Bump minor versions again on master to keep 4.2 versions separate from master

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-07-21 18:36:31 +02:00
449 changed files with 2434 additions and 5210 deletions
@@ -1,958 +1,6 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.

-version 4.2.5
- configure: update copyright year
- avformat/matroskadec: Reset state also on failure in matroska_reset_status()
- avformat/wavdec: Check smv_block_size
- avformat/rmdec: Check for multiple audio_stream_info
- avcodec/apedec: Use 64bit to avoid overflow
- avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830()
- oavformat/avidec: Check offset in odml
- avformat/mpegts: use actually read packet size in mpegts_resync special case
- avfilter/scale_npp: fix non-aligned output frame dimensions
- Update for 4.2.5
- swscale/alphablend: Fix slice handling
- avcodec/mxpegdec: Check for AVDISCARD_ALL
- avcodec/flicvideo: Check remaining bytes in FLI*COPY
- avcodec/cbs_h265_syntax_template: Limit sps_num_palette_predictor_initializer_minus1 to 127
- avcodec/mpeg12dec: Do not put mpeg_f_code into an invalid state on error return
- avcodec/mpegvideo_enc: Limit bitrate tolerance to the representable
- avcodec/apedec: Fix integer overflow in intermediate
- avformat/mvdec: Do not set invalid sample rate
- avformat/rmdec: Use 64bit for intermediate for DEINT_ID_INT4
- avformat/mov: Check for duplicate clli
- avformat/jacosubdec: Check for min in t overflow in get_shift()
- avformat/mxfdec: check channel number in mxf_get_d10_aes3_packet()
- avcodec/utils: don't return negative values in av_get_audio_frame_duration()
- avcodec/jpeg2000dec: Check that atom header is within bytsetream
- avcodec/apedec: Fix 2 integer overflows in filter_3800()
- avcodec/xpmdec: Move allocations down after more error checks
- network: Define ENOTCONN as WSAENOTCONN if not defined
- avformat/avidec: Use 64bit for frame number in odml index parsing
- avcodec/mjpegbdec: Skip SOS on AVDISCARD_ALL as does mjpeg
- avcodec/mjpegdec: Check for bits left in mjpeg_decode_scan_progressive_ac()
- avformat/adtsenc: return value check for init_get_bits in adts_decode_extradata
- avcodec/webp: Check available space in loop in decode_entropy_coded_image()
- avcodec/vc1dec: ff_print_debug_info() does not support WMV3 field_mode
- avcodec/frame_thread_encoder: Free AVCodecContext structure on error during init
- avcodec/faxcompr: Check for end of input in cmode == 1 in decode_group3_2d_line()
- avcodec/vc1dec: Disable error concealment for *IMAGE
- avcodec/sbrdsp_fixed: Fix negation overflow in sbr_neg_odd_64_c()
- avformat/wtvdec: Check for EOF before seeking back in parse_media_type()
- avformat/wavdec: Use 64bit in new_pos computation
- avformat/sbgdec: Check for overflow in timestamp preparation
- avformat/dsicin: Check packet size for overflow
- avformat/bfi: check nframes
- avformat/avidec: fix position overflow in avi_load_index()
- avformat/asfdec_f: Check sizeX against padding
- avformat/aiffdec: Check for size overflow in header parsing
- avcodec/aaccoder: Add minimal bias in search_for_ms()
- avfilter/af_drmeter: Check that there is data
- avfilter/vf_mestimate: Check b_count
- avformat/mov: do not ignore errors in mov_metadata_hmmt()
- avformat/mxfdec: Check size for shrinking
- avcodec/dnxhddec: check and propagate function return value
- swscale/slice: Fix wrong return on error
- swscale/slice: Check slice for allocation failure
- avformat/matroskadec: Fix handling of huge default durations
- avcodec/lpc: check for zero err in normalization in compute_lpc_coefs()
- avformat/ftp: Check for av_strtok() failure
- tools/cws2fws: Check read() for failure
- avcodec/cpia: Fix missing src_size update
- avcodec/clearvideo: Check tile_size to be not too large
- avcodec/utils: Use 64bit for intermediate in AV_CODEC_ID_ADPCM_THP* duration calculation
- avformat/rmdec: Check old_format len for overflow
- avformat/realtextdec: Check the pts difference before using it for the duration computation
- avformat/qcp: Avoid negative nb_rates
- avformat/nutdec: Check tmp_size
- avformat/msf: Check that channels doesnt overflow during extradata construction
- avformat/mpc8: Check for position overflow in mpc8_handle_chunk()
- avformat/iff: Use 64bit in duration computation
- avformat/dxa: Check fps to be within the supported range more precissely
- avcodec/iff: Only write palette to plane 1 if its PAL8
- avformat/tta: Check for EOF in index reading loop
- Update missed irc links
- avformat/rpl: The associative law doesnt hold for signed integers in C
- avcodec/faxcompr: Check available bits in decode_uncompressed()
- avcodec/faxcompr: Check if bits are available before reading in cmode == 9 || cmode == 10
- avcodec/utils: do "calc from frame_bytes, channels, and block_align" in 64bit
- avcodec/ttadata: Add sentinel at the end of ff_tta_shift_1
- avformat/mov: Check for duplicate mdcv
- avfilter/vf_dctdnoiz: Check threads
- avfilter/vf_ciescope: Fix undefined behavior in rgb_to_xy() with black
- avformat/rpl: Check for EOF and zero framesize
- avcodec/vc2enc: Check for non negative slice bounds
- avformat/rpl: Use 64bit in bitrate computation and check it
- avcodec/svq1enc: Do not print debug RD value before it has been computed
- avcodec/aacpsy: Check bandwidth
- avcodec/aacenc: Do not divide by lambda_count if it is 0
- avcodec/aacenc: Use FLT_EPSILON for lambda minimum
- avformat/cinedec: Fix index_entries size check
- avfilter/vf_yadif: Fix handing of tiny images
- avfilter/vf_vmafmotion: Check dimensions
- avformat/movenc: Check pal_size before use
- avcodec/lpc: Avoid floating point division by 0
- avcodec/aacpsy: Avoid floating point division by 0 of norm_fac
- avcodec/aacenc: Avoid 0 lambda
- avcodec/exr: x/ymax cannot be INT_MAX
- avformat/avio: Check av_opt_copy() for failure
- avcodec/clearvideo: Check for 0 tile_shift
- avcodec/vc1: Check remaining bits in ff_vc1_parse_frame_header()
- avformat/mov: Ignore duplicate CoLL
- avformat/mov: Limit nb_chapter_tracks to input size
- avformat/utils: Use 64bit earlier in r_frame_rate check
- avformat/mvdec: Check sample rate in parse_audio_var()
- avcodec/faxcompr: Check for end of bitstream in decode_group3_1d_line() and decode_group3_2d_line()
- avcodec/utils: treat PAL8 for jpegs similar to other colorspaces
- avcodec/jpeglsdec: Set alpha plane in PAL8 so image is not 100% transparent
- avformat/asfdec_o: Use ff_get_extradata()
- avformat/id3v2: Check end for overflow in id3v2_parse()
- avformat/wtvdec: Improve size overflow checks in parse_chunks()
- avcodec/faxcompr: Check remaining bits on error in decode_group3_1d_line()
- avcodec/utils: Check ima wav duration for overflow
- avformat/cafdec: Check channels
- avcodec/dpx: Check bits_per_color earlier
- avcodec/pnm_parser: Check image size addition for overflow
- avcodec/h265_metadata_bsf: Check nb_units before accessing the first in h265_metadata_update_fragment()
- avformat/rmdec: use larger intermediate type for audio_framesize * sub_packet_h check
- avcodec/h264_slice: Check input SPS in ff_h264_update_thread_context()
- avcodec/mpegvideo: Update chroma_?_shift in ff_mpv_common_frame_size_change()
- avformat/mov: Ignore multiple STSC / STCO
- avformat/utils: Extend overflow check in dts wrap in compute_pkt_fields()
- avfilter/vf_scale: Fix adding 0 to NULL (which is UB) in scale_slice()
- avutil/common: Add FF_PTR_ADD()
- avformat/wtvdec: Check size in SBE2_STREAM_DESC_EVENT / stream2_guid
- avformat/cafdec: Do not build an index if all packets are the same
- avformat/vividas: Use equals check with n in read_sb_block()
- avcodec/sonic: Use unsigned temporary in predictor_calc_error()
- avformat/jacosubdec: Use 64bit intermediate for start/end timestamp shift
- avformat/flvdec: Check array entry number
- avcodec/h264_slice: Check sps in h264_slice_header_init()
- avformat/movenc: Avoid loosing cluster array on failure
- avformat/avidec: Check for dv streams before using priv_data in parse ##dc/##wb
- avformat/mov: Check sample size for overflow in mov_parse_stsd_audio()
- avcodec/ffwavesynth: Avoid signed integer overflow in phi_at()
- avcodec/mpeg4videoenc: Check extradata malloc()
- avcodec/speedhq: Width < 8 is not supported
- avformat/matroskadec: Check for EOF in resync loop
- avcodec/utils: Use more bits for intermediate for AV_CODEC_ID_ADPCM_MS
- avcodec/jpegls: Check A[Q] for overflow in ff_jpegls_update_state_regular()
- avformat/voc_packet: prevent remaining size from becoming negative in ff_voc_get_packet()
- avutil/timecode: Avoid fps overflow
- avformat/mvi: Check audio size for more overflows
- avcodec/flacdec: Avoid undefined shift in error case
- avcodec/ffv1dec: Check if trailer is available
- avcodec/4xm: Check pre_gb in decode_i_block()
- avcodec/dcadsp: Fix integer overflow in dmix_add_c()
- avformat/flvdec: Check double before cast in parse_keyframes_index()
- avformat/paf: Check for EOF before allocation in read_header()
- avcodec/aacdec_template: Avoid undefined negation in imdct_and_windowing_eld()
- avformat/lxfdec: Fix multiple integer overflows related to track_size
- avcodec/exr: skip bottom clearing loop when its outside the image
- avutil/parseutils: Check sign in av_parse_time()
- avformat/aiffdec: Check that SSND is at least 8 bytes
- avformat/dcstr: Check sample rate
- avcodec/alsdec: Check bitstream input in read_block()
- avformat/mov: Extend data_size check in mov_read_udta_string()
- avformat/aadec: Check for EOF while reading chapters
- avformat/voc_packet: Add a basic check on max_size
- avformat/microdvddec: use 64bit for durations
- avcodec/hapdec: Change compressed_offset to unsigned 32bit
- avformat/rmdec: Check codec_length without overflow
- avformat/mov: Check element count in mov_metadata_hmmt()
- avcodec/vp8: Move end check into MB loop in vp78_decode_mv_mb_modes()
- avcodec/fits: Check gcount and pcount being non negative
- avformat/nutdec: Check timebase count against main header length
- avformat/electronicarts: Clear partial_packet on error
- avformat/r3d: Check samples before computing duration
- avcodec/pnm_parser: Check av_image_get_buffer_size() for failure
- avformat/wavdec: Consider AV_INPUT_BUFFER_PADDING_SIZE in set_spdif()
- avformat/rmdec: Check remaining space in debug av_log() loop
- avformat/flvdec: Treat high ts byte as unsigned
- avformat/samidec: Sanity check pts
- avcodec/jpeg2000dec: Check atom_size in jp2_find_codestream()
- avformat/avidec: Use 64bit in get_duration()
- avformat/mov: Check for duplicate st3d
- avformat/mvdec: Check for EOF in read_index()
- avcodec/jpeglsdec: Fix k=16 in ls_get_code_regular()
- avformat/id3v2: Check the return from avio_get_str()
- avcodec/hevc_sei: Check payload size in decode_nal_sei_message()
- libavutil/eval: Remove CONFIG_TRAPV special handling
- avformat/wtvdec: Check len in parse_chunks() to avoid overflow
- avformat/asfdec_f: Add an additional check for the extradata size
- avformat/3dostr: Check sample_rate
- avformat/4xm: Make audio_frame_count 64bit
- avformat/mov: Use av_mul_q() to avoid integer overflows
- avcodec/vp9dsp_template: Fix integer overflows in itxfm_wrapper
- avformat/rmdec: Reorder operations to avoid overflow
- avcodec/mxpegdec: fix SOF counting
- avcodec/rscc: Check inflated_buf size whan it is used
- avformat/mvdec: Sanity check SAMPLE_WIDTH
- avformat/rmdec: Fix codecdata_length overflow check
- avcodec/simple_idct: Fix undefined integer overflow in idct4row()
- avformat/tta: Use 64bit intermediate for index
- avformat/soxdec: Check channels to be positive
- avcodec/cscd: Check output len in zlib as in lzo
- avcodec/vp3: Check input amount in theora_decode_header()
- avformat/wavdec: Check avio_get_str16le() for failure
- avformat/flvdec: Check for EOF in amf_skip_tag()
- avformat/aiffdec: Check size before subtraction in get_aiff_header()
- avformat/electronicarts: More chunk_size checks
- avcodec/cfhd: check peak.offset
- avformat/tedcaptionsdec: Check for overflow in parse_int()
- avformat/nuv: Check channels
- avformat/mpc8: Check size before implicitly converting to int
- avformat/nutdec: Fix integer overflow in count computation
- avformat/mvi: Use 64bit for testing dimensions
- avformat/utils: Check dts in update_initial_timestamps() more
- avformat/flvdec: Check for avio_read() failure in amf_get_string()
- avformat/flvdec: Check for nesting depth in amf_skip_tag()
- avformat/flvdec: Check for nesting depth in amf_parse_object()
- avformat/asfdec_o: Check for EOF in asf_read_marker()
- avformat/utils: Check dts - (1<<pts_wrap_bits) overflow
- avformat/bfi: Check chunk_header
- avformat/ads: Check size
- avformat/iff: Check block align also for ID_MAUD
- avcodec/utils: Check for integer overflow in get_audio_frame_duration() for ADPCM_DTK
- avformat/fitsdec: Better size checks
- avformat/mxfdec: Fix integer overflow in next position in mxf_read_local_tags()
- avformat/avidec: dv does not support palettes
- libavformat/utils: consider avio_size() failure in ffio_limit()
- avformat/nistspheredec: Check bits_per_coded_sample and channels
- avformat/asfdec_o: Check size vs. offset in detect_unknown_subobject()
- avformat/utils: check for integer overflow in av_get_frame_filename2()
- avutil/timecode: Avoid undefined behavior with large framenum
- avformat/mov: Check a.size before computing next_root_atom
- avformat/sbgdec: Reduce the amount of floating point in str_to_time()
- avformat/mxfdec: Free all types for both Descriptors
- uavformat/rsd: check for EOF in extradata
- avcodec/wmaprodec: Check packet size
- avcodec/rasc: Check frame before clearing
- avformat/vividas: Check number of audio channels
- avcodec/alsdec: Fix integer overflow with quant_cof
- avformat/mpegts: Fix argument type for av_log
- avformat/cafdec: clip sample rate
- avcodec/ffv1dec: Fix off by 1 error with quant tables
- avformat/mpegts: Increase pcr_incr width to 64bit
- avcodec/utils: Check bitrate for overflow in get_bit_rate()
- avformat/mov: Check if hoov is at the end
- avcodec/hevc_ps: check scaling_list_dc_coef
- avformat/iff: Check data_size
- avformat/matroskadec: Sanity check codec_id/track type
- avformat/rpl: Check the number of streams
- avformat/vividas: Check sample_rate
- avformat/vividas: Make len signed
- avcodec/h264idct_template: Fix integer overflow in ff_h264_chroma422_dc_dequant_idct()
- avformat/dsfdec: Check block_align more completely
- avformat/mpc8: Check remaining space in mpc8_parse_seektable()
- avformat/id3v2: Sanity check tlen before alloc and uncompress
- avformat/vqf: Check len for COMM chunks
- avcodec/hevc_cabac: Limit value in coeff_abs_level_remaining_decode() tighter
- avformat/cafdec: Check the return code from av_add_index_entry()
- avformat/cafdec: Check for EOF in index read loop
- avformat/cafdec: Check that bytes_per_packet and frames_per_packet are non negative
- avformat/mpc8: correct integer overflow in mpc8_parse_seektable()
- avformat/mpc8: correct 32bit timestamp truncation
- avcodec/exr: Check ymin vs. h
- avformat/avs: Use 64bit for the avio_tell() output
- avformat/wavdec: More complete size check in find_guid()
- avformat/iff: Check size before skip
- avformat/rmdec: Check for EOF in index packet reading
- avcodec/vp3dsp: Use unsigned constant to avoid undefined integer overflow in ff_vp3dsp_set_bounding_values()
- avformat/icodec: Check for zero streams and stream creation failure
- avformat/icodec: Factor failure code out in read_header()
- avformat/bintext: Check width
- avformat/sbgdec: Check that end is not before start
- avformat/lvfdec: Check stream_index before use
- avformat/au: cleanup on EOF return in au_read_annotation()
- avformat/mpegts: Limit copied data to space
- avformat/bintext: Check width in idf_read_header()
- avformat/iff: check size against INT64_MAX
- avformat/vividas: improve extradata packing checks in track_header()
- avformat/paf: Check for EOF in read_table()
- avformat/gxf: Check pkt_len
- avformat/aiffdec: Check packet size
- avformat/concatdec: use av_strstart()
- avformat/wavdec: Refuse to read chunks bigger than the filesize in w64_read_header()
- avformat/rsd: Check size and start before computing duration
- avformat/vividas: better check of current_sb_entry
- avformat/iff: More completely check body_size
- avformat/xwma: Check for EOF in dpds_table read code
- avcodec/utils: Check sample rate before use for AV_CODEC_ID_BINKAUDIO_DCT in get_audio_frame_duration()
- avcodec/dirac_parser: do not offset AV_NOPTS_OFFSET
- avformat/rmdec: Make expected_len 64bit
- avformat/pcm: Check block_align
- avformat/lrcdec: Clip timestamps
- avformat/electronicarts: Check for EOF in each iteration of the loop in ea_read_packet()
- avformat/ifv: Check that total frames do not overflow
- avcodec/vp9dsp_template: Fix some overflows in iadst8_1d()
- avcodec/fits: Check bscale
- avformat/nistspheredec: Check bps
- avformat/jacosubdec: Use 64bit inside get_shift()
- avformat/genh: Check block_align
- avformat/mvi: Check count for overflow
- avcodec/magicyuv: Check slice size before reading flags and pred
- avformat/asfdec_f: Check for negative ext_len
- avformat/bethsoftvid: Check image dimensions before use
- avformat/genh: Check block_align for how it will be used in SDX2_DPCM
- avformat/au: Check for EOF in au_read_annotation()
- avformat/vividas: Check for zero v_size
- avformat/segafilm: Do not assume AV_CODEC_ID_NONE is 0
- avformat/segafilm: Check that there is a stream
- avformat/wtvdec: Check dir_length
- avformat/ffmetadec: finalize AVBPrint on errors
- avcodec/decode/ff_get_buffer: Check for overflow in FFALIGN()
- avcodec/exr: Check limits to avoid overflow in delta computation
- avformat/boadec: Check that channels and block_align are set
- avformat/asfdec_f: Check name_len for overflow
- avcodec/h264idct_template: Fix integer overflow in ff_h264_chroma422_dc_dequant_idct()
- avcodec/aacdec_fixed: Limit index in vector_pow43()
- avformat/rmdec: sanity check coded_framesize
- avformat/flvdec: Check for EOF in amf_parse_object()
- avcodec/smacker: Check remaining bits in SMK_BLK_FULL
- avcodec/cook: Check subpacket index against max
- avcodec/utils: Check for overflow with ATRAC* in get_audio_frame_duration()
- avcodec/hevcpred_template: Fix diagonal chroma availability in 4:2:2 edge case in intra_pred
- avformat/icodec: Change order of operations to avoid NULL dereference
- avcodec/exr: Fix overflow with many blocks
- avcodec/vp9dsp_template: Fix integer overflows in idct16_1d()
- avcodec/ansi: Check initial dimensions
- avcodec/hevcdec: Check slice_cb_qp_offset / slice_cr_qp_offset
- avcodec/sonic: Check for overread
- avformat/subviewerdec: fail on AV_NOPTS_VALUE
- avcodec/exr: Check line size for overflow
- avcodec/exr: Check xdelta, ydelta
- avcodec/celp_filters: Avoid invalid negation in ff_celp_lp_synthesis_filter()
- avcodec/takdsp: Fix negative shift in decorrelate_sf()
- avcodec/dxtory: Fix negative stride shift in dx2_decode_slice_420()
- avformat/asfdec_f: Change order or operations slightly
- avformat/dxa: Use av_rescale() for duration computation
- avcodec/vc1_block: Fix integer overflow in ac value
- avformat/iff: Check data_size not overflowing int64
- avcodec/dxtory: Fix negative shift in dx2_decode_slice_410()
- avcodec/sonic: Check channels before deallocating
- avformat/vividas: Check for EOF in first loop in track_header()
- avcodec/ansi: Check nb_args for overflow
- avformat/wc3movie: Cleanup on wc3_read_header() failure
- avformat/wc3movie: Move wc3_read_close() up
- avcodec/diracdsp: Fix integer anomaly in dequant_subband_*
- avutil/fixed_dsp: Fix integer overflows in butterflies_fixed_c()
- avcodec/wmalosslessdec: Check remaining space before padding and channel residue
- avformat/cdg: Fix integer overflow in duration computation
- avcodec/mpc: Fix multiple numerical overflows in ff_mpc_dequantize_and_synth()
- avcodec/agm: Fix off by 1 error in decode_inter_plane()
- avformat/electronicarts: Check if there are any streams
- avcodec/ffwavesynth: Fix integer overflow in wavesynth_synth_sample / WS_SINE
- avcodec/vp9dsp_template: Fix integer overflow in iadst8_1d()
- avformat/avidec: Fix io_fsize overflow
- avcodec/cfhd: Check transform type
- avcodec/tiff: Restrict tag order based on specification
- avformat/siff: Reject audio packets without audio stream
- avformat/mpeg: Check avio_read() return value in get_pts()
- avcodec/tiff: Check bpp/bppcount for 0
- avcodec/snowdec: Sanity check hcoeff
- avformat/mov: Check comp_brand_size
- avcodec/alac: Check decorr_shift to avoid invalid shift
- avcodec/tdsc: Fix tile checks
- avcodec/cbs_jpeg: Fix uninitialized end index in cbs_jpeg_split_fragment()
- avcodec/cuviddec: backport extradata fixes
- avcodec/cuviddec: handle arbitrarily sized extradata
- lavf/tls_gnutls: check for interrupt inside handshake loop
- avformat/tls_schannel: immediately return decrypted data if available
- avformat/tls_schannel: always decrypt all received data
- avformat/sdp: Fix potential write beyond end of buffer
- avformat/mm: Check for existence of audio stream
-
-version 4.2.4
- avformat/mov: Fix unaligned read of uint32_t and endian-dependance in mov_read_default
- avcodec/apedec: Fix undefined integer overflow with 24bit
- avcodec/loco: Fix integer overflow with large values from loco_get_rice()
- avformat/smjpegdec: Check the existence of referred streams
- avcodec/pnmdec: Fix misaligned reads
- avcodec/scpr3: Fix out of array access with dectab
- avcodec/dstdec: Replace AC overread check by sample rate check
- avutil/avsscanf: Add () to avoid integer overflow in scanexp()
- avformat/utils: reorder duration computation to avoid overflow
- avcodec/pngdec: Check for fctl after idat
- avformat/hls: Pass a copy of the URL for probing
- avformat/hls: check segment duration value of EXTINF
- avutil/common: Fix integer overflow in av_ceil_log2_c()
- avcodec/wmalosslessdec: fix overflow with pred in revert_cdlms
- avformat/mvdec: Fix integer overflow with billions of channels
- avformat/microdvddec: skip malformed lines without frame number.
- avformat/mxfdec: free duplicated utf16 strings
- avformat/4xm: Check that a video stream was created before returning packets for it
- avcodec/ffwavesynth: Avoid undefined operation on ts overflow
- avcodec/mpeg4videodec: Fix 2 integer overflows in get_amv()
- avcodec/lossless_audiodsp: Fix undefined overflows in scalarproduct_and_madd_int16_c()
- avcodec/sonic: Fix several integer overflows
- avcodec/mpeg4videodec: avoid invalid values and reinitialize in format changes for studio profile
- avcodec/pixlet: Fix log(0) check
- avcodec/iff: Fix off by x error
- avcodec/wmalosslessdec: Check block_align maximum
- avcodec/loco: Fix signed integer overflow in loco_get_rice()
- avformat/thp: Check fps
- avformat/mpl2dec: Fix integer overflow with duration
- avcodec/cbs: Allocate more CodedBitstreamUnit at once in cbs_insert_unit()
- avcodec/mpeg12dec: remove outdated comments
- avcodec/snowdec: Avoid integer overflow with huge qlog
- avformat/mov: Check if DTS is AV_NOPTS_VALUE in mov_find_next_sample().
- avcodec/mpeg12dec: Fix got_output
- avformat/4xm: Cleanup on GET_LIST_HEADER() failure
- avcodec/lzf: Consider the needed size in reallocation
- avformat/mlvdec: fail reading a packet with 0 streams
- avformat/thp: Check compcount
- avcodec/adpcm: XA: Check shift similar to filter
- avcodec/huffyuvdec: Test vertical coordinate more often
- avformat/rawdec: fix identifier names
- avcodec/hq_hqa: Check info size
- avcodec/wmalosslessdec: Fix integer overflow in mclms_predict()
- avcodec/vp9dsp_template: Fix integer overflow(s) in iadst16_1d()
- avcodec/h264dec: Disable forced small_padding on flag2 fast
- avformat/oggparsevorbis: Error out on double init of vp
- avcodec/h264_metadata_bsf: Fix invalid av_freep
- avformat/hnm: Check for extradata allocation failure
- avcodec/bitstream: Don't check for undefined behaviour after it happened
- avformat/avc, mxfenc: Avoid allocation of H264 SPS structure, fix memleak
- avcodec/cbs_av1: Fix writing uvlc numbers >= INT_MAX
- avformat/mov: Fix memleak
- avformat/mov: fix memleaks
- libavformat/mov: Fix memleaks when demuxing DV audio
- avformat/mov: Fix reel_name size check
- avformat/mov: Fix memleak upon encountering repeating tags
- avformat/matroskaenc: Don't use NULL for %s format string
- avformat/webvttdec: Fix memleak upon read header failure
- avformat/vplayerdec: Fix memleak upon read header failure
- avformat/tedcaptionsdec: Fix memleak upon read header failure
- avformat/subviewerdec: Fix memleak upon read header failure
- avformat/subviewer1dec: Fix memleak upon read header failure
- avformat/stldec: Fix memleak upon read header failure
- avformat/srtdec: Fix memleak upon read header failure
- avformat/sccdec: Fix memleak upon read header failure
- avformat/samidec: Fix memleak upon read header failure
- avformat/pjsdec: Fix memleak upon read header failure
- avformat/mpsubdec: Fix memleak upon read header failure
- avformat/mpl2dec: Fix memleak upon read header failure
- avformat/microdvddec: Fix memleak upon read header failure
- avformat/lrcdec: Fix memleak upon read header failure
- avformat/jacosubdec: Fix memleak upon read header failure
- avformat/assdec: Fix memleak upon read header failure
- avformat/aqtitledec: Fix memleak upon read header failure
- avformat/mov: Fix memleaks upon read_header failure
- avformat/omadec: Fix memleaks upon read_header failure
- avformat/matroskadec: Fix memleaks in WebM DASH manifest demuxer
- avformat/matroskadec: Use right number of tracks
- avformat/matroskadec: Fix handling gigantic durations
- avformat/aviobuf: Don't check for overflow after it happened
- avformat/apngenc: Add deinit function
- avcodec/hevc_mp4toannexb_bsf: Check NAL size against available input
- avcodec/nvenc: honor max bitrate in CQ mode
- avcodec/nvenc: zero avg and max bitrate in CQ mode
- libavcodec/libvpxenc: Don't free user-provided AVPacket
- libavcodec/libmp3lame: Don't free user-provided AVPacket
- avcodec/libopusenc: Don't free user-provided AVPacket
-
-version 4.2.3
- avcodec/pnmdec: Use unsigned for maxval rescaling
- avcodec/ivi: Clear got_p_frame before decoding a new frame using it
- avcodec/dsddec: Check channels
- avcodec/xvididct: Fix integer overflow in idct_row()
- avcodec/wmalosslessdec: Fix integer overflows in revert_inter_ch_decorr()
- avcodec/cbs_jpeg: Fix infinite loop in cbs_jpeg_split_fragment()
- avformat/mpegenc: Fix integer overflow with AV_NOPTS_VALUE
- avformat/swfenc: Fix integer overflow in frame rate handling
- avformat/aadec: Check toc_size to contain the minimum to demuxer uses
- avcodec/cbs_h265_syntax_template: Limit num_long_term_pics more strictly
- ffplay: set stream_index to -1 earlier to prevent segfault
- avformat/mov: Free temp buffer upon negative sample_size error.
- avformat/matroskadec: Improve forward compability
- avformat/matroskadec: Don't discard valid packets
- avformat/matroskaenc: Don't segfault when seekability changes
- avformat/utils: Fix memleaks
- avformat/utils: Fix memleaks in avformat_open_input()
- avfilter/vf_dedot: Fix leak of AVFrame if making it writable fails
- avfilter/vf_paletteuse: Fix potential double-free of AVFrame
- avformat/mov: Don't leak MOVFragmentStreamInfo on error
- avformat/mov: Free encryption data on error
- fftools/ffmpeg: Free swresample dictionary during cleanup
- avcodec/mediacodec_wrapper: fix {input,output}_buffers global reference leak
- avformat/webm_chunk: Close IO if writing header fails
- avcodec/cavsdsp: Fix undefined left shifts of negative numbers
- avcodec/ra144enc: Fix invalid left shift of negative number
- avcodec/adxenc: Avoid undefined left shift of negative numbers
- avcodec/adpcm: Fix undefined left shifts of negative numbers
- avcodec/proresenc_anatoliy: Fix invalid left shift of negative number
- avformat/aviobuf: Honor avio_open[2] documentation
- avcodec/cinepakenc: Fix invalid shifts
- avfilter/vf_xbr: Fix left shift of negative number
- avfilter/vf_hqx: Fix undefined left shifts of negative numbers
- avcodec/jpeg2000dwt: Fix undefined shifts of negative numbers
- avcodec/ituh263dec: Fix undefined left shift of negative number
- avcodec/dnxhdenc: Fix undefined left shifts of negative numbers
- swscale/utils: Fix invalid left shifts of negative numbers
- swscale/x86/swscale: Fix undefined left shifts of negative numbers
- fftools/ffmpeg_opt: Fix signed integer overflow
- avcodec/exr: Fix undefined left shifts of negative numbers
- avformat/movenc: Fix undefined shift
- avcodec/pcm: Fix undefined shifts
- avcodec/wavpackenc: Fix undefined shifts
- avutil/encryption_info: Don't pass NULL to memcpy
- avcodec/ac3enc: Fix memleak
- avcodec/ac3enc: Fix invalid shift
- avcodec/g723_1dec: Fix invalid shift
- avcodec/tdsc: Fix undefined shifts
- avcodec/ttaenc: Fix undefined shift
- avformat/avidec: Fix memleak with embedded GAB2 subtitles
- avformat/matroskadec: Don't discard the upper 32bits of TrackNumber
- dump_extradata: Insert extradata even for small packets
- avformat/segafilmenc: Fix undefined left shift of 1 by 31 places
- avformat/wtvdec: Fix memleak when reading header fails
- avformat/dashenc: Fix leak of AVFormatContext on error
- avformat/fitsdec: Fix potential leak of string in AVBPrint
- avformat/matroskadec: Sanitize SeekHead entries
- avformat/matroskaenc: Fix memleak upon encountering bogus chapter
- avformat/matroskaenc: Make ebml_num_size() more robust
- avformat/oggenc: Don't free AVStream's priv_data, fix memleak
- avformat/utils: Fix memleak when decoding subtitle in find_stream_info
- fftools/ffmpeg_opt: Check attachment filesize
- avformat/mpeg: Don't use unintialized value
- avformat/webmdashenc: Check codec types
- avformat/webmdashenc: Fix memleak upon realloc failure
- avformat/subtitles: Don't increment packet counter prematurely
- avformat/bethsoftvid: Fix potential memleak upon reallocation failure
- avformat/smoothstreaming: Fix memleaks on errors
- avformat/matroskaenc: Check BlockAdditional size before use
- avformat/matroskaenc: Check functions that can fail
- avformat/matroskaenc: Check for reformatting errors
- avformat/matroskadec: Check before allocations
- avfilter/vf_unsharp: Don't dereference NULL
- avcodec/zmbvenc: Correct offset in buffer
- avcodec/cbs_h2645: Fix potential out-of-bounds array access
- avformat/mov: Don't allow negative sample sizes.
- mpeg4videoenc: Don't crash with -fsanitize=bounds
- avformat/mpegts: Shuffle avio_seek
- avcodec/binkaudio: Fix 2Ghz sample_rate
- avcodec/adpcm: Fix integer overflow in ADPCM THP
- avcodec/ralf: Check num_blocks before use
- avcodec/iff: Test video_size being non zero
- avcodec/utvideodec: Fix integer overflow in decode_plane()
- avcodec/ttadsp: Fix several integer overflows in tta_filter_process_c()
- avcodec/ralf: Fix integer overflow in decode_block()
- avcodec/nuv: widen buf_size type
- avcodec/iff: Fix several integer overflows
- avcodec/g729postfilter: Clip gain before scaling with AGC_FAC1
- avcodec/alac: Fix integer overflow with 24/20bps samples
- avcodec/dstdec: Check sample rate
- avformat/thp: Require a video stream
- avformat/mpeg: Decrease score by 1 for files with very little valid data
- avcodec/pngdec: Check length in fdAT
- avcodec/g2meet: Check tile_width in epic_jb_decode_tile()
- avcodec/hapdec: Check tex_size more strictly and before using it
- avcodec/vp9dsp_template: Fix integer overflows in idct32_1d()
- avcodec/alacdsp: Fix invalid shift in append_extra_bits()
- libavcodec/wmalosslessdec: prevent sum of positive numbers from becoming negative
- avcodec/dstdec: Fix integer overflow in read_table()
- avcodec/txd: Check for input size against the header size.
- avcodec/svq1dec: Check that there is data left after the header
- avcodec/cbs_h265_syntax_template: Check num_negative/positive_pics when inter_ref_pic_set_prediction_flag is set
- avcodec/intrax8: Check for end of bitstream in ff_intrax8_decode_picture()
- avcodec/hevc_mp4toannexb_bsf: Check nalu_size
- avcodec/iff: Check length before memcpy() in decode_deep_rle32()
- avcodec/iff: Fix invalid pointer intermediates in decode_deep_rle32()
- avcodec/pngdec: Pass ret from decode_iccp_chunk()
- avcodec/rv40dsp: Fix integer overflows in rv40_weight_func_*()
- avcodec/ac3dec_fixed: Fix several invalid left shifts in scale_coefs()
- avcodec/flac_parser: Do not lose header count in find_headers_search()
- avcodec/audiodsp: Fix integer overflow in scalarproduct_int16_c()
- avcodec/cbs_jpeg_syntax_template: Check array index in huffman_table()
- avcodec/cbs_jpeg_syntax_template: Check table index before use in dht()
- avformat/oggdec: Check for EOF after page header
- swscale/yuv2rgb: Fix vertical dither offset with slices
- avcodec/dpcm: clip exponent into supported range in XAN DPCM
- avcodec/flacdsp_template: Fix invalid shifts in decorrelate
- avcodec/xvididct: Fix integer overflow in MULT()
- avcodec/ffwavesynth: Correct undefined overflow of PINK_UNIT
- avcodec/cbs_h264_syntax_template: fix off by 1 error with slice_group_change_cycle
- swscale/output: Fix integer overflow in yuv2rgb_write_full() with out of range input
- swscale/output: Fix integer overflow in alpha computation in yuv2gbrp16_full_X_c()
- libavformat/amr.c: Check return value from avio_read()
- libavformat/mov.c: Free aes_decrypt to avoid leaking memory
- libavformat/oggdec.c: Check return value from avio_read()
- avformat/asfdec_f: Fix overflow check in get_tag()
- avformat/nsvdec: Fix memleaks on errors while reading the header
- avcodec/ffwavesynth: Fix integer overflow in computation of ddphi
- avcodec/cbs_jpeg: Check length for SOS
- avcodec/adpcm: Fix invalid shift in AV_CODEC_ID_ADPCM_PSX
- avcodec/mpeg12dec: Fix invalid shift in mpeg2_fast_decode_block_intra()
- avcodec/cbs_h2645: Treat slices without data as invalid
- avcodec/cbs_h2645: Remove dead code to delete trailing zeroes
- avcodec/cbs_av1_syntax_template: Set seen_frame_header only after successfull uncompressed_header()
- avcodec/mpegaudioenc_template: fix invalid shift of sample
- avcodec/motion_est_template: Fix invalid shifts in no_sub_motion_search()
- libavformat/avienc: Check bits per sample for PAL8
- avformat/mpegts: Improve the position determination for avpriv_mpegts_parse_packet()
- avcodec/magicyuv: Check that there are enough lines for interlacing to be possible
- avformat/mvdec: Check stream numbers
- avcodec/pcm: Fix invalid shift in AV_CODEC_ID_PCM_LXF
- avcodec/qdm2: Check fft_coefs_index
- avformat/utils: Fix integer overflow with complex time bases in avformat_find_stream_info()
- avformat/avidec: Avoid integer overflow in NI switch check
- fftools/ffmpeg: Fix integer overflow in duration computation in seek_to_start()
- avfilter/vf_aspect: Fix integer overflow in compute_dar()
- avcodec/apedec: Fix invalid shift with 24 bps
- avformat/utils: Fix undefined behavior in ff_configure_buffers_for_index()
- avcodec/dpcm: Fix integer overflow in AV_CODEC_ID_GREMLIN_DPCM
- avcodec/wmalosslessdec: Fix integer overflow with sliding in padding bits
- avcodec/wmalosslessdec: Fix loop in revert_acfilter()
- avcodec/agm: YUV420 without DCT needs even dimensions
- avcodec/agm: Test remaining data in decode_raw_intra_rgb()
- avcodec/lagarith: Sanity check scale
- avcodec/apedec: Fix integer overflows in predictor_decode_mono_3950()
- avcodec/ralf: Fix integer overflow in apply_lpc()
- avcodec/dca_lbr: Fix some error codes and error passing
- avcodec/wmavoice: Fix rounding and integer anomalies in calc_input_response()
- avcodec/wmavoice: sanity check block_align
- avcodec/pcm: Fix invalid shift in pcm_decode_frame for LXF
- avcodec/snappy: Sanity check bytestream2_get_levarint()
- avcodec/mlpdsp: Fix a invalid shift in ff_mlp_rematrix_channel()
- avcodec/avdct: Clear IDCTDSPContext context
- avcodec/x86/diracdsp: Fix high bits on Windows x86_64
- tests/fate/lavf-video.mak: fix fate-lavf-gif dependencies
- avformat/mov: Check STCO location
- avcodec/wmalosslessdec: Fix multiple integer overflows
- avcodec/apedec: Fix undefined integer overflow in decode_array_0000()
- avcodec/smacker: Check space before decoding type
- avcodec/rawdec: Use linesize in b64a
- avcodec/iff: Over-allocate ham_palbuf for HAM6 IFF-PBM
- avcodec/x86/diracdsp: Fix incorrect src addressing in dequant_subband_32()
- avfilter/vf_find_rect: Remove assert
- avfilter/vf_find_rect: Increase worst case score
- swscale/input: Fix several invalid shifts related to rgb2yuv constants
- swscale/output: Fix several invalid shifts in yuv2rgb_full_1_c_template()
- swscale/swscale: Fix several invalid shifts related to vChrDrop
- avcodec/hevc_mp4toannexb_bsf: check that nalu size doesnt overflow
- avcodec/hevc_mp4toannexb_bsf: Avoid NULL memcpy()
- avcodec/cbs_av1: Check leb128 values read
- avcodec/wmalosslessdec: move channel check up
- avcodec/cbs_h2645: Skip all 0 NAL units
- avcodec/adpcm: Fix overflow in FFABS() IMA_EA_EACS
- avcodec/alac: Fix integer overflow in LPC coefficient adaption
- avcodec/g729postfilter: Optimize out overflowing multiplication from apply_tilt_comp()
- avcodec/vc1dec: Check field_mode for sprites
- avcodec/vc1dec: Limit bits by the actual bitstream size
- avcodec/vmdaudio: Check block_align more
- configure: bump year
- avcodec/pgssubdec: Free subtitle on error
- avcodec/nvenc: use framerate if available
- avcodec/cbs_h265: fix writing extension_data bits
- avcodec/nvenc: offset dts to account for b-frame reordering
- Revert "avformat/rtp: Pass sources and block filter addresses via sdp file for rtp"
- avformat/matroskadec: Fix default value of BlockAddID
- avformat/dashdec: Don't allocate and leak strings that are never used
- avformat/matroskaenc: Write level 1 elements in one go
- avformat/rtp: Pass sources and block filter addresses via sdp file for rtp
- avformat/bintext: avoid division by zero
-
-
-version 4.2.2
- cbs_mpeg2: Fix parsing the last unit
- cbs_mpeg2: Rearrange start code search
- cbs_mpeg2: Decompose Sequence End
- cbs_mpeg2: Fix parsing of picture and slice headers
- cbs: Remove useless initializations
- mpeg2_metadata, cbs_mpeg2: Fix handling of colour_description
- lavc/cbs_h2645_syntax_template: Fix memleak
- avcodec/cbs: Fix potential overflow
- avcodec/cbs: Factor out common code for writing units
- avcodec/ffwavesynth: Fix undefined overflow in wavesynth_synth_sample()
- avcodec/ffwavesynth: Fix undefined overflow in wavesynth_synth_sample()
- avcodec/cook: Use 3 stage VLC decoding for channel_coupling
- avcodec/wmalosslessdec: Fixes undefined overflow in dequantization in decode_subframe()
- avcodec/sonic: Check e in get_symbol()
- avcodec/twinvqdec: Correct overflow in block align check
- avcodec/vc1dec: Fix "return -1" cases
- avcodec/vc1dec: Free sprite_output_frame on error
- avcodec/atrac9dec: Clamp band_ext_data to max that can be read if skipped.
- avcodec/agm: Include block size in the MV check for flags == 3
- avcodec/wmadec: Keep track of exponent initialization per channel
- avcodec/iff: Check that video_size is large enough for the read parameters
- avcodec/cbs_vp9: Check data_size
- avcodec/cbs_vp9: Check index_size
- avcodec/adpcm: Clip predictor for APC
- avcodec/targa: Check colors vs. available space
- avcodec/dstdec: Use get_ur_golomb_jpegls()
- avcodec/wmavoice: Check remaining input in parse_packet_header()
- avcodec/wmalosslessdec: Fix 2 overflows in mclms
- avcodec/wmaprodec: Fixes integer overflow with 32bit samples
- avcodec/adpcm: Fix invalid shift in xa_decode()
- avcodec/wmalosslessdec: Fix several integer issues
- avcodec/wmalosslessdec: Check that padding bits is not more than sample bits
- avcodec/iff: Skip overflowing runs in decode_delta_d()
- avcodec/pnm: Check that the header is not truncated
- avcodec/mp3_header_decompress_bsf: Check sample_rate_index
- avcodec/cbs_av1_syntax_template: Check num_y_points
- avformat/rmdec: Initialize and sanity check offset in ivr_read_header()
- avcodec/agm: Do not allow MVs out of the picture area as no edge is allocated
- avcodec/apedec: Fix 2 integer overflows
- avformat/id3v2: Fix double-free on error
- avcodec/wmaprodec: Set packet_loss when we error out on a sanity check
- avcodec/wmaprodec: Check offset
- avcodec/truemotion2: Fix 2 integer overflows in tm2_low_res_block()
- avcodec/wmaprodec: Check if the channel sum of all internal contexts match the external
- avcodec/atrac9dec: Check q_unit_cnt more completely before using it to access at9_tab_band_ext_group
- avcodec/fitsdec: Use lrint()
- avcodec/g729dec: Avoid using buf_size
- avcodec/g729dec: Factor block_size out
- avcodec/g729dec: require buf_size to be non 0
- avcodec/alac: Fix integer overflow in lpc_prediction() with sign
- avcodec/wmaprodec: Fix buflen computation in save_bits()
- avcodec/vc1_block: Fix integer overflow in AC rescaling in vc1_decode_i_block_adv()
- avcodec/vmdaudio: Check chunk counts to avoid integer overflow
- avformat/mxfdec: Clear metadata_sets_count in mxf_read_close()
- avcodec/nuv: Use ff_set_dimensions()
- avformat/vividas: Error out on audio packets in the absence of audio streams
- avformat/vividas: Check and require 1 video stream
- avcodec/ffwavesynth: Fix integer overflow with pink_ts_cur/next
- avcodec/ralf: Fix integer overflows with the filter coefficient in decode_channel()
- avcodec/g729dec: Use 64bit and clip in scalar product
- avcodec/mxpegdec: Check for multiple SOF
- avcodec/nuv: Move comptype check up
- avcodec/wmavoice: Fix integer overflow in synth_frame()
- avcodec/rawdec: Check bits_per_coded_sample more pedantically for 16bit cases
- avutil/lfg: Correct index increment type to avoid undefined behavior
- avcodec/cngdec: Remove AV_CODEC_CAP_DELAY
- avcodec/iff: Move index use after check in decodeplane8()
- avcodec/atrac3: Check for huge block aligns
- avcodec/ralf: use multiply instead of shift to avoid undefined behavior in decode_block()
- avcodec/wmadec: Require previous exponents for reuse
- avcodec/vc1_block: Fix undefined behavior in ac prediction rescaling
- avcodec/qdm2: The smallest header seems to have 2 bytes so treat 1 as invalid
- avcodec/apedec: Fixes integer overflow of res+*data in do_apply_filter()
- avcodec/sonic: Fix integer overflow in predictor_calc_error()
- avformat/vividas: Add EOF check in val_1 loop in track_header()
- avcodec/atrac9dec: Check precision_fine/coarse
- avformat/mp3dec: Check that the frame fits within the probe buffer
- vcodec/agm: Alloc based on coded dimensions
- avcodec/wmaprodec: get frame during frame decode
- avcodec/interplayacm: Fix overflow of last unused value
- avcodec/adpcm: Fix undefined behavior with negative predictions in IMA OKI
- avcodec/cook: Move up and extend block_align check
- avcodec/sbcdec: Fix integer overflows in sbc_synthesize_four()
- avcodec/twinvq: Check block_align
- avcodec/cook: Enlarge gain table
- avcodec/cook: Check samples_per_channel earlier
- avcodec/atrac3plus: Check split point in fill mode 3
- avcodec/wmavoice: Check sample_rate
- avcodec/xsubdec: fix overflow in alpha handling
- avcodec/iff: Check available space before entering loop in decode_long_vertical_delta2() / decode_long_vertical_delta()
- avcodec/apedec: Fix integer overflow in filter_3800()
- avutil/lfg: Document the AVLFG struct
- avcodec/ffv1dec: Use a different error message for the slice level CRC
- avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830()
- avcodec/dstdec: Check that AC probabilities are within range
- avcodec/dstdec: Check read_table() for failure
- avformat/vividas: Fix n_sb_blocks Check
- avcodec/snowenc: Set mb_num to avoid ratecontrol floating point divisions by 0.0
- avcodec/snowenc: Fix 2 undefined shifts
- avformat/nutenc: Do not pass NULL to memcmp() in get_needed_flags()
- avcodec/aptx: Check the number of channels
- avcodec/aacdec_template: Check samplerate
- avcodec/truemotion2: Fix several integer overflows in tm2_low_res_block()
- avcodec/utils: Check block_align
- avcodec/wmalosslessdec: Fix some integer anomalies
- avcodec/adpcm: Fix invalid shifts in ADPCM DTK
- avcodec/apedec: Only clear the needed buffer space, instead of all
- avcodec/libvorbisdec: Fix insufficient input checks leading to out of array reads
- avcodec/g723_1dec: fix invalid shift with negative sid_gain
- avcodec/vp5: Check render_x/y
- avcodec/hcom: Check the root entry and the right entries
- avcodec/qdrw: Check input for header/skiped space before get_buffer()
- avcodec/ralf: Skip initializing unused filter variables
- avcodec/takdec: Fix overflow with large sample rates
- avcodec/atrac9dec: Set channels
- avcodec/alsdec: Check that input space for header exists in read_diff_float_data()
- avformat/pjsdec: Check duration for overflow
- avcodec/agm: Check for reference frame earlier
- avcodec/ptx: Check that the input contains at least one line
- avcodec/alac: Fix integer overflow in LPC
- avcodec/smacker: Fix integer overflows in pred[] in smka_decode_frame()
- avcodec/aliaspixdec: Check input size against minimal picture size
- avcodec/ffwavesynth: Fix integer overflows in pink noise addition
- avcodec/vc1_block: Fixes integer overflow in vc1_decode_i_block_adv()
- avcodec/wmalosslessdec: Check block_align
- avcodec/g729dec: Avoid computing invalid temporary pointers for ff_acelp_weighted_vector_sum()
- avcodec/g729postfilter: Fix left shift of negative value
- avcodec/binkaudio: Check sample rate
- avcodec/sbcdec: Fix integer overflows in sbc_synthesize_eight()
- avcodec/adpcm: Check initial predictor for ADPCM_IMA_EA_EACS
- avcodec/g723_1dec: Fix overflow in shift
- avcodec/apedec: Fix integer overflow in predictor_update_3930()
- avcodec/g729postfilter: Fix undefined intermediate pointers
- avcodec/g729postfilter: Fix undefined shifts
- avcodec/lsp: Fix undefined shifts in lsp2poly()
- avcodec/adpcm: Fix left shifts in AV_CODEC_ID_ADPCM_EA
- avformat/shortendec: Check k in probe
- avfilter/vf_geq: Use av_clipd() instead of av_clipf()
- avcodec/wmaprodec: Check that the streams channels do not exceed the overall channels
- avcodec/qdmc: Check input space in qdmc_get_vlc()
- avcodec/wmaprodec: Fix cleanup on error
- avcodec/pcm: Check bits_per_coded_sample
- avcodec/exr: Allow duplicate use of channel indexes
- avcodec/fitsdec: Fail on 0 naxisn
- avcodec/dxv: Subtract 12 earlier in dxv_decompress_cocg()
- libavcodec/dxv: Remove redundant seek
- avcodec/ituh263dec: Check input for minimal frame size
- avcodec/truemotion1: Check that the input has enough space for a minimal index_stream
- avformat/mpsubdec: Clear queue on error
- avcodec/sunrast: Check that the input is large enough for the maximally compressed image
- avcodec/sunrast: Check for availability of maplength before allocating image
- avformat/subtitles: Check nb_subs in ff_subtitles_queue_finalize()
- avcodec/vc1_block: Fix invalid left shift in vc1_decode_p_mb()
- avcodec/wmaprodec: Check if there is a stream
- avcodec/g2meet: Check for end of input in jpg_decode_block()
- avcodec/g2meet: Check if adjusted pixel was on the stack
- avformat/electronicarts: If no packet has been read at the end do not treat it as if theres a packet
- avcodec/dxv: Check op_offset in dxv_decompress_yo()
- avcodec/utils: Check sample_rate before opening the decoder
- avcodec/aptx: Fix multiple shift anomalies
- avcodec/fitsdec: fix use of uninitialised values
- avcodec/motionpixels: Mark 2 functions as always_inline
- avcodec/ituh263dec: Make the condition for the studio slice start code match between ff_h263_resync() and ff_mpeg4_decode_studio_slice_header()
- avcodec/ralf: Fix integer overflow in decode_channel()
- vcodec/vc1: compute rangex/y only for P/B frames
- avcodec/vc1_pred: Fix invalid shifts in scaleforopp()
- avcodec/vc1_block: Fix invalid shift with rangeredfrm
- avcodec/vc1: Check for excessive resolution
- avcodec/vc1: check REFDIST
- avcodec/apedec: Fix several integer overflows in predictor_update_filter() and do_apply_filter()
- avcodec/hevc_cabac: Tighten the limit on k in ff_hevc_cu_qp_delta_abs()
- avcodec/4xm: Check index in decode_i_block() also in the path where its not used.
- avcodec/loco: Check for end of input in the first line
- avcodec/atrac3: Check block_align
- avcodec/alsdec: Avoid dereferencing context pointer in inner interleave loop
- avcodec/hcom: Check that there are dictionary entries
- avcodec/fitsdec: Prevent division by 0 with huge data_max
- avcodec/dstdec: Fix integer overflow in samples_per_frame computation
- avcodec/g729_parser: Check block_size
- avcodec/sbcdec: Initialize number of channels
- avcodec/utils: Optimize ff_color_frame() using memcpy()
- avcodec/aacdec: Check if we run out of input in read_stream_mux_config()
- avcodec/utils: Use av_memcpy_backptr() in ff_color_frame()
- avcodec/smacker: Fix integer overflow in signed int multiply in SMK_BLK_FILL
- avcodec/alac: Fix invalid shifts in 20/24 bps
- avcodec/alac: fix undefined behavior with INT_MIN in lpc_prediction()
- avcodec/ffwavesynth: Fix integer overflow in timestamps
- avformat/vividas: Test size and packet numbers a bit more
- avformat/vividas: Check n_sb_blocks against input space
- avcodec/dxv: Check op_offset in both directions
- avcodec/adpcm: Check number of channels for MTAF
- avcodec/sunrast: Fix indention
- avcodec/sunrast: Fix return type for "unsupported (compression) type"
- avcodec/utils: Check channels fully earlier
- avformat/mov: Check for EOF in mov_read_meta()
- avcodec/hevcdec: Fix memleak of a53_caption
- avformat/vividas: Remove align offset which is always masked off
- avformat/vividas: remove dead assignment
- avformat/cdxl: Fix integer overflow in intermediate
- avcodec/hevcdec: repeat character in skiped
- repeat an even number of characters in occured
- avcodec/gdv: Replace assert() checking bitstream by if()
- libavcodec/utils: Free threads on init failure
- avcodec/htmlsubtitles: Avoid locale dependant isdigit()
- avcodec/alsdec: Check k from being outside what our implementation can handle
- avcodec/takdec: Fix integer overflow in decorrelate()
- avcodec/aacps: Fix integer overflows in hybrid_synthesis()
- avcodec/mpeg4videodec: Fix integer overflow in mpeg4_decode_studio_block()
- avcodec/vp56rac: delay signaling an error on truncated input
- avcodec/pnm_parser: Use memchr() in pnm_parse()
- tests: Fix bash errors in lavf_container tests.
- avformat/matroskadec: Fix use-after-free when demuxing ProRes
- avformat/matroskadec: Fix demuxing ProRes
- avcodec/cbs_av1: fix array size for ar_coeffs_cb_plus_128 and ar_coeffs_cr_plus_128
- avcodec/cbs_av1: avoid reading trailing bits when obu type is OBU_TILE_LIST
- lavc/cbs_h2645: Fix incorrect max size of nalu unit
- avcodec/extract_extradata_bsf: Don't unref uninitialized buffers
- avformat/av1: Fix leak of dynamic buffer in case of parsing failure
- libavformat/rtsp: return error if rtsp_hd_out is null instead of crash
- cbs_h264: Fix missing inferred colour description fields
- avcodec/cbs_av1: keep separate reference frame state for reading and writing
- avcodec/cbs_av1: fix reading reference order hint in skip_mode_params()
- avcodec/amfnec: allocate packets using av_new_packet()
- avcodec/nvenc: make sure newly allocated packets are refcounted
- lavc/mpeg4audio: add chan_config check to avoid indeterminate channels
- aformat/movenc: add missing padding to output track extradata
- avcodec/nvenc: add driver version info for SDK 9.1
- avcodec/bsf: check that AVBSFInternal was allocated before dereferencing it
-
-version 4.2.1:
- avformat/vividas: check for tiny blocks using alignment
- avcodec/vc1_pred: Fix refdist in scaleforopp()
- avcodec/vorbisdec: fix FASTDIV usage for vr_type == 2
- avcodec/iff: Check for overlap in cmap_read_palette()
- avcodec/apedec: Fix 32bit int overflow in do_apply_filter()
- lavf/rawenc: Only accept the appropriate stream type for raw muxers.
- avformat/matroskadec: use av_fast_realloc to reallocate ebml list arrays
- avformat/matroskadec: use proper types for some EbmlSyntax fields
- avcodec/ralf: fix undefined shift in extend_code()
- avcodec/ralf: fix undefined shift
- avcodec/bgmc: Check input space in ff_bgmc_decode_init()
- avcodec/vp3: Check for end of input in 2 places of vp4_unpack_macroblocks()
- avcodec/truemotion2: Fix multiple integer overflows in tm2_null_res_block()
- avcodec/vc1_block: Check the return code from vc1_decode_p_block()
- avcodec/vc1dec: Require res_sprite for wmv3images
- avcodec/vc1_block: Check for double escapes
- avcodec/vorbisdec: Check get_vlc2() failure
- avcodec/tta: Fix integer overflow in prediction
- avcodec/vb: Check input packet size to be large enough to contain flags
- avcodec/cavsdec: Limit the number of access units per packet to 2
- avcodec/atrac9dec: Check block_align
- avcodec/alac: Check for bps of 0
- avcodec/alac: Fix multiple integer overflows in lpc_prediction()
- avcodec/rl2: set dimensions
- avcodec/aacdec: Add FF_CODEC_CAP_INIT_CLEANUP
- avcodec/idcinvideo: Add 320x240 default maximum resolution
- avformat/realtextdec: free queue on error
- avcodec/vp5/6/8: use vpX_rac_is_end()
- avformat/vividas: Check av_xiphlacing() return value before use
- avcodec/alsdec: Fix integer overflow in decode_var_block_data()
- avcodec/alsdec: Limit maximum channels to 512
- avcodec/anm: Check input size for a frame with just a stop code
- avcodec/flicvideo: Optimize and Simplify FLI_COPY in flic_decode_frame_24BPP() by using bytestream2_get_buffer()
- avcodec/loco: Check left column value
- avcodec/ffwavesynth: Fixes invalid shift with pink noise seeking
- avcodec/ffwavesynth: Fix integer overflow for some corner case values
- avcodec/indeo2: Check remaining input more often
- avcodec/diracdec: Check that slices are fewer than pixels
- avcodec/vp56: Consider the alpha start as end of the prior header
- avcodec/4xm: Check for end of input in decode_p_block()
- avcodec/hevcdec: Check delta_luma_weight_l0/1
- avcodec/hnm4video: Optimize postprocess_current_frame()
- avcodec/hevc_refs: Optimize 16bit generate_missing_ref()
- avcodec/scpr: Use av_memcpy_backptr() in type 17 and 33
- avcodec/tiff: Enforce increasing offsets
- avcodec/dds: Use ff_set_dimensions()
- avformat/vividas: Fix another infinite loop
- avformat/vividas: Fix infinite loop in header parser
- avcodec/mpc8: Fix 32bit mask/enum
- avcodec/alsdec: Fix integer overflows of raw_samples in decode_var_block_data()
- avcodec/alsdec: Fix integer overflow of raw_samples in decode_blocks()
- avcodec/alsdec: fix mantisse shift
- avcodec/pngdec: consider chunk size in minimal size check
- avcodec/vc1_block: Fix invalid shifts in vc1_decode_i_blocks()
- avcodec/vc1_block: fix invalid shift in vc1_decode_p_mb()
- avcodec/aacdec_template: fix integer overflow in imdct_and_windowing()
- avformat/mpegts: Check if ready on SCTE reception
- avcodec/omx: fix xFramerate calculation
- avformat/avidec: add support for recognizing HEVC fourcc when demuxing
- avformat/mpegts: fix teletext PTS when selecting teletext streams only
- avcodec/h2645_parse: zero initialize the rbsp buffer
- avcodec/omx: Fix handling of fragmented buffers
- avcodec/omx: ensure zerocopy mode can be disabled on rpi builds
- avformat/mxfdec: do not ignore bad size errors
- avformat/matroskadec: Fix seeking
- ffplay: properly detect all window size changes
-
 version 4.2:
 - tpad filter
 - AV1 decoding support through libdav1d
@@ -988,7 +36,6 @@ version 4.2:
 - derain filter
 - deesser filter
 - mov muxer writes tracks with unspecified language instead of English by default
- add support for using clang to compile CUDA kernels


 version 4.1:
@@ -1 +1 @@
-4.2.5
+4.1.git
@@ -1,15 +0,0 @@
-
-              ┌────────────────────────────────────┐
-              │ RELEASE NOTES for FFmpeg 4.2 "Ada" │
-              └────────────────────────────────────┘
-
-   The FFmpeg Project proudly presents FFmpeg 4.2 "Ada", about 8
-   months after the release of FFmpeg 4.1.
-
-   A complete Changelog is available at the root of the project, and the
-   complete Git history on https://git.ffmpeg.org/gitweb/ffmpeg.git
-
-   We hope you will like this release as much as we enjoyed working on it, and
-   as usual, if you have any questions about it, or any FFmpeg related topic,
-   feel free to join us on the #ffmpeg IRC channel (on irc.libera.chat) or ask
-   on the mailing-lists.
@@ -1,131 +0,0 @@
-/*
- * Minimum CUDA compatibility definitions header
- *
- * Copyright (c) 2019 Rodger Combs
- *
- * This file is part of FFmpeg.
- *
- * FFmpeg is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * FFmpeg is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with FFmpeg; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
- */
-
-#ifndef COMPAT_CUDA_CUDA_RUNTIME_H
-#define COMPAT_CUDA_CUDA_RUNTIME_H
-
-// Common macros
-#define __global__ __attribute__((global))
-#define __device__ __attribute__((device))
-#define __device_builtin__ __attribute__((device_builtin))
-#define __align__(N) __attribute__((aligned(N)))
-#define __inline__ __inline__ __attribute__((always_inline))
-
-#define max(a, b) ((a) > (b) ? (a) : (b))
-#define min(a, b) ((a) < (b) ? (a) : (b))
-#define abs(x) ((x) < 0 ? -(x) : (x))
-
-#define atomicAdd(a, b) (__atomic_fetch_add(a, b, __ATOMIC_SEQ_CST))
-
-// Basic typedefs
-typedef __device_builtin__ unsigned long long cudaTextureObject_t;
-
-typedef struct __device_builtin__ __align__(2) uchar2
-{
-    unsigned char x, y;
-} uchar2;
-
-typedef struct __device_builtin__ __align__(4) ushort2
-{
-    unsigned short x, y;
-} ushort2;
-
-typedef struct __device_builtin__ uint3
-{
-    unsigned int x, y, z;
-} uint3;
-
-typedef struct uint3 dim3;
-
-typedef struct __device_builtin__ __align__(8) int2
-{
-    int x, y;
-} int2;
-
-typedef struct __device_builtin__ __align__(4) uchar4
-{
-    unsigned char x, y, z, w;
-} uchar4;
-
-typedef struct __device_builtin__ __align__(8) ushort4
-{
-    unsigned char x, y, z, w;
-} ushort4;
-
-typedef struct __device_builtin__ __align__(16) int4
-{
-    int x, y, z, w;
-} int4;
-
-// Accessors for special registers
-#define GETCOMP(reg, comp) \
-    asm("mov.u32 %0, %%" #reg "." #comp ";" : "=r"(tmp)); \
-    ret.comp = tmp;
-
-#define GET(name, reg) static inline __device__ uint3 name() {\
-    uint3 ret; \
-    unsigned tmp; \
-    GETCOMP(reg, x) \
-    GETCOMP(reg, y) \
-    GETCOMP(reg, z) \
-    return ret; \
-}
-
-GET(getBlockIdx, ctaid)
-GET(getBlockDim, ntid)
-GET(getThreadIdx, tid)
-
-// Instead of externs for these registers, we turn access to them into calls into trivial ASM
-#define blockIdx (getBlockIdx())
-#define blockDim (getBlockDim())
-#define threadIdx (getThreadIdx())
-
-// Basic initializers (simple macros rather than inline functions)
-#define make_uchar2(a, b) ((uchar2){.x = a, .y = b})
-#define make_ushort2(a, b) ((ushort2){.x = a, .y = b})
-#define make_uchar4(a, b, c, d) ((uchar4){.x = a, .y = b, .z = c, .w = d})
-#define make_ushort4(a, b, c, d) ((ushort4){.x = a, .y = b, .z = c, .w = d})
-
-// Conversions from the tex instruction's 4-register output to various types
-#define TEX2D(type, ret) static inline __device__ void conv(type* out, unsigned a, unsigned b, unsigned c, unsigned d) {*out = (ret);}
-
-TEX2D(unsigned char, a & 0xFF)
-TEX2D(unsigned short, a & 0xFFFF)
-TEX2D(uchar2, make_uchar2(a & 0xFF, b & 0xFF))
-TEX2D(ushort2, make_ushort2(a & 0xFFFF, b & 0xFFFF))
-TEX2D(uchar4, make_uchar4(a & 0xFF, b & 0xFF, c & 0xFF, d & 0xFF))
-TEX2D(ushort4, make_ushort4(a & 0xFFFF, b & 0xFFFF, c & 0xFFFF, d & 0xFFFF))
-
-// Template calling tex instruction and converting the output to the selected type
-template <class T>
-static inline __device__ T tex2D(cudaTextureObject_t texObject, float x, float y)
-{
-  T ret;
-  unsigned ret1, ret2, ret3, ret4;
-  asm("tex.2d.v4.u32.f32 {%0, %1, %2, %3}, [%4, {%5, %6}];" :
-      "=r"(ret1), "=r"(ret2), "=r"(ret3), "=r"(ret4) :
-      "l"(texObject), "f"(x), "f"(y));
-  conv(&ret, ret1, ret2, ret3, ret4);
-  return ret;
-}
-
-#endif /* COMPAT_CUDA_CUDA_RUNTIME_H */
@@ -16,8 +16,8 @@
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

-#ifndef COMPAT_CUDA_DYNLINK_LOADER_H
-#define COMPAT_CUDA_DYNLINK_LOADER_H
+#ifndef AV_COMPAT_CUDA_DYNLINK_LOADER_H
+#define AV_COMPAT_CUDA_DYNLINK_LOADER_H

 #include "libavutil/log.h"
 #include "compat/w32dlfcn.h"
@@ -30,4 +30,4 @@

 #include <ffnvcodec/dynlink_loader.h>

-#endif /* COMPAT_CUDA_DYNLINK_LOADER_H */
+#endif
@@ -322,7 +322,6 @@ External library support:
  --disable-amf            disable AMF video encoding code [autodetect]
  --disable-audiotoolbox   disable Apple AudioToolbox code [autodetect]
  --enable-cuda-nvcc       enable Nvidia CUDA compiler [no]
-  --disable-cuda-llvm      disable CUDA compilation using clang [autodetect]
  --disable-cuvid          disable Nvidia CUVID support [autodetect]
  --disable-d3d11va        disable Microsoft Direct3D 11 video acceleration code [autodetect]
  --disable-dxva2          disable Microsoft DirectX 9 video acceleration code [autodetect]
@@ -371,7 +370,7 @@ Toolchain options:
  --cxx=CXX                use C compiler CXX [$cxx_default]
  --objcc=OCC              use ObjC compiler OCC [$cc_default]
  --dep-cc=DEPCC           use dependency generator DEPCC [$cc_default]
-  --nvcc=NVCC              use Nvidia CUDA compiler NVCC or clang [$nvcc_default]
+  --nvcc=NVCC              use Nvidia CUDA compiler NVCC [$nvcc_default]
  --ld=LD                  use linker LD [$ld_default]
  --pkg-config=PKGCONFIG   use pkg-config tool PKGCONFIG [$pkg_config_default]
  --pkg-config-flags=FLAGS pass additional flags to pkgconf []
@@ -526,7 +525,7 @@ die(){

 If you think configure made a mistake, make sure you are using the latest
 version from Git.  If the latest version fails, report the problem to the
-ffmpeg-user@ffmpeg.org mailing list or IRC #ffmpeg on irc.libera.chat.
+ffmpeg-user@ffmpeg.org mailing list or IRC #ffmpeg on irc.freenode.net.
 EOF
    if disabled logging; then
        cat <<EOF
@@ -1039,16 +1038,12 @@ test_nvcc(){
    tmpcu_=$TMPCU
    tmpo_=$TMPO
    [ -x "$(command -v cygpath)" ] && tmpcu_=$(cygpath -m $tmpcu_) && tmpo_=$(cygpath -m $tmpo_)
-    test_cmd $nvcc $nvccflags "$@" $NVCC_C $(nvcc_o $tmpo_) $tmpcu_
+    test_cmd $nvcc -ptx $NVCCFLAGS "$@" $NVCC_C $(nvcc_o $tmpo_) $tmpcu_
 }

 check_nvcc() {
    log check_nvcc "$@"
-    name=$1
-    shift 1
-    disabled $name && return
-    disable $name
-    test_nvcc "$@" <<EOF && enable $name
+    test_nvcc <<EOF
 extern "C" {
    __global__ void hello(unsigned char *data) {}
 }
@@ -1819,7 +1814,6 @@ HWACCEL_AUTODETECT_LIBRARY_LIST="
    audiotoolbox
    crystalhd
    cuda
-    cuda_llvm
    cuvid
    d3d11va
    dxva2
@@ -2993,10 +2987,8 @@ v4l2_m2m_deps="linux_videodev2_h sem_timedwait"

 hwupload_cuda_filter_deps="ffnvcodec"
 scale_npp_filter_deps="ffnvcodec libnpp"
-scale_cuda_filter_deps="ffnvcodec"
-scale_cuda_filter_deps_any="cuda_nvcc cuda_llvm"
-thumbnail_cuda_filter_deps="ffnvcodec"
-thumbnail_cuda_filter_deps_any="cuda_nvcc cuda_llvm"
+scale_cuda_filter_deps="ffnvcodec cuda_nvcc"
+thumbnail_cuda_filter_deps="ffnvcodec cuda_nvcc"
 transpose_npp_filter_deps="ffnvcodec libnpp"

 amf_deps_any="libdl LoadLibrary"
@@ -3555,8 +3547,7 @@ zscale_filter_deps="libzimg const_nan"
 scale_vaapi_filter_deps="vaapi"
 vpp_qsv_filter_deps="libmfx"
 vpp_qsv_filter_select="qsvvpp"
-yadif_cuda_filter_deps="ffnvcodec"
-yadif_cuda_filter_deps_any="cuda_nvcc cuda_llvm"
+yadif_cuda_filter_deps="ffnvcodec cuda_nvcc"

 # examples
 avio_dir_cmd_deps="avformat avutil"
@@ -3660,6 +3651,8 @@ version_script='--version-script'
 objformat="elf32"
 x86asmexe_default="nasm"
 windres_default="windres"
+nvcc_default="nvcc"
+nvccflags_default="-gencode arch=compute_30,code=sm_30 -O2"
 striptype="direct"

 # OS
@@ -4227,20 +4220,6 @@ windres_default="${cross_prefix}${windres_default}"

 sysinclude_default="${sysroot}/usr/include"

-if enabled cuda_sdk; then
-    warn "Option --enable-cuda-sdk is deprecated. Use --enable-cuda-nvcc instead."
-    enable cuda_nvcc
-fi
-
-if enabled cuda_nvcc; then
-    nvcc_default="nvcc"
-    nvccflags_default="-gencode arch=compute_30,code=sm_30 -O2"
-else
-    nvcc_default="clang"
-    nvccflags_default="--cuda-gpu-arch=sm_30 -O2"
-    NVCC_C=""
-fi
-
 set_default arch cc cxx doxygen pkg_config ranlib strip sysinclude \
    target_exec x86asmexe nvcc
 enabled cross_compile || host_cc_default=$cc
@@ -6081,21 +6060,9 @@ check_type "d3d9.h dxva2api.h" DXVA2_ConfigPictureDecode -D_WIN32_WINNT=0x0602

 check_type "vdpau/vdpau.h" "VdpPictureInfoHEVC"

-if [ -z "$nvccflags" ]; then
-    nvccflags=$nvccflags_default
-fi
-
-if enabled x86_64 || enabled ppc64 || enabled aarch64; then
-    nvccflags="$nvccflags -m64"
-else
-    nvccflags="$nvccflags -m32"
-fi
-
-if enabled cuda_nvcc; then
-    nvccflags="$nvccflags -ptx"
-else
-    nvccflags="$nvccflags -S -nocudalib -nocudainc --cuda-device-only -include ${source_link}/compat/cuda/cuda_runtime.h"
-    check_nvcc cuda_llvm
+if enabled cuda_sdk; then
+    warn "Option --enable-cuda-sdk is deprecated. Use --enable-cuda-nvcc instead."
+    enable cuda_nvcc
 fi

 if ! disabled ffnvcodec; then
@@ -6173,7 +6140,7 @@ for func in $COMPLEX_FUNCS; do
 done

 # these are off by default, so fail if requested and not available
-enabled cuda_nvcc         && { check_nvcc cuda_nvcc || die "ERROR: failed checking for nvcc."; }
+enabled cuda_nvcc         && { check_nvcc || die "ERROR: failed checking for nvcc."; }
 enabled chromaprint       && require chromaprint chromaprint.h chromaprint_get_version -lchromaprint
 enabled decklink          && { require_headers DeckLinkAPI.h &&
                               { test_cpp_condition DeckLinkAPIVersion.h "BLACKMAGIC_DECKLINK_API_VERSION >= 0x0a090500" || die "ERROR: Decklink API version must be >= 10.9.5."; } }
@@ -6734,6 +6701,16 @@ if [ -z "$optflags" ]; then
    fi
 fi

+if [ -z "$nvccflags" ]; then
+    nvccflags=$nvccflags_default
+fi
+
+if enabled x86_64 || enabled ppc64 || enabled aarch64; then
+    nvccflags="$nvccflags -m64"
+else
+    nvccflags="$nvccflags -m32"
+fi
+
 check_optflags(){
    check_cflags "$@"
    enabled lto && check_ldflags "$@"
@@ -7397,7 +7374,7 @@ cat > $TMPH <<EOF
 #define FFMPEG_CONFIG_H
 #define FFMPEG_CONFIGURATION "$(c_escape $FFMPEG_CONFIGURATION)"
 #define FFMPEG_LICENSE "$(c_escape $license)"
-#define CONFIG_THIS_YEAR 2021
+#define CONFIG_THIS_YEAR 2019
 #define FFMPEG_DATADIR "$(eval c_escape $datadir)"
 #define AVCONV_DATADIR "$(eval c_escape $datadir)"
 #define CC_IDENT "$(c_escape ${cc_ident:-Unknown compiler})"
@@ -38,7 +38,7 @@ PROJECT_NAME           = FFmpeg
 # could be handy for archiving the generated documentation or if some version
 # control system is used.

-PROJECT_NUMBER         = 4.2.5
+PROJECT_NUMBER         =

 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
@@ -418,4 +418,4 @@ done:

 When all of this is done, you can submit your patch to the ffmpeg-devel
 mailing-list for review.  If you need any help, feel free to come on our IRC
-channel, #ffmpeg-devel on irc.libera.chat.
+channel, #ffmpeg-devel on irc.freenode.net.
@@ -38,6 +38,7 @@ OBJCCFLAGS  = $(CPPFLAGS) $(CFLAGS) $(OBJCFLAGS)
 ASFLAGS    := $(CPPFLAGS) $(ASFLAGS)
 CXXFLAGS   := $(CPPFLAGS) $(CFLAGS) $(CXXFLAGS)
 X86ASMFLAGS += $(IFLAGS:%=%/) -I$(<D)/ -Pconfig.asm
+NVCCFLAGS  += -ptx

 HOSTCCFLAGS = $(IFLAGS) $(HOSTCPPFLAGS) $(HOSTCFLAGS)
 LDFLAGS    := $(ALLFFLIBS:%=$(LD_PATH)lib%) $(LDFLAGS)
@@ -90,7 +91,7 @@ COMPILE_NVCC = $(call COMPILE,NVCC)
 %.h.c:
 	$(Q)echo '#include "$*.h"' >$@

-%.ptx: %.cu $(SRC_PATH)/compat/cuda/cuda_runtime.h
+%.ptx: %.cu
 	$(COMPILE_NVCC)

 %.ptx.c: %.ptx
@@ -567,7 +567,6 @@ static void ffmpeg_cleanup(int ret)
        ost->audio_channels_mapped = 0;

        av_dict_free(&ost->sws_dict);
-        av_dict_free(&ost->swr_opts);

        avcodec_free_context(&ost->enc_ctx);
        avcodec_parameters_free(&ost->ref_par);
@@ -4236,8 +4235,7 @@ static int seek_to_start(InputFile *ifile, AVFormatContext *is)
            ifile->time_base = ist->st->time_base;
        /* the total duration of the stream, max_pts - min_pts is
         * the duration of the stream without the last frame */
-        if (ist->max_pts > ist->min_pts && ist->max_pts - (uint64_t)ist->min_pts < INT64_MAX - duration)
-            duration += ist->max_pts - ist->min_pts;
+        duration += ist->max_pts - ist->min_pts;
        ifile->time_base = duration_max(duration, &ifile->duration, ist->st->time_base,
                                        ifile->time_base);
    }
@@ -1,4 +1,3 @@
-
 /*
 * ffmpeg option parsing
 *
@@ -2373,14 +2372,12 @@ loop_end:
                   o->attachments[i]);
            exit_program(1);
        }
-        if (len > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE ||
-            !(attachment = av_malloc(len + AV_INPUT_BUFFER_PADDING_SIZE))) {
-            av_log(NULL, AV_LOG_FATAL, "Attachment %s too large.\n",
+        if (!(attachment = av_malloc(len))) {
+            av_log(NULL, AV_LOG_FATAL, "Attachment %s too large to fit into memory.\n",
                   o->attachments[i]);
            exit_program(1);
        }
        avio_read(pb, attachment, len);
-        memset(attachment + len, 0, AV_INPUT_BUFFER_PADDING_SIZE);

        ost = new_attachment_stream(o, oc, -1);
        ost->stream_copy               = 0;
@@ -2772,14 +2769,13 @@ static int opt_target(void *optctx, const char *opt, const char *arg)
    } else {
        /* Try to determine PAL/NTSC by peeking in the input files */
        if (nb_input_files) {
-            int i, j;
+            int i, j, fr;
            for (j = 0; j < nb_input_files; j++) {
                for (i = 0; i < input_files[j]->nb_streams; i++) {
                    AVStream *st = input_files[j]->ctx->streams[i];
-                    int64_t fr;
                    if (st->codecpar->codec_type != AVMEDIA_TYPE_VIDEO)
                        continue;
-                    fr = st->time_base.den * 1000LL / st->time_base.num;
+                    fr = st->time_base.den * 1000 / st->time_base.num;
                    if (fr == 25000) {
                        norm = PAL;
                        break;
@@ -2760,6 +2760,9 @@ static int read_thread(void *arg)
    }

    memset(st_index, -1, sizeof(st_index));
+    is->last_video_stream = is->video_stream = -1;
+    is->last_audio_stream = is->audio_stream = -1;
+    is->last_subtitle_stream = is->subtitle_stream = -1;
    is->eof = 0;

    ic = avformat_alloc_context();
@@ -3065,9 +3068,6 @@ static VideoState *stream_open(const char *filename, AVInputFormat *iformat)
    is = av_mallocz(sizeof(VideoState));
    if (!is)
        return NULL;
-    is->last_video_stream = is->video_stream = -1;
-    is->last_audio_stream = is->audio_stream = -1;
-    is->last_subtitle_stream = is->subtitle_stream = -1;
    is->filename = av_strdup(filename);
    if (!is->filename)
        goto fail;
@@ -3436,7 +3436,7 @@ static void event_loop(VideoState *cur_stream)
            break;
        case SDL_WINDOWEVENT:
            switch (event.window.event) {
-                case SDL_WINDOWEVENT_SIZE_CHANGED:
+                case SDL_WINDOWEVENT_RESIZED:
                    screen_width  = cur_stream->width  = event.window.data1;
                    screen_height = cur_stream->height = event.window.data2;
                    if (cur_stream->vis_texture) {
@@ -351,8 +351,6 @@ static int decode_p_block(FourXContext *f, uint16_t *dst, const uint16_t *src,
    index = size2index[log2h][log2w];
    av_assert0(index >= 0);

-    if (get_bits_left(&f->gb) < 1)
-        return AVERROR_INVALIDDATA;
    h     = 1 << log2h;
    code  = get_vlc2(&f->gb, block_type_vlc[1 - (f->version > 1)][index].table,
                     BLOCK_TYPE_VLC_BITS, 1);
@@ -498,8 +496,8 @@ static int decode_i_block(FourXContext *f, int16_t *block)
 {
    int code, i, j, level, val;

-    if (get_bits_left(&f->pre_gb) < 2) {
-        av_log(f->avctx, AV_LOG_ERROR, "%d bits left before decode_i_block()\n", get_bits_left(&f->pre_gb));
+    if (get_bits_left(&f->gb) < 2){
+        av_log(f->avctx, AV_LOG_ERROR, "%d bits left before decode_i_block()\n", get_bits_left(&f->gb));
        return AVERROR_INVALIDDATA;
    }

@@ -525,10 +523,6 @@ static int decode_i_block(FourXContext *f, int16_t *block)
            break;
        if (code == 0xf0) {
            i += 16;
-            if (i >= 64) {
-                av_log(f->avctx, AV_LOG_ERROR, "run %d overflow\n", i);
-                return 0;
-            }
        } else {
            if (code & 0xf) {
                level = get_xbits(&f->gb, code & 0xf);
@@ -843,25 +843,25 @@ static void search_for_ms(AACEncContext *s, ChannelElement *cpe)
                                                    sce0->ics.swb_sizes[g],
                                                    sce0->sf_idx[w*16+g],
                                                    sce0->band_type[w*16+g],
-                                                    lambda / (band0->threshold + FLT_MIN), INFINITY, &b1, NULL, 0);
+                                                    lambda / band0->threshold, INFINITY, &b1, NULL, 0);
                        dist1 += quantize_band_cost(s, &sce1->coeffs[start + (w+w2)*128],
                                                    R34,
                                                    sce1->ics.swb_sizes[g],
                                                    sce1->sf_idx[w*16+g],
                                                    sce1->band_type[w*16+g],
-                                                    lambda / (band1->threshold + FLT_MIN), INFINITY, &b2, NULL, 0);
+                                                    lambda / band1->threshold, INFINITY, &b2, NULL, 0);
                        dist2 += quantize_band_cost(s, M,
                                                    M34,
                                                    sce0->ics.swb_sizes[g],
                                                    mididx,
                                                    midcb,
-                                                    lambda / (minthr + FLT_MIN), INFINITY, &b3, NULL, 0);
+                                                    lambda / minthr, INFINITY, &b3, NULL, 0);
                        dist2 += quantize_band_cost(s, S,
                                                    S34,
                                                    sce1->ics.swb_sizes[g],
                                                    sididx,
                                                    sidcb,
-                                                    mslambda / (minthr * bmax + FLT_MIN), INFINITY, &b4, NULL, 0);
+                                                    mslambda / (minthr * bmax), INFINITY, &b4, NULL, 0);
                        B0 += b1+b2;
                        B1 += b3+b4;
                        dist1 -= b1+b2;
@@ -409,8 +409,6 @@ static int read_stream_mux_config(struct LATMContext *latmctx,
            } else {
                int esc;
                do {
-                    if (get_bits_left(gb) < 9)
-                        return AVERROR_INVALIDDATA;
                    esc = get_bits(gb, 1);
                    skip_bits(gb, 8);
                } while (esc);
@@ -561,7 +559,7 @@ AVCodec ff_aac_decoder = {
        AV_SAMPLE_FMT_FLTP, AV_SAMPLE_FMT_NONE
    },
    .capabilities    = AV_CODEC_CAP_CHANNEL_CONF | AV_CODEC_CAP_DR1,
-    .caps_internal   = FF_CODEC_CAP_INIT_THREADSAFE | FF_CODEC_CAP_INIT_CLEANUP,
+    .caps_internal   = FF_CODEC_CAP_INIT_THREADSAFE,
    .channel_layouts = aac_channel_layout,
    .flush = flush,
    .priv_class      = &aac_decoder_class,
@@ -586,7 +584,7 @@ AVCodec ff_aac_latm_decoder = {
        AV_SAMPLE_FMT_FLTP, AV_SAMPLE_FMT_NONE
    },
    .capabilities    = AV_CODEC_CAP_CHANNEL_CONF | AV_CODEC_CAP_DR1,
-    .caps_internal   = FF_CODEC_CAP_INIT_THREADSAFE | FF_CODEC_CAP_INIT_CLEANUP,
+    .caps_internal   = FF_CODEC_CAP_INIT_THREADSAFE,
    .channel_layouts = aac_channel_layout,
    .flush = flush,
    .profiles        = NULL_IF_CONFIG_SMALL(ff_aac_profiles),
@@ -155,9 +155,9 @@ static void vector_pow43(int *coefs, int len)
    for (i=0; i<len; i++) {
        coef = coefs[i];
        if (coef < 0)
-            coef = -(int)ff_cbrt_tab_fixed[(-coef) & 8191];
+            coef = -(int)ff_cbrt_tab_fixed[-coef];
        else
-            coef =  (int)ff_cbrt_tab_fixed[  coef  & 8191];
+            coef = (int)ff_cbrt_tab_fixed[coef];
        coefs[i] = coef;
    }
 }
@@ -1157,9 +1157,6 @@ static av_cold int aac_decode_init(AVCodecContext *avctx)
    AACContext *ac = avctx->priv_data;
    int ret;

-    if (avctx->sample_rate > 96000)
-        return AVERROR_INVALIDDATA;
-
    ret = ff_thread_once(&aac_table_init, &aac_static_table_init);
    if (ret != 0)
        return AVERROR_UNKNOWN;
@@ -2662,7 +2659,7 @@ static void imdct_and_windowing(AACContext *ac, SingleChannelElement *sce)
        ac->mdct.imdct_half(&ac->mdct, buf, in);
 #if USE_FIXED
        for (i=0; i<1024; i++)
-          buf[i] = (buf[i] + 4LL) >> 3;
+          buf[i] = (buf[i] + 4) >> 3;
 #endif /* USE_FIXED */
    }

@@ -2807,7 +2804,7 @@ static void imdct_and_windowing_ld(AACContext *ac, SingleChannelElement *sce)

 static void imdct_and_windowing_eld(AACContext *ac, SingleChannelElement *sce)
 {
-    UINTFLOAT *in   = sce->coeffs;
+    INTFLOAT *in    = sce->coeffs;
    INTFLOAT *out   = sce->ret;
    INTFLOAT *saved = sce->saved;
    INTFLOAT *buf  = ac->buf_mdct;
@@ -28,7 +28,6 @@
 *              TODOs:
 * add sane pulse detection
 ***********************************/
-#include <float.h>

 #include "libavutil/libm.h"
 #include "libavutil/thread.h"
@@ -856,7 +855,7 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
                /* Not so fast though */
                ratio = sqrtf(ratio);
            }
-            s->lambda = av_clipf(s->lambda * ratio, FLT_EPSILON, 65536.f);
+            s->lambda = FFMIN(s->lambda * ratio, 65536.f);

            /* Keep iterating if we must reduce and lambda is in the sky */
            if (ratio > 0.9f && ratio < 1.1f) {
@@ -901,7 +900,7 @@ static av_cold int aac_encode_end(AVCodecContext *avctx)
 {
    AACEncContext *s = avctx->priv_data;

-    av_log(avctx, AV_LOG_INFO, "Qavg: %.3f\n", s->lambda_count ? s->lambda_sum / s->lambda_count : NAN);
+    av_log(avctx, AV_LOG_INFO, "Qavg: %.3f\n", s->lambda_sum / s->lambda_count);

    ff_mdct_end(&s->mdct1024);
    ff_mdct_end(&s->mdct128);
@@ -414,33 +414,33 @@ static void hybrid_synthesis(PSDSPContext *dsp, INTFLOAT out[2][38][64],
            memset(out[0][n], 0, 5*sizeof(out[0][n][0]));
            memset(out[1][n], 0, 5*sizeof(out[1][n][0]));
            for (i = 0; i < 12; i++) {
-                out[0][n][0] += (UINTFLOAT)in[   i][n][0];
-                out[1][n][0] += (UINTFLOAT)in[   i][n][1];
+                out[0][n][0] += in[   i][n][0];
+                out[1][n][0] += in[   i][n][1];
            }
            for (i = 0; i < 8; i++) {
-                out[0][n][1] += (UINTFLOAT)in[12+i][n][0];
-                out[1][n][1] += (UINTFLOAT)in[12+i][n][1];
+                out[0][n][1] += in[12+i][n][0];
+                out[1][n][1] += in[12+i][n][1];
            }
            for (i = 0; i < 4; i++) {
-                out[0][n][2] += (UINTFLOAT)in[20+i][n][0];
-                out[1][n][2] += (UINTFLOAT)in[20+i][n][1];
-                out[0][n][3] += (UINTFLOAT)in[24+i][n][0];
-                out[1][n][3] += (UINTFLOAT)in[24+i][n][1];
-                out[0][n][4] += (UINTFLOAT)in[28+i][n][0];
-                out[1][n][4] += (UINTFLOAT)in[28+i][n][1];
+                out[0][n][2] += in[20+i][n][0];
+                out[1][n][2] += in[20+i][n][1];
+                out[0][n][3] += in[24+i][n][0];
+                out[1][n][3] += in[24+i][n][1];
+                out[0][n][4] += in[28+i][n][0];
+                out[1][n][4] += in[28+i][n][1];
            }
        }
        dsp->hybrid_synthesis_deint(out, in + 27, 5, len);
    } else {
        for (n = 0; n < len; n++) {
-            out[0][n][0] = (UINTFLOAT)in[0][n][0] + in[1][n][0] + in[2][n][0] +
-                           (UINTFLOAT)in[3][n][0] + in[4][n][0] + in[5][n][0];
-            out[1][n][0] = (UINTFLOAT)in[0][n][1] + in[1][n][1] + in[2][n][1] +
-                           (UINTFLOAT)in[3][n][1] + in[4][n][1] + in[5][n][1];
-            out[0][n][1] = (UINTFLOAT)in[6][n][0] + in[7][n][0];
-            out[1][n][1] = (UINTFLOAT)in[6][n][1] + in[7][n][1];
-            out[0][n][2] = (UINTFLOAT)in[8][n][0] + in[9][n][0];
-            out[1][n][2] = (UINTFLOAT)in[8][n][1] + in[9][n][1];
+            out[0][n][0] = in[0][n][0] + in[1][n][0] + in[2][n][0] +
+                           in[3][n][0] + in[4][n][0] + in[5][n][0];
+            out[1][n][0] = in[0][n][1] + in[1][n][1] + in[2][n][1] +
+                           in[3][n][1] + in[4][n][1] + in[5][n][1];
+            out[0][n][1] = in[6][n][0] + in[7][n][0];
+            out[1][n][1] = in[6][n][1] + in[7][n][1];
+            out[0][n][2] = in[8][n][0] + in[9][n][0];
+            out[1][n][2] = in[8][n][1] + in[9][n][1];
        }
        dsp->hybrid_synthesis_deint(out, in + 7, 3, len);
    }
@@ -308,9 +308,6 @@ static av_cold int psy_3gpp_init(FFPsyContext *ctx) {
    const int bandwidth    = ctx->cutoff ? ctx->cutoff : AAC_CUTOFF(ctx->avctx);
    const float num_bark   = calc_bark((float)bandwidth);

-    if (bandwidth <= 0)
-        return AVERROR(EINVAL);
-
    ctx->model_priv_data = av_mallocz(sizeof(AacPsyContext));
    if (!ctx->model_priv_data)
        return AVERROR(ENOMEM);
@@ -797,7 +794,7 @@ static void psy_3gpp_analyze_channel(FFPsyContext *ctx, int channel,

        if (pe < 1.15f * desired_pe) {
            /* 6.6.1.3.6 "Final threshold modification by linearization" */
-            norm_fac = norm_fac ? 1.0f / norm_fac : 0;
+            norm_fac = 1.0f / norm_fac;
            for (w = 0; w < wi->num_windows*16; w += 16) {
                for (g = 0; g < num_bands; g++) {
                    AacPsyBand *band = &pch->band[w+g];
@@ -107,30 +107,29 @@ static void scale_coefs (
      }
    } else {
      shift = -shift;
-      mul <<= shift;
      for (i=0; i<len; i+=8) {

          temp = src[i] * mul;
          temp1 = src[i+1] * mul;
          temp2 = src[i+2] * mul;

-          dst[i] = temp;
+          dst[i] = temp << shift;
          temp3 = src[i+3] * mul;

-          dst[i+1] = temp1;
+          dst[i+1] = temp1 << shift;
          temp4 = src[i + 4] * mul;
-          dst[i+2] = temp2;
+          dst[i+2] = temp2 << shift;

          temp5 = src[i+5] * mul;
-          dst[i+3] = temp3;
+          dst[i+3] = temp3 << shift;
          temp6 = src[i+6] * mul;

-          dst[i+4] = temp4;
+          dst[i+4] = temp4 << shift;
          temp7 = src[i+7] * mul;

-          dst[i+5] = temp5;
-          dst[i+6] = temp6;
-          dst[i+7] = temp7;
+          dst[i+5] = temp5 << shift;
+          dst[i+6] = temp6 << shift;
+          dst[i+7] = temp7 << shift;

      }
    }
@@ -1065,7 +1065,7 @@ static int bit_alloc(AC3EncodeContext *s, int snr_offset)
 {
    int blk, ch;

-    snr_offset = (snr_offset - 240) * 4;
+    snr_offset = (snr_offset - 240) << 2;

    reset_block_bap(s);
    for (blk = 0; blk < s->num_blocks; blk++) {
@@ -2051,8 +2051,7 @@ av_cold int ff_ac3_encode_close(AVCodecContext *avctx)
        av_freep(&block->cpl_coord_mant);
    }

-    if (s->mdct_end)
-        s->mdct_end(s);
+    s->mdct_end(s);

    return 0;
 }
@@ -2434,7 +2433,7 @@ av_cold int ff_ac3_encode_init(AVCodecContext *avctx)

    ret = validate_options(s);
    if (ret)
-        goto init_fail;
+        return ret;

    avctx->frame_size = AC3_BLOCK_SIZE * s->num_blocks;
    avctx->initial_padding = AC3_BLOCK_SIZE;
@@ -110,10 +110,6 @@ static av_cold int adpcm_decode_init(AVCodecContext * avctx)
    case AV_CODEC_ID_ADPCM_MTAF:
        min_channels = 2;
        max_channels = 8;
-        if (avctx->channels & 1) {
-            avpriv_request_sample(avctx, "channel count %d\n", avctx->channels);
-            return AVERROR_PATCHWELCOME;
-        }
        break;
    case AV_CODEC_ID_ADPCM_PSX:
        max_channels = 8;
@@ -139,8 +135,8 @@ static av_cold int adpcm_decode_init(AVCodecContext * avctx)
        break;
    case AV_CODEC_ID_ADPCM_IMA_APC:
        if (avctx->extradata && avctx->extradata_size >= 8) {
-            c->status[0].predictor = av_clip_intp2(AV_RL32(avctx->extradata    ), 18);
-            c->status[1].predictor = av_clip_intp2(AV_RL32(avctx->extradata + 4), 18);
+            c->status[0].predictor = AV_RL32(avctx->extradata);
+            c->status[1].predictor = AV_RL32(avctx->extradata + 4);
        }
        break;
    case AV_CODEC_ID_ADPCM_IMA_WS:
@@ -337,7 +333,7 @@ static inline int16_t adpcm_ima_oki_expand_nibble(ADPCMChannelStatus *c, int nib
    c->predictor = av_clip_intp2(predictor, 11);
    c->step_index = step_index;

-    return c->predictor * 16;
+    return c->predictor << 4;
 }

 static inline int16_t adpcm_ct_expand_nibble(ADPCMChannelStatus *c, int8_t nibble)
@@ -426,10 +422,6 @@ static int xa_decode(AVCodecContext *avctx, int16_t *out0, int16_t *out1,
            avpriv_request_sample(avctx, "unknown XA-ADPCM filter %d", filter);
            filter=0;
        }
-        if (shift < 0) {
-            avpriv_request_sample(avctx, "unknown XA-ADPCM shift %d", shift);
-            shift = 0;
-        }
        f0 = xa_adpcm_table[filter][0];
        f1 = xa_adpcm_table[filter][1];

@@ -440,7 +432,7 @@ static int xa_decode(AVCodecContext *avctx, int16_t *out0, int16_t *out1,
            d = in[16+i+j*4];

            t = sign_extend(d, 4);
-            s = t*(1<<shift) + ((s_1*f0 + s_2*f1+32)>>6);
+            s = ( t<<shift ) + ((s_1*f0 + s_2*f1+32)>>6);
            s_2 = s_1;
            s_1 = av_clip_int16(s);
            out0[j] = s_1;
@@ -455,14 +447,10 @@ static int xa_decode(AVCodecContext *avctx, int16_t *out0, int16_t *out1,

        shift  = 12 - (in[5+i*2] & 15);
        filter = in[5+i*2] >> 4;
-        if (filter >= FF_ARRAY_ELEMS(xa_adpcm_table) || shift < 0) {
+        if (filter >= FF_ARRAY_ELEMS(xa_adpcm_table)) {
            avpriv_request_sample(avctx, "unknown XA-ADPCM filter %d", filter);
            filter=0;
        }
-        if (shift < 0) {
-            avpriv_request_sample(avctx, "unknown XA-ADPCM shift %d", shift);
-            shift = 0;
-        }

        f0 = xa_adpcm_table[filter][0];
        f1 = xa_adpcm_table[filter][1];
@@ -471,7 +459,7 @@ static int xa_decode(AVCodecContext *avctx, int16_t *out0, int16_t *out1,
            d = in[16+i+j*4];

            t = sign_extend(d >> 4, 4);
-            s = t*(1<<shift) + ((s_1*f0 + s_2*f1+32)>>6);
+            s = ( t<<shift ) + ((s_1*f0 + s_2*f1+32)>>6);
            s_2 = s_1;
            s_1 = av_clip_int16(s);
            out1[j] = s_1;
@@ -1210,11 +1198,8 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
                return AVERROR_INVALIDDATA;
            }
        }
-        for (i=0; i<=st; i++) {
+        for (i=0; i<=st; i++)
            c->status[i].predictor  = bytestream2_get_le32u(&gb);
-            if (FFABS((int64_t)c->status[i].predictor) > (1<<16))
-                return AVERROR_INVALIDDATA;
-        }

        for (n = nb_samples >> (1 - st); n > 0; n--) {
            int byte   = bytestream2_get_byteu(&gb);
@@ -1261,8 +1246,8 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,

            for (count2 = 0; count2 < 28; count2++) {
                byte = bytestream2_get_byteu(&gb);
-                next_left_sample  = sign_extend(byte >> 4, 4) * (1 << shift_left);
-                next_right_sample = sign_extend(byte,      4) * (1 << shift_right);
+                next_left_sample  = sign_extend(byte >> 4, 4) << shift_left;
+                next_right_sample = sign_extend(byte,      4) << shift_right;

                next_left_sample = (next_left_sample +
                    (current_left_sample * coeff1l) +
@@ -1301,7 +1286,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
            if (st) byte[1] = bytestream2_get_byteu(&gb);
            for(i = 4; i >= 0; i-=4) { /* Pairwise samples LL RR (st) or LL LL (mono) */
                for(channel = 0; channel < avctx->channels; channel++) {
-                    int sample = sign_extend(byte[channel] >> i, 4) * (1 << shift[channel]);
+                    int sample = sign_extend(byte[channel] >> i, 4) << shift[channel];
                    sample = (sample +
                             c->status[channel].sample1 * coeff[channel][0] +
                             c->status[channel].sample2 * coeff[channel][1] + 0x80) >> 8;
@@ -1362,10 +1347,10 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,

                    for (count2=0; count2<28; count2++) {
                        if (count2 & 1)
-                            next_sample = (unsigned)sign_extend(byte,    4) << shift;
+                            next_sample = sign_extend(byte,    4) << shift;
                        else {
                            byte = bytestream2_get_byte(&gb);
-                            next_sample = (unsigned)sign_extend(byte >> 4, 4) << shift;
+                            next_sample = sign_extend(byte >> 4, 4) << shift;
                        }

                        next_sample += (current_sample  * coeff1) +
@@ -1416,11 +1401,11 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
                    int level, pred;
                    int byte = bytestream2_get_byteu(&gb);

-                    level = sign_extend(byte >> 4, 4) * (1 << shift[n]);
+                    level = sign_extend(byte >> 4, 4) << shift[n];
                    pred  = s[-1] * coeff[0][n] + s[-2] * coeff[1][n];
                    s[0]  = av_clip_int16((level + pred + 0x80) >> 8);

-                    level = sign_extend(byte, 4) * (1 << shift[n]);
+                    level = sign_extend(byte, 4) << shift[n];
                    pred  = s[0] * coeff[0][n] + s[-1] * coeff[1][n];
                    s[1]  = av_clip_int16((level + pred + 0x80) >> 8);
                }
@@ -1577,8 +1562,8 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
                        sampledat = sign_extend(byte >> 4, 4);
                    }

-                    sampledat = ((prev1 * factor1 + prev2 * factor2) >> 11) +
-                                sampledat * scale;
+                    sampledat = ((prev1 * factor1 + prev2 * factor2) +
+                                 ((sampledat * scale) << 11)) >> 11;
                    *samples = av_clip_int16(sampledat);
                    prev2 = prev1;
                    prev1 = *samples++;
@@ -1640,8 +1625,8 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
                int byte = bytestream2_get_byteu(&gb);
                int index = (byte >> 4) & 7;
                unsigned int exp = byte & 0x0F;
-                int64_t factor1 = table[ch][index * 2];
-                int64_t factor2 = table[ch][index * 2 + 1];
+                int factor1 = table[ch][index * 2];
+                int factor2 = table[ch][index * 2 + 1];

                /* Decode 14 samples.  */
                for (n = 0; n < 14 && (i * 14 + n < nb_samples); n++) {
@@ -1655,7 +1640,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
                    }

                    sampledat = ((c->status[ch].sample1 * factor1
-                                + c->status[ch].sample2 * factor2) >> 11) + sampledat * (1 << exp);
+                                + c->status[ch].sample2 * factor2) >> 11) + (sampledat << exp);
                    *samples = av_clip_int16(sampledat);
                    c->status[ch].sample2 = c->status[ch].sample1;
                    c->status[ch].sample1 = *samples++;
@@ -1702,7 +1687,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
                    else
                        sampledat = sign_extend(byte >> 4, 4);

-                    sampledat = ((sampledat * (1 << 12)) >> (header & 0xf)) * (1 << 6) + prev;
+                    sampledat = (((sampledat << 12) >> (header & 0xf)) << 6) + prev;
                    *samples++ = av_clip_int16(sampledat >> 6);
                    c->status[channel].sample2 = c->status[channel].sample1;
                    c->status[channel].sample1 = sampledat;
@@ -1739,7 +1724,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
                            scale = sign_extend(byte, 4);
                        }

-                        scale  = scale * (1 << 12);
+                        scale  = scale << 12;
                        sample = (int)((scale >> shift) + (c->status[channel].sample1 * xa_adpcm_table[filter][0] + c->status[channel].sample2 * xa_adpcm_table[filter][1]) / 64);
                    }
                    *samples++ = av_clip_int16(sample);
@@ -48,7 +48,7 @@ static void adx_encode(ADXContext *c, uint8_t *adx, const int16_t *wav,
    s2 = prev->s2;
    for (i = 0, j = 0; j < 32; i += channels, j++) {
        s0 = wav[i];
-        d = s0 + ((-c->coeff[0] * s1 - c->coeff[1] * s2) >> COEFF_BITS);
+        d = ((s0 << COEFF_BITS) - c->coeff[0] * s1 - c->coeff[1] * s2) >> COEFF_BITS;
        if (max < d)
            max = d;
        if (min > d)
@@ -79,13 +79,13 @@ static void adx_encode(ADXContext *c, uint8_t *adx, const int16_t *wav,
    s1 = prev->s1;
    s2 = prev->s2;
    for (i = 0, j = 0; j < 32; i += channels, j++) {
-        d = wav[i] + ((-c->coeff[0] * s1 - c->coeff[1] * s2) >> COEFF_BITS);
+        d = ((wav[i] << COEFF_BITS) - c->coeff[0] * s1 - c->coeff[1] * s2) >> COEFF_BITS;

        d = av_clip_intp2(ROUNDED_DIV(d, scale), 3);

        put_sbits(&pb, 4, d);

-        s0 = d * scale + ((c->coeff[0] * s1 + c->coeff[1] * s2) >> COEFF_BITS);
+        s0 = ((d << COEFF_BITS) * scale + c->coeff[0] * s1 + c->coeff[1] * s2) >> COEFF_BITS;
        s2 = s1;
        s1 = s0;
    }
@@ -423,8 +423,8 @@ static int decode_inter_plane(AGMContext *s, GetBitContext *gb, int size,
                int map = s->map[x];

                if (orig_mv_x >= -32) {
-                    if (y * 8 + mv_y < 0 || y * 8 + mv_y + 8 > h ||
-                        x * 8 + mv_x < 0 || x * 8 + mv_x + 8 > w)
+                    if (y * 8 + mv_y < 0 || y * 8 + mv_y >= h ||
+                        x * 8 + mv_x < 0 || x * 8 + mv_x >= w)
                        return AVERROR_INVALIDDATA;

                    copy_block8(frame->data[plane] + (s->blocks_h - 1 - y) * 8 * frame->linesize[plane] + x * 8,
@@ -460,8 +460,8 @@ static int decode_inter_plane(AGMContext *s, GetBitContext *gb, int size,
                    return ret;

                if (orig_mv_x >= -32) {
-                    if (y * 8 + mv_y < 0 || y * 8 + mv_y + 8 > h ||
-                        x * 8 + mv_x < 0 || x * 8 + mv_x + 8 > w)
+                    if (y * 8 + mv_y < 0 || y * 8 + mv_y >= h ||
+                        x * 8 + mv_x < 0 || x * 8 + mv_x >= w)
                        return AVERROR_INVALIDDATA;

                    copy_block8(frame->data[plane] + (s->blocks_h - 1 - y) * 8 * frame->linesize[plane] + x * 8,
@@ -573,16 +573,13 @@ static int decode_raw_intra_rgb(AVCodecContext *avctx, GetByteContext *gbyte, AV
    uint8_t *dst = frame->data[0] + (avctx->height - 1) * frame->linesize[0];
    uint8_t r = 0, g = 0, b = 0;

-    if (bytestream2_get_bytes_left(gbyte) < 3 * avctx->width * avctx->height)
-        return AVERROR_INVALIDDATA;
-
    for (int y = 0; y < avctx->height; y++) {
        for (int x = 0; x < avctx->width; x++) {
-            dst[x*3+0] = bytestream2_get_byteu(gbyte) + r;
+            dst[x*3+0] = bytestream2_get_byte(gbyte) + r;
            r = dst[x*3+0];
-            dst[x*3+1] = bytestream2_get_byteu(gbyte) + g;
+            dst[x*3+1] = bytestream2_get_byte(gbyte) + g;
            g = dst[x*3+1];
-            dst[x*3+2] = bytestream2_get_byteu(gbyte) + b;
+            dst[x*3+2] = bytestream2_get_byte(gbyte) + b;
            b = dst[x*3+2];
        }
        dst -= frame->linesize[0];
@@ -830,7 +827,7 @@ static int decode_intra(AVCodecContext *avctx, GetBitContext *gb, AVFrame *frame
 static int decode_motion_vectors(AVCodecContext *avctx, GetBitContext *gb)
 {
    AGMContext *s = avctx->priv_data;
-    int nb_mvs = ((avctx->coded_height + 15) >> 4) * ((avctx->coded_width + 15) >> 4);
+    int nb_mvs = ((avctx->height + 15) >> 4) * ((avctx->width + 15) >> 4);
    int ret, skip = 0, value, map;

    av_fast_padded_malloc(&s->mvectors, &s->mvectors_size,
@@ -1120,13 +1117,6 @@ static int decode_frame(AVCodecContext *avctx, void *data,
    frame->key_frame = s->key_frame;
    frame->pict_type = s->key_frame ? AV_PICTURE_TYPE_I : AV_PICTURE_TYPE_P;

-    if (!s->key_frame) {
-        if (!s->prev_frame->data[0]) {
-            av_log(avctx, AV_LOG_ERROR, "Missing reference frame.\n");
-            return AVERROR_INVALIDDATA;
-        }
-    }
-
    if (header) {
        if (avctx->codec_tag == MKTAG('A', 'G', 'M', '0') ||
            avctx->codec_tag == MKTAG('A', 'G', 'M', '1'))
@@ -1196,6 +1186,10 @@ static int decode_frame(AVCodecContext *avctx, void *data,
        else
            ret = decode_intra(avctx, gb, frame);
    } else {
+        if (!s->prev_frame->data[0]) {
+            av_log(avctx, AV_LOG_ERROR, "Missing reference frame.\n");
+            return AVERROR_INVALIDDATA;
+        }
        if (s->prev_frame-> width != frame->width ||
            s->prev_frame->height != frame->height)
            return AVERROR_INVALIDDATA;
@@ -1242,11 +1236,6 @@ static av_cold int decode_init(AVCodecContext *avctx)
    s->dct = avctx->codec_tag != MKTAG('A', 'G', 'M', '4') &&
             avctx->codec_tag != MKTAG('A', 'G', 'M', '5');

-    if (!s->rgb && !s->dct) {
-        if ((avctx->width & 1) || (avctx->height & 1))
-            return AVERROR_INVALIDDATA;
-    }
-
    avctx->idct_algo = FF_IDCT_SIMPLE;
    ff_idctdsp_init(&s->idsp, avctx);
    ff_init_scantable(s->idsp.idct_permutation, &s->scantable, ff_zigzag_direct);
@@ -171,12 +171,12 @@ static inline int sign_only(int v)
    return v ? FFSIGN(v) : 0;
 }

-static void lpc_prediction(int32_t *error_buffer, uint32_t *buffer_out,
+static void lpc_prediction(int32_t *error_buffer, int32_t *buffer_out,
                           int nb_samples, int bps, int16_t *lpc_coefs,
                           int lpc_order, int lpc_quant)
 {
    int i;
-    uint32_t *pred = buffer_out;
+    int32_t *pred = buffer_out;

    /* first sample always copies */
    *buffer_out = *error_buffer;
@@ -208,27 +208,27 @@ static void lpc_prediction(int32_t *error_buffer, uint32_t *buffer_out,
    for (; i < nb_samples; i++) {
        int j;
        int val = 0;
-        unsigned error_val = error_buffer[i];
+        int error_val = error_buffer[i];
        int error_sign;
        int d = *pred++;

        /* LPC prediction */
        for (j = 0; j < lpc_order; j++)
            val += (pred[j] - d) * lpc_coefs[j];
-        val = (val + (1LL << (lpc_quant - 1))) >> lpc_quant;
+        val = (val + (1 << (lpc_quant - 1))) >> lpc_quant;
        val += d + error_val;
        buffer_out[i] = sign_extend(val, bps);

        /* adapt LPC coefficients */
        error_sign = sign_only(error_val);
        if (error_sign) {
-            for (j = 0; j < lpc_order && (int)(error_val * error_sign) > 0; j++) {
+            for (j = 0; j < lpc_order && error_val * error_sign > 0; j++) {
                int sign;
                val  = d - pred[j];
                sign = sign_only(val) * error_sign;
                lpc_coefs[j] -= sign;
-                val *= (unsigned)sign;
-                error_val -= (val >> lpc_quant) * (j + 1U);
+                val *= sign;
+                error_val -= (val >> lpc_quant) * (j + 1);
            }
        }
    }
@@ -250,12 +250,10 @@ static int decode_element(AVCodecContext *avctx, AVFrame *frame, int ch_index,

    alac->extra_bits = get_bits(&alac->gb, 2) << 3;
    bps = alac->sample_size - alac->extra_bits + channels - 1;
-    if (bps > 32) {
+    if (bps > 32U) {
        avpriv_report_missing_feature(avctx, "bps %d", bps);
        return AVERROR_PATCHWELCOME;
    }
-    if (bps < 1)
-        return AVERROR_INVALIDDATA;

    /* whether the frame is compressed */
    is_compressed = !get_bits1(&alac->gb);
@@ -302,9 +300,6 @@ static int decode_element(AVCodecContext *avctx, AVFrame *frame, int ch_index,
        decorr_shift       = get_bits(&alac->gb, 8);
        decorr_left_weight = get_bits(&alac->gb, 8);

-        if (channels == 2 && decorr_left_weight && decorr_shift > 31)
-            return AVERROR_INVALIDDATA;
-
        for (ch = 0; ch < channels; ch++) {
            prediction_type[ch]   = get_bits(&alac->gb, 4);
            lpc_quant[ch]         = get_bits(&alac->gb, 4);
@@ -400,13 +395,13 @@ static int decode_element(AVCodecContext *avctx, AVFrame *frame, int ch_index,
    case 20: {
        for (ch = 0; ch < channels; ch++) {
            for (i = 0; i < alac->nb_samples; i++)
-                alac->output_samples_buffer[ch][i] *= 1U << 12;
+                alac->output_samples_buffer[ch][i] <<= 12;
        }}
        break;
    case 24: {
        for (ch = 0; ch < channels; ch++) {
            for (i = 0; i < alac->nb_samples; i++)
-                alac->output_samples_buffer[ch][i] *= 1U << 8;
+                alac->output_samples_buffer[ch][i] <<= 8;
        }}
        break;
    }
@@ -49,7 +49,7 @@ static void append_extra_bits(int32_t *buffer[2], int32_t *extra_bits_buffer[2],

    for (ch = 0; ch < channels; ch++)
        for (i = 0; i < nb_samples; i++)
-            buffer[ch][i] = ((unsigned)buffer[ch][i] << extra_bits) | extra_bits_buffer[ch][i];
+            buffer[ch][i] = (buffer[ch][i] << extra_bits) | extra_bits_buffer[ch][i];
 }

 av_cold void ff_alacdsp_init(ALACDSPContext *c)
@@ -62,9 +62,6 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
    if (ret < 0)
        return ret;

-    if (bytestream2_get_bytes_left(&gb) < width*height / 255)
-        return AVERROR_INVALIDDATA;
-
    ret = ff_get_buffer(avctx, f, 0);
    if (ret < 0)
        return ret;
@@ -348,11 +348,6 @@ static av_cold int read_specific_config(ALSDecContext *ctx)
    if (als_id != MKBETAG('A','L','S','\0'))
        return AVERROR_INVALIDDATA;

-    if (avctx->channels > FF_SANE_NB_CHANNELS) {
-        avpriv_request_sample(avctx, "Huge number of channels\n");
-        return AVERROR_PATCHWELCOME;
-    }
-
    ctx->cur_frame_length = sconf->frame_length;

    // read channel config
@@ -662,7 +657,7 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)

    // do not continue in case of a damaged stream since
    // block_length must be evenly divisible by sub_blocks
-    if (bd->block_length & (sub_blocks - 1) || bd->block_length <= 0) {
+    if (bd->block_length & (sub_blocks - 1)) {
        av_log(avctx, AV_LOG_WARNING,
               "Block length is not evenly divisible by the number of subblocks.\n");
        return AVERROR_INVALIDDATA;
@@ -761,7 +756,7 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
            }

            for (k = 2; k < opt_order; k++)
-                quant_cof[k] = (quant_cof[k] * (1U << 14)) + (add_base << 13);
+                quant_cof[k] = (quant_cof[k] * (1 << 14)) + (add_base << 13);
        }
    }

@@ -821,9 +816,7 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
        unsigned int low;
        unsigned int value;

-        int ret = ff_bgmc_decode_init(gb, &high, &low, &value);
-        if (ret < 0)
-            return ret;
+        ff_bgmc_decode_init(gb, &high, &low, &value);

        current_res = bd->raw_samples + start;

@@ -833,9 +826,6 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
            k    [sb] = s[sb] > b ? s[sb] - b : 0;
            delta[sb] = 5 - s[sb] + k[sb];

-            if (k[sb] >= 32)
-                return AVERROR_INVALIDDATA;
-
            ff_bgmc_decode(gb, sb_len, current_res,
                        delta[sb], sx[sb], &high, &low, &value, ctx->bgmc_lut, ctx->bgmc_lut_status);

@@ -928,7 +918,7 @@ static int decode_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
            y = 1 << 6;

            for (base = begin; base < end; base++, tab++)
-                y += (uint64_t)MUL64(bd->ltp_gain[tab], raw_samples[base]);
+                y += MUL64(bd->ltp_gain[tab], raw_samples[base]);

            raw_samples[ltp_smp] += y >> 7;
        }
@@ -940,7 +930,7 @@ static int decode_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
            y = 1 << 19;

            for (sb = 0; sb < smp; sb++)
-                y += (uint64_t)MUL64(lpc_cof[sb], raw_samples[-(sb + 1)]);
+                y += MUL64(lpc_cof[sb], raw_samples[-(sb + 1)]);

            *raw_samples++ -= y >> 20;
            parcor_to_lpc(smp, quant_cof, lpc_cof);
@@ -956,7 +946,7 @@ static int decode_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)

        // reconstruct difference signal for prediction (joint-stereo)
        if (bd->js_blocks && bd->raw_other) {
-            uint32_t *left, *right;
+            int32_t *left, *right;

            if (bd->raw_other > raw_samples) {  // D = R - L
                left  = raw_samples;
@@ -1015,10 +1005,6 @@ static int read_block(ALSDecContext *ctx, ALSBlockData *bd)
    ALSSpecificConfig *sconf = &ctx->sconf;

    *bd->shift_lsbs = 0;
-
-    if (get_bits_left(gb) < 1)
-        return AVERROR_INVALIDDATA;
-
    // read block type flag and read the samples accordingly
    if (get_bits1(gb)) {
        ret = read_var_block_data(ctx, bd);
@@ -1189,10 +1175,10 @@ static int decode_blocks(ALSDecContext *ctx, unsigned int ra_frame,
                av_log(ctx->avctx, AV_LOG_WARNING, "Invalid channel pair.\n");

            for (s = 0; s < div_blocks[b]; s++)
-                bd[0].raw_samples[s] = bd[1].raw_samples[s] - (unsigned)bd[0].raw_samples[s];
+                bd[0].raw_samples[s] = bd[1].raw_samples[s] - bd[0].raw_samples[s];
        } else if (bd[1].js_blocks) {
            for (s = 0; s < div_blocks[b]; s++)
-                bd[1].raw_samples[s] = bd[1].raw_samples[s] + (unsigned)bd[0].raw_samples[s];
+                bd[1].raw_samples[s] = bd[1].raw_samples[s] + bd[0].raw_samples[s];
        }

        offset  += div_blocks[b];
@@ -1418,11 +1404,7 @@ static SoftFloat_IEEE754 multiply(SoftFloat_IEEE754 a, SoftFloat_IEEE754 b) {
        }
    }

-    if (cutoff_bit_count >= 0) {
-        mantissa = (unsigned int)(mantissa_temp >> cutoff_bit_count);
-    } else {
-        mantissa = (unsigned int)(mantissa_temp <<-cutoff_bit_count);
-    }
+    mantissa = (unsigned int)(mantissa_temp >> cutoff_bit_count);

    // Need one more shift?
    if (mantissa & 0x01000000ul) {
@@ -1479,9 +1461,6 @@ static int read_diff_float_data(ALSDecContext *ctx, unsigned int ra_frame) {
        ff_mlz_flush_dict(ctx->mlz);
    }

-    if (avctx->channels * 8 > get_bits_left(gb))
-        return AVERROR_INVALIDDATA;
-
    for (c = 0; c < avctx->channels; ++c) {
        if (use_acf) {
            //acf_flag
@@ -1822,17 +1801,15 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame_ptr,
    #define INTERLEAVE_OUTPUT(bps)                                                   \
    {                                                                                \
        int##bps##_t *dest = (int##bps##_t*)frame->data[0];                          \
-        int channels = avctx->channels;                                              \
-        int32_t **raw_samples = ctx->raw_samples;                                    \
        shift = bps - ctx->avctx->bits_per_raw_sample;                               \
        if (!ctx->cs_switch) {                                                       \
            for (sample = 0; sample < ctx->cur_frame_length; sample++)               \
-                for (c = 0; c < channels; c++)                                       \
-                    *dest++ = raw_samples[c][sample] * (1U << shift);                \
+                for (c = 0; c < avctx->channels; c++)                                \
+                    *dest++ = ctx->raw_samples[c][sample] * (1U << shift);            \
        } else {                                                                     \
            for (sample = 0; sample < ctx->cur_frame_length; sample++)               \
-                for (c = 0; c < channels; c++)                                       \
-                    *dest++ = raw_samples[sconf->chan_pos[c]][sample] * (1U << shift);\
+                for (c = 0; c < avctx->channels; c++)                                \
+                    *dest++ = ctx->raw_samples[sconf->chan_pos[c]][sample] * (1U << shift); \
        }                                                                            \
    }

@@ -438,7 +438,7 @@ static int amf_copy_buffer(AVCodecContext *avctx, AVPacket *pkt, AMFBuffer *buff
    int64_t          timestamp = AV_NOPTS_VALUE;
    int64_t          size = buffer->pVtbl->GetSize(buffer);

-    if ((ret = av_new_packet(pkt, size)) < 0) {
+    if ((ret = ff_alloc_packet2(avctx, pkt, size, 0)) < 0) {
        return ret;
    }
    memcpy(pkt->data, buffer->pVtbl->GetNative(buffer), size);
@@ -119,9 +119,6 @@ static int decode_frame(AVCodecContext *avctx,
    uint8_t *dst, *dst_end;
    int count, ret;

-    if (buf_size < 7)
-        return AVERROR_INVALIDDATA;
-
    if ((ret = ff_reget_buffer(avctx, s->frame)) < 0)
        return ret;
    dst     = s->frame->data[0];
@@ -430,8 +430,7 @@ static int decode_frame(AVCodecContext *avctx,
                    s->args[s->nb_args] = FFMAX(s->args[s->nb_args], 0) * 10 + buf[0] - '0';
                break;
            case ';':
-                if (s->nb_args < MAX_NB_ARGS)
-                    s->nb_args++;
+                s->nb_args++;
                if (s->nb_args < MAX_NB_ARGS)
                    s->args[s->nb_args] = 0;
                break;
@@ -474,11 +473,6 @@ static av_cold int decode_close(AVCodecContext *avctx)
    return 0;
 }

-static const AVCodecDefault ansi_defaults[] = {
-    { "max_pixels", "640*480" },
-    { NULL },
-};
-
 AVCodec ff_ansi_decoder = {
    .name           = "ansi",
    .long_name      = NULL_IF_CONFIG_SMALL("ASCII/ANSI art"),
@@ -490,5 +484,4 @@ AVCodec ff_ansi_decoder = {
    .decode         = decode_frame,
    .capabilities   = AV_CODEC_CAP_DR1,
    .caps_internal  = FF_CODEC_CAP_INIT_THREADSAFE,
-    .defaults       = ansi_defaults,
 };
@@ -589,7 +589,7 @@ static void decode_array_0000(APEContext *ctx, GetBitContext *gb,
                              int32_t *out, APERice *rice, int blockstodecode)
 {
    int i;
-    unsigned ksummax, ksummin;
+    int ksummax, ksummin;

    rice->ksum = 0;
    for (i = 0; i < FFMIN(blockstodecode, 5); i++) {
@@ -610,7 +610,7 @@ static void decode_array_0000(APEContext *ctx, GetBitContext *gb,
    ksummin = rice->k ? (1 << rice->k + 6) : 0;
    for (; i < blockstodecode; i++) {
        out[i] = get_rice_ook(&ctx->gb, rice->k);
-        rice->ksum += out[i] - (unsigned)out[i - 64];
+        rice->ksum += out[i] - out[i - 64];
        while (rice->ksum < ksummin) {
            rice->k--;
            ksummin = rice->k ? ksummin >> 1 : 0;
@@ -836,7 +836,7 @@ static av_always_inline int filter_fast_3320(APEPredictor *p,
    else
        p->coeffsA[filter][0]--;

-    p->filterA[filter] += (unsigned)p->lastA[filter];
+    p->filterA[filter] += p->lastA[filter];

    return p->filterA[filter];
 }
@@ -859,9 +859,9 @@ static av_always_inline int filter_3800(APEPredictor *p,
        return predictionA;
    }
    d2 =  p->buf[delayA];
-    d1 = (p->buf[delayA] - (unsigned)p->buf[delayA - 1]) * 2;
-    d0 =  p->buf[delayA] + ((p->buf[delayA - 2] - (unsigned)p->buf[delayA - 1]) * 8);
-    d3 =  p->buf[delayB] * 2U - p->buf[delayB - 1];
+    d1 = (p->buf[delayA] - p->buf[delayA - 1]) << 1;
+    d0 =  p->buf[delayA] + ((p->buf[delayA - 2] - p->buf[delayA - 1]) << 3);
+    d3 =  p->buf[delayB] * 2 - p->buf[delayB - 1];
    d4 =  p->buf[delayB];

    predictionA = d0 * p->coeffsA[filter][0] +
@@ -881,7 +881,7 @@ static av_always_inline int filter_3800(APEPredictor *p,
    p->coeffsB[filter][1] -= (((d4 >> 30) & 2) - 1) * sign;

    p->filterB[filter] = p->lastA[filter] + (predictionB >> shift);
-    p->filterA[filter] = p->filterB[filter] + (unsigned)((int)(p->filterA[filter] * 31U) >> 5);
+    p->filterA[filter] = p->filterB[filter] + ((p->filterA[filter] * 31) >> 5);

    return p->filterA[filter];
 }
@@ -902,7 +902,7 @@ static void long_filter_high_3800(int32_t *buffer, int order, int shift, int len
        dotprod = 0;
        sign = APESIGN(buffer[i]);
        for (j = 0; j < order; j++) {
-            dotprod += delay[j] * (unsigned)coeffs[j];
+            dotprod += delay[j] * coeffs[j];
            coeffs[j] += ((delay[j] >> 31) | 1) * sign;
        }
        buffer[i] -= dotprod >> shift;
@@ -916,8 +916,7 @@ static void long_filter_ehigh_3830(int32_t *buffer, int length)
 {
    int i, j;
    int32_t dotprod, sign;
-    int32_t delay[8] = { 0 };
-    uint32_t coeffs[8] = { 0 };
+    int32_t coeffs[8] = { 0 }, delay[8] = { 0 };

    for (i = 0; i < length; i++) {
        dotprod = 0;
@@ -929,7 +928,7 @@ static void long_filter_ehigh_3830(int32_t *buffer, int length)
        for (j = 7; j > 0; j--)
            delay[j] = delay[j - 1];
        delay[0] = buffer[i];
-        buffer[i] -= (unsigned)(dotprod >> 9);
+        buffer[i] -= dotprod >> 9;
    }
 }

@@ -1052,7 +1051,7 @@ static av_always_inline int predictor_update_3930(APEPredictor *p,
                  d3 * p->coeffsA[filter][3];

    p->lastA[filter] = decoded + (predictionA >> 9);
-    p->filterA[filter] = p->lastA[filter] + ((int)(p->filterA[filter] * 31U) >> 5);
+    p->filterA[filter] = p->lastA[filter] + ((p->filterA[filter] * 31) >> 5);

    sign = APESIGN(decoded);
    p->coeffsA[filter][0] += ((d0 < 0) * 2 - 1) * sign;
@@ -1122,7 +1121,7 @@ static av_always_inline int predictor_update_filter(APEPredictor *p,

    p->buf[delayA]     = p->lastA[filter];
    p->buf[adaptA]     = APESIGN(p->buf[delayA]);
-    p->buf[delayA - 1] = p->buf[delayA] - (unsigned)p->buf[delayA - 1];
+    p->buf[delayA - 1] = p->buf[delayA] - p->buf[delayA - 1];
    p->buf[adaptA - 1] = APESIGN(p->buf[delayA - 1]);

    predictionA = p->buf[delayA    ] * p->coeffsA[filter][0] +
@@ -1133,7 +1132,7 @@ static av_always_inline int predictor_update_filter(APEPredictor *p,
    /*  Apply a scaled first-order filter compression */
    p->buf[delayB]     = p->filterA[filter ^ 1] - ((int)(p->filterB[filter] * 31U) >> 5);
    p->buf[adaptB]     = APESIGN(p->buf[delayB]);
-    p->buf[delayB - 1] = p->buf[delayB] - (unsigned)p->buf[delayB - 1];
+    p->buf[delayB - 1] = p->buf[delayB] - p->buf[delayB - 1];
    p->buf[adaptB - 1] = APESIGN(p->buf[delayB - 1]);
    p->filterB[filter] = p->filterA[filter ^ 1];

@@ -1203,14 +1202,14 @@ static void predictor_decode_mono_3950(APEContext *ctx, int count)
        A = *decoded0;

        p->buf[YDELAYA] = currentA;
-        p->buf[YDELAYA - 1] = p->buf[YDELAYA] - (unsigned)p->buf[YDELAYA - 1];
+        p->buf[YDELAYA - 1] = p->buf[YDELAYA] - p->buf[YDELAYA - 1];

        predictionA = p->buf[YDELAYA    ] * p->coeffsA[0][0] +
                      p->buf[YDELAYA - 1] * p->coeffsA[0][1] +
                      p->buf[YDELAYA - 2] * p->coeffsA[0][2] +
                      p->buf[YDELAYA - 3] * p->coeffsA[0][3];

-        currentA = A + (unsigned)(predictionA >> 10);
+        currentA = A + (predictionA >> 10);

        p->buf[YADAPTCOEFFSA]     = APESIGN(p->buf[YDELAYA    ]);
        p->buf[YADAPTCOEFFSA - 1] = APESIGN(p->buf[YDELAYA - 1]);
@@ -1230,7 +1229,7 @@ static void predictor_decode_mono_3950(APEContext *ctx, int count)
            p->buf = p->historybuffer;
        }

-        p->filterA[0] = currentA + (unsigned)((int)(p->filterA[0] * 31U) >> 5);
+        p->filterA[0] = currentA + ((int)(p->filterA[0] * 31U) >> 5);
        *(decoded0++) = p->filterA[0];
    }

@@ -1267,8 +1266,8 @@ static void do_apply_filter(APEContext *ctx, int version, APEFilter *f,
                                                     f->delay - order,
                                                     f->adaptcoeffs - order,
                                                     order, APESIGN(*data));
-        res = (int)(res + (1U << (fracbits - 1))) >> fracbits;
-        res += (unsigned)*data;
+        res = (res + (1 << (fracbits - 1))) >> fracbits;
+        res += *data;
        *data++ = res;

        /* Update the output history */
@@ -1283,10 +1282,10 @@ static void do_apply_filter(APEContext *ctx, int version, APEFilter *f,
            /* Version 3.98 and later files */

            /* Update the adaption coefficients */
-            absres = res < 0 ? -(unsigned)res : res;
+            absres = FFABS(res);
            if (absres)
                *f->adaptcoeffs = APESIGN(res) *
-                                  (8 << ((absres > f->avg * 3LL) + (absres > (f->avg + f->avg / 3))));
+                                  (8 << ((absres > f->avg * 3) + (absres > f->avg * 4 / 3)));
                /* equivalent to the following code
                    if (absres <= f->avg * 4 / 3)
                        *f->adaptcoeffs = APESIGN(res) * 8;
@@ -1298,7 +1297,7 @@ static void do_apply_filter(APEContext *ctx, int version, APEFilter *f,
            else
                *f->adaptcoeffs = 0;

-            f->avg += (int)(absres - (unsigned)f->avg) / 16;
+            f->avg += (absres - f->avg) / 16;

            f->adaptcoeffs[-1] >>= 1;
            f->adaptcoeffs[-2] >>= 1;
@@ -1377,7 +1376,7 @@ static void ape_unpack_mono(APEContext *ctx, int count)

 static void ape_unpack_stereo(APEContext *ctx, int count)
 {
-    unsigned left, right;
+    int32_t left, right;
    int32_t *decoded0 = ctx->decoded[0];
    int32_t *decoded1 = ctx->decoded[1];

@@ -1394,7 +1393,7 @@ static void ape_unpack_stereo(APEContext *ctx, int count)

    /* Decorrelate and scale to output depth */
    while (count--) {
-        left = *decoded1 - (unsigned)(*decoded0 / 2);
+        left = *decoded1 - (*decoded0 / 2);
        right = left + *decoded0;

        *(decoded0++) = left;
@@ -1452,8 +1451,7 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data,
        if (s->fileversion >= 3900) {
            if (offset > 3) {
                av_log(avctx, AV_LOG_ERROR, "Incorrect offset passed\n");
-                av_freep(&s->data);
-                s->data_size = 0;
+                s->data = NULL;
                return AVERROR_INVALIDDATA;
            }
            if (s->data_end - s->ptr < offset) {
@@ -1501,7 +1499,7 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data,
    av_fast_malloc(&s->decoded_buffer, &s->decoded_size, decoded_buffer_size);
    if (!s->decoded_buffer)
        return AVERROR(ENOMEM);
-    memset(s->decoded_buffer, 0, decoded_buffer_size);
+    memset(s->decoded_buffer, 0, s->decoded_size);
    s->decoded[0] = s->decoded_buffer;
    s->decoded[1] = s->decoded_buffer + FFALIGN(blockstodecode, 8);

@@ -1543,7 +1541,7 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data,
        for (ch = 0; ch < s->channels; ch++) {
            sample24 = (int32_t *)frame->data[ch];
            for (i = 0; i < blockstodecode; i++)
-                *sample24++ = s->decoded[ch][i] * 256U;
+                *sample24++ = s->decoded[ch][i] << 8;
        }
        break;
    }
@@ -480,7 +480,7 @@ static void aptx_update_codeword_history(Channel *channel)
    int32_t cw = ((channel->quantize[0].quantized_sample & 3) << 0) +
                 ((channel->quantize[1].quantized_sample & 2) << 1) +
                 ((channel->quantize[2].quantized_sample & 1) << 3);
-    channel->codeword_history = (cw << 8) + ((unsigned)channel->codeword_history << 4);
+    channel->codeword_history = (cw << 8) + (channel->codeword_history << 4);
 }

 static void aptx_generate_dither(Channel *channel)
@@ -492,9 +492,9 @@ static void aptx_generate_dither(Channel *channel)
    aptx_update_codeword_history(channel);

    m = (int64_t)5184443 * (channel->codeword_history >> 7);
-    d = (m * 4) + (m >> 22);
+    d = (m << 2) + (m >> 22);
    for (subband = 0; subband < NB_SUBBANDS; subband++)
-        channel->dither[subband] = (unsigned)d << (23 - 5*subband);
+        channel->dither[subband] = d << (23 - 5*subband);
    channel->dither_parity = (d >> 25) & 1;
 }

@@ -759,12 +759,12 @@ static void aptx_invert_quantization(InvertQuantize *invert_quantize,
    if (quantized_sample < 0)
        qr = -qr;

-    qr = rshift64_clip24((qr * (1LL<<32)) + MUL64(dither, tables->invert_quantize_dither_factors[idx]), 32);
+    qr = rshift64_clip24(((int64_t)qr<<32) + MUL64(dither, tables->invert_quantize_dither_factors[idx]), 32);
    invert_quantize->reconstructed_difference = MUL64(invert_quantize->quantization_factor, qr) >> 19;

    /* update factor_select */
    factor_select = 32620 * invert_quantize->factor_select;
-    factor_select = rshift32(factor_select + (tables->quantize_factor_select_offset[idx] * (1 << 15)), 15);
+    factor_select = rshift32(factor_select + (tables->quantize_factor_select_offset[idx] << 15), 15);
    invert_quantize->factor_select = av_clip(factor_select, 0, tables->factor_max);

    /* update quantization factor */
@@ -801,7 +801,7 @@ static void aptx_prediction_filtering(Prediction *prediction,
    prediction->previous_reconstructed_sample = reconstructed_sample;

    reconstructed_differences = aptx_reconstructed_differences_update(prediction, reconstructed_difference, order);
-    srd0 = FFDIFFSIGN(reconstructed_difference, 0) * (1 << 23);
+    srd0 = FFDIFFSIGN(reconstructed_difference, 0) << 23;
    for (i = 0; i < order; i++) {
        int32_t srd = FF_SIGNBIT(reconstructed_differences[-i-1]) | 1;
        prediction->d_weight[i] -= rshift32(prediction->d_weight[i] - srd*srd0, 8);
@@ -830,7 +830,7 @@ static void aptx_process_subband(InvertQuantize *invert_quantize,

    range = 0x100000;
    sw1 = rshift32(-same_sign[1] * prediction->s_weight[1], 1);
-    sw1 = (av_clip(sw1, -range, range) & ~0xF) * 16;
+    sw1 = (av_clip(sw1, -range, range) & ~0xF) << 4;

    range = 0x300000;
    weight[0] = 254 * prediction->s_weight[0] + 0x800000*same_sign[0] + sw1;
@@ -989,9 +989,6 @@ static av_cold int aptx_init(AVCodecContext *avctx)
    AptXContext *s = avctx->priv_data;
    int chan, subband;

-    if (avctx->channels != 2)
-        return AVERROR_INVALIDDATA;
-
    s->hd = avctx->codec->id == AV_CODEC_ID_APTX_HD;
    s->block_size = s->hd ? 6 : 4;

@@ -1047,7 +1044,7 @@ static int aptx_decode_frame(AVCodecContext *avctx, void *data,
        for (channel = 0; channel < NB_CHANNELS; channel++)
            for (sample = 0; sample < 4; sample++)
                AV_WN32A(&frame->data[channel][4*(opos+sample)],
-                         samples[channel][sample] * 256);
+                         samples[channel][sample] << 8);
    }

    *got_frame_ptr = 1;
@@ -31,8 +31,7 @@ static av_cold int ass_decode_init(AVCodecContext *avctx)
    avctx->subtitle_header = av_malloc(avctx->extradata_size + 1);
    if (!avctx->subtitle_header)
        return AVERROR(ENOMEM);
-    if (avctx->extradata_size)
-        memcpy(avctx->subtitle_header, avctx->extradata, avctx->extradata_size);
+    memcpy(avctx->subtitle_header, avctx->extradata, avctx->extradata_size);
    avctx->subtitle_header[avctx->extradata_size] = 0;
    avctx->subtitle_header_size = avctx->extradata_size;
    return 0;
@@ -964,7 +964,7 @@ static av_cold int atrac3_decode_init(AVCodecContext *avctx)
        return AVERROR_INVALIDDATA;
    }

-    if (avctx->block_align > 1024 || avctx->block_align <= 0)
+    if (avctx->block_align >= UINT_MAX / 2)
        return AVERROR(EINVAL);

    q->decoded_bytes_buffer = av_mallocz(FFALIGN(avctx->block_align, 4) +
@@ -456,10 +456,6 @@ static int decode_channel_wordlen(GetBitContext *gb, Atrac3pChanUnitCtx *ctx,
    } else if (chan->fill_mode == 3) {
        pos = ch_num ? chan->num_coded_vals + chan->split_point
                     : ctx->num_quant_units - chan->split_point;
-        if (pos > FF_ARRAY_ELEMS(chan->qu_wordlen)) {
-            av_log(avctx, AV_LOG_ERROR, "Split point beyond array\n");
-            pos = FF_ARRAY_ELEMS(chan->qu_wordlen);
-        }
        for (i = chan->num_coded_vals; i < pos; i++)
            chan->qu_wordlen[i] = 1;
    }
@@ -121,7 +121,7 @@ static inline int parse_gradient(ATRAC9Context *s, ATRAC9BlockData *b,
    }
    b->grad_boundary = get_bits(gb, 4);

-    if (grad_range[0] >= grad_range[1] || grad_range[1] > 31)
+    if (grad_range[0] >= grad_range[1] || grad_range[1] > 47)
        return AVERROR_INVALIDDATA;

    if (grad_value[0] > 31 || grad_value[1] > 31)
@@ -190,7 +190,7 @@ static inline void calc_precision(ATRAC9Context *s, ATRAC9BlockData *b,
    for (int i = 0; i < b->q_unit_cnt; i++) {
        c->precision_fine[i] = 0;
        if (c->precision_coarse[i] > 15) {
-            c->precision_fine[i] = FFMIN(c->precision_coarse[i], 30) - 15;
+            c->precision_fine[i] = c->precision_coarse[i] - 15;
            c->precision_coarse[i] = 15;
        }
    }
@@ -202,7 +202,7 @@ static inline int parse_band_ext(ATRAC9Context *s, ATRAC9BlockData *b,
    int ext_band = 0;

    if (b->has_band_ext) {
-        if (b->q_unit_cnt < 13 || b->q_unit_cnt > 20)
+        if (b->q_unit_cnt < 13)
            return AVERROR_INVALIDDATA;
        ext_band = at9_tab_band_ext_group[b->q_unit_cnt - 13][2];
        if (stereo) {
@@ -226,18 +226,8 @@ static inline int parse_band_ext(ATRAC9Context *s, ATRAC9BlockData *b,
    b->channel[0].band_ext = get_bits(gb, 2);
    b->channel[0].band_ext = ext_band > 2 ? b->channel[0].band_ext : 4;

-    if (!get_bits(gb, 5)) {
-        for (int i = 0; i <= stereo; i++) {
-            ATRAC9ChannelData *c = &b->channel[i];
-            const int count = at9_tab_band_ext_cnt[c->band_ext][ext_band];
-            for (int j = 0; j < count; j++) {
-                int len = at9_tab_band_ext_lengths[c->band_ext][ext_band][j];
-                c->band_ext_data[j] = av_clip_uintp2_c(c->band_ext_data[j], len);
-            }
-        }
-
+    if (!get_bits(gb, 5))
        return 0;
-    }

    for (int i = 0; i <= stereo; i++) {
        ATRAC9ChannelData *c = &b->channel[i];
@@ -852,11 +842,6 @@ static av_cold int atrac9_decode_init(AVCodecContext *avctx)

    av_lfg_init(&s->lfg, 0xFBADF00D);

-    if (avctx->block_align <= 0) {
-        av_log(avctx, AV_LOG_ERROR, "Invalid block align\n");
-        return AVERROR_INVALIDDATA;
-    }
-
    if (avctx->extradata_size != 12) {
        av_log(avctx, AV_LOG_ERROR, "Invalid extradata length!\n");
        return AVERROR_INVALIDDATA;
@@ -886,7 +871,6 @@ static av_cold int atrac9_decode_init(AVCodecContext *avctx)
    s->block_config = &at9_block_layout[block_config_idx];

    avctx->channel_layout = s->block_config->channel_layout;
-    avctx->channels       = av_get_channel_layout_nb_channels(avctx->channel_layout);
    avctx->sample_fmt     = AV_SAMPLE_FMT_FLTP;

    if (get_bits1(&gb)) {
@@ -79,7 +79,7 @@ static void vector_clipf_c(float *dst, const float *src, int len,
 static int32_t scalarproduct_int16_c(const int16_t *v1, const int16_t *v2,
                                     int order)
 {
-    unsigned res = 0;
+    int res = 0;

    while (order--)
        res += *v1++ **v2++;
@@ -100,7 +100,7 @@ int avcodec_dct_init(AVDCT *dsp)

 #if CONFIG_IDCTDSP
    {
-        IDCTDSPContext idsp = {0};
+        IDCTDSPContext idsp;
        ff_idctdsp_init(&idsp, avctx);
        COPY(idsp, idct);
        COPY(idsp, idct_permutation);
@@ -485,17 +485,12 @@ av_cold void ff_bgmc_end(uint8_t **cf_lut, int **cf_lut_status)


 /** Initialize decoding and reads the first value */
-int ff_bgmc_decode_init(GetBitContext *gb, unsigned int *h,
+void ff_bgmc_decode_init(GetBitContext *gb, unsigned int *h,
                         unsigned int *l, unsigned int *v)
 {
-    if (get_bits_left(gb) < VALUE_BITS)
-        return AVERROR_INVALIDDATA;
-
    *h = TOP_VALUE;
    *l = 0;
    *v = get_bits_long(gb, VALUE_BITS);
-
-    return 0;
 }


@@ -40,7 +40,7 @@ int ff_bgmc_init(AVCodecContext *avctx, uint8_t **cf_lut, int **cf_lut_status);
 void ff_bgmc_end(uint8_t **cf_lut, int **cf_lut_status);


-int ff_bgmc_decode_init(GetBitContext *gb,
+void ff_bgmc_decode_init(GetBitContext *gb,
                      unsigned int *h, unsigned int *l, unsigned int *v);


@@ -95,8 +95,6 @@ static av_cold int decode_init(AVCodecContext *avctx)
    if (avctx->codec->id == AV_CODEC_ID_BINKAUDIO_RDFT) {
        // audio is already interleaved for the RDFT format variant
        avctx->sample_fmt = AV_SAMPLE_FMT_FLT;
-        if (sample_rate > INT_MAX / avctx->channels)
-            return AVERROR_INVALIDDATA;
        sample_rate  *= avctx->channels;
        s->channels = 1;
        if (!s->version_b)
@@ -109,7 +107,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
    s->frame_len     = 1 << frame_len_bits;
    s->overlap_len   = s->frame_len / 16;
    s->block_size    = (s->frame_len - s->overlap_len) * s->channels;
-    sample_rate_half = (sample_rate + 1LL) / 2;
+    sample_rate_half = (sample_rate + 1) / 2;
    if (avctx->codec->id == AV_CODEC_ID_BINKAUDIO_RDFT)
        s->root = 2.0 / (sqrt(s->frame_len) * 32768.0);
    else
@@ -162,9 +162,9 @@ static int build_table(VLC *vlc, int table_nb_bits, int nb_codes,
    uint32_t code;
    volatile VLC_TYPE (* volatile table)[2]; // the double volatile is needed to prevent an internal compiler error in gcc 4.2

+    table_size = 1 << table_nb_bits;
    if (table_nb_bits > 30)
       return AVERROR(EINVAL);
-    table_size = 1 << table_nb_bits;
    table_index = alloc_table(vlc, table_size, flags & INIT_VLC_USE_NEW_STATIC);
    ff_dlog(NULL, "new table index=%d size=%d\n", table_index, table_size);
    if (table_index < 0)
@@ -204,10 +204,6 @@ static int pix_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
        avpriv_request_sample(avctx, "Format %d", hdr.format);
        return AVERROR_PATCHWELCOME;
    }
-    bytes_per_scanline = bytes_pp * hdr.width;
-
-    if (bytestream2_get_bytes_left(&gb) < hdr.height * bytes_per_scanline)
-        return AVERROR_INVALIDDATA;

    if ((ret = ff_set_dimensions(avctx, hdr.width, hdr.height)) < 0)
        return ret;
@@ -265,6 +261,7 @@ static int pix_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
    bytestream2_skip(&gb, 8);

    // read the image data to the buffer
+    bytes_per_scanline = bytes_pp * hdr.width;
    bytes_left = bytestream2_get_bytes_left(&gb);

    if (chunk_type != IMAGE_DATA_CHUNK || data_len != bytes_left ||
@@ -47,8 +47,7 @@ void av_bsf_free(AVBSFContext **pctx)

    av_opt_free(ctx);

-    if (ctx->internal)
-        av_packet_free(&ctx->internal->buffer_pkt);
+    av_packet_free(&ctx->internal->buffer_pkt);
    av_freep(&ctx->internal);
    av_freep(&ctx->priv_data);

@@ -1215,7 +1215,6 @@ static int cavs_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
    int input_size, ret;
    const uint8_t *buf_end;
    const uint8_t *buf_ptr;
-    int frame_start = 0;

    if (buf_size == 0) {
        if (!h->low_delay && h->DPB[0].f->data[0]) {
@@ -1249,9 +1248,6 @@ static int cavs_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
                h->got_keyframe = 1;
            }
        case PIC_PB_START_CODE:
-            if (frame_start > 1)
-                return AVERROR_INVALIDDATA;
-            frame_start ++;
            if (*got_frame)
                av_frame_unref(data);
            *got_frame = 0;
@@ -201,20 +201,20 @@ static void cavs_idct8_add_c(uint8_t *dst, int16_t *block, ptrdiff_t stride)
    src[0][0] += 8;

    for( i = 0; i < 8; i++ ) {
-        const int a0 = 3 * src[i][1] - 2 * src[i][7];
-        const int a1 = 3 * src[i][3] + 2 * src[i][5];
-        const int a2 = 2 * src[i][3] - 3 * src[i][5];
-        const int a3 = 2 * src[i][1] + 3 * src[i][7];
+        const int a0 =  3*src[i][1] - (src[i][7]<<1);
+        const int a1 =  3*src[i][3] + (src[i][5]<<1);
+        const int a2 =  (src[i][3]<<1) - 3*src[i][5];
+        const int a3 =  (src[i][1]<<1) + 3*src[i][7];

-        const int b4 = 2 * (a0 + a1 + a3) + a1;
-        const int b5 = 2 * (a0 - a1 + a2) + a0;
-        const int b6 = 2 * (a3 - a2 - a1) + a3;
-        const int b7 = 2 * (a0 - a2 - a3) - a2;
+        const int b4 = ((a0 + a1 + a3)<<1) + a1;
+        const int b5 = ((a0 - a1 + a2)<<1) + a0;
+        const int b6 = ((a3 - a2 - a1)<<1) + a3;
+        const int b7 = ((a0 - a2 - a3)<<1) - a2;

-        const int a7 = 4 * src[i][2] - 10 * src[i][6];
-        const int a6 = 4 * src[i][6] + 10 * src[i][2];
-        const int a5 = 8 * (src[i][0] - src[i][4]) + 4;
-        const int a4 = 8 * (src[i][0] + src[i][4]) + 4;
+        const int a7 = (src[i][2]<<2) - 10*src[i][6];
+        const int a6 = (src[i][6]<<2) + 10*src[i][2];
+        const int a5 = ((src[i][0] - src[i][4]) << 3) + 4;
+        const int a4 = ((src[i][0] + src[i][4]) << 3) + 4;

        const int b0 = a4 + a6;
        const int b1 = a5 + a7;
@@ -231,20 +231,20 @@ static void cavs_idct8_add_c(uint8_t *dst, int16_t *block, ptrdiff_t stride)
        src[i][7] = (b0 - b4) >> 3;
    }
    for( i = 0; i < 8; i++ ) {
-        const int a0 = 3 * src[1][i] - 2 * src[7][i];
-        const int a1 = 3 * src[3][i] + 2 * src[5][i];
-        const int a2 = 2 * src[3][i] - 3 * src[5][i];
-        const int a3 = 2 * src[1][i] + 3 * src[7][i];
+        const int a0 =  3*src[1][i] - (src[7][i]<<1);
+        const int a1 =  3*src[3][i] + (src[5][i]<<1);
+        const int a2 =  (src[3][i]<<1) - 3*src[5][i];
+        const int a3 =  (src[1][i]<<1) + 3*src[7][i];

-        const int b4 = 2 * (a0 + a1 + a3) + a1;
-        const int b5 = 2 * (a0 - a1 + a2) + a0;
-        const int b6 = 2 * (a3 - a2 - a1) + a3;
-        const int b7 = 2 * (a0 - a2 - a3) - a2;
+        const int b4 = ((a0 + a1 + a3)<<1) + a1;
+        const int b5 = ((a0 - a1 + a2)<<1) + a0;
+        const int b6 = ((a3 - a2 - a1)<<1) + a3;
+        const int b7 = ((a0 - a2 - a3)<<1) - a2;

-        const int a7 = 4 * src[2][i] - 10 * src[6][i];
-        const int a6 = 4 * src[6][i] + 10 * src[2][i];
-        const int a5 = 8 * (src[0][i] - src[4][i]);
-        const int a4 = 8 * (src[0][i] + src[4][i]);
+        const int a7 = (src[2][i]<<2) - 10*src[6][i];
+        const int a6 = (src[6][i]<<2) + 10*src[2][i];
+        const int a5 = (src[0][i] - src[4][i]) << 3;
+        const int a4 = (src[0][i] + src[4][i]) << 3;

        const int b0 = a4 + a6;
        const int b1 = a5 + a7;
@@ -95,12 +95,10 @@ int ff_cbs_init(CodedBitstreamContext **ctx_ptr,
    ctx->log_ctx = log_ctx;
    ctx->codec   = type;

-    if (type->priv_data_size) {
-        ctx->priv_data = av_mallocz(ctx->codec->priv_data_size);
-        if (!ctx->priv_data) {
-            av_freep(&ctx);
-            return AVERROR(ENOMEM);
-        }
+    ctx->priv_data = av_mallocz(ctx->codec->priv_data_size);
+    if (!ctx->priv_data) {
+        av_freep(&ctx);
+        return AVERROR(ENOMEM);
    }

    ctx->decompose_unit_types = NULL;
@@ -122,7 +120,6 @@ void ff_cbs_close(CodedBitstreamContext **ctx_ptr)
    if (ctx->codec && ctx->codec->close)
        ctx->codec->close(ctx);

-    av_freep(&ctx->write_buffer);
    av_freep(&ctx->priv_data);
    av_freep(ctx_ptr);
 }
@@ -283,59 +280,6 @@ int ff_cbs_read(CodedBitstreamContext *ctx,
    return cbs_read_fragment_content(ctx, frag);
 }

-static int cbs_write_unit_data(CodedBitstreamContext *ctx,
-                               CodedBitstreamUnit *unit)
-{
-    PutBitContext pbc;
-    int ret;
-
-    if (!ctx->write_buffer) {
-        // Initial write buffer size is 1MB.
-        ctx->write_buffer_size = 1024 * 1024;
-
-    reallocate_and_try_again:
-        ret = av_reallocp(&ctx->write_buffer, ctx->write_buffer_size);
-        if (ret < 0) {
-            av_log(ctx->log_ctx, AV_LOG_ERROR, "Unable to allocate a "
-                   "sufficiently large write buffer (last attempt "
-                   "%"SIZE_SPECIFIER" bytes).\n", ctx->write_buffer_size);
-            return ret;
-        }
-    }
-
-    init_put_bits(&pbc, ctx->write_buffer, ctx->write_buffer_size);
-
-    ret = ctx->codec->write_unit(ctx, unit, &pbc);
-    if (ret < 0) {
-        if (ret == AVERROR(ENOSPC)) {
-            // Overflow.
-            if (ctx->write_buffer_size == INT_MAX / 8)
-                return AVERROR(ENOMEM);
-            ctx->write_buffer_size = FFMIN(2 * ctx->write_buffer_size, INT_MAX / 8);
-            goto reallocate_and_try_again;
-        }
-        // Write failed for some other reason.
-        return ret;
-    }
-
-    // Overflow but we didn't notice.
-    av_assert0(put_bits_count(&pbc) <= 8 * ctx->write_buffer_size);
-
-    if (put_bits_count(&pbc) % 8)
-        unit->data_bit_padding = 8 - put_bits_count(&pbc) % 8;
-    else
-        unit->data_bit_padding = 0;
-
-    flush_put_bits(&pbc);
-
-    ret = ff_cbs_alloc_unit_data(ctx, unit, put_bits_count(&pbc) / 8);
-    if (ret < 0)
-        return ret;
-
-    memcpy(unit->data, ctx->write_buffer, unit->data_size);
-
-    return 0;
-}

 int ff_cbs_write_fragment_data(CodedBitstreamContext *ctx,
                               CodedBitstreamFragment *frag)
@@ -351,7 +295,7 @@ int ff_cbs_write_fragment_data(CodedBitstreamContext *ctx,
        av_buffer_unref(&unit->data_ref);
        unit->data = NULL;

-        err = cbs_write_unit_data(ctx, unit);
+        err = ctx->codec->write_unit(ctx, unit);
        if (err < 0) {
            av_log(ctx->log_ctx, AV_LOG_ERROR, "Failed to write unit %d "
                   "(type %"PRIu32").\n", i, unit->type);
@@ -693,11 +637,11 @@ static int cbs_insert_unit(CodedBitstreamContext *ctx,
            memmove(units + position + 1, units + position,
                    (frag->nb_units - position) * sizeof(*units));
    } else {
-        units = av_malloc_array(frag->nb_units*2 + 1, sizeof(*units));
+        units = av_malloc_array(frag->nb_units + 1, sizeof(*units));
        if (!units)
            return AVERROR(ENOMEM);

-        frag->nb_units_allocated = 2*frag->nb_units_allocated + 1;
+        ++frag->nb_units_allocated;

        if (position > 0)
            memcpy(units, frag->units, position * sizeof(*units));
@@ -210,13 +210,6 @@ typedef struct CodedBitstreamContext {
     * From AV_LOG_*; defaults to AV_LOG_TRACE.
     */
    int trace_level;
-
-    /**
-     * Write buffer. Used as intermediate buffer when writing units.
-     * For internal use of cbs only.
-     */
-    uint8_t *write_buffer;
-    size_t   write_buffer_size;
 } CodedBitstreamContext;


@@ -125,9 +125,8 @@ static int cbs_av1_write_uvlc(CodedBitstreamContext *ctx, PutBitContext *pbc,
        put_bits(pbc, 1, 1);
    } else {
        zeroes = av_log2(value + 1);
-        v = value - (1U << zeroes) + 1;
-        put_bits(pbc, zeroes, 0);
-        put_bits(pbc, 1, 1);
+        v = value - (1 << zeroes) + 1;
+        put_bits(pbc, zeroes + 1, 1);
        put_bits(pbc, zeroes, v);
    }

@@ -171,9 +170,6 @@ static int cbs_av1_read_leb128(CodedBitstreamContext *ctx, GetBitContext *gbc,
            break;
    }

-    if (value > UINT32_MAX)
-        return AVERROR_INVALIDDATA;
-
    if (ctx->trace_enable)
        ff_cbs_trace_syntax_element(ctx, position, name, NULL, "", value);

@@ -578,7 +574,7 @@ static size_t cbs_av1_get_payload_bytes_left(GetBitContext *gbc)
 #define RWContext GetBitContext

 #define xf(width, name, var, range_min, range_max, subs, ...) do { \
-        uint32_t value; \
+        uint32_t value = range_min; \
        CHECK(ff_cbs_read_unsigned(ctx, rw, width, #name, \
                                   SUBSCRIPTS(subs, __VA_ARGS__), \
                                   &value, range_min, range_max)); \
@@ -586,7 +582,7 @@ static size_t cbs_av1_get_payload_bytes_left(GetBitContext *gbc)
    } while (0)

 #define xsu(width, name, var, subs, ...) do { \
-        int32_t value; \
+        int32_t value = 0; \
        CHECK(ff_cbs_read_signed(ctx, rw, width, #name, \
                                 SUBSCRIPTS(subs, __VA_ARGS__), &value, \
                                 MIN_INT_BITS(width), \
@@ -595,27 +591,27 @@ static size_t cbs_av1_get_payload_bytes_left(GetBitContext *gbc)
    } while (0)

 #define uvlc(name, range_min, range_max) do { \
-        uint32_t value; \
+        uint32_t value = range_min; \
        CHECK(cbs_av1_read_uvlc(ctx, rw, #name, \
                                &value, range_min, range_max)); \
        current->name = value; \
    } while (0)

 #define ns(max_value, name, subs, ...) do { \
-        uint32_t value; \
+        uint32_t value = 0; \
        CHECK(cbs_av1_read_ns(ctx, rw, max_value, #name, \
                              SUBSCRIPTS(subs, __VA_ARGS__), &value)); \
        current->name = value; \
    } while (0)

 #define increment(name, min, max) do { \
-        uint32_t value; \
+        uint32_t value = 0; \
        CHECK(cbs_av1_read_increment(ctx, rw, min, max, #name, &value)); \
        current->name = value; \
    } while (0)

 #define subexp(name, max, subs, ...) do { \
-        uint32_t value; \
+        uint32_t value = 0; \
        CHECK(cbs_av1_read_subexp(ctx, rw, max, #name, \
                                  SUBSCRIPTS(subs, __VA_ARGS__), &value)); \
        current->name = value; \
@@ -633,7 +629,7 @@ static size_t cbs_av1_get_payload_bytes_left(GetBitContext *gbc)
    } while (0)

 #define leb128(name) do { \
-        uint64_t value; \
+        uint64_t value = 0; \
        CHECK(cbs_av1_read_leb128(ctx, rw, #name, &value)); \
        current->name = value; \
    } while (0)
@@ -944,8 +940,6 @@ static int cbs_av1_read_unit(CodedBitstreamContext *ctx,
        priv->spatial_id  = 0;
    }

-    priv->ref = (AV1ReferenceFrameState *)&priv->read_ref;
-
    switch (obu->header.obu_type) {
    case AV1_OBU_SEQUENCE_HEADER:
        {
@@ -1044,7 +1038,6 @@ static int cbs_av1_read_unit(CodedBitstreamContext *ctx,

    if (obu->obu_size > 0 &&
        obu->header.obu_type != AV1_OBU_TILE_GROUP &&
-        obu->header.obu_type != AV1_OBU_TILE_LIST &&
        obu->header.obu_type != AV1_OBU_FRAME) {
        int nb_bits = obu->obu_size * 8 + start_pos - end_pos;

@@ -1089,8 +1082,6 @@ static int cbs_av1_write_obu(CodedBitstreamContext *ctx,
    td = NULL;
    start_pos = put_bits_count(pbc);

-    priv->ref = (AV1ReferenceFrameState *)&priv->write_ref;
-
    switch (obu->header.obu_type) {
    case AV1_OBU_SEQUENCE_HEADER:
        {
@@ -1209,19 +1200,66 @@ static int cbs_av1_write_obu(CodedBitstreamContext *ctx,
        return AVERROR(ENOSPC);

    if (obu->obu_size > 0) {
-        memmove(pbc->buf + data_pos,
-                pbc->buf + start_pos, header_size);
+        memmove(priv->write_buffer + data_pos,
+                priv->write_buffer + start_pos, header_size);
        skip_put_bytes(pbc, header_size);

        if (td) {
-            memcpy(pbc->buf + data_pos + header_size,
+            memcpy(priv->write_buffer + data_pos + header_size,
                   td->data, td->data_size);
            skip_put_bytes(pbc, td->data_size);
        }
    }

+    return 0;
+}
+
+static int cbs_av1_write_unit(CodedBitstreamContext *ctx,
+                              CodedBitstreamUnit *unit)
+{
+    CodedBitstreamAV1Context *priv = ctx->priv_data;
+    PutBitContext pbc;
+    int err;
+
+    if (!priv->write_buffer) {
+        // Initial write buffer size is 1MB.
+        priv->write_buffer_size = 1024 * 1024;
+
+    reallocate_and_try_again:
+        err = av_reallocp(&priv->write_buffer, priv->write_buffer_size);
+        if (err < 0) {
+            av_log(ctx->log_ctx, AV_LOG_ERROR, "Unable to allocate a "
+                   "sufficiently large write buffer (last attempt "
+                   "%"SIZE_SPECIFIER" bytes).\n", priv->write_buffer_size);
+            return err;
+        }
+    }
+
+    init_put_bits(&pbc, priv->write_buffer, priv->write_buffer_size);
+
+    err = cbs_av1_write_obu(ctx, unit, &pbc);
+    if (err == AVERROR(ENOSPC)) {
+        // Overflow.
+        priv->write_buffer_size *= 2;
+        goto reallocate_and_try_again;
+    }
+    if (err < 0)
+        return err;
+
+    // Overflow but we didn't notice.
+    av_assert0(put_bits_count(&pbc) <= 8 * priv->write_buffer_size);
+
    // OBU data must be byte-aligned.
-    av_assert0(put_bits_count(pbc) % 8 == 0);
+    av_assert0(put_bits_count(&pbc) % 8 == 0);
+
+    unit->data_size = put_bits_count(&pbc) / 8;
+    flush_put_bits(&pbc);
+
+    err = ff_cbs_alloc_unit_data(ctx, unit, unit->data_size);
+    if (err < 0)
+        return err;
+
+    memcpy(unit->data, priv->write_buffer, unit->data_size);

    return 0;
 }
@@ -1260,6 +1298,8 @@ static void cbs_av1_close(CodedBitstreamContext *ctx)

    av_buffer_unref(&priv->sequence_header_ref);
    av_buffer_unref(&priv->frame_header_ref);
+
+    av_freep(&priv->write_buffer);
 }

 const CodedBitstreamType ff_cbs_type_av1 = {
@@ -1269,7 +1309,7 @@ const CodedBitstreamType ff_cbs_type_av1 = {

    .split_fragment    = &cbs_av1_split_fragment,
    .read_unit         = &cbs_av1_read_unit,
-    .write_unit        = &cbs_av1_write_obu,
+    .write_unit        = &cbs_av1_write_unit,
    .assemble_fragment = &cbs_av1_assemble_fragment,

    .close             = &cbs_av1_close,
@@ -256,8 +256,8 @@ typedef struct AV1RawFrameHeader {
    uint8_t  update_grain;
    uint8_t  film_grain_params_ref_idx;
    uint8_t  num_y_points;
-    uint8_t  point_y_value[14];
-    uint8_t  point_y_scaling[14];
+    uint8_t  point_y_value[16];
+    uint8_t  point_y_scaling[16];
    uint8_t  chroma_scaling_from_luma;
    uint8_t  num_cb_points;
    uint8_t  point_cb_value[16];
@@ -268,8 +268,8 @@ typedef struct AV1RawFrameHeader {
    uint8_t  grain_scaling_minus_8;
    uint8_t  ar_coeff_lag;
    uint8_t  ar_coeffs_y_plus_128[24];
-    uint8_t  ar_coeffs_cb_plus_128[25];
-    uint8_t  ar_coeffs_cr_plus_128[25];
+    uint8_t  ar_coeffs_cb_plus_128[24];
+    uint8_t  ar_coeffs_cr_plus_128[24];
    uint8_t  ar_coeff_shift_minus_6;
    uint8_t  grain_scale_shift;
    uint8_t  cb_mult;
@@ -441,9 +441,11 @@ typedef struct CodedBitstreamAV1Context {
    int tile_cols;
    int tile_rows;

-    AV1ReferenceFrameState *ref;
-    AV1ReferenceFrameState read_ref[AV1_NUM_REF_FRAMES];
-    AV1ReferenceFrameState write_ref[AV1_NUM_REF_FRAMES];
+    AV1ReferenceFrameState ref[AV1_NUM_REF_FRAMES];
+
+    // Write buffer.
+    uint8_t *write_buffer;
+    size_t   write_buffer_size;
 } CodedBitstreamAV1Context;


@@ -419,17 +419,16 @@ static int FUNC(frame_size_with_refs)(CodedBitstreamContext *ctx, RWContext *rw,
    for (i = 0; i < AV1_REFS_PER_FRAME; i++) {
        flags(found_ref[i], 1, i);
        if (current->found_ref[i]) {
-            AV1ReferenceFrameState *ref;
+            AV1ReferenceFrameState *ref =
+                &priv->ref[current->ref_frame_idx[i]];

-            if (current->ref_frame_idx[i] < 0 ||
-                !priv->ref[current->ref_frame_idx[i]].valid) {
+            if (!ref->valid) {
                av_log(ctx->log_ctx, AV_LOG_ERROR,
                       "Missing reference frame needed for frame size "
                       "(ref = %d, ref_frame_idx = %d).\n",
                       i, current->ref_frame_idx[i]);
                return AVERROR_INVALIDDATA;
            }
-            ref = &priv->ref[current->ref_frame_idx[i]];

            priv->upscaled_width = ref->upscaled_width;
            priv->frame_width    = ref->frame_width;
@@ -882,7 +881,7 @@ static int FUNC(skip_mode_params)(CodedBitstreamContext *ctx, RWContext *rw,
        forward_idx  = -1;
        backward_idx = -1;
        for (i = 0; i < AV1_REFS_PER_FRAME; i++) {
-            ref_hint = priv->ref[current->ref_frame_idx[i]].order_hint;
+            ref_hint = priv->ref[i].order_hint;
            dist = cbs_av1_get_relative_dist(seq, ref_hint,
                                             current->order_hint);
            if (dist < 0) {
@@ -913,7 +912,7 @@ static int FUNC(skip_mode_params)(CodedBitstreamContext *ctx, RWContext *rw,

            second_forward_idx = -1;
            for (i = 0; i < AV1_REFS_PER_FRAME; i++) {
-                ref_hint = priv->ref[current->ref_frame_idx[i]].order_hint;
+                ref_hint = priv->ref[i].order_hint;
                if (cbs_av1_get_relative_dist(seq, ref_hint,
                                              forward_hint) < 0) {
                    if (second_forward_idx < 0 ||
@@ -1045,7 +1044,7 @@ static int FUNC(film_grain_params)(CodedBitstreamContext *ctx, RWContext *rw,
        return 0;
    }

-    fc(4, num_y_points, 0, 14);
+    fb(4, num_y_points);
    for (i = 0; i < current->num_y_points; i++) {
        fbs(8, point_y_value[i],   1, i);
        fbs(8, point_y_scaling[i], 1, i);
@@ -1500,6 +1499,8 @@ static int FUNC(frame_header_obu)(CodedBitstreamContext *ctx, RWContext *rw,
        else
            HEADER("Frame Header");

+        priv->seen_frame_header = 1;
+
 #ifdef READ
        start_pos = get_bits_count(rw);
 #else
@@ -289,28 +289,28 @@ static int cbs_write_se_golomb(CodedBitstreamContext *ctx, PutBitContext *pbc,
 #define RWContext GetBitContext

 #define xu(width, name, var, range_min, range_max, subs, ...) do { \
-        uint32_t value; \
+        uint32_t value = range_min; \
        CHECK(ff_cbs_read_unsigned(ctx, rw, width, #name, \
                                   SUBSCRIPTS(subs, __VA_ARGS__), \
                                   &value, range_min, range_max)); \
        var = value; \
    } while (0)
 #define xue(name, var, range_min, range_max, subs, ...) do { \
-        uint32_t value; \
+        uint32_t value = range_min; \
        CHECK(cbs_read_ue_golomb(ctx, rw, #name, \
                                 SUBSCRIPTS(subs, __VA_ARGS__), \
                                 &value, range_min, range_max)); \
        var = value; \
    } while (0)
 #define xi(width, name, var, range_min, range_max, subs, ...) do { \
-        int32_t value; \
+        int32_t value = range_min; \
        CHECK(ff_cbs_read_signed(ctx, rw, width, #name, \
                                 SUBSCRIPTS(subs, __VA_ARGS__), \
                                 &value, range_min, range_max)); \
        var = value; \
    } while (0)
 #define xse(name, var, range_min, range_max, subs, ...) do { \
-        int32_t value; \
+        int32_t value = range_min; \
        CHECK(cbs_read_se_golomb(ctx, rw, #name, \
                                 SUBSCRIPTS(subs, __VA_ARGS__), \
                                 &value, range_min, range_max)); \
@@ -568,10 +568,7 @@ static int cbs_h2645_fragment_add_nals(CodedBitstreamContext *ctx,
        // Remove trailing zeroes.
        while (size > 0 && nal->data[size - 1] == 0)
            --size;
-        if (size == 0) {
-            av_log(ctx->log_ctx, AV_LOG_VERBOSE, "Discarding empty 0 NAL unit\n");
-            continue;
-        }
+        av_assert0(size > 0);

        ref = (nal->data == nal->raw_data) ? frag->data_ref
                                           : packet->rbsp.rbsp_buffer_ref;
@@ -751,7 +748,7 @@ static int cbs_h26 ## h26n ## _replace_ ## ps_var(CodedBitstreamContext *ctx, \
    CodedBitstreamH26 ## h26n ## Context *priv = ctx->priv_data; \
    H26 ## h26n ## Raw ## ps_name *ps_var = unit->content; \
    unsigned int id = ps_var->id_element; \
-    if (id >= FF_ARRAY_ELEMS(priv->ps_var)) { \
+    if (id > FF_ARRAY_ELEMS(priv->ps_var)) { \
        av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid " #ps_name \
               " id : %d.\n", id); \
        return AVERROR_INVALIDDATA; \
@@ -858,11 +855,15 @@ static int cbs_h264_read_nal_unit(CodedBitstreamContext *ctx,
            if (err < 0)
                return err;

-            if (!cbs_h2645_read_more_rbsp_data(&gbc))
-                return AVERROR_INVALIDDATA;
-
            pos = get_bits_count(&gbc);
            len = unit->data_size;
+            if (!unit->data[len - 1]) {
+                int z;
+                for (z = 0; z < len && !unit->data[len - z - 1]; z++);
+                av_log(ctx->log_ctx, AV_LOG_DEBUG, "Deleted %d trailing zeroes "
+                       "from slice data.\n", z);
+                len -= z;
+            }

            slice->data_size = len - pos / 8;
            slice->data_ref  = av_buffer_ref(unit->data_ref);
@@ -1036,11 +1037,15 @@ static int cbs_h265_read_nal_unit(CodedBitstreamContext *ctx,
            if (err < 0)
                return err;

-            if (!cbs_h2645_read_more_rbsp_data(&gbc))
-                return AVERROR_INVALIDDATA;
-
            pos = get_bits_count(&gbc);
            len = unit->data_size;
+            if (!unit->data[len - 1]) {
+                int z;
+                for (z = 0; z < len && !unit->data[len - z - 1]; z++);
+                av_log(ctx->log_ctx, AV_LOG_DEBUG, "Deleted %d trailing zeroes "
+                       "from slice data.\n", z);
+                len -= z;
+            }

            slice->data_size = len - pos / 8;
            slice->data_ref  = av_buffer_ref(unit->data_ref);
@@ -1096,7 +1101,7 @@ static int cbs_h2645_write_slice_data(CodedBitstreamContext *ctx,
    const uint8_t *pos = data + data_bit_start / 8;

    av_assert0(data_bit_start >= 0 &&
-               data_size > data_bit_start / 8);
+               8 * data_size > data_bit_start);

    if (data_size * 8 + 8 > put_bits_left(pbc))
        return AVERROR(ENOSPC);
@@ -1375,6 +1380,65 @@ static int cbs_h265_write_nal_unit(CodedBitstreamContext *ctx,
    return 0;
 }

+static int cbs_h2645_write_nal_unit(CodedBitstreamContext *ctx,
+                                    CodedBitstreamUnit *unit)
+{
+    CodedBitstreamH2645Context *priv = ctx->priv_data;
+    enum AVCodecID codec_id = ctx->codec->codec_id;
+    PutBitContext pbc;
+    int err;
+
+    if (!priv->write_buffer) {
+        // Initial write buffer size is 1MB.
+        priv->write_buffer_size = 1024 * 1024;
+
+    reallocate_and_try_again:
+        err = av_reallocp(&priv->write_buffer, priv->write_buffer_size);
+        if (err < 0) {
+            av_log(ctx->log_ctx, AV_LOG_ERROR, "Unable to allocate a "
+                   "sufficiently large write buffer (last attempt "
+                   "%"SIZE_SPECIFIER" bytes).\n", priv->write_buffer_size);
+            return err;
+        }
+    }
+
+    init_put_bits(&pbc, priv->write_buffer, priv->write_buffer_size);
+
+    if (codec_id == AV_CODEC_ID_H264)
+        err = cbs_h264_write_nal_unit(ctx, unit, &pbc);
+    else
+        err = cbs_h265_write_nal_unit(ctx, unit, &pbc);
+
+    if (err == AVERROR(ENOSPC)) {
+        // Overflow.
+        priv->write_buffer_size *= 2;
+        goto reallocate_and_try_again;
+    }
+    // Overflow but we didn't notice.
+    av_assert0(put_bits_count(&pbc) <= 8 * priv->write_buffer_size);
+
+    if (err < 0) {
+        // Write failed for some other reason.
+        return err;
+    }
+
+    if (put_bits_count(&pbc) % 8)
+        unit->data_bit_padding = 8 - put_bits_count(&pbc) % 8;
+    else
+        unit->data_bit_padding = 0;
+
+    unit->data_size = (put_bits_count(&pbc) + 7) / 8;
+    flush_put_bits(&pbc);
+
+    err = ff_cbs_alloc_unit_data(ctx, unit, unit->data_size);
+    if (err < 0)
+        return err;
+
+    memcpy(unit->data, priv->write_buffer, unit->data_size);
+
+    return 0;
+}
+
 static int cbs_h2645_assemble_fragment(CodedBitstreamContext *ctx,
                                       CodedBitstreamFragment *frag)
 {
@@ -1390,7 +1454,7 @@ static int cbs_h2645_assemble_fragment(CodedBitstreamContext *ctx,
    max_size = 0;
    for (i = 0; i < frag->nb_units; i++) {
        // Start code + content with worst-case emulation prevention.
-        max_size += 4 + frag->units[i].data_size * 3 / 2;
+        max_size += 3 + frag->units[i].data_size * 3 / 2;
    }

    data = av_malloc(max_size + AV_INPUT_BUFFER_PADDING_SIZE);
@@ -1469,6 +1533,8 @@ static void cbs_h264_close(CodedBitstreamContext *ctx)

    ff_h2645_packet_uninit(&h264->common.read_packet);

+    av_freep(&h264->common.write_buffer);
+
    for (i = 0; i < FF_ARRAY_ELEMS(h264->sps); i++)
        av_buffer_unref(&h264->sps_ref[i]);
    for (i = 0; i < FF_ARRAY_ELEMS(h264->pps); i++)
@@ -1482,6 +1548,8 @@ static void cbs_h265_close(CodedBitstreamContext *ctx)

    ff_h2645_packet_uninit(&h265->common.read_packet);

+    av_freep(&h265->common.write_buffer);
+
    for (i = 0; i < FF_ARRAY_ELEMS(h265->vps); i++)
        av_buffer_unref(&h265->vps_ref[i]);
    for (i = 0; i < FF_ARRAY_ELEMS(h265->sps); i++)
@@ -1497,7 +1565,7 @@ const CodedBitstreamType ff_cbs_type_h264 = {

    .split_fragment    = &cbs_h2645_split_fragment,
    .read_unit         = &cbs_h264_read_nal_unit,
-    .write_unit        = &cbs_h264_write_nal_unit,
+    .write_unit        = &cbs_h2645_write_nal_unit,
    .assemble_fragment = &cbs_h2645_assemble_fragment,

    .close             = &cbs_h264_close,
@@ -1510,7 +1578,7 @@ const CodedBitstreamType ff_cbs_type_h265 = {

    .split_fragment    = &cbs_h2645_split_fragment,
    .read_unit         = &cbs_h265_read_nal_unit,
-    .write_unit        = &cbs_h265_write_nal_unit,
+    .write_unit        = &cbs_h2645_write_nal_unit,
    .assemble_fragment = &cbs_h2645_assemble_fragment,

    .close             = &cbs_h265_close,
@@ -19,6 +19,9 @@
 #ifndef AVCODEC_CBS_H2645_H
 #define AVCODEC_CBS_H2645_H

+#include <stddef.h>
+#include <stdint.h>
+
 #include "h2645_parse.h"


@@ -30,6 +33,10 @@ typedef struct CodedBitstreamH2645Context {
    int nal_length_size;
    // Packet reader.
    H2645Packet read_packet;
+
+    // Write buffer
+    uint8_t *write_buffer;
+    size_t write_buffer_size;
 } CodedBitstreamH2645Context;


@@ -137,10 +137,6 @@ static int FUNC(vui_parameters)(CodedBitstreamContext *ctx, RWContext *rw,
            ub(8, colour_primaries);
            ub(8, transfer_characteristics);
            ub(8, matrix_coefficients);
-        } else {
-            infer(colour_primaries,         2);
-            infer(transfer_characteristics, 2);
-            infer(matrix_coefficients,      2);
        }
    } else {
        infer(video_format,             5);
@@ -954,7 +950,6 @@ static int FUNC(sei)(CodedBitstreamContext *ctx, RWContext *rw,
        current->payload[k].payload_type = payload_type;
        current->payload[k].payload_size = payload_size;

-        current->payload_count++;
        CHECK(FUNC(sei_payload)(ctx, rw, &current->payload[k]));

        if (!cbs_h2645_read_more_rbsp_data(rw))
@@ -965,6 +960,7 @@ static int FUNC(sei)(CodedBitstreamContext *ctx, RWContext *rw,
               "SEI message: found %d.\n", k);
        return AVERROR_INVALIDDATA;
    }
+    current->payload_count = k + 1;
 #else
    for (k = 0; k < current->payload_count; k++) {
        PutBitContext start_state;
@@ -1366,7 +1362,7 @@ static int FUNC(slice_header)(CodedBitstreamContext *ctx, RWContext *rw,
                   (sps->pic_height_in_map_units_minus1 + 1);
        max = (pic_size + pps->slice_group_change_rate_minus1) /
              (pps->slice_group_change_rate_minus1 + 1);
-        bits = av_ceil_log2(max + 1);
+        bits = av_log2(2 * max - 1);

        u(bits, slice_group_change_cycle, 0, max);
    }
@@ -80,7 +80,7 @@ static int FUNC(extension_data)(CodedBitstreamContext *ctx, RWContext *rw,
    }
 #else
    for (k = 0; k < current->bit_length; k++)
-        xu(1, extension_data, current->data[k / 8] >> (7 - k % 8) & 1, 0, 1, 0);
+        xu(1, extension_data, current->data[k / 8] >> (7 - k % 8), 0, 1, 0);
 #endif
    return 0;
 }
@@ -601,8 +601,6 @@ static int FUNC(st_ref_pic_set)(CodedBitstreamContext *ctx, RWContext *rw,
            }
        }

-        if (i > 15)
-            return AVERROR_INVALIDDATA;
        infer(num_negative_pics, i);
        for (i = 0; i < current->num_negative_pics; i++) {
            infer(delta_poc_s0_minus1[i],
@@ -632,8 +630,6 @@ static int FUNC(st_ref_pic_set)(CodedBitstreamContext *ctx, RWContext *rw,
            }
        }

-        if (i + current->num_negative_pics > 15)
-            return AVERROR_INVALIDDATA;
        infer(num_positive_pics, i);
        for (i = 0; i < current->num_positive_pics; i++) {
            infer(delta_poc_s1_minus1[i],
@@ -722,7 +718,7 @@ static int FUNC(sps_scc_extension)(CodedBitstreamContext *ctx, RWContext *rw,

        flag(sps_palette_predictor_initializer_present_flag);
        if (current->sps_palette_predictor_initializer_present_flag) {
-            ue(sps_num_palette_predictor_initializer_minus1, 0, 127);
+            ue(sps_num_palette_predictor_initializer_minus1, 0, 128);
            for (comp = 0; comp < (current->chroma_format_idc ? 3 : 1); comp++) {
                int bit_depth = comp == 0 ? current->bit_depth_luma_minus8 + 8
                                          : current->bit_depth_chroma_minus8 + 8;
@@ -1371,7 +1367,7 @@ static int FUNC(slice_segment_header)(CodedBitstreamContext *ctx, RWContext *rw,
                    infer(num_long_term_sps, 0);
                    idx_size = 0;
                }
-                ue(num_long_term_pics, 0, HEVC_MAX_REFS - current->num_long_term_sps);
+                ue(num_long_term_pics, 0, HEVC_MAX_LONG_TERM_REF_PICS);

                for (i = 0; i < current->num_long_term_sps +
                                current->num_long_term_pics; i++) {
@@ -2188,7 +2184,6 @@ static int FUNC(sei)(CodedBitstreamContext *ctx, RWContext *rw,
        current->payload[k].payload_type = payload_type;
        current->payload[k].payload_size = payload_size;

-        current->payload_count++;
        CHECK(FUNC(sei_payload)(ctx, rw, &current->payload[k], prefix));

        if (!cbs_h2645_read_more_rbsp_data(rw))
@@ -2199,6 +2194,7 @@ static int FUNC(sei)(CodedBitstreamContext *ctx, RWContext *rw,
               "SEI message: found %d.\n", k);
        return AVERROR_INVALIDDATA;
    }
+    current->payload_count = k + 1;
 #else
    for (k = 0; k < current->payload_count; k++) {
        PutBitContext start_state;
@@ -44,11 +44,9 @@ typedef struct CodedBitstreamType {
    int (*read_unit)(CodedBitstreamContext *ctx,
                     CodedBitstreamUnit *unit);

-    // Write the data bitstream from unit->content into pbc.
-    // Return value AVERROR(ENOSPC) indicates that pbc was too small.
+    // Write the unit->data bitstream from unit->content.
    int (*write_unit)(CodedBitstreamContext *ctx,
-                      CodedBitstreamUnit *unit,
-                      PutBitContext *pbc);
+                      CodedBitstreamUnit *unit);

    // Read the data from all of frag->units and assemble it into
    // a bitstream for the whole fragment.
@@ -45,7 +45,7 @@
 #define FUNC(name) cbs_jpeg_read_ ## name

 #define xu(width, name, range_min, range_max, subs, ...) do { \
-        uint32_t value; \
+        uint32_t value = range_min; \
        CHECK(ff_cbs_read_unsigned(ctx, rw, width, #name, \
                                   SUBSCRIPTS(subs, __VA_ARGS__), \
                                   &value, range_min, range_max)); \
@@ -148,15 +148,15 @@ static int cbs_jpeg_split_fragment(CodedBitstreamContext *ctx,
        if (marker == JPEG_MARKER_EOI) {
            break;
        } else if (marker == JPEG_MARKER_SOS) {
-            next_marker = -1;
-            end = start;
            for (i = start; i + 1 < frag->data_size; i++) {
                if (frag->data[i] != 0xff)
                    continue;
                end = i;
                for (++i; i + 1 < frag->data_size &&
                          frag->data[i] == 0xff; i++);
-                if (i + 1 < frag->data_size) {
+                if (i + 1 >= frag->data_size) {
+                    next_marker = -1;
+                } else {
                    if (frag->data[i] == 0x00)
                        continue;
                    next_marker = frag->data[i];
@@ -197,9 +197,6 @@ static int cbs_jpeg_split_fragment(CodedBitstreamContext *ctx,
        if (marker == JPEG_MARKER_SOS) {
            length = AV_RB16(frag->data + start);

-            if (length > end - start)
-                return AVERROR_INVALIDDATA;
-
            data_ref = NULL;
            data     = av_malloc(end - start +
                                 AV_INPUT_BUFFER_PADDING_SIZE);
@@ -380,13 +377,58 @@ static int cbs_jpeg_write_segment(CodedBitstreamContext *ctx,
 }

 static int cbs_jpeg_write_unit(CodedBitstreamContext *ctx,
-                               CodedBitstreamUnit *unit,
-                               PutBitContext *pbc)
+                                CodedBitstreamUnit *unit)
 {
+    CodedBitstreamJPEGContext *priv = ctx->priv_data;
+    PutBitContext pbc;
+    int err;
+
+    if (!priv->write_buffer) {
+        // Initial write buffer size is 1MB.
+        priv->write_buffer_size = 1024 * 1024;
+
+    reallocate_and_try_again:
+        err = av_reallocp(&priv->write_buffer, priv->write_buffer_size);
+        if (err < 0) {
+            av_log(ctx->log_ctx, AV_LOG_ERROR, "Unable to allocate a "
+                   "sufficiently large write buffer (last attempt "
+                   "%"SIZE_SPECIFIER" bytes).\n", priv->write_buffer_size);
+            return err;
+        }
+    }
+
+    init_put_bits(&pbc, priv->write_buffer, priv->write_buffer_size);
+
    if (unit->type == JPEG_MARKER_SOS)
-        return cbs_jpeg_write_scan   (ctx, unit, pbc);
+        err = cbs_jpeg_write_scan(ctx, unit, &pbc);
    else
-        return cbs_jpeg_write_segment(ctx, unit, pbc);
+        err = cbs_jpeg_write_segment(ctx, unit, &pbc);
+
+    if (err == AVERROR(ENOSPC)) {
+        // Overflow.
+        priv->write_buffer_size *= 2;
+        goto reallocate_and_try_again;
+    }
+    if (err < 0) {
+        // Write failed for some other reason.
+        return err;
+    }
+
+    if (put_bits_count(&pbc) % 8)
+        unit->data_bit_padding = 8 - put_bits_count(&pbc) % 8;
+    else
+        unit->data_bit_padding = 0;
+
+    unit->data_size = (put_bits_count(&pbc) + 7) / 8;
+    flush_put_bits(&pbc);
+
+    err = ff_cbs_alloc_unit_data(ctx, unit, unit->data_size);
+    if (err < 0)
+        return err;
+
+    memcpy(unit->data, priv->write_buffer, unit->data_size);
+
+    return 0;
 }

 static int cbs_jpeg_assemble_fragment(CodedBitstreamContext *ctx,
@@ -457,11 +499,22 @@ static int cbs_jpeg_assemble_fragment(CodedBitstreamContext *ctx,
    return 0;
 }

+static void cbs_jpeg_close(CodedBitstreamContext *ctx)
+{
+    CodedBitstreamJPEGContext *priv = ctx->priv_data;
+
+    av_freep(&priv->write_buffer);
+}
+
 const CodedBitstreamType ff_cbs_type_jpeg = {
    .codec_id          = AV_CODEC_ID_MJPEG,

+    .priv_data_size    = sizeof(CodedBitstreamJPEGContext),
+
    .split_fragment    = &cbs_jpeg_split_fragment,
    .read_unit         = &cbs_jpeg_read_unit,
    .write_unit        = &cbs_jpeg_write_unit,
    .assemble_fragment = &cbs_jpeg_assemble_fragment,
+
+    .close             = &cbs_jpeg_close,
 };
@@ -120,4 +120,11 @@ typedef struct JPEGRawComment {
 } JPEGRawComment;


+typedef struct CodedBitstreamJPEGContext {
+    // Write buffer.
+    uint8_t *write_buffer;
+    size_t write_buffer_size;
+} CodedBitstreamJPEGContext;
+
+
 #endif /* AVCODEC_CBS_JPEG_H */
@@ -89,8 +89,6 @@ static int FUNC(huffman_table)(CodedBitstreamContext *ctx, RWContext *rw,
    ij = 0;
    for (i = 0; i < 16; i++) {
        for (j = 0; j < current->L[i]; j++) {
-            if (ij >= 224)
-                return AVERROR_INVALIDDATA;
            us(8, V[ij], ij, 0, 255);
            ++ij;
        }
@@ -110,9 +108,6 @@ static int FUNC(dht)(CodedBitstreamContext *ctx, RWContext *rw,

    n = 2;
    for (i = 0; n < current->Lh; i++) {
-        if (i >= 8)
-            return AVERROR_INVALIDDATA;
-
        CHECK(FUNC(huffman_table)(ctx, rw, &current->table[i]));

        ++n;
@@ -48,26 +48,17 @@
        xui(width, name, current->name, 0, MAX_UINT_BITS(width), subs, __VA_ARGS__)
 #define uirs(width, name, subs, ...) \
        xui(width, name, current->name, 1, MAX_UINT_BITS(width), subs, __VA_ARGS__)
-#define xui(width, name, var, range_min, range_max, subs, ...) \
-        xuia(width, #name, var, range_min, range_max, subs, __VA_ARGS__)
 #define sis(width, name, subs, ...) \
        xsi(width, name, current->name, subs, __VA_ARGS__)

-#define marker_bit() \
-        bit("marker_bit", 1)
-#define bit(string, value) do { \
-        av_unused uint32_t bit = value; \
-        xuia(1, string, bit, value, value, 0); \
-    } while (0)
-

 #define READ
 #define READWRITE read
 #define RWContext GetBitContext

-#define xuia(width, string, var, range_min, range_max, subs, ...) do { \
-        uint32_t value; \
-        CHECK(ff_cbs_read_unsigned(ctx, rw, width, string, \
+#define xui(width, name, var, range_min, range_max, subs, ...) do { \
+        uint32_t value = 0; \
+        CHECK(ff_cbs_read_unsigned(ctx, rw, width, #name, \
                                   SUBSCRIPTS(subs, __VA_ARGS__), \
                                   &value, range_min, range_max)); \
        var = value; \
@@ -82,31 +73,32 @@
        var = value; \
    } while (0)

+#define marker_bit() do { \
+        av_unused uint32_t one; \
+        CHECK(ff_cbs_read_unsigned(ctx, rw, 1, "marker_bit", NULL, &one, 1, 1)); \
+    } while (0)
+
 #define nextbits(width, compare, var) \
    (get_bits_left(rw) >= width && \
     (var = show_bits(rw, width)) == (compare))

-#define infer(name, value) do { \
-        current->name = value; \
-    } while (0)
-
 #include "cbs_mpeg2_syntax_template.c"

 #undef READ
 #undef READWRITE
 #undef RWContext
-#undef xuia
+#undef xui
 #undef xsi
+#undef marker_bit
 #undef nextbits
-#undef infer


 #define WRITE
 #define READWRITE write
 #define RWContext PutBitContext

-#define xuia(width, string, var, range_min, range_max, subs, ...) do { \
-        CHECK(ff_cbs_write_unsigned(ctx, rw, width, string, \
+#define xui(width, name, var, range_min, range_max, subs, ...) do { \
+        CHECK(ff_cbs_write_unsigned(ctx, rw, width, #name, \
                                    SUBSCRIPTS(subs, __VA_ARGS__), \
                                    var, range_min, range_max)); \
    } while (0)
@@ -118,35 +110,23 @@
                                  MAX_INT_BITS(width))); \
    } while (0)

-#define nextbits(width, compare, var) (var)
-
-#define infer(name, value) do { \
-        if (current->name != (value)) { \
-            av_log(ctx->log_ctx, AV_LOG_WARNING, "Warning: " \
-                   "%s does not match inferred value: " \
-                   "%"PRId64", but should be %"PRId64".\n", \
-                   #name, (int64_t)current->name, (int64_t)(value)); \
-        } \
+#define marker_bit() do { \
+        CHECK(ff_cbs_write_unsigned(ctx, rw, 1, "marker_bit", NULL, 1, 1, 1)); \
    } while (0)

+#define nextbits(width, compare, var) (var)
+
 #include "cbs_mpeg2_syntax_template.c"

 #undef WRITE
 #undef READWRITE
 #undef RWContext
-#undef xuia
+#undef xui
 #undef xsi
+#undef marker_bit
 #undef nextbits
-#undef infer


-static void cbs_mpeg2_free_picture_header(void *unit, uint8_t *content)
-{
-    MPEG2RawPictureHeader *picture = (MPEG2RawPictureHeader*)content;
-    av_buffer_unref(&picture->extra_information_picture.extra_information_ref);
-    av_freep(&content);
-}
-
 static void cbs_mpeg2_free_user_data(void *unit, uint8_t *content)
 {
    MPEG2RawUserData *user = (MPEG2RawUserData*)content;
@@ -157,7 +137,7 @@ static void cbs_mpeg2_free_user_data(void *unit, uint8_t *content)
 static void cbs_mpeg2_free_slice(void *unit, uint8_t *content)
 {
    MPEG2RawSlice *slice = (MPEG2RawSlice*)content;
-    av_buffer_unref(&slice->header.extra_information_slice.extra_information_ref);
+    av_buffer_unref(&slice->header.extra_information_ref);
    av_buffer_unref(&slice->data_ref);
    av_freep(&content);
 }
@@ -167,54 +147,41 @@ static int cbs_mpeg2_split_fragment(CodedBitstreamContext *ctx,
                                    int header)
 {
    const uint8_t *start, *end;
-    CodedBitstreamUnitType unit_type;
-    uint32_t start_code = -1;
+    uint8_t *unit_data;
+    uint32_t start_code = -1, next_start_code = -1;
    size_t unit_size;
-    int err, i, final = 0;
+    int err, i, unit_type;

    start = avpriv_find_start_code(frag->data, frag->data + frag->data_size,
                                   &start_code);
-    if (start_code >> 8 != 0x000001) {
-        // No start code found.
-        return AVERROR_INVALIDDATA;
-    }
-
    for (i = 0;; i++) {
+        end = avpriv_find_start_code(start, frag->data + frag->data_size,
+                                     &next_start_code);
+
        unit_type = start_code & 0xff;

-        if (start == frag->data + frag->data_size) {
-            // The last four bytes form a start code which constitutes
-            // a unit of its own.  In this situation avpriv_find_start_code
-            // won't modify start_code at all so modify start_code so that
-            // the next unit will be treated as the last unit.
-            start_code = 0;
-        }
-
-        end = avpriv_find_start_code(start--, frag->data + frag->data_size,
-                                     &start_code);
-
-        // start points to the byte containing the start_code_identifier
-        // (may be the last byte of fragment->data); end points to the byte
-        // following the byte containing the start code identifier (or to
-        // the end of fragment->data).
-        if (start_code >> 8 == 0x000001) {
+        // The start and end pointers point at to the byte following the
+        // start_code_identifier in the start code that they found.
+        if (end == frag->data + frag->data_size) {
+            // We didn't find a start code, so this is the final unit.
+            unit_size = end - (start - 1);
+        } else {
            // Unit runs from start to the beginning of the start code
            // pointed to by end (including any padding zeroes).
-            unit_size = (end - 4) - start;
-        } else {
-           // We didn't find a start code, so this is the final unit.
-           unit_size = end - start;
-           final     = 1;
+            unit_size = (end - 4) - (start - 1);
        }

-        err = ff_cbs_insert_unit_data(ctx, frag, i, unit_type, (uint8_t*)start,
-                                      unit_size, frag->data_ref);
+        unit_data = (uint8_t *)start - 1;
+
+        err = ff_cbs_insert_unit_data(ctx, frag, i, unit_type,
+                                      unit_data, unit_size, frag->data_ref);
        if (err < 0)
            return err;

-        if (final)
+        if (end == frag->data + frag->data_size)
            break;

+        start_code = next_start_code;
        start = end;
    }

@@ -273,7 +240,7 @@ static int cbs_mpeg2_read_unit(CodedBitstreamContext *ctx,
            } \
            break;
            START(MPEG2_START_PICTURE,   MPEG2RawPictureHeader,
-                  picture_header,           &cbs_mpeg2_free_picture_header);
+                  picture_header,           NULL);
            START(MPEG2_START_USER_DATA, MPEG2RawUserData,
                  user_data,                &cbs_mpeg2_free_user_data);
            START(MPEG2_START_SEQUENCE_HEADER, MPEG2RawSequenceHeader,
@@ -282,8 +249,6 @@ static int cbs_mpeg2_read_unit(CodedBitstreamContext *ctx,
                  extension_data,           NULL);
            START(MPEG2_START_GROUP,     MPEG2RawGroupOfPicturesHeader,
                  group_of_pictures_header, NULL);
-            START(MPEG2_START_SEQUENCE_END, MPEG2RawSequenceEnd,
-                  sequence_end,             NULL);
 #undef START
        default:
            return AVERROR(ENOSYS);
@@ -310,7 +275,6 @@ static int cbs_mpeg2_write_header(CodedBitstreamContext *ctx,
        START(MPEG2_START_EXTENSION,       MPEG2RawExtensionData,  extension_data);
        START(MPEG2_START_GROUP,           MPEG2RawGroupOfPicturesHeader,
                                                         group_of_pictures_header);
-        START(MPEG2_START_SEQUENCE_END,    MPEG2RawSequenceEnd,    sequence_end);
 #undef START
    default:
        av_log(ctx->log_ctx, AV_LOG_ERROR, "Write unimplemented for start "
@@ -337,7 +301,7 @@ static int cbs_mpeg2_write_slice(CodedBitstreamContext *ctx,
        uint8_t *pos = slice->data + slice->data_bit_start / 8;

        av_assert0(slice->data_bit_start >= 0 &&
-                   slice->data_size > slice->data_bit_start / 8);
+                   8 * slice->data_size > slice->data_bit_start);

        if (slice->data_size * 8 + 8 > put_bits_left(pbc))
            return AVERROR(ENOSPC);
@@ -371,13 +335,58 @@ static int cbs_mpeg2_write_slice(CodedBitstreamContext *ctx,
 }

 static int cbs_mpeg2_write_unit(CodedBitstreamContext *ctx,
-                                CodedBitstreamUnit *unit,
-                                PutBitContext *pbc)
+                                CodedBitstreamUnit *unit)
 {
+    CodedBitstreamMPEG2Context *priv = ctx->priv_data;
+    PutBitContext pbc;
+    int err;
+
+    if (!priv->write_buffer) {
+        // Initial write buffer size is 1MB.
+        priv->write_buffer_size = 1024 * 1024;
+
+    reallocate_and_try_again:
+        err = av_reallocp(&priv->write_buffer, priv->write_buffer_size);
+        if (err < 0) {
+            av_log(ctx->log_ctx, AV_LOG_ERROR, "Unable to allocate a "
+                   "sufficiently large write buffer (last attempt "
+                   "%"SIZE_SPECIFIER" bytes).\n", priv->write_buffer_size);
+            return err;
+        }
+    }
+
+    init_put_bits(&pbc, priv->write_buffer, priv->write_buffer_size);
+
    if (MPEG2_START_IS_SLICE(unit->type))
-        return cbs_mpeg2_write_slice (ctx, unit, pbc);
+        err = cbs_mpeg2_write_slice(ctx, unit, &pbc);
    else
-        return cbs_mpeg2_write_header(ctx, unit, pbc);
+        err = cbs_mpeg2_write_header(ctx, unit, &pbc);
+
+    if (err == AVERROR(ENOSPC)) {
+        // Overflow.
+        priv->write_buffer_size *= 2;
+        goto reallocate_and_try_again;
+    }
+    if (err < 0) {
+        // Write failed for some other reason.
+        return err;
+    }
+
+    if (put_bits_count(&pbc) % 8)
+        unit->data_bit_padding = 8 - put_bits_count(&pbc) % 8;
+    else
+        unit->data_bit_padding = 0;
+
+    unit->data_size = (put_bits_count(&pbc) + 7) / 8;
+    flush_put_bits(&pbc);
+
+    err = ff_cbs_alloc_unit_data(ctx, unit, unit->data_size);
+    if (err < 0)
+        return err;
+
+    memcpy(unit->data, priv->write_buffer, unit->data_size);
+
+    return 0;
 }

 static int cbs_mpeg2_assemble_fragment(CodedBitstreamContext *ctx,
@@ -417,6 +426,13 @@ static int cbs_mpeg2_assemble_fragment(CodedBitstreamContext *ctx,
    return 0;
 }

+static void cbs_mpeg2_close(CodedBitstreamContext *ctx)
+{
+    CodedBitstreamMPEG2Context *priv = ctx->priv_data;
+
+    av_freep(&priv->write_buffer);
+}
+
 const CodedBitstreamType ff_cbs_type_mpeg2 = {
    .codec_id          = AV_CODEC_ID_MPEG2VIDEO,

@@ -426,4 +442,6 @@ const CodedBitstreamType ff_cbs_type_mpeg2 = {
    .read_unit         = &cbs_mpeg2_read_unit,
    .write_unit        = &cbs_mpeg2_write_unit,
    .assemble_fragment = &cbs_mpeg2_assemble_fragment,
+
+    .close             = &cbs_mpeg2_close,
 };
@@ -114,12 +114,6 @@ typedef struct MPEG2RawGroupOfPicturesHeader {
    uint8_t broken_link;
 } MPEG2RawGroupOfPicturesHeader;

-typedef struct MPEG2RawExtraInformation {
-    uint8_t     *extra_information;
-    AVBufferRef *extra_information_ref;
-    size_t       extra_information_length;
-} MPEG2RawExtraInformation;
-
 typedef struct MPEG2RawPictureHeader {
    uint8_t picture_start_code;

@@ -132,7 +126,7 @@ typedef struct MPEG2RawPictureHeader {
    uint8_t full_pel_backward_vector;
    uint8_t backward_f_code;

-    MPEG2RawExtraInformation extra_information_picture;
+    uint8_t extra_bit_picture;
 } MPEG2RawPictureHeader;

 typedef struct MPEG2RawPictureCodingExtension {
@@ -200,7 +194,11 @@ typedef struct MPEG2RawSliceHeader {
    uint8_t slice_picture_id_enable;
    uint8_t slice_picture_id;

-    MPEG2RawExtraInformation extra_information_slice;
+    uint8_t extra_bit_slice;
+
+    size_t extra_information_length;
+    uint8_t *extra_information;
+    AVBufferRef *extra_information_ref;
 } MPEG2RawSliceHeader;

 typedef struct MPEG2RawSlice {
@@ -212,10 +210,6 @@ typedef struct MPEG2RawSlice {
    AVBufferRef *data_ref;
 } MPEG2RawSlice;

-typedef struct MPEG2RawSequenceEnd {
-    uint8_t sequence_end_code;
-} MPEG2RawSequenceEnd;
-

 typedef struct CodedBitstreamMPEG2Context {
    // Elements stored in headers which are required for other decoding.
@@ -225,6 +219,10 @@ typedef struct CodedBitstreamMPEG2Context {
    uint8_t scalable_mode;
    uint8_t progressive_sequence;
    uint8_t number_of_frame_centre_offsets;
+
+    // Write buffer.
+    uint8_t *write_buffer;
+    size_t write_buffer_size;
 } CodedBitstreamMPEG2Context;


@@ -144,10 +144,6 @@ static int FUNC(sequence_display_extension)(CodedBitstreamContext *ctx, RWContex
        uir(8, transfer_characteristics);
        uir(8, matrix_coefficients);
 #endif
-    } else {
-        infer(colour_primaries,         2);
-        infer(transfer_characteristics, 2);
-        infer(matrix_coefficients,      2);
    }

    ui(14, display_horizontal_size);
@@ -173,40 +169,6 @@ static int FUNC(group_of_pictures_header)(CodedBitstreamContext *ctx, RWContext
    return 0;
 }

-static int FUNC(extra_information)(CodedBitstreamContext *ctx, RWContext *rw,
-                                   MPEG2RawExtraInformation *current,
-                                   const char *element_name, const char *marker_name)
-{
-    int err;
-    size_t k;
-#ifdef READ
-    GetBitContext start = *rw;
-    uint8_t bit;
-
-    for (k = 0; nextbits(1, 1, bit); k++)
-        skip_bits(rw, 1 + 8);
-    current->extra_information_length = k;
-    if (k > 0) {
-        *rw = start;
-        current->extra_information_ref =
-            av_buffer_allocz(k + AV_INPUT_BUFFER_PADDING_SIZE);
-        if (!current->extra_information_ref)
-            return AVERROR(ENOMEM);
-        current->extra_information = current->extra_information_ref->data;
-    }
-#endif
-
-    for (k = 0; k < current->extra_information_length; k++) {
-        bit(marker_name, 1);
-        xuia(8, element_name,
-             current->extra_information[k], 0, 255, 1, k);
-    }
-
-    bit(marker_name, 0);
-
-    return 0;
-}
-
 static int FUNC(picture_header)(CodedBitstreamContext *ctx, RWContext *rw,
                                MPEG2RawPictureHeader *current)
 {
@@ -231,8 +193,7 @@ static int FUNC(picture_header)(CodedBitstreamContext *ctx, RWContext *rw,
        ui(3, backward_f_code);
    }

-    CHECK(FUNC(extra_information)(ctx, rw, &current->extra_information_picture,
-                                  "extra_information_picture[k]", "extra_bit_picture"));
+    ui(1, extra_bit_picture);

    return 0;
 }
@@ -404,22 +365,39 @@ static int FUNC(slice_header)(CodedBitstreamContext *ctx, RWContext *rw,
        ui(1, intra_slice);
        ui(1, slice_picture_id_enable);
        ui(6, slice_picture_id);
+
+        {
+            size_t k;
+#ifdef READ
+            GetBitContext start;
+            uint8_t bit;
+            start = *rw;
+            for (k = 0; nextbits(1, 1, bit); k++)
+                skip_bits(rw, 8);
+            current->extra_information_length = k;
+            if (k > 0) {
+                *rw = start;
+                current->extra_information_ref =
+                    av_buffer_alloc(current->extra_information_length);
+                if (!current->extra_information_ref)
+                    return AVERROR(ENOMEM);
+                current->extra_information = current->extra_information_ref->data;
+                for (k = 0; k < current->extra_information_length; k++) {
+                    xui(1, extra_bit_slice, bit, 1, 1, 0);
+                    xui(8, extra_information_slice[k],
+                        current->extra_information[k], 0, 255, 1, k);
+                }
+            }
+#else
+            for (k = 0; k < current->extra_information_length; k++) {
+                xui(1, extra_bit_slice, 1, 1, 1, 0);
+                xui(8, extra_information_slice[k],
+                    current->extra_information[k], 0, 255, 1, k);
+            }
+#endif
+        }
    }
-
-    CHECK(FUNC(extra_information)(ctx, rw, &current->extra_information_slice,
-                                  "extra_information_slice[k]", "extra_bit_slice"));
-
-    return 0;
-}
-
-static int FUNC(sequence_end)(CodedBitstreamContext *ctx, RWContext *rw,
-                              MPEG2RawSequenceEnd *current)
-{
-    int err;
-
-    HEADER("Sequence End");
-
-    ui(8, sequence_end_code);
+    ui(1, extra_bit_slice);

    return 0;
 }
@@ -267,14 +267,14 @@ static int cbs_vp9_write_le(CodedBitstreamContext *ctx, PutBitContext *pbc,
 #define RWContext GetBitContext

 #define xf(width, name, var, subs, ...) do { \
-        uint32_t value; \
+        uint32_t value = 0; \
        CHECK(ff_cbs_read_unsigned(ctx, rw, width, #name, \
                                   SUBSCRIPTS(subs, __VA_ARGS__), \
                                   &value, 0, (1 << width) - 1)); \
        var = value; \
    } while (0)
 #define xs(width, name, var, subs, ...) do { \
-        int32_t value; \
+        int32_t value = 0; \
        CHECK(cbs_vp9_read_s(ctx, rw, width, #name, \
                             SUBSCRIPTS(subs, __VA_ARGS__), &value)); \
        var = value; \
@@ -282,7 +282,7 @@ static int cbs_vp9_write_le(CodedBitstreamContext *ctx, PutBitContext *pbc,


 #define increment(name, min, max) do { \
-        uint32_t value; \
+        uint32_t value = 0; \
        CHECK(cbs_vp9_read_increment(ctx, rw, min, max, #name, &value)); \
        current->name = value; \
    } while (0)
@@ -315,7 +315,7 @@ static int cbs_vp9_write_le(CodedBitstreamContext *ctx, PutBitContext *pbc,
    } while (0)

 #define fixed(width, name, value) do { \
-        av_unused uint32_t fixed_value; \
+        av_unused uint32_t fixed_value = value; \
        CHECK(ff_cbs_read_unsigned(ctx, rw, width, #name, \
                                   0, &fixed_value, value, value)); \
    } while (0)
@@ -416,9 +416,6 @@ static int cbs_vp9_split_fragment(CodedBitstreamContext *ctx,
    uint8_t superframe_header;
    int err;

-    if (frag->data_size == 0)
-        return AVERROR_INVALIDDATA;
-
    // Last byte in the packet.
    superframe_header = frag->data[frag->data_size - 1];

@@ -431,9 +428,6 @@ static int cbs_vp9_split_fragment(CodedBitstreamContext *ctx,
        index_size = 2 + (((superframe_header & 0x18) >> 3) + 1) *
                          ((superframe_header & 0x07) + 1);

-        if (index_size > frag->data_size)
-            return AVERROR_INVALIDDATA;
-
        err = init_get_bits(&gbc, frag->data + frag->data_size - index_size,
                            8 * index_size);
        if (err < 0)
@@ -528,28 +522,62 @@ static int cbs_vp9_read_unit(CodedBitstreamContext *ctx,
 }

 static int cbs_vp9_write_unit(CodedBitstreamContext *ctx,
-                              CodedBitstreamUnit *unit,
-                              PutBitContext *pbc)
+                              CodedBitstreamUnit *unit)
 {
+    CodedBitstreamVP9Context *priv = ctx->priv_data;
    VP9RawFrame *frame = unit->content;
+    PutBitContext pbc;
    int err;

-    err = cbs_vp9_write_frame(ctx, pbc, frame);
+    if (!priv->write_buffer) {
+        // Initial write buffer size is 1MB.
+        priv->write_buffer_size = 1024 * 1024;
+
+    reallocate_and_try_again:
+        err = av_reallocp(&priv->write_buffer, priv->write_buffer_size);
+        if (err < 0) {
+            av_log(ctx->log_ctx, AV_LOG_ERROR, "Unable to allocate a "
+                   "sufficiently large write buffer (last attempt "
+                   "%"SIZE_SPECIFIER" bytes).\n", priv->write_buffer_size);
+            return err;
+        }
+    }
+
+    init_put_bits(&pbc, priv->write_buffer, priv->write_buffer_size);
+
+    err = cbs_vp9_write_frame(ctx, &pbc, frame);
+    if (err == AVERROR(ENOSPC)) {
+        priv->write_buffer_size *= 2;
+        goto reallocate_and_try_again;
+    }
    if (err < 0)
        return err;

    // Frame must be byte-aligned.
-    av_assert0(put_bits_count(pbc) % 8 == 0);
+    av_assert0(put_bits_count(&pbc) % 8 == 0);
+
+    unit->data_size        = put_bits_count(&pbc) / 8;
+    unit->data_bit_padding = 0;
+    flush_put_bits(&pbc);

    if (frame->data) {
-        if (frame->data_size > put_bits_left(pbc) / 8)
-            return AVERROR(ENOSPC);
+        if (unit->data_size + frame->data_size >
+            priv->write_buffer_size) {
+            priv->write_buffer_size *= 2;
+            goto reallocate_and_try_again;
+        }

-        flush_put_bits(pbc);
-        memcpy(put_bits_ptr(pbc), frame->data, frame->data_size);
-        skip_put_bytes(pbc, frame->data_size);
+        memcpy(priv->write_buffer + unit->data_size,
+               frame->data, frame->data_size);
+        unit->data_size += frame->data_size;
    }

+    err = ff_cbs_alloc_unit_data(ctx, unit, unit->data_size);
+    if (err < 0)
+        return err;
+
+    memcpy(unit->data, priv->write_buffer, unit->data_size);
+
    return 0;
 }

@@ -643,6 +671,13 @@ static int cbs_vp9_assemble_fragment(CodedBitstreamContext *ctx,
    return 0;
 }

+static void cbs_vp9_close(CodedBitstreamContext *ctx)
+{
+    CodedBitstreamVP9Context *priv = ctx->priv_data;
+
+    av_freep(&priv->write_buffer);
+}
+
 const CodedBitstreamType ff_cbs_type_vp9 = {
    .codec_id          = AV_CODEC_ID_VP9,

@@ -652,4 +687,6 @@ const CodedBitstreamType ff_cbs_type_vp9 = {
    .read_unit         = &cbs_vp9_read_unit,
    .write_unit        = &cbs_vp9_write_unit,
    .assemble_fragment = &cbs_vp9_assemble_fragment,
+
+    .close             = &cbs_vp9_close,
 };
@@ -207,6 +207,10 @@ typedef struct CodedBitstreamVP9Context {
    int bit_depth;

    VP9ReferenceFrameState ref[VP9_NUM_REF_FRAMES];
+
+    // Write buffer.
+    uint8_t *write_buffer;
+    size_t write_buffer_size;
 } CodedBitstreamVP9Context;


@@ -65,11 +65,11 @@ int ff_celp_lp_synthesis_filter(int16_t *out, const int16_t *filter_coeffs,
    int i,n;

    for (n = 0; n < buffer_length; n++) {
-        int sum = rounder, sum1;
+        int sum = -rounder, sum1;
        for (i = 1; i <= filter_length; i++)
-            sum -= (unsigned)(filter_coeffs[i-1] * out[n-i]);
+            sum += (unsigned)(filter_coeffs[i-1] * out[n-i]);

-        sum1 = ((sum >> 12) + in[n]) >> shift;
+        sum1 = ((-sum >> 12) + in[n]) >> shift;
        sum  = av_clip_int16(sum1);

        if (stop_on_overflow && sum != sum1)
@@ -444,10 +444,6 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
                avpriv_report_missing_feature(avctx, "Transform type of %"PRIu16, data);
                ret = AVERROR_PATCHWELCOME;
                break;
-            } else if (data == 1) {
-                av_log(avctx, AV_LOG_ERROR, "unsupported transform type\n");
-                ret = AVERROR_PATCHWELCOME;
-                break;
            }
            av_log(avctx, AV_LOG_DEBUG, "Transform-type? %"PRIu16"\n", data);
        } else if (abstag >= 0x4000 && abstag <= 0x40ff) {
@@ -550,12 +546,6 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
            s->peak.level   = 0;
        } else if (tag == -74 && s->peak.offset) {
            s->peak.level = data;
-            if (s->peak.offset < 4 - bytestream2_tell(&s->peak.base) ||
-                s->peak.offset > 4 + bytestream2_get_bytes_left(&s->peak.base)
-            ) {
-                ret = AVERROR_INVALIDDATA;
-                goto end;
-            }
            bytestream2_seek(&s->peak.base, s->peak.offset - 4, SEEK_CUR);
        } else
            av_log(avctx, AV_LOG_DEBUG,  "Unknown tag %i data %x\n", tag, data);
@@ -544,9 +544,8 @@ static int encode_mode(CinepakEncContext *s, int h,
                       uint8_t *last_data[4], int last_linesize[4],
                       strip_info *info, unsigned char *buf)
 {
-    int x, y, z, bits, temp_size, header_ofs, ret = 0, mb_count = s->w * h / MB_AREA;
+    int x, y, z, flags, bits, temp_size, header_ofs, ret = 0, mb_count = s->w * h / MB_AREA;
    int needs_extra_bit, should_write_temp;
-    uint32_t flags;
    unsigned char temp[64]; // 32/2 = 16 V4 blocks at 4 B each -> 64 B
    mb_info *mb;
    uint8_t *sub_scratch_data[4] = { 0 }, *sub_last_data[4] = { 0 };
@@ -600,7 +599,7 @@ static int encode_mode(CinepakEncContext *s, int h,
            flags = 0;
            for (y = x; y < FFMIN(x + 32, mb_count); y++)
                if (s->mb[y].best_encoding == ENC_V4)
-                    flags |= 1U << (31 - y + x);
+                    flags |= 1 << (31 - y + x);

            AV_WB32(&buf[ret], flags);
            ret += 4;
@@ -627,13 +626,13 @@ static int encode_mode(CinepakEncContext *s, int h,

        for (x = 0; x < mb_count; x++) {
            mb                = &s->mb[x];
-            flags            |= (uint32_t)(mb->best_encoding != ENC_SKIP) << (31 - bits++);
+            flags            |= (mb->best_encoding != ENC_SKIP) << (31 - bits++);
            needs_extra_bit   = 0;
            should_write_temp = 0;

            if (mb->best_encoding != ENC_SKIP) {
                if (bits < 32)
-                    flags |= (uint32_t)(mb->best_encoding == ENC_V4) << (31 - bits++);
+                    flags |= (mb->best_encoding == ENC_V4) << (31 - bits++);
                else
                    needs_extra_bit = 1;
            }
@@ -652,7 +651,7 @@ static int encode_mode(CinepakEncContext *s, int h,
            }

            if (needs_extra_bit) {
-                flags = (uint32_t)(mb->best_encoding == ENC_V4) << 31;
+                flags = (mb->best_encoding == ENC_V4) << 31;
                bits  = 1;
            }

@@ -665,8 +665,8 @@ static av_cold int clv_decode_init(AVCodecContext *avctx)
    }

    c->tile_shift = av_log2(c->tile_size);
-    if (1U << c->tile_shift != c->tile_size || c->tile_shift < 1 || c->tile_shift > 30) {
-        av_log(avctx, AV_LOG_ERROR, "Tile size: %d, is not power of 2 > 1 and < 2^31\n", c->tile_size);
+    if (1 << c->tile_shift != c->tile_size) {
+        av_log(avctx, AV_LOG_ERROR, "Tile size: %d, is not power of 2.\n", c->tile_size);
        return AVERROR_INVALIDDATA;
    }

@@ -173,7 +173,7 @@ AVCodec ff_comfortnoise_decoder = {
    .close          = cng_decode_close,
    .sample_fmts    = (const enum AVSampleFormat[]){ AV_SAMPLE_FMT_S16,
                                                     AV_SAMPLE_FMT_NONE },
-    .capabilities   = AV_CODEC_CAP_DR1,
+    .capabilities   = AV_CODEC_CAP_DELAY | AV_CODEC_CAP_DR1,
    .caps_internal  = FF_CODEC_CAP_INIT_THREADSAFE |
                      FF_CODEC_CAP_INIT_CLEANUP,
 };
@@ -143,7 +143,7 @@ typedef struct cook {

    /* generate tables and related variables */
    int                 gain_size_factor;
-    float               gain_table[31];
+    float               gain_table[23];

    /* data buffers */

@@ -185,8 +185,8 @@ static av_cold void init_gain_table(COOKContext *q)
 {
    int i;
    q->gain_size_factor = q->samples_per_channel / 8;
-    for (i = 0; i < 31; i++)
-        q->gain_table[i] = pow(pow2tab[i + 48],
+    for (i = 0; i < 23; i++)
+        q->gain_table[i] = pow(pow2tab[i + 52],
                               (1.0 / (double) q->gain_size_factor));
 }

@@ -670,7 +670,7 @@ static void interpolate_float(COOKContext *q, float *buffer,
        for (i = 0; i < q->gain_size_factor; i++)
            buffer[i] *= fc1;
    } else {                                        // smooth gain
-        fc2 = q->gain_table[15 + (gain_index_next - gain_index)];
+        fc2 = q->gain_table[11 + (gain_index_next - gain_index)];
        for (i = 0; i < q->gain_size_factor; i++) {
            buffer[i] *= fc1;
            fc1       *= fc2;
@@ -759,7 +759,7 @@ static int decouple_info(COOKContext *q, COOKSubpacket *p, int *decouple_tab)
        for (i = 0; i < length; i++)
            decouple_tab[start + i] = get_vlc2(&q->gb,
                                               p->channel_coupling.table,
-                                               p->channel_coupling.bits, 3);
+                                               p->channel_coupling.bits, 2);
    else
        for (i = 0; i < length; i++) {
            int v = get_bits(&q->gb, p->js_vlc_bits);
@@ -1075,19 +1075,12 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)
        return AVERROR_INVALIDDATA;
    }

-    if (avctx->block_align >= INT_MAX / 8)
-        return AVERROR(EINVAL);
-
    /* Initialize RNG. */
    av_lfg_init(&q->random_state, 0);

    ff_audiodsp_init(&q->adsp);

    while (bytestream2_get_bytes_left(&gb)) {
-        if (s >= FFMIN(MAX_SUBPACKETS, avctx->block_align)) {
-            avpriv_request_sample(avctx, "subpackets > %d", FFMIN(MAX_SUBPACKETS, avctx->block_align));
-            return AVERROR_PATCHWELCOME;
-        }
        /* 8 for mono, 16 for stereo, ? for multichannel
           Swap to right endianness so we don't need to care later on. */
        q->subpacket[s].cookversion      = bytestream2_get_be32(&gb);
@@ -1219,16 +1212,11 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)

        q->num_subpackets++;
        s++;
+        if (s > FFMIN(MAX_SUBPACKETS, avctx->block_align)) {
+            avpriv_request_sample(avctx, "subpackets > %d", FFMIN(MAX_SUBPACKETS, avctx->block_align));
+            return AVERROR_PATCHWELCOME;
+        }
    }
-
-    /* Try to catch some obviously faulty streams, otherwise it might be exploitable */
-    if (q->samples_per_channel != 256 && q->samples_per_channel != 512 &&
-        q->samples_per_channel != 1024) {
-        avpriv_request_sample(avctx, "samples_per_channel = %d",
-                              q->samples_per_channel);
-        return AVERROR_PATCHWELCOME;
-    }
-
    /* Generate tables */
    init_pow2table();
    init_gain_table(q);
@@ -1237,6 +1225,10 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)
    if ((ret = init_cook_vlc_tables(q)))
        return ret;

+
+    if (avctx->block_align >= UINT_MAX / 2)
+        return AVERROR(EINVAL);
+
    /* Pad the databuffer with:
       DECODE_BYTES_PAD1 or DECODE_BYTES_PAD2 for decode_bytes(),
       AV_INPUT_BUFFER_PADDING_SIZE, for the bitstreamreader. */
@@ -1260,6 +1252,14 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)
        q->saturate_output = saturate_output_float;
    }

+    /* Try to catch some obviously faulty streams, otherwise it might be exploitable */
+    if (q->samples_per_channel != 256 && q->samples_per_channel != 512 &&
+        q->samples_per_channel != 1024) {
+        avpriv_request_sample(avctx, "samples_per_channel = %d",
+                              q->samples_per_channel);
+        return AVERROR_PATCHWELCOME;
+    }
+
    avctx->sample_fmt = AV_SAMPLE_FMT_FLTP;
    if (channel_mask)
        avctx->channel_layout = channel_mask;
@@ -111,7 +111,6 @@ static int cpia_decode_frame(AVCodecContext *avctx,
        // Read line length, two byte little endian
        linelength = AV_RL16(src);
        src += 2;
-        src_size -= 2;

        if (src_size < linelength) {
            frame->decode_error_flags = FF_DECODE_ERROR_INVALID_BITSTREAM;
@@ -93,7 +93,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
    case 1: { // zlib compression
 #if CONFIG_ZLIB
        unsigned long dlen = c->decomp_size;
-        if (uncompress(c->decomp_buf, &dlen, &buf[2], buf_size - 2) != Z_OK || dlen != c->decomp_size) {
+        if (uncompress(c->decomp_buf, &dlen, &buf[2], buf_size - 2) != Z_OK) {
            av_log(avctx, AV_LOG_ERROR, "error during zlib decompression\n");
            return AVERROR_INVALIDDATA;
        }
@@ -90,7 +90,7 @@ typedef struct CuvidContext
    CUVIDDECODECAPS caps8, caps10, caps12;

    CUVIDPARSERPARAMS cuparseinfo;
-    CUVIDEOFORMATEX *cuparse_ext;
+    CUVIDEOFORMATEX cuparse_ext;

    CudaFunctions *cudl;
    CuvidFunctions *cvdl;
@@ -714,7 +714,6 @@ static av_cold int cuvid_decode_end(AVCodecContext *avctx)
    av_buffer_unref(&ctx->hwdevice);

    av_freep(&ctx->key_frame);
-    av_freep(&ctx->cuparse_ext);

    cuvid_free_functions(&ctx->cvdl);

@@ -825,8 +824,6 @@ static av_cold int cuvid_decode_init(AVCodecContext *avctx)
    CUcontext cuda_ctx = NULL;
    CUcontext dummy;
    const AVBitStreamFilter *bsf;
-    uint8_t *extradata;
-    int extradata_size;
    int ret = 0;

    enum AVPixelFormat pix_fmts[3] = { AV_PIX_FMT_CUDA,
@@ -923,8 +920,11 @@ static av_cold int cuvid_decode_init(AVCodecContext *avctx)
    ctx->cudl = device_hwctx->internal->cuda_dl;

    memset(&ctx->cuparseinfo, 0, sizeof(ctx->cuparseinfo));
+    memset(&ctx->cuparse_ext, 0, sizeof(ctx->cuparse_ext));
    memset(&seq_pkt, 0, sizeof(seq_pkt));

+    ctx->cuparseinfo.pExtVideoInfo = &ctx->cuparse_ext;
+
    switch (avctx->codec->id) {
 #if CONFIG_H264_CUVID_DECODER
    case AV_CODEC_ID_H264:
@@ -994,26 +994,17 @@ static av_cold int cuvid_decode_init(AVCodecContext *avctx)
            goto error;
        }

-        extradata = ctx->bsf->par_out->extradata;
-        extradata_size = ctx->bsf->par_out->extradata_size;
-    } else {
-        extradata = avctx->extradata;
-        extradata_size = avctx->extradata_size;
+        ctx->cuparse_ext.format.seqhdr_data_length = ctx->bsf->par_out->extradata_size;
+        memcpy(ctx->cuparse_ext.raw_seqhdr_data,
+               ctx->bsf->par_out->extradata,
+               FFMIN(sizeof(ctx->cuparse_ext.raw_seqhdr_data), ctx->bsf->par_out->extradata_size));
+    } else if (avctx->extradata_size > 0) {
+        ctx->cuparse_ext.format.seqhdr_data_length = avctx->extradata_size;
+        memcpy(ctx->cuparse_ext.raw_seqhdr_data,
+               avctx->extradata,
+               FFMIN(sizeof(ctx->cuparse_ext.raw_seqhdr_data), avctx->extradata_size));
    }

-    ctx->cuparse_ext = av_mallocz(sizeof(*ctx->cuparse_ext)
-            + FFMAX(extradata_size - (int)sizeof(ctx->cuparse_ext->raw_seqhdr_data), 0));
-    if (!ctx->cuparse_ext) {
-        ret = AVERROR(ENOMEM);
-        goto error;
-    }
-
-    if (extradata_size > 0)
-        memcpy(ctx->cuparse_ext->raw_seqhdr_data, extradata, extradata_size);
-    ctx->cuparse_ext->format.seqhdr_data_length = extradata_size;
-
-    ctx->cuparseinfo.pExtVideoInfo = ctx->cuparse_ext;
-
    ctx->key_frame = av_mallocz(ctx->nb_surfaces * sizeof(int));
    if (!ctx->key_frame) {
        ret = AVERROR(ENOMEM);
@@ -1042,8 +1033,8 @@ static av_cold int cuvid_decode_init(AVCodecContext *avctx)
    if (ret < 0)
        goto error;

-    seq_pkt.payload = ctx->cuparse_ext->raw_seqhdr_data;
-    seq_pkt.payload_size = ctx->cuparse_ext->format.seqhdr_data_length;
+    seq_pkt.payload = ctx->cuparse_ext.raw_seqhdr_data;
+    seq_pkt.payload_size = ctx->cuparse_ext.format.seqhdr_data_length;

    if (seq_pkt.payload && seq_pkt.payload_size) {
        ret = CHECK_CU(ctx->cvdl->cuvidParseVideoData(ctx->cuparser, &seq_pkt));
@@ -1102,8 +1093,8 @@ static void cuvid_flush(AVCodecContext *avctx)
    if (ret < 0)
        goto error;

-    seq_pkt.payload = ctx->cuparse_ext->raw_seqhdr_data;
-    seq_pkt.payload_size = ctx->cuparse_ext->format.seqhdr_data_length;
+    seq_pkt.payload = ctx->cuparse_ext.raw_seqhdr_data;
+    seq_pkt.payload_size = ctx->cuparse_ext.format.seqhdr_data_length;

    if (seq_pkt.payload && seq_pkt.payload_size) {
        ret = CHECK_CU(ctx->cvdl->cuvidParseVideoData(ctx->cuparser, &seq_pkt));
@@ -154,7 +154,7 @@ static int parse_lfe_24(DCALbrDecoder *s)
    step_i = get_bits(&s->gb, 8);
    if (step_i > step_max) {
        av_log(s->avctx, AV_LOG_ERROR, "Invalid LFE step size index\n");
-        return AVERROR_INVALIDDATA;
+        return -1;
    }

    step = ff_dca_lfe_step_size_24[step_i];
@@ -208,7 +208,7 @@ static int parse_lfe_16(DCALbrDecoder *s)
    step_i = get_bits(&s->gb, 8);
    if (step_i > step_max) {
        av_log(s->avctx, AV_LOG_ERROR, "Invalid LFE step size index\n");
-        return AVERROR_INVALIDDATA;
+        return -1;
    }

    step = ff_dca_lfe_step_size_16[step_i];
@@ -246,17 +246,14 @@ static int parse_lfe_16(DCALbrDecoder *s)

 static int parse_lfe_chunk(DCALbrDecoder *s, LBRChunk *chunk)
 {
-    int ret;
-
    if (!(s->flags & LBR_FLAG_LFE_PRESENT))
        return 0;

    if (!chunk->len)
        return 0;

-    ret = init_get_bits8(&s->gb, chunk->data, chunk->len);
-    if (ret < 0)
-        return ret;
+    if (init_get_bits8(&s->gb, chunk->data, chunk->len) < 0)
+        return -1;

    // Determine bit depth from chunk size
    if (chunk->len >= 52)
@@ -265,7 +262,7 @@ static int parse_lfe_chunk(DCALbrDecoder *s, LBRChunk *chunk)
        return parse_lfe_16(s);

    av_log(s->avctx, AV_LOG_ERROR, "LFE chunk too short\n");
-    return AVERROR_INVALIDDATA;
+    return -1;
 }

 static inline int parse_vlc(GetBitContext *s, VLC *vlc, int max_depth)
@@ -294,13 +291,13 @@ static int parse_tonal(DCALbrDecoder *s, int group)
        for (freq = 1;; freq++) {
            if (get_bits_left(&s->gb) < 1) {
                av_log(s->avctx, AV_LOG_ERROR, "Tonal group chunk too short\n");
-                return AVERROR_INVALIDDATA;
+                return -1;
            }

            diff = parse_vlc(&s->gb, &ff_dca_vlc_tnl_grp[group], 2);
            if (diff >= FF_ARRAY_ELEMS(ff_dca_fst_amp)) {
                av_log(s->avctx, AV_LOG_ERROR, "Invalid tonal frequency diff\n");
-                return AVERROR_INVALIDDATA;
+                return -1;
            }

            diff = get_bitsz(&s->gb, diff >> 2) + ff_dca_fst_amp[diff];
@@ -310,7 +307,7 @@ static int parse_tonal(DCALbrDecoder *s, int group)
            freq += diff - 2;
            if (freq >> (5 - group) > s->nsubbands * 4 - 6) {
                av_log(s->avctx, AV_LOG_ERROR, "Invalid spectral line offset\n");
-                return AVERROR_INVALIDDATA;
+                return -1;
            }

            // Main channel
@@ -361,21 +358,19 @@ static int parse_tonal(DCALbrDecoder *s, int group)

 static int parse_tonal_chunk(DCALbrDecoder *s, LBRChunk *chunk)
 {
-    int sb, group, ret;
+    int sb, group;

    if (!chunk->len)
        return 0;

-    ret = init_get_bits8(&s->gb, chunk->data, chunk->len);
-
-    if (ret < 0)
-        return ret;
+    if (init_get_bits8(&s->gb, chunk->data, chunk->len) < 0)
+        return -1;

    // Scale factors
    if (chunk->id == LBR_CHUNK_SCF || chunk->id == LBR_CHUNK_TONAL_SCF) {
        if (get_bits_left(&s->gb) < 36) {
            av_log(s->avctx, AV_LOG_ERROR, "Tonal scale factor chunk too short\n");
-            return AVERROR_INVALIDDATA;
+            return -1;
        }
        for (sb = 0; sb < 6; sb++)
            s->tonal_scf[sb] = get_bits(&s->gb, 6);
@@ -383,25 +378,20 @@ static int parse_tonal_chunk(DCALbrDecoder *s, LBRChunk *chunk)

    // Tonal groups
    if (chunk->id == LBR_CHUNK_TONAL || chunk->id == LBR_CHUNK_TONAL_SCF)
-        for (group = 0; group < 5; group++) {
-            ret = parse_tonal(s, group);
-            if (ret < 0)
-                return ret;
-        }
+        for (group = 0; group < 5; group++)
+            if (parse_tonal(s, group) < 0)
+                return -1;

    return 0;
 }

 static int parse_tonal_group(DCALbrDecoder *s, LBRChunk *chunk)
 {
-    int ret;
-
    if (!chunk->len)
        return 0;

-    ret = init_get_bits8(&s->gb, chunk->data, chunk->len);
-    if (ret < 0)
-        return ret;
+    if (init_get_bits8(&s->gb, chunk->data, chunk->len) < 0)
+        return -1;

    return parse_tonal(s, chunk->id);
 }
@@ -414,7 +404,7 @@ static int ensure_bits(GetBitContext *s, int n)
 {
    int left = get_bits_left(s);
    if (left < 0)
-        return AVERROR_INVALIDDATA;
+        return -1;
    if (left < n) {
        skip_bits_long(s, left);
        return 1;
@@ -443,7 +433,7 @@ static int parse_scale_factors(DCALbrDecoder *s, uint8_t *scf)
        dist = parse_vlc(&s->gb, &ff_dca_vlc_rsd_apprx, 1) + 1;
        if (dist > 7 - sf) {
            av_log(s->avctx, AV_LOG_ERROR, "Invalid scale factor distance\n");
-            return AVERROR_INVALIDDATA;
+            return -1;
        }

        if (ensure_bits(&s->gb, 20))
@@ -508,26 +498,22 @@ static int parse_st_code(GetBitContext *s, int min_v)

 static int parse_grid_1_chunk(DCALbrDecoder *s, LBRChunk *chunk, int ch1, int ch2)
 {
-    int ch, sb, sf, nsubbands, ret;
+    int ch, sb, sf, nsubbands;

    if (!chunk->len)
        return 0;

-    ret = init_get_bits8(&s->gb, chunk->data, chunk->len);
-    if (ret < 0)
-        return ret;
+    if (init_get_bits8(&s->gb, chunk->data, chunk->len) < 0)
+        return -1;

    // Scale factors
    nsubbands = ff_dca_scf_to_grid_1[s->nsubbands - 1] + 1;
    for (sb = 2; sb < nsubbands; sb++) {
-        ret = parse_scale_factors(s, s->grid_1_scf[ch1][sb]);
-        if (ret < 0)
-            return ret;
-        if (ch1 != ch2 && ff_dca_grid_1_to_scf[sb] < s->min_mono_subband) {
-            ret = parse_scale_factors(s, s->grid_1_scf[ch2][sb]);
-            if (ret < 0)
-                return ret;
-        }
+        if (parse_scale_factors(s, s->grid_1_scf[ch1][sb]) < 0)
+            return -1;
+        if (ch1 != ch2 && ff_dca_grid_1_to_scf[sb] < s->min_mono_subband
+            && parse_scale_factors(s, s->grid_1_scf[ch2][sb]) < 0)
+            return -1;
    }

    if (get_bits_left(&s->gb) < 1)
@@ -546,7 +532,7 @@ static int parse_grid_1_chunk(DCALbrDecoder *s, LBRChunk *chunk, int ch1, int ch

    if (get_bits_left(&s->gb) < 0) {
        av_log(s->avctx, AV_LOG_ERROR, "First grid chunk too short\n");
-        return AVERROR_INVALIDDATA;
+        return -1;
    }

    // Stereo image for partial mono mode
@@ -576,16 +562,14 @@ static int parse_grid_1_chunk(DCALbrDecoder *s, LBRChunk *chunk, int ch1, int ch

 static int parse_grid_1_sec_ch(DCALbrDecoder *s, int ch2)
 {
-    int sb, nsubbands, ret;
+    int sb, nsubbands;

    // Scale factors
    nsubbands = ff_dca_scf_to_grid_1[s->nsubbands - 1] + 1;
    for (sb = 2; sb < nsubbands; sb++) {
-        if (ff_dca_grid_1_to_scf[sb] >= s->min_mono_subband) {
-            ret = parse_scale_factors(s, s->grid_1_scf[ch2][sb]);
-            if (ret < 0)
-                return ret;
-        }
+        if (ff_dca_grid_1_to_scf[sb] >= s->min_mono_subband
+            && parse_scale_factors(s, s->grid_1_scf[ch2][sb]) < 0)
+            return -1;
    }

    // Average values for third grid
@@ -725,7 +709,7 @@ static int parse_ts(DCALbrDecoder *s, int ch1, int ch2,
            s->sb_indices[sb] = sb_reorder;
        }
        if (sb_reorder >= s->nsubbands)
-            return AVERROR_INVALIDDATA;
+            return -1;

        // Third grid scale factors
        if (sb == 12) {
@@ -747,7 +731,7 @@ static int parse_ts(DCALbrDecoder *s, int ch1, int ch2,

        quant_level = s->quant_levels[ch1 / 2][sb];
        if (!quant_level)
-            return AVERROR_INVALIDDATA;
+            return -1;

        // Time samples for one or both channels
        if (sb < s->max_mono_subband && sb_reorder >= s->min_mono_subband) {
@@ -808,14 +792,13 @@ static int parse_lpc(DCALbrDecoder *s, int ch1, int ch2, int start_sb, int end_s
 static int parse_high_res_grid(DCALbrDecoder *s, LBRChunk *chunk, int ch1, int ch2)
 {
    int quant_levels[DCA_LBR_SUBBANDS];
-    int sb, ch, ol, st, max_sb, profile, ret;
+    int sb, ch, ol, st, max_sb, profile;

    if (!chunk->len)
        return 0;

-    ret = init_get_bits8(&s->gb, chunk->data, chunk->len);
-    if (ret < 0)
-        return ret;
+    if (init_get_bits8(&s->gb, chunk->data, chunk->len) < 0)
+        return -1;

    // Quantizer profile
    profile = get_bits(&s->gb, 8);
@@ -849,20 +832,18 @@ static int parse_high_res_grid(DCALbrDecoder *s, LBRChunk *chunk, int ch1, int c
        s->quant_levels[ch1 / 2][sb] = quant_levels[sb];

    // LPC for the first two subbands
-    ret = parse_lpc(s, ch1, ch2, 0, 2);
-    if (ret < 0)
-        return ret;
+    if (parse_lpc(s, ch1, ch2, 0, 2) < 0)
+        return -1;

    // Time-samples for the first two subbands of main channel
-    ret = parse_ts(s, ch1, ch2, 0, 2, 0);
-    if (ret < 0)
-        return ret;
+    if (parse_ts(s, ch1, ch2, 0, 2, 0) < 0)
+        return -1;

    // First two bands of the first grid
    for (sb = 0; sb < 2; sb++)
        for (ch = ch1; ch <= ch2; ch++)
-            if ((ret = parse_scale_factors(s, s->grid_1_scf[ch][sb])) < 0)
-                return ret;
+            if (parse_scale_factors(s, s->grid_1_scf[ch][sb]) < 0)
+                return -1;

    return 0;
 }
@@ -911,42 +892,39 @@ static int parse_grid_2(DCALbrDecoder *s, int ch1, int ch2,

 static int parse_ts1_chunk(DCALbrDecoder *s, LBRChunk *chunk, int ch1, int ch2)
 {
-    int ret;
    if (!chunk->len)
        return 0;
-    if ((ret = init_get_bits8(&s->gb, chunk->data, chunk->len)) < 0)
-        return ret;
-    if ((ret = parse_lpc(s, ch1, ch2, 2, 3)) < 0)
-        return ret;
-    if ((ret = parse_ts(s, ch1, ch2, 2, 4, 0)) < 0)
-        return ret;
-    if ((ret = parse_grid_2(s, ch1, ch2, 0, 1, 0)) < 0)
-        return ret;
-    if ((ret = parse_ts(s, ch1, ch2, 4, 6, 0)) < 0)
-        return ret;
+    if (init_get_bits8(&s->gb, chunk->data, chunk->len) < 0)
+        return -1;
+    if (parse_lpc(s, ch1, ch2, 2, 3) < 0)
+        return -1;
+    if (parse_ts(s, ch1, ch2, 2, 4, 0) < 0)
+        return -1;
+    if (parse_grid_2(s, ch1, ch2, 0, 1, 0) < 0)
+        return -1;
+    if (parse_ts(s, ch1, ch2, 4, 6, 0) < 0)
+        return -1;
    return 0;
 }

 static int parse_ts2_chunk(DCALbrDecoder *s, LBRChunk *chunk, int ch1, int ch2)
 {
-    int ret;
-
    if (!chunk->len)
        return 0;
-    if ((ret = init_get_bits8(&s->gb, chunk->data, chunk->len)) < 0)
-        return ret;
-    if ((ret = parse_grid_2(s, ch1, ch2, 1, 3, 0)) < 0)
-        return ret;
-    if ((ret = parse_ts(s, ch1, ch2, 6, s->max_mono_subband, 0)) < 0)
-        return ret;
+    if (init_get_bits8(&s->gb, chunk->data, chunk->len) < 0)
+        return -1;
+    if (parse_grid_2(s, ch1, ch2, 1, 3, 0) < 0)
+        return -1;
+    if (parse_ts(s, ch1, ch2, 6, s->max_mono_subband, 0) < 0)
+        return -1;
    if (ch1 != ch2) {
-        if ((ret = parse_grid_1_sec_ch(s, ch2)) < 0)
-            return ret;
-        if ((ret = parse_grid_2(s, ch1, ch2, 0, 3, 1)) < 0)
-            return ret;
+        if (parse_grid_1_sec_ch(s, ch2) < 0)
+            return -1;
+        if (parse_grid_2(s, ch1, ch2, 0, 3, 1) < 0)
+            return -1;
    }
-    if ((ret = parse_ts(s, ch1, ch2, s->min_mono_subband, s->nsubbands, 1)) < 0)
-        return ret;
+    if (parse_ts(s, ch1, ch2, s->min_mono_subband, s->nsubbands, 1) < 0)
+        return -1;
    return 0;
 }

@@ -954,13 +932,11 @@ static int init_sample_rate(DCALbrDecoder *s)
 {
    double scale = (-1.0 / (1 << 17)) * sqrt(1 << (2 - s->limited_range));
    int i, br_per_ch = s->bit_rate_scaled / s->nchannels_total;
-    int ret;

    ff_mdct_end(&s->imdct);

-    ret = ff_mdct_init(&s->imdct, s->freq_range + 6, 1, scale);
-    if (ret < 0)
-        return ret;
+    if (ff_mdct_init(&s->imdct, s->freq_range + 6, 1, scale) < 0)
+        return -1;

    for (i = 0; i < 32 << s->freq_range; i++)
        s->window[i] = ff_dca_long_window[i << (2 - s->freq_range)];
@@ -999,7 +975,7 @@ static int alloc_sample_buffer(DCALbrDecoder *s)
    // Reallocate time sample buffer
    av_fast_mallocz(&s->ts_buffer, &s->ts_size, nsamples * sizeof(float));
    if (!s->ts_buffer)
-        return AVERROR(ENOMEM);
+        return -1;

    ptr = s->ts_buffer + DCA_LBR_TIME_HISTORY;
    for (ch = 0; ch < s->nchannels; ch++) {
@@ -1820,7 +1796,7 @@ av_cold int ff_dca_lbr_init(DCALbrDecoder *s)
    init_tables();

    if (!(s->fdsp = avpriv_float_dsp_alloc(0)))
-        return AVERROR(ENOMEM);
+        return -1;

    s->lbr_rand = 1;
    return 0;
@@ -328,7 +328,7 @@ static void dmix_add_c(int32_t *dst, const int32_t *src, int coeff, ptrdiff_t le
    int i;

    for (i = 0; i < len; i++)
-        dst[i] += (unsigned)mul15(src[i], coeff);
+        dst[i] += mul15(src[i], coeff);
 }

 static void dmix_scale_c(int32_t *dst, int scale, ptrdiff_t len)
@@ -613,7 +613,6 @@ static int dds_decode(AVCodecContext *avctx, void *data,
    AVFrame *frame = data;
    int mipmap;
    int ret;
-    int width, height;

    ff_texturedsp_init(&ctx->texdsp);
    bytestream2_init(gbc, avpkt->data, avpkt->size);
@@ -632,9 +631,9 @@ static int dds_decode(AVCodecContext *avctx, void *data,

    bytestream2_skip(gbc, 4); // flags

-    height = bytestream2_get_le32(gbc);
-    width  = bytestream2_get_le32(gbc);
-    ret = ff_set_dimensions(avctx, width, height);
+    avctx->height = bytestream2_get_le32(gbc);
+    avctx->width  = bytestream2_get_le32(gbc);
+    ret = av_image_check_size(avctx->width, avctx->height, 0, avctx);
    if (ret < 0) {
        av_log(avctx, AV_LOG_ERROR, "Invalid image size %dx%d.\n",
               avctx->width, avctx->height);
@@ -1910,8 +1910,7 @@ static int get_buffer_internal(AVCodecContext *avctx, AVFrame *frame, int flags)
    int ret;

    if (avctx->codec_type == AVMEDIA_TYPE_VIDEO) {
-        if ((unsigned)avctx->width > INT_MAX - STRIDE_ALIGN ||
-            (ret = av_image_check_size2(FFALIGN(avctx->width, STRIDE_ALIGN), avctx->height, avctx->max_pixels, AV_PIX_FMT_NONE, 0, avctx)) < 0 || avctx->pix_fmt<0) {
+        if ((ret = av_image_check_size2(FFALIGN(avctx->width, STRIDE_ALIGN), avctx->height, avctx->max_pixels, AV_PIX_FMT_NONE, 0, avctx)) < 0 || avctx->pix_fmt<0) {
            av_log(avctx, AV_LOG_ERROR, "video_get_buffer: image parameters invalid\n");
            return AVERROR(EINVAL);
        }
@@ -212,10 +212,10 @@ static int dirac_combine_frame(AVCodecParserContext *s, AVCodecContext *avctx,
        if (parse_timing_info && pu1.prev_pu_offset >= 13) {
            uint8_t *cur_pu = pc->buffer +
                              pc->index - 13 - pu1.prev_pu_offset;
-            int64_t pts = AV_RB32(cur_pu + 13);
+            int pts = AV_RB32(cur_pu + 13);
            if (s->last_pts == 0 && s->last_dts == 0)
                s->dts = pts - 1;
-            else if (s->last_dts != AV_NOPTS_VALUE)
+            else
                s->dts = s->last_dts + 1;
            s->pts = pts;
            if (!avctx->has_b_frames && (cur_pu[4] & 0x03))
@@ -1276,9 +1276,7 @@ static int dirac_unpack_idwt_params(DiracContext *s)
        s->num_y        = get_interleaved_ue_golomb(gb);
        if (s->num_x * s->num_y == 0 || s->num_x * (uint64_t)s->num_y > INT_MAX ||
            s->num_x * (uint64_t)s->avctx->width  > INT_MAX ||
-            s->num_y * (uint64_t)s->avctx->height > INT_MAX ||
-            s->num_x > s->avctx->width ||
-            s->num_y > s->avctx->height
+            s->num_y * (uint64_t)s->avctx->height > INT_MAX
        ) {
            av_log(s->avctx,AV_LOG_ERROR,"Invalid numx/y\n");
            s->num_x = s->num_y = 0;
@@ -198,9 +198,9 @@ static void dequant_subband_ ## PX ## _c(uint8_t *src, uint8_t *dst, ptrdiff_t s
        PX c, sign, *src_r = (PX *)src, *dst_r = (PX *)dst;                                \
        for (i = 0; i < tot_h; i++) {                                                      \
            c = *src_r++;                                                                  \
-            if     (c < 0) c = -((-(unsigned)c*qf + qs) >> 2);                             \
-            else if(c > 0) c =  (( (unsigned)c*qf + qs) >> 2);                             \
-            *dst_r++ = c;                                                                  \
+            sign = FFSIGN(c)*(!!c);                                                        \
+            c = (FFABS(c)*(unsigned)qf + qs) >> 2;                                                   \
+            *dst_r++ = c*sign;                                                             \
        }                                                                                  \
        src += tot_h << (sizeof(PX) >> 1);                                                 \
        dst += stride;                                                                     \
@@ -111,7 +111,6 @@ static av_cold int dnxhd_decode_init(AVCodecContext *avctx)

 static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth)
 {
-    int ret;
    if (cid != ctx->cid) {
        int index;

@@ -131,26 +130,19 @@ static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth)
        ff_free_vlc(&ctx->dc_vlc);
        ff_free_vlc(&ctx->run_vlc);

-        if ((ret = init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,
+        init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,
                 ctx->cid_table->ac_bits, 1, 1,
-                 ctx->cid_table->ac_codes, 2, 2, 0)) < 0)
-            goto out;
-        if ((ret = init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12,
+                 ctx->cid_table->ac_codes, 2, 2, 0);
+        init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12,
                 ctx->cid_table->dc_bits, 1, 1,
-                 ctx->cid_table->dc_codes, 1, 1, 0)) < 0)
-            goto out;
-        if ((ret = init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,
+                 ctx->cid_table->dc_codes, 1, 1, 0);
+        init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,
                 ctx->cid_table->run_bits, 1, 1,
-                 ctx->cid_table->run_codes, 2, 2, 0)) < 0)
-            goto out;
+                 ctx->cid_table->run_codes, 2, 2, 0);

        ctx->cid = cid;
    }
-    ret = 0;
-out:
-    if (ret < 0)
-        av_log(ctx->avctx, AV_LOG_ERROR, "init_vlc failed\n");
-    return ret;
+    return 0;
 }

 static av_cold int dnxhd_decode_init_thread_copy(AVCodecContext *avctx)
@@ -220,7 +220,7 @@ static av_cold int dnxhd_init_vlc(DNXHDEncContext *ctx)
    ctx->vlc_bits  = ctx->orig_vlc_bits + max_level * 2;
    for (level = -max_level; level < max_level; level++) {
        for (run = 0; run < 2; run++) {
-            int index = level * (1 << 1) | run;
+            int index = (level << 1) | run;
            int sign, offset = 0, alevel = level;

            MASK_ABS(sign, alevel);
@@ -616,7 +616,7 @@ void dnxhd_encode_block(DNXHDEncContext *ctx, int16_t *block,
        slevel = block[j];
        if (slevel) {
            int run_level = i - last_non_zero - 1;
-            int rlevel = slevel * (1 << 1) | !!run_level;
+            int rlevel = (slevel << 1) | !!run_level;
            put_bits(&ctx->m.pb, ctx->vlc_bits[rlevel], ctx->vlc_codes[rlevel]);
            if (run_level)
                put_bits(&ctx->m.pb, ctx->run_bits[run_level],
@@ -696,7 +696,7 @@ int dnxhd_calc_ac_bits(DNXHDEncContext *ctx, int16_t *block, int last_index)
        level = block[j];
        if (level) {
            int run_level = i - last_non_zero - 1;
-            bits += ctx->vlc_bits[level * (1 << 1) |
+            bits += ctx->vlc_bits[(level << 1) |
                    !!run_level] + ctx->run_bits[run_level];
            last_non_zero = i;
        }
@@ -305,8 +305,9 @@ static int dpcm_decode_frame(AVCodecContext *avctx, void *data,
                shift[ch] -= (2 * n);
            diff = sign_extend((diff &~ 3) << 8, 16);

-            /* saturate the shifter to 0..31 */
-            shift[ch] = av_clip_uintp2(shift[ch], 5);
+            /* saturate the shifter to a lower limit of 0 */
+            if (shift[ch] < 0)
+                shift[ch] = 0;

            diff >>= shift[ch];
            predictor[ch] += diff;
@@ -366,7 +367,7 @@ static int dpcm_decode_frame(AVCodecContext *avctx, void *data,
        while (output_samples < samples_end) {
            uint8_t n = bytestream2_get_byteu(&gb);

-            *output_samples++ = s->sample[idx] += (unsigned)s->array[n];
+            *output_samples++ = s->sample[idx] += s->array[n];
            idx ^= 1;
        }
        }
@@ -206,9 +206,6 @@ static int decode_frame(AVCodecContext *avctx,
        return AVERROR_PATCHWELCOME;
    }

-    if (bits_per_color > 32)
-        return AVERROR_INVALIDDATA;
-
    buf += 820;
    avctx->sample_aspect_ratio.num = read32(&buf, endian);
    avctx->sample_aspect_ratio.den = read32(&buf, endian);
@@ -44,9 +44,6 @@ static av_cold int decode_init(AVCodecContext *avctx)
    int i;
    uint8_t silence;

-    if (!avctx->channels)
-        return AVERROR_INVALIDDATA;
-
    ff_init_dsd_data();

    s = av_malloc_array(sizeof(DSDContext), avctx->channels);
@@ -37,7 +37,7 @@
 #define DST_MAX_CHANNELS 6
 #define DST_MAX_ELEMENTS (2 * DST_MAX_CHANNELS)

-#define DSD_FS44(sample_rate) (sample_rate * 8LL / 44100)
+#define DSD_FS44(sample_rate) (sample_rate * 8 / 44100)

 #define DST_SAMPLES_PER_FRAME(sample_rate) (588 * DSD_FS44(sample_rate))

@@ -85,16 +85,6 @@ static av_cold int decode_init(AVCodecContext *avctx)
        return AVERROR_PATCHWELCOME;
    }

-    // the sample rate is only allowed to be 64,128,256 * 44100 by ISO/IEC 14496-3:2005(E)
-    // We are a bit more tolerant here, but this check is needed to bound the size and duration
-    if (avctx->sample_rate > 512 * 44100)
-        return AVERROR_INVALIDDATA;
-
-
-    if (DST_SAMPLES_PER_FRAME(avctx->sample_rate) & 7) {
-        return AVERROR_PATCHWELCOME;
-    }
-
    avctx->sample_fmt = AV_SAMPLE_FMT_FLT;

    for (i = 0; i < avctx->channels; i++)
@@ -130,7 +120,7 @@ static int read_map(GetBitContext *gb, Table *t, unsigned int map[DST_MAX_CHANNE

 static av_always_inline int get_sr_golomb_dst(GetBitContext *gb, unsigned int k)
 {
-    int v = get_ur_golomb_jpegls(gb, k, get_bits_left(gb), 0);
+    int v = get_ur_golomb(gb, k, get_bits_left(gb), 0);
    if (v && get_bits1(gb))
        v = -v;
    return v;
@@ -165,16 +155,12 @@ static int read_table(GetBitContext *gb, Table *t, const int8_t code_pred_coeff[
            for (j = method + 1; j < t->length[i]; j++) {
                int c, x = 0;
                for (k = 0; k < method + 1; k++)
-                    x += code_pred_coeff[method][k] * (unsigned)t->coeff[i][j - k - 1];
+                    x += code_pred_coeff[method][k] * t->coeff[i][j - k - 1];
                c = get_sr_golomb_dst(gb, lsb_size);
                if (x >= 0)
                    c -= (x + 4) / 8;
                else
                    c += (-x + 3) / 8;
-                if (!is_signed) {
-                    if (c < offset || c >= offset + (1<<coeff_bits))
-                        return AVERROR_INVALIDDATA;
-                }
                t->coeff[i][j] = c;
            }
        }
@@ -312,15 +298,11 @@ static int decode_frame(AVCodecContext *avctx, void *data,

    /* Filter Coef Sets (10.12) */

-    ret = read_table(gb, &s->fsets, fsets_code_pred_coeff, 7, 9, 1, 0);
-    if (ret < 0)
-        return ret;
+    read_table(gb, &s->fsets, fsets_code_pred_coeff, 7, 9, 1, 0);

    /* Probability Tables (10.13) */

-    ret = read_table(gb, &s->probs, probs_code_pred_coeff, 6, 7, 0, 1);
-    if (ret < 0)
-        return ret;
+    read_table(gb, &s->probs, probs_code_pred_coeff, 6, 7, 0, 1);

    /* Arithmetic Coded Data (10.11) */

@@ -51,8 +51,8 @@ static int dump_extradata(AVBSFContext *ctx, AVPacket *out)
    if (ctx->par_in->extradata &&
        (s->freq == DUMP_FREQ_ALL ||
         (s->freq == DUMP_FREQ_KEYFRAME && in->flags & AV_PKT_FLAG_KEY)) &&
-         (in->size < ctx->par_in->extradata_size ||
-          memcmp(in->data, ctx->par_in->extradata, ctx->par_in->extradata_size))) {
+         in->size >= ctx->par_in->extradata_size &&
+         memcmp(in->data, ctx->par_in->extradata, ctx->par_in->extradata_size)) {
        if (in->size >= INT_MAX - ctx->par_in->extradata_size) {
            ret = AVERROR(ERANGE);
            goto fail;
@@ -456,7 +456,7 @@ static int dx2_decode_slice_410(GetBitContext *gb, AVFrame *frame,
            V[x >> 2] = decode_sym(gb, lru[2]) ^ 0x80;
        }

-        Y += ystride * 4;
+        Y += ystride << 2;
        U += ustride;
        V += vstride;
    }
@@ -501,7 +501,7 @@ static int dx2_decode_slice_420(GetBitContext *gb, AVFrame *frame,
            V[x >> 1] = decode_sym(gb, lru[2]) ^ 0x80;
        }

-        Y += ystride * 2;
+        Y += ystride << 1;
        U += ustride;
        V += vstride;
    }
@@ -745,7 +745,7 @@ static int dxv_decompress_cocg(DXVContext *ctx, GetByteContext *gb,
    int skip0, skip1, oi0 = 0, oi1 = 0;
    int ret, state0 = 0, state1 = 0;

-    if (op_offset < 12 || op_offset - 12 > bytestream2_get_bytes_left(gb))
+    if (op_offset < 12)
        return AVERROR_INVALIDDATA;

    dst = tex_data;
@@ -755,6 +755,7 @@ static int dxv_decompress_cocg(DXVContext *ctx, GetByteContext *gb,
    skip0 = dxv_decompress_opcodes(gb, op_data0, op_size0);
    if (skip0 < 0)
        return skip0;
+    bytestream2_seek(gb, data_start + op_offset + skip0 - 12, SEEK_SET);
    if (op_size1 > max_op_size1)
        return AVERROR_INVALIDDATA;
    skip1 = dxv_decompress_opcodes(gb, op_data1, op_size1);
@@ -783,7 +784,7 @@ static int dxv_decompress_cocg(DXVContext *ctx, GetByteContext *gb,
            return ret;
    }

-    bytestream2_seek(gb, data_start - 12 + op_offset + skip0 + skip1, SEEK_SET);
+    bytestream2_seek(gb, data_start + op_offset + skip0 + skip1 - 12, SEEK_SET);

    return 0;
 }
@@ -798,9 +799,6 @@ static int dxv_decompress_yo(DXVContext *ctx, GetByteContext *gb,
    uint8_t *dst, *table0[256] = { 0 }, *table1[256] = { 0 };
    int ret, state = 0, skip, oi = 0, v, vv;

-    if (op_offset < 8 || op_offset - 8 > bytestream2_get_bytes_left(gb))
-        return AVERROR_INVALIDDATA;
-
    dst = tex_data;
    bytestream2_skip(gb, op_offset - 8);
    if (op_size > max_op_size)
@@ -300,9 +300,6 @@ static int tgv_decode_frame(AVCodecContext *avctx,
            s->palette[i] = 0xFFU << 24 | AV_RB24(buf);
            buf += 3;
        }
-        if (buf_end - buf < 5) {
-            return AVERROR_INVALIDDATA;
-        }
    }

    if ((ret = ff_get_buffer(avctx, frame, AV_GET_BUFFER_FLAG_REF)) < 0)
@@ -131,9 +131,6 @@ static int tqi_decode_frame(AVCodecContext *avctx,
    AVFrame *frame = data;
    int ret, w, h;

-    if (buf_size < 12)
-        return AVERROR_INVALIDDATA;
-
    t->avctx = avctx;

    w = AV_RL16(&buf[0]);
@@ -881,7 +881,7 @@ static int pxr24_uncompress(EXRContext *s, const uint8_t *src,
                in     = ptr[3] + s->xdelta;

                for (j = 0; j < s->xdelta; ++j) {
-                    uint32_t diff = ((uint32_t)*(ptr[0]++) << 24) |
+                    uint32_t diff = (*(ptr[0]++) << 24) |
                    (*(ptr[1]++) << 16) |
                    (*(ptr[2]++) << 8 ) |
                    (*(ptr[3]++));
@@ -1092,9 +1092,6 @@ static int decode_block(AVCodecContext *avctx, void *tdata,
        if ((col + td->xsize) != s->xdelta)/* not the last tile of the line */
            axmax = 0; /* doesn't add pixel at the right of the datawindow */

-        if (td->xsize * (uint64_t)s->current_channel_offset > INT_MAX)
-            return AVERROR_INVALIDDATA;
-
        td->channel_line_size = td->xsize * s->current_channel_offset;/* uncompress size of one line */
        uncompressed_size = td->channel_line_size * (uint64_t)td->ysize;/* uncompress size of the block */
    } else {
@@ -1114,9 +1111,6 @@ static int decode_block(AVCodecContext *avctx, void *tdata,
        td->ysize          = FFMIN(s->scan_lines_per_block, s->ymax - line + 1); /* s->ydelta - line ?? */
        td->xsize          = s->xdelta;

-        if (td->xsize * (uint64_t)s->current_channel_offset > INT_MAX)
-            return AVERROR_INVALIDDATA;
-
        td->channel_line_size = td->xsize * s->current_channel_offset;/* uncompress size of one line */
        uncompressed_size = td->channel_line_size * (uint64_t)td->ysize;/* uncompress size of the block */

@@ -1313,7 +1307,6 @@ static int decode_header(EXRContext *s, AVFrame *frame)
    int magic_number, version, i, flags, sar = 0;
    int layer_match = 0;
    int ret;
-    int dup_channels = 0;

    s->current_channel_offset = 0;
    s->xmin               = ~0;
@@ -1472,12 +1465,10 @@ static int decode_header(EXRContext *s, AVFrame *frame)
                    s->pixel_type                     = current_pixel_type;
                    s->channel_offsets[channel_index] = s->current_channel_offset;
                } else if (channel_index >= 0) {
-                    av_log(s->avctx, AV_LOG_WARNING,
+                    av_log(s->avctx, AV_LOG_ERROR,
                            "Multiple channels with index %d.\n", channel_index);
-                    if (++dup_channels > 10) {
-                        ret = AVERROR_INVALIDDATA;
-                        goto fail;
-                    }
+                    ret = AVERROR_INVALIDDATA;
+                    goto fail;
                }

                s->channels = av_realloc(s->channels,
@@ -1520,28 +1511,15 @@ static int decode_header(EXRContext *s, AVFrame *frame)
            continue;
        } else if ((var_size = check_header_variable(s, "dataWindow", "box2i",
                                                     31)) >= 0) {
-            int xmin, ymin, xmax, ymax;
            if (!var_size) {
                ret = AVERROR_INVALIDDATA;
                goto fail;
            }

-            xmin   = bytestream2_get_le32(&s->gb);
-            ymin   = bytestream2_get_le32(&s->gb);
-            xmax   = bytestream2_get_le32(&s->gb);
-            ymax   = bytestream2_get_le32(&s->gb);
-
-            if (xmin > xmax || ymin > ymax ||
-                ymax == INT_MAX || xmax == INT_MAX ||
-                (unsigned)xmax - xmin >= INT_MAX ||
-                (unsigned)ymax - ymin >= INT_MAX) {
-                ret = AVERROR_INVALIDDATA;
-                goto fail;
-            }
-            s->xmin = xmin;
-            s->xmax = xmax;
-            s->ymin = ymin;
-            s->ymax = ymax;
+            s->xmin   = bytestream2_get_le32(&s->gb);
+            s->ymin   = bytestream2_get_le32(&s->gb);
+            s->xmax   = bytestream2_get_le32(&s->gb);
+            s->ymax   = bytestream2_get_le32(&s->gb);
            s->xdelta = (s->xmax - s->xmin) + 1;
            s->ydelta = (s->ymax - s->ymin) + 1;

@@ -1758,9 +1736,7 @@ static int decode_frame(AVCodecContext *avctx, void *data,
        s->ymin > s->ymax                  ||
        s->xdelta != s->xmax - s->xmin + 1 ||
        s->xmax >= s->w                    ||
-        s->ymax >= s->h                    ||
-        s->ydelta == 0xFFFFFFFF || s->xdelta == 0xFFFFFFFF
-    ) {
+        s->ymax >= s->h) {
        av_log(avctx, AV_LOG_ERROR, "Wrong or missing size information.\n");
        return AVERROR_INVALIDDATA;
    }
@@ -1784,7 +1760,7 @@ static int decode_frame(AVCodecContext *avctx, void *data,
    if ((ret = ff_thread_get_buffer(avctx, &frame, 0)) < 0)
        return ret;

-    if (bytestream2_get_bytes_left(&s->gb)/8 < nb_blocks)
+    if (bytestream2_get_bytes_left(&s->gb) < nb_blocks * 8)
        return AVERROR_INVALIDDATA;

    // check offset table and recreate it if need
@@ -1812,7 +1788,7 @@ static int decode_frame(AVCodecContext *avctx, void *data,
    ptr         = picture->data[0];

    // Zero out the start if ymin is not 0
-    for (y = 0; y < FFMIN(s->ymin, s->h); y++) {
+    for (y = 0; y < s->ymin; y++) {
        memset(ptr, 0, out_line_size);
        ptr += picture->linesize[0];
    }
@@ -1822,12 +1798,10 @@ static int decode_frame(AVCodecContext *avctx, void *data,
    avctx->execute2(avctx, decode_block, s->thread_data, NULL, nb_blocks);

    // Zero out the end if ymax+1 is not h
-    if ((s->ymax+1) < avctx->height) {
-        ptr = picture->data[0] + ((s->ymax+1) * picture->linesize[0]);
-        for (y = s->ymax + 1; y < avctx->height; y++) {
-            memset(ptr, 0, out_line_size);
-            ptr += picture->linesize[0];
-        }
+    ptr = picture->data[0] + ((s->ymax+1) * picture->linesize[0]);
+    for (y = s->ymax + 1; y < avctx->height; y++) {
+        memset(ptr, 0, out_line_size);
+        ptr += picture->linesize[0];
    }

    picture->pict_type = AV_PICTURE_TYPE_I;
@@ -85,7 +85,7 @@ static int extract_extradata_av1(AVBSFContext *ctx, AVPacket *pkt,
    }

    if (extradata_size && has_seq) {
-        AVBufferRef *filtered_buf = NULL;
+        AVBufferRef *filtered_buf;
        uint8_t *extradata, *filtered_data;

        if (s->remove) {
@@ -179,7 +179,7 @@ static int extract_extradata_h2645(AVBSFContext *ctx, AVPacket *pkt,
    if (extradata_size &&
        ((ctx->par_in->codec_id == AV_CODEC_ID_HEVC && has_sps && has_vps) ||
         (ctx->par_in->codec_id == AV_CODEC_ID_H264 && has_sps))) {
-        AVBufferRef *filtered_buf = NULL;
+        AVBufferRef *filtered_buf;
        uint8_t *extradata, *filtered_data;

        if (s->remove) {
@@ -141,8 +141,6 @@ static int decode_uncompressed(AVCodecContext *avctx, GetBitContext *gb,
                return AVERROR_INVALIDDATA;
            }
            cwi = 10 - av_log2(cwi);
-            if (get_bits_left(gb) < cwi + 1)
-                return AVERROR_INVALIDDATA;
            skip_bits(gb, cwi + 1);
            if (cwi > 5) {
                newmode = get_bits1(gb);
@@ -208,8 +206,6 @@ static int decode_group3_1d_line(AVCodecContext *avctx, GetBitContext *gb,
    unsigned int run = 0;
    unsigned int t;
    for (;;) {
-        if (get_bits_left(gb) <= 0)
-            return AVERROR_INVALIDDATA;
        t    = get_vlc2(gb, ccitt_vlc[mode].table, 9, 2);
        run += t;
        if (t < 64) {
@@ -228,7 +224,7 @@ static int decode_group3_1d_line(AVCodecContext *avctx, GetBitContext *gb,
            run       = 0;
            mode      = !mode;
        } else if ((int)t == -1) {
-            if (get_bits_left(gb) > 12 && show_bits(gb, 12) == 15) {
+            if (show_bits(gb, 12) == 15) {
                int ret;
                skip_bits(gb, 12);
                ret = decode_uncompressed(avctx, gb, &pix_left, &runs, runend, &mode);
@@ -255,10 +251,7 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
    unsigned int offs = 0, run = 0;

    while (offs < width) {
-        int cmode;
-        if (get_bits_left(gb) <= 0)
-            return AVERROR_INVALIDDATA;
-        cmode = get_vlc2(gb, ccitt_group3_2d_vlc.table, 9, 1);
+        int cmode = get_vlc2(gb, ccitt_group3_2d_vlc.table, 9, 1);
        if (cmode == -1) {
            av_log(avctx, AV_LOG_ERROR, "Incorrect mode VLC\n");
            return AVERROR_INVALIDDATA;
@@ -280,8 +273,6 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
            for (k = 0; k < 2; k++) {
                run = 0;
                for (;;) {
-                    if (get_bits_left(gb) <= 0)
-                        return AVERROR_INVALIDDATA;
                    t = get_vlc2(gb, ccitt_vlc[mode].table, 9, 2);
                    if (t == -1) {
                        av_log(avctx, AV_LOG_ERROR, "Incorrect code\n");
@@ -305,10 +296,7 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
                mode = !mode;
            }
        } else if (cmode == 9 || cmode == 10) {
-            int xxx;
-            if (get_bits_left(gb) < 3)
-                return AVERROR_INVALIDDATA;
-            xxx = get_bits(gb, 3);
+            int xxx = get_bits(gb, 3);
            if (cmode == 9 && xxx == 7) {
                int ret;
                int pix_left = width - offs;
@@ -789,7 +789,7 @@ static int read_header(FFV1Context *f)

            if (f->version == 2) {
                int idx = get_symbol(c, state, 0);
-                if (idx >= (unsigned)f->quant_table_count) {
+                if (idx > (unsigned)f->quant_table_count) {
                    av_log(f->avctx, AV_LOG_ERROR,
                           "quant_table_index out of range\n");
                    return AVERROR_INVALIDDATA;
@@ -893,10 +893,8 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac
        int trailer = 3 + 5*!!f->ec;
        int v;

-        if (i || f->version > 2) {
-            if (trailer > buf_p - buf) v = INT_MAX;
-            else                       v = AV_RB24(buf_p-trailer) + trailer;
-        } else                         v = buf_p - c->bytestream_start;
+        if (i || f->version > 2) v = AV_RB24(buf_p-trailer) + trailer;
+        else                     v = buf_p - c->bytestream_start;
        if (buf_p - c->bytestream_start < v) {
            av_log(avctx, AV_LOG_ERROR, "Slice pointer chain broken\n");
            ff_thread_report_progress(&f->picture, INT_MAX, 0);
@@ -908,7 +906,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac
            unsigned crc = av_crc(av_crc_get_table(AV_CRC_32_IEEE), 0, buf_p, v);
            if (crc) {
                int64_t ts = avpkt->pts != AV_NOPTS_VALUE ? avpkt->pts : avpkt->dts;
-                av_log(f->avctx, AV_LOG_ERROR, "slice CRC mismatch %X!", crc);
+                av_log(f->avctx, AV_LOG_ERROR, "CRC mismatch %X!", crc);
                if (ts != AV_NOPTS_VALUE && avctx->pkt_timebase.num) {
                    av_log(f->avctx, AV_LOG_ERROR, "at %f seconds\n", ts*av_q2d(avctx->pkt_timebase));
                } else if (ts != AV_NOPTS_VALUE) {
@@ -188,7 +188,7 @@ static uint64_t frac64(uint64_t a, uint64_t b)

 static uint64_t phi_at(struct ws_interval *in, int64_t ts)
 {
-    uint64_t dt = ts - (uint64_t)in->ts_start;
+    uint64_t dt = ts - in->ts_start;
    uint64_t dt2 = dt & 1 ? /* dt * (dt - 1) / 2 without overflow */
                   dt * ((dt - 1) >> 1) : (dt >> 1) * (dt - 1);
    return in->phi0 + dt * in->dphi0 + dt2 * in->ddphi;
@@ -217,10 +217,10 @@ static void wavesynth_seek(struct wavesynth_context *ws, int64_t ts)
    *last = -1;
    lcg_seek(&ws->dither_state, (uint32_t)ts - (uint32_t)ws->cur_ts);
    if (ws->pink_need) {
-        uint64_t pink_ts_cur  = (ws->cur_ts + (uint64_t)PINK_UNIT - 1) & ~(PINK_UNIT - 1);
-        uint64_t pink_ts_next = ts & ~(PINK_UNIT - 1);
+        int64_t pink_ts_cur  = (ws->cur_ts + PINK_UNIT - 1) & ~(PINK_UNIT - 1);
+        int64_t pink_ts_next = ts & ~(PINK_UNIT - 1);
        int pos = ts & (PINK_UNIT - 1);
-        lcg_seek(&ws->pink_state, (uint32_t)(pink_ts_next - pink_ts_cur) * 2);
+        lcg_seek(&ws->pink_state, (pink_ts_next - pink_ts_cur) << 1);
        if (pos) {
            pink_fill(ws);
            ws->pink_pos = pos;
@@ -281,7 +281,7 @@ static int wavesynth_parse_extradata(AVCodecContext *avc)
                dphi1 = frac64(f1, (int64_t)avc->sample_rate << 16);
                dphi2 = frac64(f2, (int64_t)avc->sample_rate << 16);
                in->dphi0 = dphi1;
-                in->ddphi = (int64_t)(dphi2 - (uint64_t)dphi1) / dt;
+                in->ddphi = (dphi2 - dphi1) / dt;
                if (phi & 0x80000000) {
                    phi &= ~0x80000000;
                    if (phi >= i)
@@ -301,8 +301,8 @@ static int wavesynth_parse_extradata(AVCodecContext *avc)
            default:
                return AVERROR(EINVAL);
        }
-        in->amp0 = (uint64_t)a1 << 32;
-        in->damp = (int64_t)(((uint64_t)a2 << 32) - ((uint64_t)a1 << 32)) / dt;
+        in->amp0 = (int64_t)a1 << 32;
+        in->damp = (((int64_t)a2 << 32) - ((int64_t)a1 << 32)) / dt;
    }
    if (edata != edata_end)
        return AVERROR(EINVAL);
@@ -350,8 +350,7 @@ fail:
 static void wavesynth_synth_sample(struct wavesynth_context *ws, int64_t ts,
                                   int32_t *channels)
 {
-    int32_t amp, *cv;
-    unsigned val;
+    int32_t amp, val, *cv;
    struct ws_interval *in;
    int i, *last, pink;
    uint32_t c, all_ch = 0;
@@ -373,12 +372,12 @@ static void wavesynth_synth_sample(struct wavesynth_context *ws, int64_t ts,
        in->amp  += in->damp;
        switch (in->type) {
            case WS_SINE:
-                val = amp * (unsigned)ws->sin[in->phi >> (64 - SIN_BITS)];
+                val = amp * ws->sin[in->phi >> (64 - SIN_BITS)];
                in->phi  += in->dphi;
                in->dphi += in->ddphi;
                break;
            case WS_NOISE:
-                val = amp * (unsigned)pink;
+                val = amp * pink;
                break;
            default:
                val = 0;
@@ -386,7 +385,7 @@ static void wavesynth_synth_sample(struct wavesynth_context *ws, int64_t ts,
        all_ch |= in->channels;
        for (c = in->channels, cv = channels; c; c >>= 1, cv++)
            if (c & 1)
-                *cv += (unsigned)val;
+                *cv += val;
    }
    val = (int32_t)lcg_next(&ws->dither_state) >> 16;
    for (c = all_ch, cv = channels; c; c >>= 1, cv++)
@@ -444,7 +443,7 @@ static int wavesynth_decode(AVCodecContext *avc, void *rframe, int *rgot_frame,
    if (r < 0)
        return r;
    pcm = (int16_t *)frame->data[0];
-    for (s = 0; s < duration; s++, ts+=(uint64_t)1) {
+    for (s = 0; s < duration; s++, ts++) {
        memset(channels, 0, avc->channels * sizeof(*channels));
        if (ts >= ws->next_ts)
            wavesynth_enter_intervals(ws, ts);
@@ -452,7 +451,7 @@ static int wavesynth_decode(AVCodecContext *avc, void *rframe, int *rgot_frame,
        for (c = 0; c < avc->channels; c++)
            *(pcm++) = channels[c] >> 16;
    }
-    ws->cur_ts += (uint64_t)duration;
+    ws->cur_ts += duration;
    *rgot_frame = 1;
    return packet->size;
 }
@@ -187,8 +187,6 @@ int avpriv_fits_header_parse_line(void *avcl, FITSHeader *header, const uint8_t
            header->blank = t;
            header->blank_found = 1;
        } else if (!strcmp(keyword, "BSCALE") && sscanf(value, "%lf", &d) == 1) {
-            if (d <= 0)
-                return AVERROR_INVALIDDATA;
            header->bscale = d;
        } else if (!strcmp(keyword, "BZERO") && sscanf(value, "%lf", &d) == 1) {
            header->bzero = d;
@@ -205,12 +203,8 @@ int avpriv_fits_header_parse_line(void *avcl, FITSHeader *header, const uint8_t
        } else if (!strcmp(keyword, "GROUPS") && sscanf(value, "%c", &c) == 1) {
            header->groups = (c == 'T');
        } else if (!strcmp(keyword, "GCOUNT") && sscanf(value, "%"SCNd64"", &t) == 1) {
-            if (t < 0 || t > INT_MAX)
-                return AVERROR_INVALIDDATA;
            header->gcount = t;
        } else if (!strcmp(keyword, "PCOUNT") && sscanf(value, "%"SCNd64"", &t) == 1) {
-            if (t < 0 || t > INT_MAX)
-                return AVERROR_INVALIDDATA;
            header->pcount = t;
        }
        dict_set_if_not_null(metadata, keyword, value);
@@ -143,7 +143,7 @@ static int fits_read_header(AVCodecContext *avctx, const uint8_t **ptr, FITSHead

    size = abs(header->bitpix) >> 3;
    for (i = 0; i < header->naxis; i++) {
-        if (size == 0 || header->naxisn[i] > SIZE_MAX / size) {
+        if (size && header->naxisn[i] > SIZE_MAX / size) {
            av_log(avctx, AV_LOG_ERROR, "unsupported size of FITS image");
            return AVERROR_INVALIDDATA;
        }
@@ -264,13 +264,6 @@ static int fits_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
            CASE_RGB(16, dst16, uint16_t, AV_RB16);
        }
    } else {
-        double scale = header.data_max - header.data_min;
-
-        if (scale <= 0 || !isfinite(scale)) {
-            scale = 1;
-        }
-        scale = 1/scale;
-
        switch (header.bitpix) {
 #define CASE_GRAY(cas, dst, type, t, rd) \
    case cas: \
@@ -279,7 +272,7 @@ static int fits_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
            for (j = 0; j < avctx->width; j++) { \
                t = rd; \
                if (!header.blank_found || t != header.blank) { \
-                    *dst++ = lrint(((t - header.data_min) * ((1 << (sizeof(type) * 8)) - 1)) * scale); \
+                    *dst++ = ((t - header.data_min) * ((1 << (sizeof(type) * 8)) - 1)) / (header.data_max - header.data_min); \
                } else { \
                    *dst++ = fitsctx->blank_val; \
                } \
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .2.5
 .1.git