.\n", #name); \
-        } \
-    } while (0)
-        READ_AND_PATCH(colour_primaries);
-        READ_AND_PATCH(transfer_characteristics);
-        READ_AND_PATCH(matrix_coefficients);
-#undef READ_AND_PATCH
-#else
-        uir(8, colour_primaries);
-        uir(8, transfer_characteristics);
-        uir(8, matrix_coefficients);
-#endif
+        ui(8, colour_primaries);
+        ui(8, transfer_characteristics);
+        ui(8, matrix_coefficients);
    }

    ui(14, display_horizontal_size);
@@ -179,7 +163,7 @@ static int FUNC(picture_header)(CodedBitstreamContext *ctx, RWContext *rw,
    ui(8,  picture_start_code);

    ui(10, temporal_reference);
-    uir(3, picture_coding_type);
+    ui(3,  picture_coding_type);
    ui(16, vbv_delay);

    if (current->picture_coding_type == 2 ||
@@ -206,10 +190,10 @@ static int FUNC(picture_coding_extension)(CodedBitstreamContext *ctx, RWContext

    HEADER("Picture Coding Extension");

-    uir(4, f_code[0][0]);
-    uir(4, f_code[0][1]);
-    uir(4, f_code[1][0]);
-    uir(4, f_code[1][1]);
+    ui(4, f_code[0][0]);
+    ui(4, f_code[0][1]);
+    ui(4, f_code[1][0]);
+    ui(4, f_code[1][1]);

    ui(2, intra_dc_precision);
    ui(2, picture_structure);
@@ -266,25 +250,25 @@ static int FUNC(quant_matrix_extension)(CodedBitstreamContext *ctx, RWContext *r
    ui(1, load_intra_quantiser_matrix);
    if (current->load_intra_quantiser_matrix) {
        for (i = 0; i < 64; i++)
-            uirs(8, intra_quantiser_matrix[i], 1, i);
+            uis(8, intra_quantiser_matrix[i], 1, i);
    }

    ui(1, load_non_intra_quantiser_matrix);
    if (current->load_non_intra_quantiser_matrix) {
        for (i = 0; i < 64; i++)
-            uirs(8, non_intra_quantiser_matrix[i], 1, i);
+            uis(8, non_intra_quantiser_matrix[i], 1, i);
    }

    ui(1, load_chroma_intra_quantiser_matrix);
    if (current->load_chroma_intra_quantiser_matrix) {
        for (i = 0; i < 64; i++)
-            uirs(8, intra_quantiser_matrix[i], 1, i);
+            uis(8, intra_quantiser_matrix[i], 1, i);
    }

    ui(1, load_chroma_non_intra_quantiser_matrix);
    if (current->load_chroma_non_intra_quantiser_matrix) {
        for (i = 0; i < 64; i++)
-            uirs(8, chroma_non_intra_quantiser_matrix[i], 1, i);
+            uis(8, chroma_non_intra_quantiser_matrix[i], 1, i);
    }

    return 0;
@@ -299,9 +283,9 @@ static int FUNC(picture_display_extension)(CodedBitstreamContext *ctx, RWContext
    HEADER("Picture Display Extension");

    for (i = 0; i < mpeg2->number_of_frame_centre_offsets; i++) {
-        sis(16, frame_centre_horizontal_offset[i], 1, i);
+        ui(16, frame_centre_horizontal_offset[i]);
        marker_bit();
-        sis(16, frame_centre_vertical_offset[i],   1, i);
+        ui(16, frame_centre_vertical_offset[i]);
        marker_bit();
    }

@@ -358,7 +342,7 @@ static int FUNC(slice_header)(CodedBitstreamContext *ctx, RWContext *rw,
            ui(7, priority_breakpoint);
    }

-    uir(5, quantiser_scale_code);
+    ui(5, quantiser_scale_code);

    if (nextbits(1, 1, current->slice_extension_flag)) {
        ui(1, slice_extension_flag);
@@ -377,22 +361,21 @@ static int FUNC(slice_header)(CodedBitstreamContext *ctx, RWContext *rw,
            current->extra_information_length = k;
            if (k > 0) {
                *rw = start;
-                current->extra_information_ref =
-                    av_buffer_alloc(current->extra_information_length);
-                if (!current->extra_information_ref)
+                current->extra_information =
+                    av_malloc(current->extra_information_length);
+                if (!current->extra_information)
                    return AVERROR(ENOMEM);
-                current->extra_information = current->extra_information_ref->data;
                for (k = 0; k < current->extra_information_length; k++) {
-                    xui(1, extra_bit_slice, bit, 1, 1, 0);
+                    xui(1, extra_bit_slice, bit, 0);
                    xui(8, extra_information_slice[k],
-                        current->extra_information[k], 0, 255, 1, k);
+                        current->extra_information[k], 1, k);
                }
            }
 #else
            for (k = 0; k < current->extra_information_length; k++) {
-                xui(1, extra_bit_slice, 1, 1, 1, 0);
+                xui(1, extra_bit_slice, 1, 0);
                xui(8, extra_information_slice[k],
-                    current->extra_information[k], 0, 255, 1, k);
+                    current->extra_information[k], 1, k);
            }
 #endif
        }
@@ -305,7 +305,7 @@ static int cbs_vp9_write_le(CodedBitstreamContext *ctx, PutBitContext *pbc,

 #define prob(name, subs, ...) do { \
        uint8_t prob_coded; \
-        uint8_t prob; \
+        int8_t prob; \
        xf(1, name.prob_coded, prob_coded, subs, __VA_ARGS__); \
        if (prob_coded) \
            xf(8, name.prob, prob, subs, __VA_ARGS__); \
@@ -416,9 +416,6 @@ static int cbs_vp9_split_fragment(CodedBitstreamContext *ctx,
    uint8_t superframe_header;
    int err;

-    if (frag->data_size == 0)
-        return AVERROR_INVALIDDATA;
-
    // Last byte in the packet.
    superframe_header = frag->data[frag->data_size - 1];

@@ -431,9 +428,6 @@ static int cbs_vp9_split_fragment(CodedBitstreamContext *ctx,
        index_size = 2 + (((superframe_header & 0x18) >> 3) + 1) *
                          ((superframe_header & 0x07) + 1);

-        if (index_size > frag->data_size)
-            return AVERROR_INVALIDDATA;
-
        err = init_get_bits(&gbc, frag->data + frag->data_size - index_size,
                            8 * index_size);
        if (err < 0)
@@ -463,7 +457,7 @@ static int cbs_vp9_split_fragment(CodedBitstreamContext *ctx,
        }
        if (pos + index_size != frag->data_size) {
            av_log(ctx->log_ctx, AV_LOG_WARNING, "Extra padding at "
-                   "end of superframe: %"SIZE_SPECIFIER" bytes.\n",
+                   "end of superframe: %zu bytes.\n",
                   frag->data_size - (pos + index_size));
        }

@@ -544,7 +538,7 @@ static int cbs_vp9_write_unit(CodedBitstreamContext *ctx,
        if (err < 0) {
            av_log(ctx->log_ctx, AV_LOG_ERROR, "Unable to allocate a "
                   "sufficiently large write buffer (last attempt "
-                   "%"SIZE_SPECIFIER" bytes).\n", priv->write_buffer_size);
+                   "%zu bytes).\n", priv->write_buffer_size);
            return err;
        }
    }
@@ -212,10 +212,10 @@ static const unsigned char pac2_attribs[32][3] = // Color, font, ident

 struct Screen {
    /* +1 is used to compensate null character of string */
-    uint8_t characters[SCREEN_ROWS+1][SCREEN_COLUMNS+1];
-    uint8_t charsets[SCREEN_ROWS+1][SCREEN_COLUMNS+1];
-    uint8_t colors[SCREEN_ROWS+1][SCREEN_COLUMNS+1];
-    uint8_t fonts[SCREEN_ROWS+1][SCREEN_COLUMNS+1];
+    uint8_t characters[SCREEN_ROWS][SCREEN_COLUMNS+1];
+    uint8_t charsets[SCREEN_ROWS][SCREEN_COLUMNS+1];
+    uint8_t colors[SCREEN_ROWS][SCREEN_COLUMNS+1];
+    uint8_t fonts[SCREEN_ROWS][SCREEN_COLUMNS+1];
    /*
     * Bitmask of used rows; if a bit is not set, the
     * corresponding row is not used.
@@ -81,8 +81,11 @@ static av_cold int cdg_decode_init(AVCodecContext *avctx)
        return AVERROR(ENOMEM);
    cc->transparency = -1;

+    avctx->width   = CDG_FULL_WIDTH;
+    avctx->height  = CDG_FULL_HEIGHT;
    avctx->pix_fmt = AV_PIX_FMT_PAL8;
-    return ff_set_dimensions(avctx, CDG_FULL_WIDTH, CDG_FULL_HEIGHT);
+
+    return 0;
 }

 static void cdg_border_preset(CDGraphicsContext *cc, uint8_t *data)
@@ -555,9 +555,6 @@ static int clv_decode_frame(AVCodecContext *avctx, void *data,
    } else {
        int plane;

-        if (c->pmb_width * c->pmb_height > 8LL*(buf_size - bytestream2_tell(&gb)))
-            return AVERROR_INVALIDDATA;
-
        if ((ret = ff_reget_buffer(avctx, c->pic)) < 0)
            return ret;

@@ -573,8 +570,6 @@ static int clv_decode_frame(AVCodecContext *avctx, void *data,

        for (j = 0; j < c->pmb_height; j++) {
            for (i = 0; i < c->pmb_width; i++) {
-                if (get_bits_left(&c->gb) <= 0)
-                    return AVERROR_INVALIDDATA;
                if (get_bits1(&c->gb)) {
                    MV mv = mvi_predict(&c->mvi, i, j, zero_mv);

@@ -665,7 +660,7 @@ static av_cold int clv_decode_init(AVCodecContext *avctx)
    }

    c->tile_shift = av_log2(c->tile_size);
-    if (1U << c->tile_shift != c->tile_size) {
+    if (1 << c->tile_shift != c->tile_size) {
        av_log(avctx, AV_LOG_ERROR, "Tile size: %d, is not power of 2.\n", c->tile_size);
        return AVERROR_INVALIDDATA;
    }
@@ -174,5 +174,5 @@ AVCodec ff_comfortnoise_decoder = {
    .close          = cng_decode_close,
    .sample_fmts    = (const enum AVSampleFormat[]){ AV_SAMPLE_FMT_S16,
                                                     AV_SAMPLE_FMT_NONE },
-    .capabilities   = AV_CODEC_CAP_DR1,
+    .capabilities   = AV_CODEC_CAP_DELAY | AV_CODEC_CAP_DR1,
 };
@@ -143,7 +143,7 @@ typedef struct cook {

    /* generate tables and related variables */
    int                 gain_size_factor;
-    float               gain_table[31];
+    float               gain_table[23];

    /* data buffers */

@@ -185,8 +185,8 @@ static av_cold void init_gain_table(COOKContext *q)
 {
    int i;
    q->gain_size_factor = q->samples_per_channel / 8;
-    for (i = 0; i < 31; i++)
-        q->gain_table[i] = pow(pow2tab[i + 48],
+    for (i = 0; i < 23; i++)
+        q->gain_table[i] = pow(pow2tab[i + 52],
                               (1.0 / (double) q->gain_size_factor));
 }

@@ -670,7 +670,7 @@ static void interpolate_float(COOKContext *q, float *buffer,
        for (i = 0; i < q->gain_size_factor; i++)
            buffer[i] *= fc1;
    } else {                                        // smooth gain
-        fc2 = q->gain_table[15 + (gain_index_next - gain_index)];
+        fc2 = q->gain_table[11 + (gain_index_next - gain_index)];
        for (i = 0; i < q->gain_size_factor; i++) {
            buffer[i] *= fc1;
            fc1       *= fc2;
@@ -759,7 +759,7 @@ static int decouple_info(COOKContext *q, COOKSubpacket *p, int *decouple_tab)
        for (i = 0; i < length; i++)
            decouple_tab[start + i] = get_vlc2(&q->gb,
                                               p->channel_coupling.table,
-                                               p->channel_coupling.bits, 3);
+                                               p->channel_coupling.bits, 2);
    else
        for (i = 0; i < length; i++) {
            int v = get_bits(&q->gb, p->js_vlc_bits);
@@ -1075,9 +1075,6 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)
        return AVERROR_INVALIDDATA;
    }

-    if (avctx->block_align >= INT_MAX / 8)
-        return AVERROR(EINVAL);
-
    /* Initialize RNG. */
    av_lfg_init(&q->random_state, 0);

@@ -1220,15 +1217,6 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)
            return AVERROR_PATCHWELCOME;
        }
    }
-
-    /* Try to catch some obviously faulty streams, otherwise it might be exploitable */
-    if (q->samples_per_channel != 256 && q->samples_per_channel != 512 &&
-        q->samples_per_channel != 1024) {
-        avpriv_request_sample(avctx, "samples_per_channel = %d",
-                              q->samples_per_channel);
-        return AVERROR_PATCHWELCOME;
-    }
-
    /* Generate tables */
    init_pow2table();
    init_gain_table(q);
@@ -1237,6 +1225,10 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)
    if ((ret = init_cook_vlc_tables(q)))
        return ret;

+
+    if (avctx->block_align >= UINT_MAX / 2)
+        return AVERROR(EINVAL);
+
    /* Pad the databuffer with:
       DECODE_BYTES_PAD1 or DECODE_BYTES_PAD2 for decode_bytes(),
       AV_INPUT_BUFFER_PADDING_SIZE, for the bitstreamreader. */
@@ -1260,6 +1252,14 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)
        q->saturate_output = saturate_output_float;
    }

+    /* Try to catch some obviously faulty streams, otherwise it might be exploitable */
+    if (q->samples_per_channel != 256 && q->samples_per_channel != 512 &&
+        q->samples_per_channel != 1024) {
+        avpriv_request_sample(avctx, "samples_per_channel = %d",
+                              q->samples_per_channel);
+        return AVERROR_PATCHWELCOME;
+    }
+
    avctx->sample_fmt = AV_SAMPLE_FMT_FLTP;
    if (channel_mask)
        avctx->channel_layout = channel_mask;
@@ -63,7 +63,7 @@ static int cpia_decode_frame(AVCodecContext *avctx,
    uint8_t *y, *u, *v, *y_end, *u_end, *v_end;

    // Check header
-    if ( avpkt->size < FRAME_HEADER_SIZE + avctx->height * 3
+    if ( avpkt->size < FRAME_HEADER_SIZE
      || header[0] != MAGIC_0 || header[1] != MAGIC_1
      || (header[17] != SUBSAMPLE_420 && header[17] != SUBSAMPLE_422)
      || (header[18] != YUVORDER_YUYV && header[18] != YUVORDER_UYVY)
@@ -70,7 +70,6 @@ typedef struct CuvidContext
    int deint_mode;
    int deint_mode_current;
    int64_t prev_pts;
-    int progressive_sequence;

    int internal_error;
    int decoder_flushing;
@@ -229,8 +228,6 @@ static int CUDAAPI cuvid_handle_video_sequence(void *opaque, CUVIDEOFORMAT* form
                              ? cudaVideoDeinterlaceMode_Weave
                              : ctx->deint_mode;

-    ctx->progressive_sequence = format->progressive_sequence;
-
    if (!format->progressive_sequence && ctx->deint_mode_current == cudaVideoDeinterlaceMode_Weave)
        avctx->flags |= AV_CODEC_FLAG_INTERLACED_DCT;
    else
@@ -363,9 +360,6 @@ static int CUDAAPI cuvid_handle_picture_display(void *opaque, CUVIDPARSERDISPINF
    parsed_frame.dispinfo = *dispinfo;
    ctx->internal_error = 0;

-    // For some reason, dispinfo->progressive_frame is sometimes wrong.
-    parsed_frame.dispinfo.progressive_frame = ctx->progressive_sequence;
-
    if (ctx->deint_mode_current == cudaVideoDeinterlaceMode_Weave) {
        av_fifo_generic_write(ctx->frame_queue, &parsed_frame, sizeof(CuvidParsedFrame), NULL);
    } else {
@@ -613,7 +613,6 @@ static int dds_decode(AVCodecContext *avctx, void *data,
    AVFrame *frame = data;
    int mipmap;
    int ret;
-    int width, height;

    ff_texturedsp_init(&ctx->texdsp);
    bytestream2_init(gbc, avpkt->data, avpkt->size);
@@ -632,9 +631,9 @@ static int dds_decode(AVCodecContext *avctx, void *data,

    bytestream2_skip(gbc, 4); // flags

-    height = bytestream2_get_le32(gbc);
-    width  = bytestream2_get_le32(gbc);
-    ret = ff_set_dimensions(avctx, width, height);
+    avctx->height = bytestream2_get_le32(gbc);
+    avctx->width  = bytestream2_get_le32(gbc);
+    ret = av_image_check_size(avctx->width, avctx->height, 0, avctx);
    if (ret < 0) {
        av_log(avctx, AV_LOG_ERROR, "Invalid image size %dx%d.\n",
               avctx->width, avctx->height);
@@ -355,8 +355,6 @@ static int dfa_decode_frame(AVCodecContext *avctx,

    bytestream2_init(&gb, avpkt->data, avpkt->size);
    while (bytestream2_get_bytes_left(&gb) > 0) {
-        if (bytestream2_get_bytes_left(&gb) < 12)
-            return AVERROR_INVALIDDATA;
        bytestream2_skip(&gb, 4);
        chunk_size = bytestream2_get_le32(&gb);
        chunk_type = bytestream2_get_le32(&gb);
@@ -212,7 +212,7 @@ static int dirac_combine_frame(AVCodecParserContext *s, AVCodecContext *avctx,
        if (parse_timing_info && pu1.prev_pu_offset >= 13) {
            uint8_t *cur_pu = pc->buffer +
                              pc->index - 13 - pu1.prev_pu_offset;
-            int64_t pts = AV_RB32(cur_pu + 13);
+            int pts = AV_RB32(cur_pu + 13);
            if (s->last_pts == 0 && s->last_dts == 0)
                s->dts = pts - 1;
            else
@@ -676,11 +676,6 @@ static int decode_component(DiracContext *s, int comp)
            b->length = get_interleaved_ue_golomb(&s->gb);
            if (b->length) {
                b->quant = get_interleaved_ue_golomb(&s->gb);
-                if (b->quant > (DIRAC_MAX_QUANT_INDEX - 1)) {
-                    av_log(s->avctx, AV_LOG_ERROR, "Unsupported quant %d\n", b->quant);
-                    b->quant = 0;
-                    return AVERROR_INVALIDDATA;
-                }
                align_get_bits(&s->gb);
                b->coeff_data = s->gb.buffer + get_bits_count(&s->gb)/8;
                b->length = FFMIN(b->length, FFMAX(get_bits_left(&s->gb)/8, 0));
@@ -1271,9 +1266,7 @@ static int dirac_unpack_idwt_params(DiracContext *s)
        s->num_y        = get_interleaved_ue_golomb(gb);
        if (s->num_x * s->num_y == 0 || s->num_x * (uint64_t)s->num_y > INT_MAX ||
            s->num_x * (uint64_t)s->avctx->width  > INT_MAX ||
-            s->num_y * (uint64_t)s->avctx->height > INT_MAX ||
-            s->num_x > s->avctx->width ||
-            s->num_y > s->avctx->height
+            s->num_y * (uint64_t)s->avctx->height > INT_MAX
        ) {
            av_log(s->avctx,AV_LOG_ERROR,"Invalid numx/y\n");
            s->num_x = s->num_y = 0;
@@ -1429,9 +1422,9 @@ static void global_mv(DiracContext *s, DiracBlock *block, int x, int y, int ref)
    int *b      = s->globalmc[ref].pan_tilt;
    int *c      = s->globalmc[ref].perspective;

-    int64_t m   = (1<<ep) - (c[0]*(int64_t)x + c[1]*(int64_t)y);
-    int64_t mx  = m * (int64_t)((A[0][0] * (int64_t)x + A[0][1]*(int64_t)y) + (1LL<<ez) * b[0]);
-    int64_t my  = m * (int64_t)((A[1][0] * (int64_t)x + A[1][1]*(int64_t)y) + (1LL<<ez) * b[1]);
+    int m       = (1<<ep) - (c[0]*x + c[1]*y);
+    int64_t mx  = m * (int64_t)((A[0][0] * (int64_t)x + A[0][1]*(int64_t)y) + (1<<ez) * b[0]);
+    int64_t my  = m * (int64_t)((A[1][0] * (int64_t)x + A[1][1]*(int64_t)y) + (1<<ez) * b[1]);

    block->u.mv[ref][0] = (mx + (1<<(ez+ep))) >> (ez+ep);
    block->u.mv[ref][1] = (my + (1<<(ez+ep))) >> (ez+ep);
@@ -79,9 +79,10 @@ static int dnxhd_find_frame_end(DNXHDParserContext *dctx,
                    if (remaining <= 0)
                        continue;
                }
-                remaining += i - 47;
                dctx->remaining = remaining;
-                if (buf_size >= dctx->remaining) {
+                if (buf_size - i + 47 >= dctx->remaining) {
+                    int remaining = dctx->remaining;
+
                    pc->frame_start_found = 0;
                    pc->state64 = -1;
                    dctx->cur_byte = 0;
@@ -37,7 +37,7 @@
 #define DST_MAX_CHANNELS 6
 #define DST_MAX_ELEMENTS (2 * DST_MAX_CHANNELS)

-#define DSD_FS44(sample_rate) (sample_rate * 8LL / 44100)
+#define DSD_FS44(sample_rate) (sample_rate * 8 / 44100)

 #define DST_SAMPLES_PER_FRAME(sample_rate) (588 * DSD_FS44(sample_rate))

@@ -120,7 +120,7 @@ static int read_map(GetBitContext *gb, Table *t, unsigned int map[DST_MAX_CHANNE

 static av_always_inline int get_sr_golomb_dst(GetBitContext *gb, unsigned int k)
 {
-    int v = get_ur_golomb_jpegls(gb, k, get_bits_left(gb), 0);
+    int v = get_ur_golomb(gb, k, get_bits_left(gb), 0);
    if (v && get_bits1(gb))
        v = -v;
    return v;
@@ -161,10 +161,6 @@ static int read_table(GetBitContext *gb, Table *t, const int8_t code_pred_coeff[
                    c -= (x + 4) / 8;
                else
                    c += (-x + 3) / 8;
-                if (!is_signed) {
-                    if (c < offset || c >= offset + (1<<coeff_bits))
-                        return AVERROR_INVALIDDATA;
-                }
                t->coeff[i][j] = c;
            }
        }
@@ -302,15 +298,11 @@ static int decode_frame(AVCodecContext *avctx, void *data,

    /* Filter Coef Sets (10.12) */

-    ret = read_table(gb, &s->fsets, fsets_code_pred_coeff, 7, 9, 1, 0);
-    if (ret < 0)
-        return ret;
+    read_table(gb, &s->fsets, fsets_code_pred_coeff, 7, 9, 1, 0);

    /* Probability Tables (10.13) */

-    ret = read_table(gb, &s->probs, probs_code_pred_coeff, 6, 7, 0, 1);
-    if (ret < 0)
-        return ret;
+    read_table(gb, &s->probs, probs_code_pred_coeff, 6, 7, 0, 1);

    /* Arithmetic Coded Data (10.11) */

@@ -1267,13 +1267,6 @@ static int dvbsub_parse_region_segment(AVCodecContext *avctx,
        display->y_pos = AV_RB16(buf) & 0xfff;
        buf += 2;

-        if (display->x_pos >= region->width ||
-            display->y_pos >= region->height) {
-            av_log(avctx, AV_LOG_ERROR, "Object outside region\n");
-            av_free(display);
-            return AVERROR_INVALIDDATA;
-        }
-
        if ((object->type == 1 || object->type == 2) && buf+1 < buf_end) {
            display->fgcolor = *buf++;
            display->bgcolor = *buf++;
@@ -1578,9 +1571,8 @@ static int dvbsub_parse_display_definition_segment(AVCodecContext *avctx,
    display_def->width   = bytestream_get_be16(&buf) + 1;
    display_def->height  = bytestream_get_be16(&buf) + 1;
    if (!avctx->width || !avctx->height) {
-        int ret = ff_set_dimensions(avctx, display_def->width, display_def->height);
-        if (ret < 0)
-            return ret;
+        avctx->width  = display_def->width;
+        avctx->height = display_def->height;
    }

    if (info_byte & 1<<3) { // display_window_flag
@@ -426,8 +426,7 @@ static int fill_optable(unsigned *table0, OpcodeTable *table1, int nb_elements)
 static int get_opcodes(GetByteContext *gb, uint32_t *table, uint8_t *dst, int op_size, int nb_elements)
 {
    OpcodeTable optable[1024];
-    int sum, x, val, lshift, rshift, ret, i, idx;
-    int64_t size_in_bits;
+    int sum, x, val, lshift, rshift, ret, size_in_bits, i, idx;
    unsigned endoffset, newoffset, offset;
    unsigned next;
    uint8_t *src = (uint8_t *)gb->buffer;
@@ -743,9 +742,6 @@ static int dxv_decompress_cocg(DXVContext *ctx, GetByteContext *gb,
    int skip0, skip1, oi0 = 0, oi1 = 0;
    int ret, state0 = 0, state1 = 0;

-    if (op_offset < 12 || op_offset - 12 > bytestream2_get_bytes_left(gb))
-        return AVERROR_INVALIDDATA;
-
    dst = tex_data;
    bytestream2_skip(gb, op_offset - 12);
    if (op_size0 > max_op_size0)
@@ -753,6 +749,7 @@ static int dxv_decompress_cocg(DXVContext *ctx, GetByteContext *gb,
    skip0 = dxv_decompress_opcodes(gb, op_data0, op_size0);
    if (skip0 < 0)
        return skip0;
+    bytestream2_seek(gb, data_start + op_offset + skip0 - 12, SEEK_SET);
    if (op_size1 > max_op_size1)
        return AVERROR_INVALIDDATA;
    skip1 = dxv_decompress_opcodes(gb, op_data1, op_size1);
@@ -781,7 +778,7 @@ static int dxv_decompress_cocg(DXVContext *ctx, GetByteContext *gb,
            return ret;
    }

-    bytestream2_seek(gb, data_start - 12 + op_offset + skip0 + skip1, SEEK_SET);
+    bytestream2_seek(gb, data_start + op_offset + skip0 + skip1 - 12, SEEK_SET);

    return 0;
 }
@@ -796,9 +793,6 @@ static int dxv_decompress_yo(DXVContext *ctx, GetByteContext *gb,
    uint8_t *dst, *table0[256] = { 0 }, *table1[256] = { 0 };
    int ret, state = 0, skip, oi = 0, v, vv;

-    if (op_offset < 8 || op_offset - 8 > bytestream2_get_bytes_left(gb))
-        return AVERROR_INVALIDDATA;
-
    dst = tex_data;
    bytestream2_skip(gb, op_offset - 8);
    if (op_size > max_op_size)
@@ -1057,10 +1051,6 @@ static int dxv_decode(AVCodecContext *avctx, void *data,
    avctx->pix_fmt = AV_PIX_FMT_RGBA;
    avctx->colorspace = AVCOL_SPC_RGB;

-    ctx->tex_funct = NULL;
-    ctx->tex_funct_planar[0] = NULL;
-    ctx->tex_funct_planar[1] = NULL;
-
    tag = bytestream2_get_le32(gbc);
    switch (tag) {
    case MKBETAG('D', 'X', 'T', '1'):
@@ -1202,12 +1192,6 @@ static int dxv_decode(AVCodecContext *avctx, void *data,
    ret = decompress_tex(avctx);
    if (ret < 0)
        return ret;
-    {
-        int w_block = avctx->coded_width / ctx->texture_block_w;
-        int h_block = avctx->coded_height / ctx->texture_block_h;
-        if (w_block * h_block * ctx->tex_step > ctx->tex_size * 8LL)
-            return AVERROR_INVALIDDATA;
-    }

    tframe.f = data;
    ret = ff_thread_get_buffer(avctx, &tframe, 0);
@@ -300,9 +300,6 @@ static int tgv_decode_frame(AVCodecContext *avctx,
            s->palette[i] = 0xFFU << 24 | AV_RB24(buf);
            buf += 3;
        }
-        if (buf_end - buf < 5) {
-            return AVERROR_INVALIDDATA;
-        }
    }

    if ((ret = ff_get_buffer(avctx, frame, AV_GET_BUFFER_FLAG_REF)) < 0)
@@ -131,9 +131,6 @@ static int tqi_decode_frame(AVCodecContext *avctx,
    AVFrame *frame = data;
    int ret, w, h;

-    if (buf_size < 12)
-        return AVERROR_INVALIDDATA;
-
    t->avctx = avctx;

    w = AV_RL16(&buf[0]);
@@ -437,7 +437,7 @@ static void guess_mv(ERContext *s)
    }

    if ((!(s->avctx->error_concealment&FF_EC_GUESS_MVS)) ||
-        num_avail <= FFMAX(mb_width, mb_height) / 2) {
+        num_avail <= mb_width / 2) {
        for (mb_y = 0; mb_y < mb_height; mb_y++) {
            for (mb_x = 0; mb_x < s->mb_width; mb_x++) {
                const int mb_xy = mb_x + mb_y * s->mb_stride;
@@ -1307,7 +1307,6 @@ static int decode_header(EXRContext *s, AVFrame *frame)
    int magic_number, version, i, flags, sar = 0;
    int layer_match = 0;
    int ret;
-    int dup_channels = 0;

    s->current_channel_offset = 0;
    s->xmin               = ~0;
@@ -1390,7 +1389,6 @@ static int decode_header(EXRContext *s, AVFrame *frame)
                        if (*ch_gb.buffer == '.')
                            ch_gb.buffer++;         /* skip dot if not given */
                    } else {
-                        layer_match = 0;
                        av_log(s->avctx, AV_LOG_INFO,
                               "Channel doesn't match layer : %s.\n", ch_gb.buffer);
                    }
@@ -1465,13 +1463,6 @@ static int decode_header(EXRContext *s, AVFrame *frame)
                    }
                    s->pixel_type                     = current_pixel_type;
                    s->channel_offsets[channel_index] = s->current_channel_offset;
-                } else if (channel_index >= 0) {
-                    av_log(s->avctx, AV_LOG_WARNING,
-                            "Multiple channels with index %d.\n", channel_index);
-                    if (++dup_channels > 10) {
-                        ret = AVERROR_INVALIDDATA;
-                        goto fail;
-                    }
                }

                s->channels = av_realloc(s->channels,
@@ -906,7 +906,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac
            unsigned crc = av_crc(av_crc_get_table(AV_CRC_32_IEEE), 0, buf_p, v);
            if (crc) {
                int64_t ts = avpkt->pts != AV_NOPTS_VALUE ? avpkt->pts : avpkt->dts;
-                av_log(f->avctx, AV_LOG_ERROR, "slice CRC mismatch %X!", crc);
+                av_log(f->avctx, AV_LOG_ERROR, "CRC mismatch %X!", crc);
                if (ts != AV_NOPTS_VALUE && avctx->pkt_timebase.num) {
                    av_log(f->avctx, AV_LOG_ERROR, "at %f seconds\n", ts*av_q2d(avctx->pkt_timebase));
                } else if (ts != AV_NOPTS_VALUE) {
@@ -113,12 +113,18 @@ static uint32_t lcg_next(uint32_t *s)
    return *s;
 }

-static void lcg_seek(uint32_t *s, uint32_t dt)
+static void lcg_seek(uint32_t *s, int64_t dt)
 {
    uint32_t a, c, t = *s;

-    a = LCG_A;
-    c = LCG_C;
+    if (dt >= 0) {
+        a = LCG_A;
+        c = LCG_C;
+    } else { /* coefficients for a step backward */
+        a = LCG_AI;
+        c = (uint32_t)(LCG_AI * LCG_C);
+        dt = -dt;
+    }
    while (dt) {
        if (dt & 1)
            t = a * t + c;
@@ -215,12 +221,12 @@ static void wavesynth_seek(struct wavesynth_context *ws, int64_t ts)
    ws->next_inter = i;
    ws->next_ts = i < ws->nb_inter ? ws->inter[i].ts_start : INF_TS;
    *last = -1;
-    lcg_seek(&ws->dither_state, (uint32_t)ts - (uint32_t)ws->cur_ts);
+    lcg_seek(&ws->dither_state, ts - ws->cur_ts);
    if (ws->pink_need) {
-        uint64_t pink_ts_cur  = (ws->cur_ts + PINK_UNIT - 1) & ~(PINK_UNIT - 1);
-        uint64_t pink_ts_next = ts & ~(PINK_UNIT - 1);
+        int64_t pink_ts_cur  = (ws->cur_ts + PINK_UNIT - 1) & ~(PINK_UNIT - 1);
+        int64_t pink_ts_next = ts & ~(PINK_UNIT - 1);
        int pos = ts & (PINK_UNIT - 1);
-        lcg_seek(&ws->pink_state, (uint32_t)(pink_ts_next - pink_ts_cur) * 2);
+        lcg_seek(&ws->pink_state, (pink_ts_next - pink_ts_cur) << 1);
        if (pos) {
            pink_fill(ws);
            ws->pink_pos = pos;
@@ -247,7 +253,7 @@ static int wavesynth_parse_extradata(AVCodecContext *avc)
    edata_end = edata + avc->extradata_size;
    ws->nb_inter = AV_RL32(edata);
    edata += 4;
-    if (ws->nb_inter < 0 || (edata_end - edata) / 24 < ws->nb_inter)
+    if (ws->nb_inter < 0)
        return AVERROR(EINVAL);
    ws->inter = av_calloc(ws->nb_inter, sizeof(*ws->inter));
    if (!ws->inter)
@@ -261,16 +267,13 @@ static int wavesynth_parse_extradata(AVCodecContext *avc)
        in->type     = AV_RL32(edata + 16);
        in->channels = AV_RL32(edata + 20);
        edata += 24;
-        if (in->ts_start < cur_ts ||
-            in->ts_end <= in->ts_start ||
-            (uint64_t)in->ts_end - in->ts_start > INT64_MAX
-        )
+        if (in->ts_start < cur_ts || in->ts_end <= in->ts_start)
            return AVERROR(EINVAL);
        cur_ts = in->ts_start;
        dt = in->ts_end - in->ts_start;
        switch (in->type) {
            case WS_SINE:
-                if (edata_end - edata < 20 || avc->sample_rate <= 0)
+                if (edata_end - edata < 20)
                    return AVERROR(EINVAL);
                f1  = AV_RL32(edata +  0);
                f2  = AV_RL32(edata +  4);
@@ -301,8 +304,8 @@ static int wavesynth_parse_extradata(AVCodecContext *avc)
            default:
                return AVERROR(EINVAL);
        }
-        in->amp0 = (uint64_t)a1 << 32;
-        in->damp = (int64_t)(((uint64_t)a2 << 32) - ((uint64_t)a1 << 32)) / dt;
+        in->amp0 = (int64_t)a1 << 32;
+        in->damp = (((int64_t)a2 << 32) - ((int64_t)a1 << 32)) / dt;
    }
    if (edata != edata_end)
        return AVERROR(EINVAL);
@@ -350,8 +353,7 @@ fail:
 static void wavesynth_synth_sample(struct wavesynth_context *ws, int64_t ts,
                                   int32_t *channels)
 {
-    int32_t amp, *cv;
-    unsigned val;
+    int32_t amp, val, *cv;
    struct ws_interval *in;
    int i, *last, pink;
    uint32_t c, all_ch = 0;
@@ -378,7 +380,7 @@ static void wavesynth_synth_sample(struct wavesynth_context *ws, int64_t ts,
                in->dphi += in->ddphi;
                break;
            case WS_NOISE:
-                val = amp * (unsigned)pink;
+                val = amp * pink;
                break;
            default:
                val = 0;
@@ -386,7 +388,7 @@ static void wavesynth_synth_sample(struct wavesynth_context *ws, int64_t ts,
        all_ch |= in->channels;
        for (c = in->channels, cv = channels; c; c >>= 1, cv++)
            if (c & 1)
-                *cv += (unsigned)val;
+                *cv += val;
    }
    val = (int32_t)lcg_next(&ws->dither_state) >> 16;
    for (c = all_ch, cv = channels; c; c >>= 1, cv++)
@@ -139,9 +139,6 @@ static int fic_decode_block(FICContext *ctx, GetBitContext *gb,
 {
    int i, num_coeff;

-    if (get_bits_left(gb) < 8)
-        return AVERROR_INVALIDDATA;
-
    /* Is it a skip block? */
    if (get_bits1(gb)) {
        *is_p = 1;
@@ -383,8 +380,6 @@ static int fic_decode_frame(AVCodecContext *avctx, void *data,
            slice_h      = FFALIGN(avctx->height - ctx->slice_h * (nslices - 1), 16);
        } else {
            slice_size = AV_RB32(src + tsize + FIC_HEADER_SIZE + slice * 4 + 4);
-            if (slice_size < slice_off)
-                return AVERROR_INVALIDDATA;
        }

        if (slice_size < slice_off || slice_size > msize)
@@ -138,17 +138,6 @@ int avpriv_fits_header_parse_line(void *avcl, FITSHeader *header, const uint8_t
    case STATE_BITPIX:
        CHECK_KEYWORD("BITPIX");
        CHECK_VALUE("BITPIX", bitpix);
-
-        switch(header->bitpix) {
-        case   8:
-        case  16:
-        case  32: case -32:
-        case  64: case -64: break;
-        default:
-            av_log(avcl, AV_LOG_ERROR, "invalid value of BITPIX %d\n", header->bitpix); \
-            return AVERROR_INVALIDDATA;
-        }
-
        dict_set_if_not_null(metadata, keyword, value);

        header->state = STATE_NAXIS;
@@ -143,7 +143,7 @@ static int fits_read_header(AVCodecContext *avctx, const uint8_t **ptr, FITSHead

    size = abs(header->bitpix) >> 3;
    for (i = 0; i < header->naxis; i++) {
-        if (size == 0 || header->naxisn[i] > SIZE_MAX / size) {
+        if (header->naxisn[i] > SIZE_MAX / size) {
            av_log(avctx, AV_LOG_ERROR, "unsupported size of FITS image");
            return AVERROR_INVALIDDATA;
        }
@@ -168,14 +168,6 @@ static int fits_read_header(AVCodecContext *avctx, const uint8_t **ptr, FITSHead
        header->data_min = (header->data_min - header->bzero) / header->bscale;
        header->data_max = (header->data_max - header->bzero) / header->bscale;
    }
-    if (!header->rgb && header->data_min >= header->data_max) {
-        if (header->data_min > header->data_max) {
-            av_log(avctx, AV_LOG_ERROR, "data min/max (%g %g) is invalid\n", header->data_min, header->data_max);
-            return AVERROR_INVALIDDATA;
-        }
-        av_log(avctx, AV_LOG_WARNING, "data min/max indicates a blank image\n");
-        header->data_max ++;
-    }

    return 0;
 }
@@ -264,13 +256,6 @@ static int fits_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
            CASE_RGB(16, dst16, uint16_t, AV_RB16);
        }
    } else {
-        double scale = header.data_max - header.data_min;
-
-        if (scale <= 0 || !isfinite(scale)) {
-            scale = 1;
-        }
-        scale = 1/scale;
-
        switch (header.bitpix) {
 #define CASE_GRAY(cas, dst, type, t, rd) \
    case cas: \
@@ -279,7 +264,7 @@ static int fits_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
            for (j = 0; j < avctx->width; j++) { \
                t = rd; \
                if (!header.blank_found || t != header.blank) { \
-                    *dst++ = lrint(((t - header.data_min) * ((1 << (sizeof(type) * 8)) - 1)) * scale); \
+                    *dst++ = ((t - header.data_min) * ((1 << (sizeof(type) * 8)) - 1)) / (header.data_max - header.data_min); \
                } else { \
                    *dst++ = fitsctx->blank_val; \
                } \
@@ -175,7 +175,7 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
    int lines;
    int compressed_lines;
    int starting_line;
-    int line_packets;
+    signed short line_packets;
    int y_ptr;
    int byte_run;
    int pixel_skip;
@@ -274,7 +274,7 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
                    break;
                if (y_ptr > pixel_limit)
                    return AVERROR_INVALIDDATA;
-                line_packets = sign_extend(bytestream2_get_le16(&g2), 16);
+                line_packets = bytestream2_get_le16(&g2);
                if ((line_packets & 0xC000) == 0xC000) {
                    // line skip opcode
                    line_packets = -line_packets;
@@ -508,7 +508,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,

    int lines;
    int compressed_lines;
-    int line_packets;
+    signed short line_packets;
    int y_ptr;
    int byte_run;
    int pixel_skip;
@@ -572,7 +572,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                    break;
                if (y_ptr > pixel_limit)
                    return AVERROR_INVALIDDATA;
-                line_packets = sign_extend(bytestream2_get_le16(&g2), 16);
+                line_packets = bytestream2_get_le16(&g2);
                if (line_packets < 0) {
                    line_packets = -line_packets;
                    if (line_packets > s->avctx->height)
@@ -806,7 +806,7 @@ static int flic_decode_frame_24BPP(AVCodecContext *avctx,

    int lines;
    int compressed_lines;
-    int line_packets;
+    signed short line_packets;
    int y_ptr;
    int byte_run;
    int pixel_skip;
@@ -870,7 +870,7 @@ static int flic_decode_frame_24BPP(AVCodecContext *avctx,
                    break;
                if (y_ptr > pixel_limit)
                    return AVERROR_INVALIDDATA;
-                line_packets = sign_extend(bytestream2_get_le16(&g2), 16);
+                line_packets = bytestream2_get_le16(&g2);
                if (line_packets < 0) {
                    line_packets = -line_packets;
                    if (line_packets > s->avctx->height)
@@ -900,7 +900,7 @@ static int flic_decode_frame_24BPP(AVCodecContext *avctx,
                        } else {
                            if (bytestream2_tell(&g2) + 2*byte_run > stream_ptr_after_chunk)
                                break;
-                            CHECK_PIXEL_PTR(3 * byte_run);
+                            CHECK_PIXEL_PTR(2 * byte_run);
                            for (j = 0; j < byte_run; j++, pixel_countdown--) {
                                pixel = bytestream2_get_le24(&g2);
                                AV_WL24(&pixels[pixel_ptr], pixel);
@@ -1024,7 +1024,14 @@ static int flic_decode_frame_24BPP(AVCodecContext *avctx,
                for (y_ptr = 0; y_ptr < s->frame->linesize[0] * s->avctx->height;
                     y_ptr += s->frame->linesize[0]) {

-                    bytestream2_get_buffer(&g2, pixels + y_ptr, 3*s->avctx->width);
+                    pixel_countdown = s->avctx->width;
+                    pixel_ptr = 0;
+                    while (pixel_countdown > 0) {
+                        pixel = bytestream2_get_le24(&g2);
+                        AV_WL24(&pixels[y_ptr + pixel_ptr], pixel);
+                        pixel_ptr += 3;
+                        pixel_countdown--;
+                    }
                    if (s->avctx->width & 1)
                        bytestream2_skip(&g2, 3);
                }
@@ -402,9 +402,6 @@ static int decode_frame(AVCodecContext *avctx, void *data,
    AVFrame *frame = data;
    int ret, y, x;

-    if (avpkt->size < 8)
-        return AVERROR_INVALIDDATA;
-
    if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
        return ret;

@@ -244,9 +244,6 @@ static int jpg_decode_block(JPGContext *c, GetBitContext *gb,
    const int is_chroma = !!plane;
    const uint8_t *qmat = is_chroma ? chroma_quant : luma_quant;

-    if (get_bits_left(gb) < 1)
-        return AVERROR_INVALIDDATA;
-
    c->bdsp.clear_block(block);
    dc = get_vlc2(gb, c->dc_vlc[is_chroma].table, 9, 3);
    if (dc < 0)
@@ -857,9 +854,6 @@ static int epic_decode_tile(ePICContext *dc, uint8_t *out, int tile_height,
                    uint32_t ref_pix = curr_row[x - 1];
                    if (!x || !epic_decode_from_cache(dc, ref_pix, &pix)) {
                        pix = epic_decode_pixel_pred(dc, x, y, curr_row, above_row);
-                        if (is_pixel_on_stack(dc, pix))
-                            return AVERROR_INVALIDDATA;
-
                        if (x) {
                            int ret = epic_add_pixel_to_cache(&dc->hash,
                                                              ref_pix,
@@ -667,9 +667,7 @@ static int estimate_sid_gain(G723_1_Context *p)
            if (p->sid_gain < 0) t = INT32_MIN;
            else                 t = INT32_MAX;
        } else
-            t = p->sid_gain * (1 << shift);
-    } else if(shift < -31) {
-        t = (p->sid_gain < 0) ? -1 : 0;
+            t = p->sid_gain << shift;
    }else
        t = p->sid_gain >> -shift;
    x = av_clipl_int32(t * (int64_t)cng_filt[0] >> 16);
@@ -51,12 +51,6 @@ static int g729_parse(AVCodecParserContext *s1, AVCodecContext *avctx,
        s->duration   = avctx->frame_size;
    }

-    if (!s->block_size) {
-        *poutbuf      = buf;
-        *poutbuf_size = buf_size;
-        return buf_size;
-    }
-
    if (!s->remaining)
        s->remaining = s->block_size;
    if (s->remaining <= buf_size) {
@@ -328,14 +328,11 @@ static int16_t g729d_voice_decision(int onset, int prev_voice_decision, const in

 static int32_t scalarproduct_int16_c(const int16_t * v1, const int16_t * v2, int order)
 {
-    int64_t res = 0;
+    int res = 0;

    while (order--)
        res += *v1++ * *v2++;

-    if      (res > INT32_MAX) return INT32_MAX;
-    else if (res < INT32_MIN) return INT32_MIN;
-
    return res;
 }

@@ -416,7 +413,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame_ptr,
        return ret;
    out_frame = (int16_t*) frame->data[0];

-    if (buf_size && buf_size % 10 == 0) {
+    if (buf_size % 10 == 0) {
        packet_type = FORMAT_G729_8K;
        format = &format_g729_8k;
        //Reset voice decision
@@ -156,7 +156,7 @@ static int16_t long_term_filter(AudioDSPContext *adsp, int pitch_delay_int,
            sig_scaled[i] = residual[i] >> shift;
    else
        for (i = 0; i < subframe_size + RES_PREV_DATA_SIZE; i++)
-            sig_scaled[i] = (unsigned)residual[i] << -shift;
+            sig_scaled[i] = residual[i] << -shift;

    /* Start of best delay searching code */
    gain_num = 0;
@@ -201,8 +201,8 @@ static int16_t long_term_filter(AudioDSPContext *adsp, int pitch_delay_int,
        }
        if (corr_int_num) {
            /* Compute denominator of pseudo-normalized correlation R'(0). */
-            corr_int_den = adsp->scalarproduct_int16(sig_scaled + RES_PREV_DATA_SIZE - best_delay_int,
-                                                     sig_scaled + RES_PREV_DATA_SIZE - best_delay_int,
+            corr_int_den = adsp->scalarproduct_int16(sig_scaled - best_delay_int + RES_PREV_DATA_SIZE,
+                                                    sig_scaled - best_delay_int + RES_PREV_DATA_SIZE,
                                                    subframe_size);

            /* Compute signals with non-integer delay k (with 1/8 precision),
@@ -346,7 +346,7 @@ static int16_t long_term_filter(AudioDSPContext *adsp, int pitch_delay_int,
        L_temp1 = gain_long_num * gain_long_num;
        L_temp1 = MULL(L_temp1, gain_den, FRAC_BITS);

-        tmp = ((sh_gain_long_num - sh_gain_num) * 2) - (sh_gain_long_den - sh_gain_den);
+        tmp = ((sh_gain_long_num - sh_gain_num) << 1) - (sh_gain_long_den - sh_gain_den);
        if (tmp > 0)
            L_temp0 >>= tmp;
        else
@@ -367,7 +367,7 @@ static int16_t long_term_filter(AudioDSPContext *adsp, int pitch_delay_int,
        /* Rescale selected signal to original value. */
        if (shift > 0)
            for (i = 0; i < subframe_size; i++)
-                selected_signal[i] *= 1 << shift;
+                selected_signal[i] <<= shift;
        else
            for (i = 0; i < subframe_size; i++)
                selected_signal[i] >>= -shift;
@@ -464,7 +464,7 @@ static int16_t get_tilt_comp(AudioDSPContext *adsp, int16_t *lp_gn,
            speech[i] = (speech[i] * temp + 0x4000) >> 15;
    }

-    return -(rh1 * (1 << 15)) / rh0;
+    return -(rh1 << 15) / rh0;
 }

 /**
@@ -500,14 +500,14 @@ static int16_t apply_tilt_comp(int16_t* out, int16_t* res_pst, int refl_coeff,
    tmp = res_pst[subframe_size - 1];

    for (i = subframe_size - 1; i >= 1; i--) {
-        tmp2 = (gt * res_pst[i-1]) * 2 + 0x4000;
-        tmp2 = res_pst[i] + (tmp2 >> 15);
+        tmp2 = (res_pst[i] << 15) + ((gt * res_pst[i-1]) << 1);
+        tmp2 = (tmp2 + 0x4000) >> 15;

        tmp2 = (tmp2 * ga * 2 + fact) >> sh_fact;
        out[i] = tmp2;
    }
-    tmp2 = (gt * ht_prev_data) * 2 + 0x4000;
-    tmp2 = res_pst[0] + (tmp2 >> 15);
+    tmp2 = (res_pst[0] << 15) + ((gt * ht_prev_data) << 1);
+    tmp2 = (tmp2 + 0x4000) >> 15;
    tmp2 = (tmp2 * ga * 2 + fact) >> sh_fact;
    out[0] = tmp2;

@@ -72,64 +72,9 @@ static av_cold int gdv_decode_init(AVCodecContext *avctx)
    return 0;
 }

-static void scaleup(uint8_t *dst, const uint8_t *src, int w)
-{
-    int x;
-    for (x = 0; x < w - 7; x+=8) {
-        dst[x + 0] =
-        dst[x + 1] = src[(x>>1) + 0];
-        dst[x + 2] =
-        dst[x + 3] = src[(x>>1) + 1];
-        dst[x + 4] =
-        dst[x + 5] = src[(x>>1) + 2];
-        dst[x + 6] =
-        dst[x + 7] = src[(x>>1) + 3];
-    }
-    for (; x < w; x++) {
-        dst[x] = src[(x>>1)];
-    }
-}
-
-static void scaleup_rev(uint8_t *dst, const uint8_t *src, int w)
-{
-    int x;
-
-    for (x = w - 1; (x+1) & 7; x--) {
-        dst[x] = src[(x>>1)];
-    }
-    for (x -= 7; x >= 0; x -= 8) {
-        dst[x + 6] =
-        dst[x + 7] = src[(x>>1) + 3];
-        dst[x + 4] =
-        dst[x + 5] = src[(x>>1) + 2];
-        dst[x + 2] =
-        dst[x + 3] = src[(x>>1) + 1];
-        dst[x + 0] =
-        dst[x + 1] = src[(x>>1) + 0];
-    }
-}
-
-static void scaledown(uint8_t *dst, const uint8_t *src, int w)
-{
-    int x;
-    for (x = 0; x < w - 7; x+=8) {
-        dst[x + 0] = src[2*x + 0];
-        dst[x + 1] = src[2*x + 2];
-        dst[x + 2] = src[2*x + 4];
-        dst[x + 3] = src[2*x + 6];
-        dst[x + 4] = src[2*x + 8];
-        dst[x + 5] = src[2*x +10];
-        dst[x + 6] = src[2*x +12];
-        dst[x + 7] = src[2*x +14];
-    }
-    for (; x < w; x++) {
-        dst[x] = src[2*x];
-    }
-}
-
 static void rescale(GDVContext *gdv, uint8_t *dst, int w, int h, int scale_v, int scale_h)
 {
-    int j, y;
+    int j, y, x;

    if ((gdv->scale_v == scale_v) && (gdv->scale_h == scale_h)) {
        return;
@@ -141,7 +86,14 @@ static void rescale(GDVContext *gdv, uint8_t *dst, int w, int h, int scale_v, in
            uint8_t *dst1 = dst + PREAMBLE_SIZE + y * w;
            uint8_t *src1 = dst + PREAMBLE_SIZE + (y>>!!gdv->scale_h) * (w>>1);

-            scaleup_rev(dst1, src1, w);
+            for (x = w - 1; x >= 0 && !(x&1); x--) {
+                dst1[x] = src1[(x>>1)];
+            }
+
+            for (x--; x >= 0; x-=2) {
+                dst1[x  ] =
+                dst1[x+1] = src1[(x>>1)];
+            }
        }
    } else if (gdv->scale_h) {
        for (j = 0; j < h; j++) {
@@ -156,7 +108,9 @@ static void rescale(GDVContext *gdv, uint8_t *dst, int w, int h, int scale_v, in
        for (y = 0; y < (h>>1); y++) {
            uint8_t *dst1 = dst + PREAMBLE_SIZE + y * (w>>1);
            uint8_t *src1 = dst + PREAMBLE_SIZE + y*2 * w;
-            scaledown(dst1, src1, w>>1);
+            for (x = 0; x < (w>>1); x++) {
+                dst1[x] = src1[x*2];
+            }
        }
    } else if (scale_h) {
        for (y = 0; y < (h>>1); y++) {
@@ -167,7 +121,9 @@ static void rescale(GDVContext *gdv, uint8_t *dst, int w, int h, int scale_v, in
    } else if (scale_v) {
        for (y = 0; y < h; y++) {
            uint8_t *dst1 = dst + PREAMBLE_SIZE + y * w;
-            scaledown(dst1, dst1, w>>1);
+            for (x = 0; x < (w>>1); x++) {
+                dst1[x] = dst1[x*2];
+            }
        }
    }

@@ -294,8 +250,6 @@ static int decompress_5(AVCodecContext *avctx, unsigned skip)

    while (bytestream2_get_bytes_left_p(pb) > 0 && bytestream2_get_bytes_left(gb) > 0) {
        int tag = read_bits2(&bits, gb);
-        if (bytestream2_get_bytes_left(gb) < 1)
-            return AVERROR_INVALIDDATA;
        if (tag == 0) {
            bytestream2_put_byte(pb, bytestream2_get_byte(gb));
        } else if (tag == 1) {
@@ -356,8 +310,7 @@ static int decompress_68(AVCodecContext *avctx, unsigned skip, unsigned use8)
                    if (val != ((1 << lbits) - 1)) {
                        break;
                    }
-                    if (lbits >= 16)
-                        return AVERROR_INVALIDDATA;
+                    assert(lbits < 16);
                }
                for (i = 0; i < len; i++) {
                    bytestream2_put_byte(pb, bytestream2_get_byte(gb));
@@ -476,8 +429,6 @@ static int gdv_decode_frame(AVCodecContext *avctx, void *data,
    if (pal && pal_size == AVPALETTE_SIZE)
        memcpy(gdv->pal, pal, AVPALETTE_SIZE);

-    if (compression < 2 && bytestream2_get_bytes_left(gb) < 256*3)
-        return AVERROR_INVALIDDATA;
    rescale(gdv, gdv->frame, avctx->width, avctx->height,
            !!(flags & 0x10), !!(flags & 0x20));

@@ -485,6 +436,8 @@ static int gdv_decode_frame(AVCodecContext *avctx, void *data,
    case 1:
        memset(gdv->frame + PREAMBLE_SIZE, 0, gdv->frame_size - PREAMBLE_SIZE);
    case 0:
+        if (bytestream2_get_bytes_left(gb) < 256*3)
+            return AVERROR_INVALIDDATA;
        for (i = 0; i < 256; i++) {
            unsigned r = bytestream2_get_byte(gb);
            unsigned g = bytestream2_get_byte(gb);
@@ -528,16 +481,19 @@ static int gdv_decode_frame(AVCodecContext *avctx, void *data,
        }
    } else {
        int sidx = PREAMBLE_SIZE, didx = 0;
-        int y;
+        int y, x;

        for (y = 0; y < avctx->height; y++) {
            if (!gdv->scale_v) {
                memcpy(dst + didx, gdv->frame + sidx, avctx->width);
            } else {
-                uint8_t *dst2 = dst + didx;
-                uint8_t *src2 = gdv->frame + sidx;
-
-                scaleup(dst2, src2, avctx->width);
+                for (x = 0; x < avctx->width - 1; x+=2) {
+                    dst[didx + x    ] =
+                    dst[didx + x + 1] = gdv->frame[sidx + (x>>1)];
+                }
+                for (; x < avctx->width; x++) {
+                    dst[didx + x] = gdv->frame[sidx + (x>>1)];
+                }
            }
            if (!gdv->scale_h || ((y & 1) == 1)) {
                sidx += !gdv->scale_v ? avctx->width : avctx->width/2;
@@ -49,8 +49,6 @@ extern const uint8_t ff_interleaved_dirac_golomb_vlc_code[256];

 /**
 * Read an unsigned Exp-Golomb code in the range 0 to 8190.
- *
- * @returns the read value or a negative error code.
 */
 static inline int get_ue_golomb(GetBitContext *gb)
 {
@@ -614,7 +614,7 @@ retry:
    if ((ret = ff_mpv_frame_start(s, avctx)) < 0)
        return ret;

-    if (!s->divx_packed && !avctx->hwaccel)
+    if (!s->divx_packed)
        ff_thread_finish_setup(avctx);

    if (avctx->hwaccel) {
@@ -156,8 +156,8 @@ void ff_h264_direct_ref_list_init(const H264Context *const h, H264SliceContext *
            av_log(h->avctx, AV_LOG_ERROR, "co located POCs unavailable\n");
            sl->col_parity = 1;
        } else
-            sl->col_parity = (FFABS(col_poc[0] - (int64_t)cur_poc) >=
-                              FFABS(col_poc[1] - (int64_t)cur_poc));
+        sl->col_parity = (FFABS(col_poc[0] - cur_poc) >=
+                          FFABS(col_poc[1] - cur_poc));
        ref1sidx =
        sidx     = sl->col_parity;
    // FL -> FL & differ parity
@@ -296,8 +296,7 @@ int ff_h264_init_poc(int pic_field_poc[2], int *pic_poc,
        if (picture_structure == PICT_FRAME)
            field_poc[1] += pc->delta_poc_bottom;
    } else if (sps->poc_type == 1) {
-        int abs_frame_num;
-        int64_t expected_delta_per_poc_cycle, expectedpoc;
+        int abs_frame_num, expected_delta_per_poc_cycle, expectedpoc;
        int i;

        if (sps->poc_cycle_length != 0)
@@ -91,7 +91,7 @@ static int h264_redundant_pps_filter(AVBSFContext *bsf, AVPacket *out)
        if (nal->type == H264_NAL_PPS) {
            h264_redundant_pps_fixup_pps(ctx, nal->content);
            if (!au_has_sps) {
-                av_log(bsf, AV_LOG_VERBOSE, "Deleting redundant PPS "
+                av_log(ctx, AV_LOG_VERBOSE, "Deleting redundant PPS "
                       "at %"PRId64".\n", in->pts);
                ff_cbs_delete_unit(ctx->input, au, i);
            }
@@ -373,11 +373,9 @@ int ff_h264_build_ref_list(H264Context *h, H264SliceContext *sl)
                av_assert0(0);
            }

-            if (i < 0 || mismatches_ref(h, ref)) {
+            if (i < 0) {
                av_log(h->avctx, AV_LOG_ERROR,
-                       i < 0 ? "reference picture missing during reorder\n" :
-                               "mismatching reference\n"
-                      );
+                       "reference picture missing during reorder\n");
                memset(&sl->ref_list[list][index], 0, sizeof(sl->ref_list[0][0])); // FIXME
            } else {
                for (i = index; i + 1 < sl->ref_count[list]; i++) {
@@ -678,7 +678,7 @@ static void implicit_weight_table(const H264Context *h, H264SliceContext *sl, in
            cur_poc = h->cur_pic_ptr->field_poc[h->picture_structure - 1];
        }
        if (sl->ref_count[0] == 1 && sl->ref_count[1] == 1 && !FRAME_MBAFF(h) &&
-            sl->ref_list[0][0].poc + (int64_t)sl->ref_list[1][0].poc == 2LL * cur_poc) {
+            sl->ref_list[0][0].poc + (int64_t)sl->ref_list[1][0].poc == 2 * cur_poc) {
            sl->pwt.use_weight        = 0;
            sl->pwt.use_weight_chroma = 0;
            return;
@@ -642,11 +642,11 @@ int ff_hevc_cu_qp_delta_abs(HEVCContext *s)
    }
    if (prefix_val >= 5) {
        int k = 0;
-        while (k < 7 && get_cabac_bypass(&s->HEVClc->cc)) {
+        while (k < CABAC_MAX_BIN && get_cabac_bypass(&s->HEVClc->cc)) {
            suffix_val += 1 << k;
            k++;
        }
-        if (k == 7) {
+        if (k == CABAC_MAX_BIN) {
            av_log(s->avctx, AV_LOG_ERROR, "CABAC_MAX_BIN : %d\n", k);
            return AVERROR_INVALIDDATA;
        }
@@ -1587,25 +1587,22 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb, AVCodecContext *avctx,
    pps->entropy_coding_sync_enabled_flag = get_bits1(gb);

    if (pps->tiles_enabled_flag) {
-        int num_tile_columns_minus1 = get_ue_golomb(gb);
-        int num_tile_rows_minus1    = get_ue_golomb(gb);
-
-        if (num_tile_columns_minus1 < 0 ||
-            num_tile_columns_minus1 >= sps->ctb_width - 1) {
+        pps->num_tile_columns = get_ue_golomb_long(gb) + 1;
+        pps->num_tile_rows    = get_ue_golomb_long(gb) + 1;
+        if (pps->num_tile_columns <= 0 ||
+            pps->num_tile_columns >= sps->width) {
            av_log(avctx, AV_LOG_ERROR, "num_tile_columns_minus1 out of range: %d\n",
-                   num_tile_columns_minus1);
-            ret = num_tile_columns_minus1 < 0 ? num_tile_columns_minus1 : AVERROR_INVALIDDATA;
+                   pps->num_tile_columns - 1);
+            ret = AVERROR_INVALIDDATA;
            goto err;
        }
-        if (num_tile_rows_minus1 < 0 ||
-            num_tile_rows_minus1 >= sps->ctb_height - 1) {
+        if (pps->num_tile_rows <= 0 ||
+            pps->num_tile_rows >= sps->height) {
            av_log(avctx, AV_LOG_ERROR, "num_tile_rows_minus1 out of range: %d\n",
-                   num_tile_rows_minus1);
-            ret = num_tile_rows_minus1 < 0 ? num_tile_rows_minus1 : AVERROR_INVALIDDATA;
+                   pps->num_tile_rows - 1);
+            ret = AVERROR_INVALIDDATA;
            goto err;
        }
-        pps->num_tile_columns = num_tile_columns_minus1 + 1;
-        pps->num_tile_rows    = num_tile_rows_minus1    + 1;

        pps->column_width = av_malloc_array(pps->num_tile_columns, sizeof(*pps->column_width));
        pps->row_height   = av_malloc_array(pps->num_tile_rows,    sizeof(*pps->row_height));
@@ -344,8 +344,8 @@ typedef struct HEVCPPS {
    uint8_t tiles_enabled_flag;
    uint8_t entropy_coding_sync_enabled_flag;

-    uint16_t num_tile_columns;   ///< num_tile_columns_minus1 + 1
-    uint16_t num_tile_rows;      ///< num_tile_rows_minus1 + 1
+    int num_tile_columns;   ///< num_tile_columns_minus1 + 1
+    int num_tile_rows;      ///< num_tile_rows_minus1 + 1
    uint8_t uniform_spacing_flag;
    uint8_t loop_filter_across_tiles_enabled_flag;

@@ -394,7 +394,7 @@ static void mark_ref(HEVCFrame *frame, int flag)
 static HEVCFrame *generate_missing_ref(HEVCContext *s, int poc)
 {
    HEVCFrame *frame;
-    int i, y;
+    int i, x, y;

    frame = alloc_frame(s);
    if (!frame)
@@ -407,11 +407,11 @@ static HEVCFrame *generate_missing_ref(HEVCContext *s, int poc)
                       frame->frame->buf[i]->size);
        } else {
            for (i = 0; frame->frame->data[i]; i++)
-                for (y = 0; y < (s->ps.sps->height >> s->ps.sps->vshift[i]); y++) {
-                    uint8_t *dst = frame->frame->data[i] + y * frame->frame->linesize[i];
-                    AV_WN16(dst, 1 << (s->ps.sps->bit_depth - 1));
-                    av_memcpy_backptr(dst + 2, 2, 2*(s->ps.sps->width >> s->ps.sps->hshift[i]) - 2);
-                }
+                for (y = 0; y < (s->ps.sps->height >> s->ps.sps->vshift[i]); y++)
+                    for (x = 0; x < (s->ps.sps->width >> s->ps.sps->hshift[i]); x++) {
+                        AV_WN16(frame->frame->data[i] + y * frame->frame->linesize[i] + 2 * x,
+                                1 << (s->ps.sps->bit_depth - 1));
+                    }
        }
    }

@@ -182,8 +182,6 @@ static int pred_weight_table(HEVCContext *s, GetBitContext *gb)
    for (i = 0; i < s->sh.nb_refs[L0]; i++) {
        if (luma_weight_l0_flag[i]) {
            int delta_luma_weight_l0 = get_se_golomb(gb);
-            if ((int8_t)delta_luma_weight_l0 != delta_luma_weight_l0)
-                return AVERROR_INVALIDDATA;
            s->sh.luma_weight_l0[i] = (1 << s->sh.luma_log2_weight_denom) + delta_luma_weight_l0;
            s->sh.luma_offset_l0[i] = get_se_golomb(gb);
        }
@@ -226,8 +224,6 @@ static int pred_weight_table(HEVCContext *s, GetBitContext *gb)
        for (i = 0; i < s->sh.nb_refs[L1]; i++) {
            if (luma_weight_l1_flag[i]) {
                int delta_luma_weight_l1 = get_se_golomb(gb);
-                if ((int8_t)delta_luma_weight_l1 != delta_luma_weight_l1)
-                    return AVERROR_INVALIDDATA;
                s->sh.luma_weight_l1[i] = (1 << s->sh.luma_log2_weight_denom) + delta_luma_weight_l1;
                s->sh.luma_offset_l1[i] = get_se_golomb(gb);
            }
@@ -489,11 +485,6 @@ static int hls_slice_header(HEVCContext *s)

    // Coded parameters
    sh->first_slice_in_pic_flag = get_bits1(gb);
-    if (s->ref && sh->first_slice_in_pic_flag) {
-        av_log(s->avctx, AV_LOG_ERROR, "Two slices reporting being the first in the same frame.\n");
-        return 1; // This slice will be skipped later, do not corrupt state
-    }
-
    if ((IS_IDR(s) || IS_BLA(s)) && sh->first_slice_in_pic_flag) {
        s->seq_decode = (s->seq_decode + 1) & 0xff;
        s->max_ra     = INT_MAX;
@@ -2924,11 +2915,6 @@ static int decode_nal_unit(HEVCContext *s, const H2645NAL *nal)
        ret = hls_slice_header(s);
        if (ret < 0)
            return ret;
-        if (ret == 1) {
-            ret = AVERROR_INVALIDDATA;
-            goto fail;
-        }
-

        if (
            (s->avctx->skip_frame >= AVDISCARD_BIDIR && s->sh.slice_type == HEVC_SLICE_B) ||
@@ -3321,8 +3307,6 @@ static av_cold int hevc_decode_free(AVCodecContext *avctx)

    ff_h2645_packet_uninit(&s->pkt);

-    ff_hevc_reset_sei(&s->sei);
-
    return 0;
 }

@@ -3516,7 +3500,6 @@ static void hevc_decode_flush(AVCodecContext *avctx)
 {
    HEVCContext *s = avctx->priv_data;
    ff_hevc_flush_dpb(s);
-    ff_hevc_reset_sei(&s->sei);
    s->max_ra = INT_MAX;
    s->eos = 1;
 }
@@ -559,6 +559,8 @@ static av_always_inline int ff_hevc_nal_is_nonref(enum HEVCNALUnitType type)
    case HEVC_NAL_VCL_N10:
    case HEVC_NAL_VCL_N12:
    case HEVC_NAL_VCL_N14:
+    case HEVC_NAL_BLA_N_LP:
+    case HEVC_NAL_IDR_N_LP:
        return 1;
        break;
    default: break;
@@ -117,17 +117,14 @@ static void unpack_intraframe(AVCodecContext *avctx, uint8_t *src,
 static void postprocess_current_frame(AVCodecContext *avctx)
 {
    Hnm4VideoContext *hnm = avctx->priv_data;
-    uint32_t x, y, src_y;
-    int width = hnm->width;
+    uint32_t x, y, src_x, src_y;

    for (y = 0; y < hnm->height; y++) {
-        uint8_t *dst = hnm->processed + y * width;
-        const uint8_t *src = hnm->current;
        src_y = y - (y % 2);
-        src += src_y * width + (y % 2);
-        for (x = 0; x < width; x++) {
-            dst[x] = *src;
-            src += 2;
+        src_x = src_y * hnm->width + (y % 2);
+        for (x = 0; x < hnm->width; x++) {
+            hnm->processed[(y * hnm->width) + x] = hnm->current[src_x];
+            src_x += 2;
        }
    }
 }
@@ -146,7 +143,7 @@ static void copy_processed_frame(AVCodecContext *avctx, AVFrame *frame)
    }
 }

-static int decode_interframe_v4(AVCodecContext *avctx, uint8_t *src, uint32_t size)
+static void decode_interframe_v4(AVCodecContext *avctx, uint8_t *src, uint32_t size)
 {
    Hnm4VideoContext *hnm = avctx->priv_data;
    GetByteContext gb;
@@ -165,7 +162,7 @@ static int decode_interframe_v4(AVCodecContext *avctx, uint8_t *src, uint32_t si
            if (tag == 0) {
                if (writeoffset + 2 > hnm->width * hnm->height) {
                    av_log(avctx, AV_LOG_ERROR, "writeoffset out of bounds\n");
-                    return AVERROR_INVALIDDATA;
+                    break;
                }
                hnm->current[writeoffset++] = bytestream2_get_byte(&gb);
                hnm->current[writeoffset++] = bytestream2_get_byte(&gb);
@@ -179,7 +176,7 @@ static int decode_interframe_v4(AVCodecContext *avctx, uint8_t *src, uint32_t si
                count = bytestream2_get_byte(&gb) * 2;
                if (writeoffset + count > hnm->width * hnm->height) {
                    av_log(avctx, AV_LOG_ERROR, "writeoffset out of bounds\n");
-                    return AVERROR_INVALIDDATA;
+                    break;
                }
                while (count > 0) {
                    hnm->current[writeoffset++] = bytestream2_peek_byte(&gb);
@@ -191,7 +188,7 @@ static int decode_interframe_v4(AVCodecContext *avctx, uint8_t *src, uint32_t si
            }
            if (writeoffset > hnm->width * hnm->height) {
                av_log(avctx, AV_LOG_ERROR, "writeoffset out of bounds\n");
-                return AVERROR_INVALIDDATA;
+                break;
            }
        } else {
            previous = bytestream2_peek_byte(&gb) & 0x20;
@@ -207,25 +204,24 @@ static int decode_interframe_v4(AVCodecContext *avctx, uint8_t *src, uint32_t si

            if (!backward && offset + 2*count > hnm->width * hnm->height) {
                av_log(avctx, AV_LOG_ERROR, "Attempting to read out of bounds\n");
-                return AVERROR_INVALIDDATA;
+                break;
            } else if (backward && offset + 1 >= hnm->width * hnm->height) {
                av_log(avctx, AV_LOG_ERROR, "Attempting to read out of bounds\n");
-                return AVERROR_INVALIDDATA;
+                break;
            } else if (writeoffset + 2*count > hnm->width * hnm->height) {
                av_log(avctx, AV_LOG_ERROR,
                       "Attempting to write out of bounds\n");
-                return AVERROR_INVALIDDATA;
-
+                break;
            }
            if(backward) {
                if (offset < (!!backline)*(2 * hnm->width - 1) + 2*(left-1)) {
                    av_log(avctx, AV_LOG_ERROR, "Attempting to read out of bounds\n");
-                    return AVERROR_INVALIDDATA;
+                    break;
                }
            } else {
                if (offset < (!!backline)*(2 * hnm->width - 1)) {
                    av_log(avctx, AV_LOG_ERROR, "Attempting to read out of bounds\n");
-                    return AVERROR_INVALIDDATA;
+                    break;
                }
            }

@@ -272,7 +268,6 @@ static int decode_interframe_v4(AVCodecContext *avctx, uint8_t *src, uint32_t si
            }
        }
    }
-    return 0;
 }

 static void decode_interframe_v4a(AVCodecContext *avctx, uint8_t *src,
@@ -440,9 +435,7 @@ static int hnm_decode_frame(AVCodecContext *avctx, void *data,
            decode_interframe_v4a(avctx, avpkt->data + 8, avpkt->size - 8);
            memcpy(hnm->processed, hnm->current, hnm->width * hnm->height);
        } else {
-            int ret = decode_interframe_v4(avctx, avpkt->data + 8, avpkt->size - 8);
-            if (ret < 0)
-                return ret;
+            decode_interframe_v4(avctx, avpkt->data + 8, avpkt->size - 8);
            postprocess_current_frame(avctx);
        }
        copy_processed_frame(avctx, frame);
@@ -248,18 +248,13 @@ static int hqa_decode_frame(HQContext *ctx, AVFrame *pic, size_t data_size)
    int width, height, quant;
    const uint8_t *src = ctx->gbc.buffer;

-    if (bytestream2_get_bytes_left(&ctx->gbc) < 8 + 4*(num_slices + 1))
-        return AVERROR_INVALIDDATA;
-
    width  = bytestream2_get_be16(&ctx->gbc);
    height = bytestream2_get_be16(&ctx->gbc);

-    ret = ff_set_dimensions(ctx->avctx, width, height);
-    if (ret < 0)
-        return ret;
-
    ctx->avctx->coded_width         = FFALIGN(width,  16);
    ctx->avctx->coded_height        = FFALIGN(height, 16);
+    ctx->avctx->width               = width;
+    ctx->avctx->height              = height;
    ctx->avctx->bits_per_raw_sample = 8;
    ctx->avctx->pix_fmt             = AV_PIX_FMT_YUVA422P;

--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .1.5
 .0.git