Update for 2.8.6

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
avcodec/jpeg2000dec: More completely check cdef
2016-01-28 16:23:43 +01:00 · 2016-01-28 15:53:54 +01:00 · 2016-01-28 15:53:54 +01:00 · 2016-01-28 15:53:54 +01:00 · 2016-01-28 15:53:54 +01:00 · 2016-01-28 15:53:54 +01:00
208 changed files with 4801 additions and 1015 deletions
@@ -1,7 +1,288 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.

-version <next>:
+
+version 2.8.6
+- avcodec/jpeg2000dec: More completely check cdef
+- avutil/opt: check for and handle errors in av_opt_set_dict2()
+- avcodec/flacenc: fix calculation of bits required in case of custom sample rate
+- avformat: Document urls a bit
+- avformat/libquvi: Set default demuxer and protocol limitations
+- avformat/concat: Check protocol prefix
+- doc/demuxers: Document enable_drefs and use_absolute_path
+- avcodec/mjpegdec: Check for end for both bytes in unescaping
+- avcodec/mpegvideo_enc: Check for integer overflow in ff_mpv_reallocate_putbitbuffer()
+- avformat/avformat: Replace some references to filenames by urls
+- avcodec/wmaenc: Check ff_wma_init() for failure
+- avcodec/mpeg12enc: Move high resolution thread check to before initializing threads
+- avformat/img2dec: Use AVOpenCallback
+- avformat/avio: Limit url option parsing to the documented cases
+- avformat/img2dec: do not interpret the filename by default if a IO context has been opened
+- avcodec/ass_split: Fix null pointer dereference in ff_ass_style_get()
+- mov: Add an option to toggle dref opening
+- avcodec/gif: Fix lzw buffer size
+- avcodec/put_bits: Assert buf_ptr in flush_put_bits()
+- avcodec/tiff: Check subsample & rps values more completely
+- swscale/swscale: Add some sanity checks for srcSlice* parameters
+- swscale/x86/rgb2rgb_template: Fix planar2x() for short width
+- swscale/swscale_unscaled: Fix odd height inputs for bayer_to_yv12_wrapper()
+- swscale/swscale_unscaled: Fix odd height inputs for bayer_to_rgb24_wrapper()
+- avcodec/aacenc: Check both channels for finiteness
+- asfdec_o: check for too small size in asf_read_unknown
+- asfdec_o: break if EOF is reached after asf_read_packet_header
+- asfdec_o: make sure packet_size is non-zero before seeking
+- asfdec_o: prevent overflow causing seekback
+- asfdec_o: check avio_skip in asf_read_simple_index
+- asfdec_o: reject size > INT64_MAX in asf_read_unknown
+- asfdec_o: only set asf_pkt->data_size after sanity checks
+- Merge commit '8375dc1dd101d51baa430f34c0bcadfa37873896'
+- dca: fix misaligned access in avpriv_dca_convert_bitstream
+- brstm: fix missing closing brace
+- brstm: also allocate b->table in read_packet
+- brstm: make sure an ADPC chunk was read for adpcm_thp
+- vorbisdec: reject rangebits 0 with non-0 partitions
+- vorbisdec: reject channel mapping with less than two channels
+- ffmdec: reset packet_end in case of failure
+- avformat/ipmovie: put video decoding_map_size into packet and use it in decoder
+- avformat/brstm: fix overflow
+
+
+version 2.8.5
+- avformat/hls: Even stricter URL checks
+- avformat/hls: More strict url checks
+- avcodec/pngenc: Fix mixed up linesizes
+- avcodec/pngenc: Replace memcpy by av_image_copy()
+- swscale/vscale: Check that 2 tap filters are bilinear before using bilinear code
+- swscale: Move VScalerContext into vscale.c
+- swscale/utils: Detect and skip unneeded sws_setColorspaceDetails() calls
+- swscale/yuv2rgb: Increase YUV2RGB table headroom
+- swscale/yuv2rgb: Factor YUVRGB_TABLE_LUMA_HEADROOM out
+- avformat/hls: forbid all protocols except http(s) & file
+- avformat/aviobuf: Fix end check in put_str16()
+- avformat/asfenc: Check pts
+- avcodec/mpeg4video: Check time_incr
+- avcodec/wavpackenc: Check the number of channels
+- avcodec/wavpackenc: Headers are per channel
+- avcodec/aacdec_template: Check id_map
+- avcodec/dvdec: Fix "left shift of negative value -254"
+- avcodec/g2meet: Check for ff_els_decode_bit() failure in epic_decode_run_length()
+- avcodec/mjpegdec: Fix negative shift
+- avcodec/mss2: Check for repeat overflow
+- avformat: Add integer fps from 31 to 60 to get_std_framerate()
+- avformat/ivfenc: fix division by zero
+- avcodec/mpegvideo_enc: Clip bits_per_raw_sample within valid range
+- avfilter/vf_scale: set proper out frame color range
+- avcodec/motion_est: Fix mv_penalty table size
+- avcodec/h264_slice: Fix integer overflow in implicit weight computation
+- swscale/utils: Use normal bilinear scaler if fast cannot be used due to tiny dimensions
+- avcodec/put_bits: Always check buffer end before writing
+- mjpegdec: extend check for incompatible values of s->rgb and s->ls
+- swscale/utils: Fix intermediate format for cascaded alpha downscaling
+- avformat/mov: Update handbrake_version threshold for full mp3 parsing
+- x86/float_dsp: zero extend offset from ff_scalarproduct_float_sse
+- avfilter/vf_zoompan: do not free frame we pushed to lavfi
+- nuv: sanitize negative fps rate
+- nutdec: reject negative value_len in read_sm_data
+- xwddec: prevent overflow of lsize * avctx->height
+- nutdec: only copy the header if it exists
+- exr: fix out of bounds read in get_code
+- on2avc: limit number of bits to 30 in get_egolomb
+
+
+version 2.8.4
+- rawdec: only exempt BIT0 with need_copy from buffer sanity check
+- mlvdec: check that index_entries exist
+- avcodec/mpeg4videodec: also for empty partitioned slices
+- avcodec/h264_refs: Fix long_idx check
+- avcodec/h264_mc_template: prefetch list1 only if it is used in the MB
+- avcodec/h264_slice: Simplify ref2frm indexing
+- avfilter/vf_mpdecimate: Add missing emms_c()
+- sonic: make sure num_taps * channels is not larger than frame_size
+- opus_silk: fix typo causing overflow in silk_stabilize_lsf
+- ffm: reject invalid codec_id and codec_type
+- golomb: always check for invalid UE golomb codes in get_ue_golomb
+- sbr_qmf_analysis: sanitize input for 32-bit imdct
+- sbrdsp_fixed: assert that input values are in the valid range
+- aacsbr: ensure strictly monotone time borders
+- aacenc: update max_sfb when num_swb changes
+- aaccoder: prevent crash of anmr coder
+- ffmdec: reject zero-sized chunks
+- swscale/x86/rgb2rgb_template: Fallback to mmx in interleaveBytes() if the alignment is insufficient for SSE*
+- swscale/x86/rgb2rgb_template: Do not crash on misaligend stride
+- avformat/mxfenc: Do not crash if there is no packet in the first stream
+- lavf/tee: fix side data double free.
+- avformat/hlsenc: Check the return code of avformat_write_header()
+- avformat/mov: Enable parser for mp3s by old HandBrake
+- avformat/mxfenc: Fix integer overflow in length computation
+- avformat/utils: estimate_timings_from_pts - increase retry counter, fixes invalid duration for ts files with hevc codec
+- avformat/matroskaenc: Check codecdelay before use
+- avutil/mathematics: Fix division by 0
+- mjpegdec: consider chroma subsampling in size check
+- libvpxenc: remove some unused ctrl id mappings
+- avcodec/vp3: ensure header is parsed successfully before tables
+- avcodec/jpeg2000dec: Check bpno in decode_cblk()
+- avcodec/pgssubdec: Fix left shift of 255 by 24 places cannot be represented in type int
+- swscale/utils: Fix for runtime error: left shift of negative value -1
+- avcodec/hevc: Fix integer overflow of entry_point_offset
+- avcodec/dirac_parser: Check that there is a previous PU before accessing it
+- avcodec/dirac_parser: Add basic validity checks for next_pu_offset and prev_pu_offset
+- avcodec/dirac_parser: Fix potential overflows in pointer checks
+- avcodec/wmaprodec: Check bits per sample to be within the range not causing integer overflows
+- avcodec/wmaprodec: Fix overflow of cutoff
+- avformat/smacker: fix integer overflow with pts_inc
+- avcodec/vp3: Fix "runtime error: left shift of negative value"
+- avformat/riffdec: Initialize bitrate
+- mpegencts: Fix overflow in cbr mode period calculations
+- avutil/timecode: Fix fps check
+- avutil/mathematics: return INT64_MIN (=AV_NOPTS_VALUE) from av_rescale_rnd() for overflows
+- avcodec/apedec: Check length in long_filter_high_3800()
+- avcodec/vp3: always set pix_fmt in theora_decode_header()
+- avcodec/mpeg4videodec: Check available data before reading custom matrix
+- avutil/mathematics: Do not treat INT64_MIN as positive in av_rescale_rnd
+- avutil/integer: Fix av_mod_i() with negative dividend
+- avformat/dump: Fix integer overflow in av_dump_format()
+- avcodec/h264_refs: Check that long references match before use
+- avcodec/utils: Clear dimensions in ff_get_buffer() on failure
+- avcodec/utils: Use 64bit for aspect ratio calculation in avcodec_string()
+- avcodec/hevc: Check max ctb addresses for WPP
+- avcodec/vp3: Clear context on reinitialization failure
+- avcodec/hevc: allocate entries unconditionally
+- avcodec/hevc_cabac: Fix multiple integer overflows
+- avcodec/jpeg2000dwt: Check ndeclevels before calling dwt_encode*()
+- avcodec/jpeg2000dwt: Check ndeclevels before calling dwt_decode*()
+- avcodec/hevc: Check entry_point_offsets
+- lavf/rtpenc_jpeg: Less strict check for standard Huffman tables.
+- avcodec/ffv1dec: Clear quant_table_count if its invalid
+- avcodec/ffv1dec: Print an error if the quant table count is invalid
+- doc/filters/drawtext: fix centering example
+
+
+version 2.8.3
+- avcodec/cabac: Check initial cabac decoder state
+- avcodec/cabac_functions: Fix "left shift of negative value -31767"
+- avcodec/h264_slice: Limit max_contexts when slice_context_count is initialized
+- rtmpcrypt: Do the xtea decryption in little endian mode
+- avformat/matroskadec: Check subtitle stream before dereferencing
+- avcodec/pngdec: Replace assert by request for sample for unsupported TRNS cases
+- avformat/utils: Do not init parser if probing is unfinished
+- avcodec/jpeg2000dec: Fix potential integer overflow with tile dimensions
+- avcodec/jpeg2000: Use av_image_check_size() in ff_jpeg2000_init_component()
+- avcodec/wmaprodec: Check for overread in decode_packet()
+- avcodec/smacker: Check that the data size is a multiple of a sample vector
+- avcodec/takdec: Skip last p2 sample (which is unused)
+- avcodec/dxtory: Fix input size check in dxtory_decode_v1_410()
+- avcodec/dxtory: Fix input size check in dxtory_decode_v1_420()
+- avcodec/error_resilience: avoid accessing previous or next frames tables beyond height
+- avcodec/dpx: Move need_align to act per line
+- avcodec/flashsv: Check size before updating it
+- avcodec/ivi: Check image dimensions
+- avcodec/utils: Better check for channels in av_get_audio_frame_duration()
+- avcodec/jpeg2000dec: Check for duplicate SIZ marker
+- aacsbr: don't call sbr_dequant twice without intermediate read_sbr_data
+- hqx: correct type and size check of info_offset
+- mxfdec: check edit_rate also for physical_track
+- avcodec/jpeg2000: Change coord to 32bit to support larger than 32k width or height
+- avcodec/jpeg2000dec: Check SIZ dimensions to be within the supported range
+- avcodec/jpeg2000: Check comp coords to be within the supported size
+- mpegvideo: clear overread in clear_context
+- avcodec/avrndec: Use the AVFrame format instead of the context
+- dds: disable palette flag for compressed images
+- dds: validate compressed source buffer size
+- dds: validate source buffer size before copying
+- dvdsubdec: validate offset2 similar to offset1
+- brstm: reject negative sample rate
+- aacps: avoid division by zero in stereo_processing
+- softfloat: assert when the argument of av_sqrt_sf is negative
+
+version 2.8.2
+- various fixes in the aac_fixed decoder
+- various fixes in softfloat
+- swresample/resample: increase precision for compensation
+- lavf/mov: add support for sidx fragment indexes
+- avformat/mxfenc: Only store user comment related tags when needed
+- tests/fate/avformat: Fix fate-lavf
+- doc/ffmpeg: Clarify that the sdp_file option requires an rtp output.
+- ffmpeg: Don't try and write sdp info if none of the outputs had an rtp format.
+- apng: use correct size for output buffer
+- jvdec: avoid unsigned overflow in comparison
+- avcodec/jpeg2000dec: Clip all tile coordinates
+- avcodec/microdvddec: Check for string end in 'P' case
+- avcodec/dirac_parser: Fix undefined memcpy() use
+- avformat/xmv: Discard remainder of packet on error
+- avformat/xmv: factor return check out of if/else
+- avcodec/mpeg12dec: Do not call show_bits() with invalid bits
+- avcodec/faxcompr: Add missing runs check in decode_uncompressed()
+- libavutil/channel_layout: Check strtol*() for failure
+- avformat/mpegts: Only start probing data streams within probe_packets
+- avcodec/hevc_ps: Check chroma_format_idc
+- avcodec/ffv1dec: Check for 0 quant tables
+- avcodec/mjpegdec: Reinitialize IDCT on BPP changes
+- avcodec/mjpegdec: Check index in ljpeg_decode_yuv_scan() before using it
+- avutil/file_open: avoid file handle inheritance on Windows
+- avcodec/h264_slice: Disable slice threads if there are multiple access units in a packet
+- avformat/hls: update cookies on setcookie response
+- opusdec: Don't run vector_fmul_scalar on zero length arrays
+- avcodec/opusdec: Fix extra samples read index
+- avcodec/ffv1: Initialize vlc_state on allocation
+- avcodec/ffv1dec: update progress in case of broken pointer chains
+- avcodec/ffv1dec: Clear slice coordinates if they are invalid or slice header decoding fails for other reasons
+- rtsp: Allow $ as interleaved packet indicator before a complete response header
+- videodsp: don't overread edges in vfix3 emu_edge.
+- avformat/mp3dec: improve junk skipping heuristic
+- concatdec: fix file_start_time calculation regression
+- avcodec: loongson optimize h264dsp idct and loop filter with mmi
+- avcodec/jpeg2000dec: Clear properties in jpeg2000_dec_cleanup() too
+- avformat/hls: add support for EXT-X-MAP
+- avformat/hls: fix segment selection regression on track changes of live streams
+- configure: Require libkvazaar < 0.7.
+- avcodec/vp8: Do not use num_coeff_partitions in thread/buffer setup
+
+
+version 2.8.1:
+- swscale: fix ticket #4881
+- doc: fix spelling errors
+- hls: only seek if there is an offset
+- asfdec: add more checks for size left in asf packet buffer
+- asfdec: alloc enough space for storing name in asf_read_metadata_obj
+- avcodec/pngdec: Check blend_op.
+- h264_mp4toannexb: fix pps offfset fault when there are more than one sps in avcc
+- avcodec/h264_mp4toannexb_bsf: Use av_freep() to free spspps_buf
+- avformat/avidec: Workaround broken initial frame
+- avformat/hls: fix some cases of HLS streams which require cookies
+- avcodec/pngdec: reset has_trns after every decode_frame_png()
+- lavf/img2dec: Fix memory leak
+- avcodec/mp3: fix skipping zeros
+- avformat/srtdec: make sure we probe a number
+- configure: check for ID3D11VideoContext
+- avformat/vobsub: compare correct packet stream IDs
+- avformat/srtdec: more lenient first line probing
+- avformat/srtdec: fix number check for the first character
+- avcodec/mips: build fix for MSA 64bit
+- avcodec/mips: build fix for MSA
+- avformat/httpauth: Add space after commas in HTTP/RTSP auth header
+- libavformat/hlsenc: Use of uninitialized memory unlinking old files
+- avcodec/x86/sbrdsp: Fix using uninitialized upper 32bit of noise
+- avcodec/ffv1dec: Fix off by 1 error in quant_table_count check
+- avcodec/ffv1dec: Explicitly check read_quant_table() return value
+- dnxhddata: correct weight tables
+- dnxhddec: decode and use interlace mb flag
+- swscale: fix ticket #4877
+- avcodec/rangecoder: Check e
+- avcodec/ffv1: separate slice_count from max_slice_count
+- swscale: fix ticket 4850
+- cmdutils: Filter dst/srcw/h
+- avutil/log: fix zero length gnu_printf format string warning
+- lavf/webvttenc: Require webvtt file to contain exactly one WebVTT stream.
+- swscale/swscale: Fix "unused variable" warning
+- avcodec/mjpegdec: Fix decoding RGBA RCT LJPEG
+- MAINTAINERS: add 2.8, drop 2.2
+- doc: mention libavcodec can decode Opus natively
+- hevc: properly handle no_rasl_output_flag when removing pictures from the DPB
+- avfilter/af_ladspa: process all channels for nb_handles > 1
+- configure: add libsoxr to swresample's pkgconfig
+- lavc: Fix compilation with --disable-everything --enable-parser=mpeg4video.
+
+version 2.8:
 - colorkey video filter
 - BFSTM/BCSTM demuxer
 - little-endian ADPCM_THP decoder
@@ -564,11 +564,11 @@ x86                                     Michael Niedermayer
 Releases
 ========

+2.8                                     Michael Niedermayer
 2.7                                     Michael Niedermayer
 2.6                                     Michael Niedermayer
 2.5                                     Michael Niedermayer
 2.4                                     Michael Niedermayer
-2.2                                     Michael Niedermayer

 If you want to maintain an older release, please contact us

@@ -1 +1 @@
-2.7.git
+2.8.6
@@ -0,0 +1,15 @@
+
+              ┌────────────────────────────────────────┐
+              │ RELEASE NOTES for FFmpeg 2.8 "Feynman" │
+              └────────────────────────────────────────┘
+
+   The FFmpeg Project proudly presents FFmpeg 2.8 "Feynman", about 3
+   months after the release of FFmpeg 2.7.
+
+   A complete Changelog is available at the root of the project, and the
+   complete Git history on http://source.ffmpeg.org.
+
+   We hope you will like this release as much as we enjoyed working on it, and
+   as usual, if you have any questions about it, or any FFmpeg related topic,
+   feel free to join us on the #ffmpeg IRC channel (on irc.freenode.net) or ask
+   on the mailing-lists.
@@ -563,6 +563,12 @@ int opt_default(void *optctx, const char *opt, const char *arg)
        struct SwsContext *sws = sws_alloc_context();
        int ret = av_opt_set(sws, opt, arg, 0);
        sws_freeContext(sws);
+        if (!strcmp(opt, "srcw") || !strcmp(opt, "srch") ||
+            !strcmp(opt, "dstw") || !strcmp(opt, "dsth") ||
+            !strcmp(opt, "src_format") || !strcmp(opt, "dst_format")) {
+            av_log(NULL, AV_LOG_ERROR, "Directly using swscale dimensions/format options is not supported, please use the -s or -pix_fmt options\n");
+            return AVERROR(EINVAL);
+        }
        if (ret < 0) {
            av_log(NULL, AV_LOG_ERROR, "Error setting option %s.\n", opt);
            return ret;
@@ -2374,7 +2374,7 @@ zmbv_encoder_select="zlib"

 # hardware accelerators
 crystalhd_deps="libcrystalhd_libcrystalhd_if_h"
-d3d11va_deps="d3d11_h dxva_h ID3D11VideoDecoder"
+d3d11va_deps="d3d11_h dxva_h ID3D11VideoDecoder ID3D11VideoContext"
 dxva2_deps="dxva2api_h DXVA2_ConfigPictureDecode"
 vaapi_deps="va_va_h"
 vda_deps="VideoDecodeAcceleration_VDADecoder_h pthreads CoreServices_CoreServices_h"
@@ -5147,6 +5147,7 @@ check_struct "sys/time.h sys/resource.h" "struct rusage" ru_maxrss

 check_type "windows.h dxva.h" "DXVA_PicParams_HEVC" -DWINAPI_FAMILY=WINAPI_FAMILY_DESKTOP_APP -D_CRT_BUILD_DESKTOP_APP=0
 check_type "windows.h d3d11.h" "ID3D11VideoDecoder"
+check_type "windows.h d3d11.h" "ID3D11VideoContext"
 check_type "d3d9.h dxva2api.h" DXVA2_ConfigPictureDecode -D_WIN32_WINNT=0x0602

 check_type "va/va.h" "VAPictureParameterBufferHEVC"
@@ -5239,7 +5240,7 @@ enabled libgsm            && { for gsm_hdr in "gsm.h" "gsm/gsm.h"; do
                                   check_lib "${gsm_hdr}" gsm_create -lgsm && break;
                               done || die "ERROR: libgsm not found"; }
 enabled libilbc           && require libilbc ilbc.h WebRtcIlbcfix_InitDecode -lilbc
-enabled libkvazaar        && require_pkg_config kvazaar kvazaar.h kvz_api_get
+enabled libkvazaar        && require_pkg_config "kvazaar < 0.7.0" kvazaar.h kvz_api_get
 enabled libmfx            && require_pkg_config libmfx "mfx/mfxvideo.h" MFXInit
 enabled libmodplug        && require_pkg_config libmodplug libmodplug/modplug.h ModPlug_Load
 enabled libmp3lame        && require "libmp3lame >= 3.98.3" lame/lame.h lame_set_VBR_quality -lmp3lame
@@ -5261,7 +5262,7 @@ enabled libshine          && require_pkg_config shine shine/layer3.h shine_encod
 enabled libsmbclient      && { use_pkg_config smbclient libsmbclient.h smbc_init ||
                               require smbclient libsmbclient.h smbc_init -lsmbclient; }
 enabled libsnappy         && require snappy snappy-c.h snappy_compress -lsnappy
-enabled libsoxr           && require libsoxr soxr.h soxr_create -lsoxr
+enabled libsoxr           && require libsoxr soxr.h soxr_create -lsoxr && LIBSOXR="-lsoxr"
 enabled libssh            && require_pkg_config libssh libssh/sftp.h sftp_init
 enabled libspeex          && require_pkg_config speex speex/speex.h speex_decoder_init -lspeex
 enabled libstagefright_h264 && require_cpp libstagefright_h264 "binder/ProcessState.h media/stagefright/MetaData.h
@@ -6140,7 +6141,7 @@ cat > $TMPH <<EOF
 #define FFMPEG_CONFIG_H
 #define FFMPEG_CONFIGURATION "$(c_escape $FFMPEG_CONFIGURATION)"
 #define FFMPEG_LICENSE "$(c_escape $license)"
-#define CONFIG_THIS_YEAR 2015
+#define CONFIG_THIS_YEAR 2016
 #define FFMPEG_DATADIR "$(eval c_escape $datadir)"
 #define AVCONV_DATADIR "$(eval c_escape $datadir)"
 #define CC_IDENT "$(c_escape ${cc_ident:-Unknown compiler})"
@@ -6264,4 +6265,4 @@ pkgconfig_generate libavfilter   "FFmpeg audio/video filtering library" "$LIBAVF
 pkgconfig_generate libpostproc   "FFmpeg postprocessing library"        "$LIBPOSTPROC_VERSION"   ""
 pkgconfig_generate libavresample "Libav audio resampling library"       "$LIBAVRESAMPLE_VERSION" "$LIBM"
 pkgconfig_generate libswscale    "FFmpeg image rescaling library"       "$LIBSWSCALE_VERSION"    "$LIBM"
-pkgconfig_generate libswresample "FFmpeg audio resampling library"      "$LIBSWRESAMPLE_VERSION" "$LIBM"
+pkgconfig_generate libswresample "FFmpeg audio resampling library"      "$LIBSWRESAMPLE_VERSION" "$LIBM $LIBSOXR"
@@ -15,27 +15,29 @@ libavutil:     2014-08-09

 API changes, most recent first:

-2015-xx-xx - lavc 56.58.100 - vaapi.h
+-------- 8< --------- FFmpeg 2.8 was cut here -------- 8< ---------
+
+2015-08-27 - 1dd854e1 - lavc 56.58.100 - vaapi.h
  Deprecate old VA-API context (vaapi_context) fields that were only
  set and used by libavcodec. They are all managed internally now.

-2015-xx-xx - lavu 54.31.100 - pixfmt.h
+2015-08-19 - 9f8e57ef - lavu 54.31.100 - pixfmt.h
  Add a unique pixel format for VA-API (AV_PIX_FMT_VAAPI) that
  indicates the nature of the underlying storage: a VA surface. This
  yields the same value as AV_PIX_FMT_VAAPI_VLD.
  Deprecate old VA-API related pixel formats: AV_PIX_FMT_VAAPI_MOCO,
  AV_PIX_FMT_VAAPI_IDCT, AV_PIX_FMT_VAAPI_VLD.

-2015-xx-xx - lavu 54.30.0
-  xxxxxxx -  Add av_blowfish_alloc().
-  xxxxxxx -  Add av_rc4_alloc().
-  xxxxxxx -  Add av_xtea_alloc().
-  xxxxxxx -  Add av_des_alloc().
+2015-08-02 - lavu 54.30.100 / 54.17.0
+  9ed59f1 / 7a7df34c -  Add av_blowfish_alloc().
+  a130ec9 / ae365453 -  Add av_rc4_alloc().
+  9ca1997 / 5d8bea3b -  Add av_xtea_alloc().
+  3cf08e9 / d9e8b47e -  Add av_des_alloc().

-2015-xx-xx - lavc 56.35.0 - avcodec.h
-  xxxxxxxxx - Rename CODEC_FLAG* defines to AV_CODEC_FLAG*.
-  xxxxxxxxx - Rename CODEC_CAP_* defines to AV_CODEC_CAP_*.
-  xxxxxxxxx - Rename FF_INPUT_BUFFER_PADDING_SIZE and FF_MIN_BUFFER_SIZE
+2015-07-27 - lavc 56.56.100 / 56.35.0 - avcodec.h
+  94d68a4 / 7c6eb0a1 - Rename CODEC_FLAG* defines to AV_CODEC_FLAG*.
+  444e987 / def97856 - Rename CODEC_CAP_* defines to AV_CODEC_CAP_*.
+  29d147c / 059a9348 - Rename FF_INPUT_BUFFER_PADDING_SIZE and FF_MIN_BUFFER_SIZE
              to AV_INPUT_BUFFER_PADDING_SIZE and AV_INPUT_BUFFER_MIN_SIZE.

 2015-07-22 - c40ecff - lavc 56.51.100 - avcodec.h
@@ -31,7 +31,7 @@ PROJECT_NAME           = FFmpeg
 # This could be handy for archiving the generated documentation or
 # if some version control system is used.

-PROJECT_NUMBER         =
+PROJECT_NUMBER         = 2.8.6

 # With the PROJECT_LOGO tag one can specify a logo or icon that is included
 # in the documentation. The maximum height of the logo should not exceed 55
@@ -416,6 +416,23 @@ ffmpeg -framerate 10 -pattern_type glob -i "*.png" out.mkv
@end example
@end itemize

+@section mov/mp4/3gp/Quicktme
+
+Quicktime / MP4 demuxer.
+
+This demuxer accepts the following options:
+@table @option
+@item enable_drefs
+Enable loading of external tracks, disabled by default.
+Enabling this can theoretically leak information in some use cases.
+
+@item use_absolute_path
+Allows loading of external tracks via absolute paths, disabled by default.
+Enabling this poses a security risk. It should only be enabled if the source
+is known to be non malicious.
+
+@end table
+
@section mpegts

 MPEG-2 transport stream demuxer.
@@ -1353,7 +1353,7 @@ can be selected with @code{-pred 1}.
@table @option
@item format
 Can be set to either @code{j2k} or @code{jp2} (the default) that
-allows to store non-rgb pix_fmts.
+makes it possible to store non-rgb pix_fmts.

@end table

@@ -1205,9 +1205,9 @@ The option is intended for cases where features are needed that cannot be
 specified to @command{ffserver} but can be to @command{ffmpeg}.

@item -sdp_file @var{file} (@emph{global})
-Print sdp information to @var{file}.
+Print sdp information for an output stream to @var{file}.
 This allows dumping sdp information when at least one output isn't an
-rtp stream.
+rtp stream. (Requires at least one of the output formats to be rtp).

@item -discard (@emph{input})
 Allows discarding specific streams or frames of streams at the demuxer.
@@ -1032,7 +1032,7 @@ Number_of_samples
 For example full key look like this @code{lavfi.astats.1.DC_offset} or
 this @code{lavfi.astats.Overall.Peak_count}.

-For description what each key means read bellow.
+For description what each key means read below.

@item reset
 Set number of frame after which stats are going to be recalculated.
@@ -2199,7 +2199,7 @@ Amount of milliseconds the signal has to rise above the threshold before gain
 reduction starts. Default is 20. Range is between 0.01 and 2000.

@item release
-Amount of milliseconds the signal has to fall bellow the threshold before
+Amount of milliseconds the signal has to fall below the threshold before
 reduction is decreased again. Default is 250. Range is between 0.01 and 9000.

@item makeup
@@ -4118,7 +4118,7 @@ It accepts the following options:
@item threshold1
@item threshold2
@item threshold3
-Allows to limit the maximum change for each plane, default is 65535.
+Limit the maximum change for each plane, default is 65535.
 If 0, plane will remain unchanged.
@end table

@@ -4321,7 +4321,7 @@ It accepts the following options:
@item threshold1
@item threshold2
@item threshold3
-Allows to limit the maximum change for each plane, default is 65535.
+Limit the maximum change for each plane, default is 65535.
 If 0, plane will remain unchanged.

@item coordinates
@@ -4967,7 +4967,7 @@ within the parameter list.
@item
 Show the text at the center of the video frame:
@example
-drawtext="fontsize=30:fontfile=FreeSerif.ttf:text='hello world':x=(w-text_w)/2:y=(h-text_h-line_h)/2"
+drawtext="fontsize=30:fontfile=FreeSerif.ttf:text='hello world':x=(w-text_w)/2:y=(h-text_h)/2"
@end example

@item
@@ -5206,7 +5206,7 @@ It accepts the following options:
@item threshold1
@item threshold2
@item threshold3
-Allows to limit the maximum change for each plane, default is 65535.
+Limit the maximum change for each plane, default is 65535.
 If 0, plane will remain unchanged.

@item coordinates
@@ -6900,7 +6900,7 @@ It accepts the following options:
@item threshold1
@item threshold2
@item threshold3
-Allows to limit the maximum change for each plane, default is 65535.
+Limit the maximum change for each plane, default is 65535.
 If 0, plane will remain unchanged.
@end table

@@ -9881,7 +9881,7 @@ stereo3d=sbsl:aybd
@end example

@item
-Convert input video from above bellow (left eye above, right eye below) to side by side crosseye.
+Convert input video from above below (left eye above, right eye below) to side by side crosseye.
@example
 stereo3d=abl:sbsr
@end example
@@ -983,8 +983,8 @@ following image formats are supported:
@item Musepack SV8           @tab     @tab  X
@item Nellymoser Asao        @tab  X  @tab  X
@item On2 AVC (Audio for Video Codec) @tab     @tab  X
-@item Opus                   @tab  E  @tab  E
-    @tab supported through external library libopus
+@item Opus                   @tab  E  @tab  X
+    @tab encoding supported through external library libopus
@item PCM A-law              @tab  X  @tab  X
@item PCM mu-law             @tab  X  @tab  X
@item PCM signed 8-bit planar  @tab  X  @tab  X
@@ -839,6 +839,21 @@ ffmpeg -i file.mpg -c copy \
     -y out.ts
@end example

+@section mxf, mxf_d10
+
+MXF muxer.
+
+@subsection Options
+
+The muxer options are:
+
+@table @option
+@item store_user_comments @var{bool}
+Set if user comments should be stored if available or never.
+IRT D-10 does not allow user comments. The default is thus to write them for
+mxf but not for mxf_d10
+@end table
+
@section null

 Null muxer.
@@ -2447,6 +2447,9 @@ static void print_sdp(void)
        }
    }

+    if (!j)
+        goto fail;
+
    av_sdp_create(avc, j, sdp, sizeof(sdp));

    if (!sdp_filename) {
@@ -2462,6 +2465,7 @@ static void print_sdp(void)
        }
    }

+fail:
    av_freep(&avc);
 }

@@ -861,7 +861,7 @@ OBJS-$(CONFIG_MJPEG_PARSER)            += mjpeg_parser.o
 OBJS-$(CONFIG_MLP_PARSER)              += mlp_parser.o mlp.o
 OBJS-$(CONFIG_MPEG4VIDEO_PARSER)       += mpeg4video_parser.o h263.o \
                                          mpeg4videodec.o mpeg4video.o \
-                                          ituh263dec.o h263dec.o
+                                          ituh263dec.o h263dec.o h263data.o
 OBJS-$(CONFIG_PNG_PARSER)              += png_parser.o
 OBJS-$(CONFIG_MPEGAUDIO_PARSER)        += mpegaudio_parser.o \
                                          mpegaudiodecheader.o mpegaudiodata.o
@@ -499,7 +499,7 @@ static void search_for_quantizers_anmr(AVCodecContext *avctx, AACEncContext *s,
    }
    while (idx) {
        sce->sf_idx[bandaddr[idx]] = minq + q0;
-        minq = paths[idx][minq].prev;
+        minq = FFMAX(paths[idx][minq].prev, 0);
        idx--;
    }
    //set the same quantizers inside window groups
@@ -449,6 +449,10 @@ static int output_configure(AACContext *ac,
        int type =         layout_map[i][0];
        int id =           layout_map[i][1];
        id_map[type][id] = type_counts[type]++;
+        if (id_map[type][id] >= MAX_ELEM_ID) {
+            avpriv_request_sample(ac->avctx, "Remapped id too large\n");
+            return AVERROR_PATCHWELCOME;
+        }
    }
    // Try to sniff a reasonable channel order, otherwise output the
    // channels in the order the PCE declared them.
@@ -2889,6 +2893,11 @@ static int aac_decode_er_frame(AVCodecContext *avctx, void *data,

    spectral_to_sample(ac, samples);

+    if (!ac->frame->data[0] && samples) {
+        av_log(avctx, AV_LOG_ERROR, "no frame data found\n");
+        return AVERROR_INVALIDDATA;
+    }
+
    ac->frame->nb_samples = samples;
    ac->frame->sample_rate = avctx->sample_rate;
    *got_frame_ptr = 1;
@@ -547,6 +547,7 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
            ics->num_windows        = wi[ch].num_windows;
            ics->swb_sizes          = s->psy.bands    [ics->num_windows == 8];
            ics->num_swb            = tag == TYPE_LFE ? ics->num_swb : s->psy.num_bands[ics->num_windows == 8];
+            ics->max_sfb            = FFMIN(ics->max_sfb, ics->num_swb);
            ics->swb_offset         = wi[ch].window_type[0] == EIGHT_SHORT_SEQUENCE ?
                                        ff_swb_offset_128 [s->samplerate_index]:
                                        ff_swb_offset_1024[s->samplerate_index];
@@ -571,8 +572,16 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
            }

            apply_window_and_mdct(s, &cpe->ch[ch], overlap);
-            if (isnan(cpe->ch->coeffs[0])) {
-                av_log(avctx, AV_LOG_ERROR, "Input contains NaN\n");
+
+            if (isnan(cpe->ch[ch].coeffs[    0]) || isinf(cpe->ch[ch].coeffs[    0]) ||
+                isnan(cpe->ch[ch].coeffs[  128]) || isinf(cpe->ch[ch].coeffs[  128]) ||
+                isnan(cpe->ch[ch].coeffs[2*128]) || isinf(cpe->ch[ch].coeffs[2*128]) ||
+                isnan(cpe->ch[ch].coeffs[3*128]) || isinf(cpe->ch[ch].coeffs[3*128]) ||
+                isnan(cpe->ch[ch].coeffs[4*128]) || isinf(cpe->ch[ch].coeffs[4*128]) ||
+                isnan(cpe->ch[ch].coeffs[5*128]) || isinf(cpe->ch[ch].coeffs[5*128]) ||
+                isnan(cpe->ch[ch].coeffs[6*128]) || isinf(cpe->ch[ch].coeffs[6*128]) ||
+                isnan(cpe->ch[ch].coeffs[7*128]) || isinf(cpe->ch[ch].coeffs[7*128])) {
+                av_log(avctx, AV_LOG_ERROR, "Input contains NaN/+-Inf\n");
                return AVERROR(EINVAL);
            }
            avoid_clipping(s, &cpe->ch[ch]);
@@ -940,7 +940,7 @@ static void stereo_processing(PSContext *ps, INTFLOAT (*l)[32][2], INTFLOAT (*r)
            LOCAL_ALIGNED_16(INTFLOAT, h_step, [2], [4]);
            int start = ps->border_position[e];
            int stop  = ps->border_position[e+1];
-            INTFLOAT width = Q30(1.f) / (stop - start);
+            INTFLOAT width = Q30(1.f) / ((stop - start) ? (stop - start) : 1);
 #if USE_FIXED
            width <<= 1;
 #endif
@@ -169,6 +169,10 @@ static void sbr_dequant(SpectralBandReplication *sbr, int id_aac)
                else
                  temp1.mant = 0x20000000;
                temp1.exp = (temp1.exp >> 1) + 1;
+                if (temp1.exp > 66) { // temp1 > 1E20
+                    av_log(NULL, AV_LOG_ERROR, "envelope scalefactor overflow in dequant\n");
+                    temp1 = FLOAT_1;
+                }

                temp2.exp = (pan_offset - sbr->data[1].env_facs[e][k].mant) * alpha;
                if (temp2.exp & 1)
@@ -188,6 +192,10 @@ static void sbr_dequant(SpectralBandReplication *sbr, int id_aac)
                temp1.exp = NOISE_FLOOR_OFFSET - \
                    sbr->data[0].noise_facs[e][k].mant + 2;
                temp1.mant = 0x20000000;
+                if (temp1.exp > 66) { // temp1 > 1E20
+                    av_log(NULL, AV_LOG_ERROR, "envelope scalefactor overflow in dequant\n");
+                    temp1 = FLOAT_1;
+                }
                temp2.exp = 12 - sbr->data[1].noise_facs[e][k].mant + 1;
                temp2.mant = 0x20000000;
                fac   = av_div_sf(temp1, av_add_sf(FLOAT_1, temp2));
@@ -208,7 +216,10 @@ static void sbr_dequant(SpectralBandReplication *sbr, int id_aac)
                    else
                        temp1.mant = 0x20000000;
                    temp1.exp = (temp1.exp >> 1) + 1;
-
+                    if (temp1.exp > 66) { // temp1 > 1E20
+                        av_log(NULL, AV_LOG_ERROR, "envelope scalefactor overflow in dequant\n");
+                        temp1 = FLOAT_1;
+                    }
                    sbr->data[ch].env_facs[e][k] = temp1;
                }
            for (e = 1; e <= sbr->data[ch].bs_num_noise; e++)
@@ -397,7 +408,8 @@ static void sbr_gain_calc(AACContext *ac, SpectralBandReplication *sbr,
        int delta = !((e == e_a[1]) || (e == e_a[0]));
        for (k = 0; k < sbr->n_lim; k++) {
            SoftFloat gain_boost, gain_max;
-            SoftFloat sum[2] = { { 0, 0}, { 0, 0 } };
+            SoftFloat sum[2];
+            sum[0] = sum[1] = FLOAT_0;
            for (m = sbr->f_tablelim[k] - sbr->kx[1]; m < sbr->f_tablelim[k + 1] - sbr->kx[1]; m++) {
                const SoftFloat temp = av_div_sf(sbr->e_origmapped[e][m],
                                            av_add_sf(FLOAT_1, sbr->q_mapped[e][m]));
@@ -70,6 +70,7 @@ av_cold void AAC_RENAME(ff_aac_sbr_init)(void)
 /** Places SBR in pure upsampling mode. */
 static void sbr_turnoff(SpectralBandReplication *sbr) {
    sbr->start = 0;
+    sbr->ready_for_dequant = 0;
    // Init defults used in pure upsampling mode
    sbr->kx[1] = 32; //Typo in spec, kx' inits to 32
    sbr->m[1] = 0;
@@ -177,6 +178,7 @@ static unsigned int read_sbr_header(SpectralBandReplication *sbr, GetBitContext
    SpectrumParameters old_spectrum_params;

    sbr->start = 1;
+    sbr->ready_for_dequant = 0;

    // Save last spectrum parameters variables to compare to new ones
    memcpy(&old_spectrum_params, &sbr->spectrum_params, sizeof(SpectrumParameters));
@@ -716,8 +718,8 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
    }

    for (i = 1; i <= ch_data->bs_num_env; i++) {
-        if (ch_data->t_env[i-1] > ch_data->t_env[i]) {
-            av_log(ac->avctx, AV_LOG_ERROR, "Non monotone time borders\n");
+        if (ch_data->t_env[i-1] >= ch_data->t_env[i]) {
+            av_log(ac->avctx, AV_LOG_ERROR, "Not strictly monotone time borders\n");
            return -1;
        }
    }
@@ -1032,6 +1034,7 @@ static unsigned int read_sbr_data(AACContext *ac, SpectralBandReplication *sbr,
    unsigned int cnt = get_bits_count(gb);

    sbr->id_aac = id_aac;
+    sbr->ready_for_dequant = 1;

    if (id_aac == TYPE_SCE || id_aac == TYPE_CCE) {
        if (read_sbr_single_channel_element(ac, sbr, gb)) {
@@ -1151,6 +1154,9 @@ static void sbr_qmf_analysis(AVFloatDSPContext *dsp, FFTContext *mdct,
                             INTFLOAT z[320], INTFLOAT W[2][32][32][2], int buf_idx)
 {
    int i;
+#if USE_FIXED
+    int j;
+#endif
    memcpy(x    , x+1024, (320-32)*sizeof(x[0]));
    memcpy(x+288, in,         1024*sizeof(x[0]));
    for (i = 0; i < 32; i++) { // numTimeSlots*RATE = 16*2 as 960 sample frames
@@ -1158,6 +1164,21 @@ static void sbr_qmf_analysis(AVFloatDSPContext *dsp, FFTContext *mdct,
        dsp->vector_fmul_reverse(z, sbr_qmf_window_ds, x, 320);
        sbrdsp->sum64x5(z);
        sbrdsp->qmf_pre_shuffle(z);
+#if USE_FIXED
+        for (j = 64; j < 128; j++) {
+            if (z[j] > 1<<24) {
+                av_log(NULL, AV_LOG_WARNING,
+                       "sbr_qmf_analysis: value %09d too large, setting to %09d\n",
+                       z[j], 1<<24);
+                z[j] = 1<<24;
+            } else if (z[j] < -(1<<24)) {
+                av_log(NULL, AV_LOG_WARNING,
+                       "sbr_qmf_analysis: value %09d too small, setting to %09d\n",
+                       z[j], -(1<<24));
+                z[j] = -(1<<24);
+            }
+        }
+#endif
        mdct->imdct_half(mdct, z, z+64);
        sbrdsp->qmf_post_shuffle(W[buf_idx][i], z);
        x += 32;
@@ -1412,7 +1433,7 @@ static void sbr_env_estimate(AAC_FLOAT (*e_curr)[48], INTFLOAT X_high[64][40][2]

            for (p = 0; p < sbr->n[ch_data->bs_freq_res[e + 1]]; p++) {
 #if USE_FIXED
-                SoftFloat sum = { 0, 0 };
+                SoftFloat sum = FLOAT_0;
                const SoftFloat den = av_int2sf(0x20000000 / (env_size * (table[p + 1] - table[p])), 29);
                for (k = table[p]; k < table[p + 1]; k++) {
                    sum = av_add_sf(sum, sbr->dsp.sum_square(X_high[k] + ilb, iub - ilb));
@@ -1449,6 +1470,12 @@ void AAC_RENAME(ff_sbr_apply)(AACContext *ac, SpectralBandReplication *sbr, int
        sbr_turnoff(sbr);
    }

+    if (sbr->start && !sbr->ready_for_dequant) {
+        av_log(ac->avctx, AV_LOG_ERROR,
+               "No quantized data read for sbr_dequant.\n");
+        sbr_turnoff(sbr);
+    }
+
    if (!sbr->kx_and_m_pushed) {
        sbr->kx[0] = sbr->kx[1];
        sbr->m[0] = sbr->m[1];
@@ -1458,6 +1485,7 @@ void AAC_RENAME(ff_sbr_apply)(AACContext *ac, SpectralBandReplication *sbr, int

    if (sbr->start) {
        sbr_dequant(sbr, id_aac);
+        sbr->ready_for_dequant = 0;
    }
    for (ch = 0; ch < nch; ch++) {
        /* decode channel */
@@ -892,6 +892,9 @@ static void long_filter_high_3800(int32_t *buffer, int order, int shift, int len
    int32_t dotprod, sign;
    int32_t coeffs[256], delay[256];

+    if (order >= length)
+        return;
+
    memset(coeffs, 0, order * sizeof(*coeffs));
    for (i = 0; i < order; i++)
        delay[i] = buffer[i];
@@ -525,7 +525,7 @@ ASSStyle *ff_ass_style_get(ASSSplitContext *ctx, const char *style)
    if (!style || !*style)
        style = "Default";
    for (i=0; i<ass->styles_count; i++)
-        if (!strcmp(ass->styles[i].name, style))
+        if (ass->styles[i].name && !strcmp(ass->styles[i].name, style))
            return ass->styles + i;
    return NULL;
 }
@@ -113,7 +113,7 @@ static int decode_frame(AVCodecContext *avctx, void *data,
            int shift = p->height - avctx->height;
            int subsample_h, subsample_v;

-            av_pix_fmt_get_chroma_sub_sample(avctx->pix_fmt, &subsample_h, &subsample_v);
+            av_pix_fmt_get_chroma_sub_sample(p->format, &subsample_h, &subsample_v);

            p->data[0] += p->linesize[0] * shift;
            if (p->data[2]) {
@@ -51,7 +51,7 @@ void ff_init_cabac_encoder(CABACContext *c, uint8_t *buf, int buf_size){
 *
 * @param buf_size size of buf in bits
 */
-void ff_init_cabac_decoder(CABACContext *c, const uint8_t *buf, int buf_size){
+int ff_init_cabac_decoder(CABACContext *c, const uint8_t *buf, int buf_size){
    c->bytestream_start=
    c->bytestream= buf;
    c->bytestream_end= buf + buf_size;
@@ -64,6 +64,9 @@ void ff_init_cabac_decoder(CABACContext *c, const uint8_t *buf, int buf_size){
 #endif
    c->low+= ((*c->bytestream++)<<2) + 2;
    c->range= 0x1FE;
+    if ((c->range<<(CABAC_BITS+1)) < c->low)
+        return AVERROR_INVALIDDATA;
+    return 0;
 }

 void ff_init_cabac_states(void)
@@ -56,7 +56,7 @@ typedef struct CABACContext{
 }CABACContext;

 void ff_init_cabac_encoder(CABACContext *c, uint8_t *buf, int buf_size);
-void ff_init_cabac_decoder(CABACContext *c, const uint8_t *buf, int buf_size);
+int ff_init_cabac_decoder(CABACContext *c, const uint8_t *buf, int buf_size);
 void ff_init_cabac_states(void);

 #endif /* AVCODEC_CABAC_H */
@@ -74,7 +74,8 @@ static inline void renorm_cabac_decoder_once(CABACContext *c){

 #ifndef get_cabac_inline
 static void refill2(CABACContext *c){
-    int i, x;
+    int i;
+    unsigned x;

    x= c->low ^ (c->low-1);
    i= 7 - ff_h264_norm_shift[x>>(CABAC_BITS-1)];
@@ -190,7 +191,8 @@ static av_unused const uint8_t* skip_bytes(CABACContext *c, int n) {
 #endif
    if ((int) (c->bytestream_end - ptr) < n)
        return NULL;
-    ff_init_cabac_decoder(c, ptr + n, c->bytestream_end - ptr - n);
+    if (ff_init_cabac_decoder(c, ptr + n, c->bytestream_end - ptr - n) < 0)
+        return NULL;

    return ptr;
 }
@@ -41,8 +41,6 @@ int avpriv_dca_convert_bitstream(const uint8_t *src, int src_size, uint8_t *dst,
 {
    uint32_t mrk;
    int i, tmp;
-    const uint16_t *ssrc = (const uint16_t *) src;
-    uint16_t *sdst = (uint16_t *) dst;
    PutBitContext pb;

    if ((unsigned) src_size > (unsigned) max_size)
@@ -54,8 +52,11 @@ int avpriv_dca_convert_bitstream(const uint8_t *src, int src_size, uint8_t *dst,
        memcpy(dst, src, src_size);
        return src_size;
    case DCA_SYNCWORD_CORE_LE:
-        for (i = 0; i < (src_size + 1) >> 1; i++)
-            *sdst++ = av_bswap16(*ssrc++);
+        for (i = 0; i < (src_size + 1) >> 1; i++) {
+            AV_WB16(dst, AV_RL16(src));
+            src += 2;
+            dst += 2;
+        }
        return src_size;
    case DCA_SYNCWORD_CORE_14B_BE:
    case DCA_SYNCWORD_CORE_14B_LE:
@@ -141,6 +141,12 @@ static int parse_pixel_format(AVCodecContext *avctx)
    normal_map      = flags & DDPF_NORMALMAP;
    fourcc = bytestream2_get_le32(gbc);

+    if (ctx->compressed && ctx->paletted) {
+        av_log(avctx, AV_LOG_WARNING,
+               "Disabling invalid palette flag for compressed dds.\n");
+        ctx->paletted = 0;
+    }
+
    bpp = bytestream2_get_le32(gbc); // rgbbitcount
    r   = bytestream2_get_le32(gbc); // rbitmask
    g   = bytestream2_get_le32(gbc); // gbitmask
@@ -642,9 +648,18 @@ static int dds_decode(AVCodecContext *avctx, void *data,
        return ret;

    if (ctx->compressed) {
+        int size = (avctx->coded_height / TEXTURE_BLOCK_H) *
+                   (avctx->coded_width / TEXTURE_BLOCK_W) * ctx->tex_ratio;
        ctx->slice_count = av_clip(avctx->thread_count, 1,
                                   avctx->coded_height / TEXTURE_BLOCK_H);

+        if (bytestream2_get_bytes_left(gbc) < size) {
+            av_log(avctx, AV_LOG_ERROR,
+                   "Compressed Buffer is too small (%d < %d).\n",
+                   bytestream2_get_bytes_left(gbc), size);
+            return AVERROR_INVALIDDATA;
+        }
+
        /* Use the decompress function on the texture, one block per thread. */
        ctx->tex_data = gbc->buffer;
        avctx->execute2(avctx, decompress_texture_thread, frame, NULL, ctx->slice_count);
@@ -666,6 +681,12 @@ static int dds_decode(AVCodecContext *avctx, void *data,
            frame->palette_has_changed = 1;
        }

+        if (bytestream2_get_bytes_left(gbc) < frame->height * linesize) {
+            av_log(avctx, AV_LOG_ERROR, "Buffer is too small (%d < %d).\n",
+                   bytestream2_get_bytes_left(gbc), frame->height * linesize);
+            return AVERROR_INVALIDDATA;
+        }
+
        av_image_copy_plane(frame->data[0], frame->linesize[0],
                            gbc->buffer, linesize,
                            linesize, frame->height);
@@ -100,10 +100,12 @@ typedef struct DiracParseUnit {
 static int unpack_parse_unit(DiracParseUnit *pu, DiracParseContext *pc,
                             int offset)
 {
-    uint8_t *start = pc->buffer + offset;
-    uint8_t *end   = pc->buffer + pc->index;
-    if (start < pc->buffer || (start + 13 > end))
+    int8_t *start;
+
+    if (offset < 0 || pc->index - 13 < offset)
        return 0;
+
+    start = pc->buffer + offset;
    pu->pu_type = start[4];

    pu->next_pu_offset = AV_RB32(start + 5);
@@ -112,6 +114,15 @@ static int unpack_parse_unit(DiracParseUnit *pu, DiracParseContext *pc,
    if (pu->pu_type == 0x10 && pu->next_pu_offset == 0)
        pu->next_pu_offset = 13;

+    if (pu->next_pu_offset && pu->next_pu_offset < 13) {
+        av_log(NULL, AV_LOG_ERROR, "next_pu_offset %d is invalid\n", pu->next_pu_offset);
+        return 0;
+    }
+    if (pu->prev_pu_offset && pu->prev_pu_offset < 13) {
+        av_log(NULL, AV_LOG_ERROR, "prev_pu_offset %d is invalid\n", pu->prev_pu_offset);
+        return 0;
+    }
+
    return 1;
 }

@@ -123,7 +134,7 @@ static int dirac_combine_frame(AVCodecParserContext *s, AVCodecContext *avctx,
    DiracParseContext *pc = s->priv_data;

    if (pc->overread_index) {
-        memcpy(pc->buffer, pc->buffer + pc->overread_index,
+        memmove(pc->buffer, pc->buffer + pc->overread_index,
               pc->index - pc->overread_index);
        pc->index         -= pc->overread_index;
        pc->overread_index = 0;
@@ -190,7 +201,7 @@ static int dirac_combine_frame(AVCodecParserContext *s, AVCodecContext *avctx,
        }

        /* Get the picture number to set the pts and dts*/
-        if (parse_timing_info) {
+        if (parse_timing_info && pu1.prev_pu_offset >= 13) {
            uint8_t *cur_pu = pc->buffer +
                              pc->index - 13 - pu1.prev_pu_offset;
            int pts = AV_RB32(cur_pu + 13);
@@ -48,7 +48,7 @@ static const uint8_t dnxhd_1235_chroma_weight[] = {
    90, 90, 85, 79, 73, 73, 73, 73,
 };

-/* Used in CID 1237, 1253 */
+/* Used in CID 1237, 1253, 1259 */
 static const uint8_t dnxhd_1237_luma_weight[] = {
     0,  32,  33,  34, 34, 36, 37, 36,
    36,  37,  38,  38, 38, 39, 41, 44,
@@ -60,7 +60,7 @@ static const uint8_t dnxhd_1237_luma_weight[] = {
    97, 100, 104, 102, 98, 98, 99, 99,
 };

-/* Used in CID 1237, 1253 */
+/* Used in CID 1237, 1253, 1259 */
 static const uint8_t dnxhd_1237_chroma_weight[] = {
     0,  32,  36,  39, 39, 38, 39,  41,
    45,  51,  57,  58, 53, 48, 47,  51,
@@ -204,6 +204,7 @@ static const uint8_t dnxhd_1251_chroma_weight[] = {
    61, 59, 59, 59, 61, 62, 62, 62,
 };

+/* Used in CID 1252, 1258 */
 static const uint8_t dnxhd_1252_luma_weight[] = {
      0,  32,  34, 35, 36, 36, 36, 37,
     36,  37,  39, 40, 41, 40, 40, 40,
@@ -214,6 +215,8 @@ static const uint8_t dnxhd_1252_luma_weight[] = {
     71,  82,  90, 90, 88, 87, 90, 95,
    100, 107, 103, 97, 95, 93, 99, 99,
 };
+
+/* Used in CID 1252, 1258 */
 static const uint8_t dnxhd_1252_chroma_weight[] = {
      0,  32,  35,  36,  37,  37,  38,  40,
     42,  46,  49,  50,  50,  49,  49,  53,
@@ -226,80 +229,36 @@ static const uint8_t dnxhd_1252_chroma_weight[] = {
 };

 static const uint8_t dnxhd_1256_chroma_weight[] = {
-     0, 32, 32, 32, 32, 32, 32, 33,
-    32, 32, 32, 32, 32, 32, 32, 34,
-    32, 32, 32, 32, 32, 32, 33, 37,
-    32, 32, 32, 32, 32, 32, 36, 39,
-    32, 32, 32, 32, 32, 34, 39, 44,
-    32, 37, 32, 32, 35, 40, 43, 49,
-    32, 33, 36, 36, 40, 43, 50, 60,
-    34, 37, 39, 44, 51, 56, 61, 70,
-};
-
-static const uint8_t dnxhd_1258_luma_weight[] = {
-     0, 32, 36, 36,  40,  40, 55, 60,
-    34, 36, 37, 40,  41,  48, 57, 82,
-    35, 36, 41, 41,  46,  52, 73, 82,
-    37, 40, 42, 45,  50,  65, 80, 87,
-    39, 41, 44, 49,  62,  78, 88, 90,
-    41, 44, 49, 58,  73,  90, 95, 95,
-    43, 52, 55, 68,  90, 100, 97, 93,
-    52, 53, 71, 82, 107, 103, 99, 99,
-};
-
-static const uint8_t dnxhd_1258_chroma_weight[] = {
-     0, 32, 37,  38,  49,  53,  65,  66,
-    35, 37, 40,  49,  56,  64,  65,  82,
-    36, 42, 50,  56,  64,  67,  73,  85,
-    46, 50, 57,  63,  71,  72,  89,  87,
-    49, 58, 65,  72,  78,  88,  88,  90,
-    60, 64, 74,  81,  84,  90,  95, 134,
-    62, 74, 77,  80,  90, 114, 129, 125,
-    74, 74, 90, 100, 128, 125, 116, 116,
-};
-
-static const uint8_t dnxhd_1259_luma_weight[] = {
-     0, 32, 36, 37,  41,  44,  54, 60,
-    33, 34, 36, 39,  43,  51,  62, 78,
-    34, 36, 38, 41,  49,  59,  73, 79,
-    37, 38, 40, 47,  55,  66,  80, 95,
-    38, 41, 46, 54,  63,  79,  93, 96,
-    46, 47, 56, 64,  78,  90,  97, 98,
-    49, 58, 66, 78,  89,  97, 102, 98,
-    61, 65, 82, 87, 100, 104,  99, 99,
-};
-
-static const uint8_t dnxhd_1259_chroma_weight[] = {
-     0, 32, 38, 39,  47,  51,  77, 83,
-    36, 39, 41, 48,  55,  74,  85, 95,
-    39, 45, 53, 58,  72,  83, 105, 89,
-    51, 58, 66, 73,  82, 109,  92, 95,
-    57, 75, 78, 89, 105,  95,  93, 96,
-    81, 82, 99, 99,  94,  90,  97, 98,
-    83, 96, 97, 93,  89,  97, 102, 98,
-    90, 94, 92, 88, 100, 104,  99, 99,
+     0, 32, 32, 32, 32, 32, 32, 32,
+    32, 32, 32, 32, 32, 32, 32, 32,
+    32, 32, 32, 32, 32, 32, 37, 32,
+    32, 32, 32, 32, 33, 32, 32, 32,
+    32, 32, 33, 34, 37, 36, 32, 32,
+    32, 33, 34, 37, 36, 34, 35, 36,
+    39, 44, 40, 40, 39, 39, 44, 43,
+    43, 51, 56, 50, 49, 60, 61, 70,
 };

 static const uint8_t dnxhd_1260_luma_weight[] = {
-     0, 32, 37, 37, 40, 41, 52, 53,
-    33, 36, 36, 38, 40, 48, 49, 52,
-    34, 34, 37, 39, 44, 47, 49, 54,
-    33, 35, 38, 40, 45, 46, 54, 51,
-    34, 37, 37, 42, 44, 49, 52, 48,
-    34, 34, 38, 43, 44, 51, 50, 50,
-    33, 36, 41, 44, 51, 52, 50, 54,
-    36, 38, 44, 47, 53, 53, 54, 54,
+     0, 32, 33, 34, 36, 37, 37, 36,
+    34, 33, 34, 35, 37, 38, 40, 41,
+    40, 39, 38, 37, 34, 33, 34, 37,
+    40, 44, 48, 52, 53, 49, 47, 45,
+    42, 38, 36, 36, 38, 41, 43, 44,
+    46, 49, 52, 54, 54, 49, 44, 44,
+    44, 47, 51, 51, 52, 51, 48, 50,
+    52, 53, 53, 50, 50, 54, 54, 54,
 };

 static const uint8_t dnxhd_1260_chroma_weight[] = {
-     0, 32, 40, 38, 42, 40, 45, 45,
-    34, 42, 36, 43, 38, 46, 46, 49,
-    38, 35, 43, 39, 44, 47, 47, 49,
-    35, 42, 43, 42, 46, 47, 49, 52,
-    38, 43, 43, 44, 50, 49, 56, 50,
-    42, 43, 44, 50, 51, 57, 52, 53,
-    41, 45, 46, 53, 53, 56, 53, 54,
-    46, 46, 51, 49, 56, 53, 58, 58,
+     0, 32, 34, 38, 42, 40, 38, 36,
+    35, 35, 38, 42, 43, 43, 42, 40,
+    38, 39, 43, 43, 42, 41, 43, 43,
+    42, 44, 46, 45, 45, 46, 47, 46,
+    44, 44, 45, 46, 46, 46, 50, 50,
+    47, 47, 49, 49, 49, 49, 51, 53,
+    51, 49, 53, 57, 56, 52, 50, 52,
+    56, 56, 53, 53, 53, 54, 58, 58,
 };

 /* Used in CID 1235, 1241, 1250, 1256 */
@@ -1090,14 +1049,14 @@ const CIDEntry ff_dnxhd_cid_table[] = {
      { 350, 390, 440, 730, 880 },
      { { 24000, 1001 }, { 25, 1 }, { 30000, 1001 }, { 50, 1 }, { 60000, 1001 } } },
    { 1258, 960, 720, 0, 212992, 212992, 4, 8, 5,
-      dnxhd_1258_luma_weight, dnxhd_1258_chroma_weight,
+      dnxhd_1252_luma_weight, dnxhd_1252_chroma_weight,
      dnxhd_1237_dc_codes, dnxhd_1237_dc_bits,
      dnxhd_1252_ac_codes, dnxhd_1252_ac_bits, dnxhd_1252_ac_level,
      dnxhd_1252_ac_flags,
      dnxhd_1250_run_codes, dnxhd_1250_run_bits, dnxhd_1250_run,
      { 42, 60, 75, 115 } },
    { 1259, 1440, 1080, 0, 417792, 417792, 4, 8, 3,
-      dnxhd_1259_luma_weight, dnxhd_1259_chroma_weight,
+      dnxhd_1237_luma_weight, dnxhd_1237_chroma_weight,
      dnxhd_1237_dc_codes, dnxhd_1237_dc_bits,
      dnxhd_1237_ac_codes, dnxhd_1237_ac_bits, dnxhd_1237_ac_level,
      dnxhd_1237_ac_flags,
@@ -349,7 +349,12 @@ static int dnxhd_decode_macroblock(DNXHDContext *ctx, AVFrame *frame,
    uint8_t *dest_y, *dest_u, *dest_v;
    int dct_y_offset, dct_x_offset;
    int qscale, i;
+    int interlaced_mb = 0;

+    if (ctx->cid_table->cid == 1260) {
+        interlaced_mb = get_bits1(&ctx->gb);
+        qscale = get_bits(&ctx->gb, 10);
+    } else
    qscale = get_bits(&ctx->gb, 11);
    skip_bits1(&ctx->gb);

@@ -386,8 +391,12 @@ static int dnxhd_decode_macroblock(DNXHDContext *ctx, AVFrame *frame,
        dest_u += frame->linesize[1];
        dest_v += frame->linesize[2];
    }
+    if (interlaced_mb) {
+        dct_linesize_luma   <<= 1;
+        dct_linesize_chroma <<= 1;
+    }

-    dct_y_offset = dct_linesize_luma << 3;
+    dct_y_offset = interlaced_mb ? frame->linesize[0] : (dct_linesize_luma << 3);
    dct_x_offset = 8 << shift1;
    if (!ctx->is_444) {
        ctx->idsp.idct_put(dest_y,                               dct_linesize_luma, ctx->blocks[0]);
@@ -396,7 +405,7 @@ static int dnxhd_decode_macroblock(DNXHDContext *ctx, AVFrame *frame,
        ctx->idsp.idct_put(dest_y + dct_y_offset + dct_x_offset, dct_linesize_luma, ctx->blocks[5]);

        if (!(ctx->avctx->flags & AV_CODEC_FLAG_GRAY)) {
-            dct_y_offset = dct_linesize_chroma << 3;
+            dct_y_offset = interlaced_mb ? frame->linesize[1] : (dct_linesize_chroma << 3);
            ctx->idsp.idct_put(dest_u,                dct_linesize_chroma, ctx->blocks[2]);
            ctx->idsp.idct_put(dest_v,                dct_linesize_chroma, ctx->blocks[3]);
            ctx->idsp.idct_put(dest_u + dct_y_offset, dct_linesize_chroma, ctx->blocks[6]);
@@ -409,7 +418,7 @@ static int dnxhd_decode_macroblock(DNXHDContext *ctx, AVFrame *frame,
        ctx->idsp.idct_put(dest_y + dct_y_offset + dct_x_offset, dct_linesize_luma, ctx->blocks[7]);

        if (!(ctx->avctx->flags & AV_CODEC_FLAG_GRAY)) {
-            dct_y_offset = dct_linesize_chroma << 3;
+            dct_y_offset = interlaced_mb ? frame->linesize[1] : (dct_linesize_chroma << 3);
            ctx->idsp.idct_put(dest_u,                               dct_linesize_chroma, ctx->blocks[2]);
            ctx->idsp.idct_put(dest_u + dct_x_offset,                dct_linesize_chroma, ctx->blocks[3]);
            ctx->idsp.idct_put(dest_u + dct_y_offset,                dct_linesize_chroma, ctx->blocks[8]);
@@ -348,11 +348,11 @@ static int decode_frame(AVCodecContext *avctx,
                // For 12 bit, ignore alpha
                if (elements == 4)
                    buf += 2;
-                // Jump to next aligned position
-                buf += need_align;
            }
            for (i = 0; i < 3; i++)
                ptr[i] += p->linesize[i];
+            // Jump to next aligned position
+            buf += need_align;
        }
        break;
    case 16:
@@ -347,7 +347,7 @@ retry:
                                    dct_mode                        * 22 * 64 +
                                    (quant + ff_dv_quant_offset[class1]) * 64];
            }
-            dc = dc << 2;
+            dc = dc * 4;
            /* convert to unsigned because 128 is not added in the
             * standard IDCT */
            dc                   += 1024;
@@ -346,7 +346,7 @@ static int decode_dvd_subtitles(DVDSubContext *ctx, AVSubtitle *sub_header,
            }
        }
    the_end:
-        if (offset1 >= 0) {
+        if (offset1 >= 0 && offset2 >= 0) {
            int w, h;
            uint8_t *bitmap;

@@ -65,7 +65,7 @@ static int dxtory_decode_v1_410(AVCodecContext *avctx, AVFrame *pic,
    uint8_t *Y1, *Y2, *Y3, *Y4, *U, *V;
    int ret;

-    if (src_size < avctx->width * avctx->height * 9LL / 8) {
+    if (src_size < FFALIGN(avctx->width, 4) * FFALIGN(avctx->height, 4) * 9LL / 8) {
        av_log(avctx, AV_LOG_ERROR, "packet too small\n");
        return AVERROR_INVALIDDATA;
    }
@@ -108,7 +108,7 @@ static int dxtory_decode_v1_420(AVCodecContext *avctx, AVFrame *pic,
    uint8_t *Y1, *Y2, *U, *V;
    int ret;

-    if (src_size < avctx->width * avctx->height * 3LL / 2) {
+    if (src_size < FFALIGN(avctx->width, 2) * FFALIGN(avctx->height, 2) * 3LL / 2) {
        av_log(avctx, AV_LOG_ERROR, "packet too small\n");
        return AVERROR_INVALIDDATA;
    }
@@ -381,14 +381,19 @@ static void guess_mv(ERContext *s)
 #define MV_UNCHANGED 1
    const int mb_stride = s->mb_stride;
    const int mb_width  = s->mb_width;
-    const int mb_height = s->mb_height;
+    int mb_height = s->mb_height;
    int i, depth, num_avail;
    int mb_x, mb_y, mot_step, mot_stride;

+    if (s->last_pic.f && s->last_pic.f->data[0])
+        mb_height = FFMIN(mb_height, (s->last_pic.f->height+15)>>4);
+    if (s->next_pic.f && s->next_pic.f->data[0])
+        mb_height = FFMIN(mb_height, (s->next_pic.f->height+15)>>4);
+
    set_mv_strides(s, &mot_step, &mot_stride);

    num_avail = 0;
-    for (i = 0; i < s->mb_num; i++) {
+    for (i = 0; i < mb_width * mb_height; i++) {
        const int mb_xy = s->mb_index2xy[i];
        int f = 0;
        int error = s->error_status_table[mb_xy];
@@ -413,7 +418,7 @@ static void guess_mv(ERContext *s)

    if ((!(s->avctx->error_concealment&FF_EC_GUESS_MVS)) ||
        num_avail <= mb_width / 2) {
-        for (mb_y = 0; mb_y < s->mb_height; mb_y++) {
+        for (mb_y = 0; mb_y < mb_height; mb_y++) {
            for (mb_x = 0; mb_x < s->mb_width; mb_x++) {
                const int mb_xy = mb_x + mb_y * s->mb_stride;
                int mv_dir = (s->last_pic.f && s->last_pic.f->data[0]) ? MV_DIR_FORWARD : MV_DIR_BACKWARD;
@@ -442,7 +447,7 @@ static void guess_mv(ERContext *s)
            int score_sum = 0;

            changed = 0;
-            for (mb_y = 0; mb_y < s->mb_height; mb_y++) {
+            for (mb_y = 0; mb_y < mb_height; mb_y++) {
                for (mb_x = 0; mb_x < s->mb_width; mb_x++) {
                    const int mb_xy        = mb_x + mb_y * s->mb_stride;
                    int mv_predictor[8][2] = { { 0 } };
@@ -675,7 +680,7 @@ skip_last_mv:
        if (none_left)
            return;

-        for (i = 0; i < s->mb_num; i++) {
+        for (i = 0; i < mb_width * mb_height; i++) {
            int mb_xy = s->mb_index2xy[i];
            if (fixed[mb_xy])
                fixed[mb_xy] = MV_FROZEN;
@@ -459,7 +459,7 @@ static int huf_build_dec_table(const uint64_t *hcode, int im,
        lc += 8;                                                              \
 }

-#define get_code(po, rlc, c, lc, gb, out, oe)                                 \
+#define get_code(po, rlc, c, lc, gb, out, oe, outb)                           \
 {                                                                             \
        if (po == rlc) {                                                      \
            if (lc < 8)                                                       \
@@ -468,7 +468,7 @@ static int huf_build_dec_table(const uint64_t *hcode, int im,
                                                                              \
            cs = c >> lc;                                                     \
                                                                              \
-            if (out + cs > oe)                                                \
+            if (out + cs > oe || out == outb)                                 \
                return AVERROR_INVALIDDATA;                                   \
                                                                              \
            s = out[-1];                                                      \
@@ -501,7 +501,7 @@ static int huf_decode(const uint64_t *hcode, const HufDec *hdecod,

            if (pl.len) {
                lc -= pl.len;
-                get_code(pl.lit, rlc, c, lc, gb, out, oe);
+                get_code(pl.lit, rlc, c, lc, gb, out, oe, outb);
            } else {
                int j;

@@ -518,7 +518,7 @@ static int huf_decode(const uint64_t *hcode, const HufDec *hdecod,
                        if ((hcode[pl.p[j]] >> 6) ==
                            ((c >> (lc - l)) & ((1LL << l) - 1))) {
                            lc -= l;
-                            get_code(pl.p[j], rlc, c, lc, gb, out, oe);
+                            get_code(pl.p[j], rlc, c, lc, gb, out, oe, outb);
                            break;
                        }
                    }
@@ -539,7 +539,7 @@ static int huf_decode(const uint64_t *hcode, const HufDec *hdecod,

        if (pl.len) {
            lc -= pl.len;
-            get_code(pl.lit, rlc, c, lc, gb, out, oe);
+            get_code(pl.lit, rlc, c, lc, gb, out, oe, outb);
        } else {
            return AVERROR_INVALIDDATA;
        }
@@ -189,6 +189,10 @@ static int decode_uncompressed(AVCodecContext *avctx, GetBitContext *gb,
    *mode = !*mode;
    if (newmode != *mode) { //FIXME CHECK
        *(*runs)++ = 0;
+        if (*runs >= runend) {
+            av_log(avctx, AV_LOG_ERROR, "uncompressed run overrun\n");
+            return AVERROR_INVALIDDATA;
+        }
        *mode = newmode;
    }
    return 0;
@@ -66,7 +66,7 @@ av_cold int ff_ffv1_common_init(AVCodecContext *avctx)

 av_cold int ff_ffv1_init_slice_state(FFV1Context *f, FFV1Context *fs)
 {
-    int j;
+    int j, i;

    fs->plane_count  = f->plane_count;
    fs->transparency = f->transparency;
@@ -80,10 +80,15 @@ av_cold int ff_ffv1_init_slice_state(FFV1Context *f, FFV1Context *fs)
            if (!p->state)
                return AVERROR(ENOMEM);
        } else {
-            if (!p->vlc_state)
-                p->vlc_state = av_malloc_array(p->context_count, sizeof(VlcState));
-            if (!p->vlc_state)
-                return AVERROR(ENOMEM);
+            if (!p->vlc_state) {
+                p->vlc_state = av_mallocz_array(p->context_count, sizeof(VlcState));
+                if (!p->vlc_state)
+                    return AVERROR(ENOMEM);
+                for (i = 0; i < p->context_count; i++) {
+                    p->vlc_state[i].error_sum = 4;
+                    p->vlc_state[i].count     = 1;
+                }
+            }
        }
    }

@@ -101,7 +106,7 @@ av_cold int ff_ffv1_init_slice_state(FFV1Context *f, FFV1Context *fs)
 av_cold int ff_ffv1_init_slices_state(FFV1Context *f)
 {
    int i, ret;
-    for (i = 0; i < f->slice_count; i++) {
+    for (i = 0; i < f->max_slice_count; i++) {
        FFV1Context *fs = f->slice_context[i];
        if ((ret = ff_ffv1_init_slice_state(f, fs)) < 0)
            return AVERROR(ENOMEM);
@@ -113,10 +118,10 @@ av_cold int ff_ffv1_init_slice_contexts(FFV1Context *f)
 {
    int i;

-    f->slice_count = f->num_h_slices * f->num_v_slices;
-    av_assert0(f->slice_count > 0);
+    f->max_slice_count = f->num_h_slices * f->num_v_slices;
+    av_assert0(f->max_slice_count > 0);

-    for (i = 0; i < f->slice_count; i++) {
+    for (i = 0; i < f->max_slice_count; i++) {
        int sx          = i % f->num_h_slices;
        int sy          = i / f->num_h_slices;
        int sxs         = f->avctx->width  *  sx      / f->num_h_slices;
@@ -210,7 +215,7 @@ av_cold int ff_ffv1_close(AVCodecContext *avctx)
        ff_thread_release_buffer(avctx, &s->last_picture);
    av_frame_free(&s->last_picture.f);

-    for (j = 0; j < s->slice_count; j++) {
+    for (j = 0; j < s->max_slice_count; j++) {
        FFV1Context *fs = s->slice_context[j];
        for (i = 0; i < s->plane_count; i++) {
            PlaneContext *p = &fs->plane[i];
@@ -224,14 +229,14 @@ av_cold int ff_ffv1_close(AVCodecContext *avctx)
    av_freep(&avctx->stats_out);
    for (j = 0; j < s->quant_table_count; j++) {
        av_freep(&s->initial_states[j]);
-        for (i = 0; i < s->slice_count; i++) {
+        for (i = 0; i < s->max_slice_count; i++) {
            FFV1Context *sf = s->slice_context[i];
            av_freep(&sf->rc_stat2[j]);
        }
        av_freep(&s->rc_stat2[j]);
    }

-    for (i = 0; i < s->slice_count; i++)
+    for (i = 0; i < s->max_slice_count; i++)
        av_freep(&s->slice_context[i]);

    return 0;
@@ -118,6 +118,7 @@ typedef struct FFV1Context {

    struct FFV1Context *slice_context[MAX_SLICES];
    int slice_count;
+    int max_slice_count;
    int num_v_slices;
    int num_h_slices;
    int slice_width;
@@ -47,8 +47,11 @@ static inline av_flatten int get_symbol_inline(RangeCoder *c, uint8_t *state,
    else {
        int i, e, a;
        e = 0;
-        while (get_rac(c, state + 1 + FFMIN(e, 9))) // 1..10
+        while (get_rac(c, state + 1 + FFMIN(e, 9))) { // 1..10
            e++;
+            if (e > 31)
+                return AVERROR_INVALIDDATA;
+        }

        a = 1;
        for (i = e - 1; i >= 0; i--)
@@ -302,7 +305,7 @@ static int decode_slice_header(FFV1Context *f, FFV1Context *fs)
    for (i = 0; i < f->plane_count; i++) {
        PlaneContext * const p = &fs->plane[i];
        int idx = get_symbol(c, state, 0);
-        if (idx > (unsigned)f->quant_table_count) {
+        if (idx >= (unsigned)f->quant_table_count) {
            av_log(f->avctx, AV_LOG_ERROR, "quant_table_index out of range\n");
            return -1;
        }
@@ -405,6 +408,7 @@ static int decode_slice(AVCodecContext *c, void *arg)
        if (ff_ffv1_init_slice_state(f, fs) < 0)
            return AVERROR(ENOMEM);
        if (decode_slice_header(f, fs) < 0) {
+            fs->slice_x = fs->slice_y = fs->slice_height = fs->slice_width = 0;
            fs->slice_damaged = 1;
            return AVERROR_INVALIDDATA;
        }
@@ -499,7 +503,10 @@ static int read_quant_tables(RangeCoder *c,
    int context_count = 1;

    for (i = 0; i < 5; i++) {
-        context_count *= read_quant_table(c, quant_table[i], context_count);
+        int ret = read_quant_table(c, quant_table[i], context_count);
+        if (ret < 0)
+            return ret;
+        context_count *= ret;
        if (context_count > 32768U) {
            return AVERROR_INVALIDDATA;
        }
@@ -562,8 +569,11 @@ static int read_extra_header(FFV1Context *f)
    }

    f->quant_table_count = get_symbol(c, state, 0);
-    if (f->quant_table_count > (unsigned)MAX_QUANT_TABLES)
+    if (f->quant_table_count > (unsigned)MAX_QUANT_TABLES || !f->quant_table_count) {
+        av_log(f->avctx, AV_LOG_ERROR, "quant table count %d is invalid\n", f->quant_table_count);
+        f->quant_table_count = 0;
        return AVERROR_INVALIDDATA;
+    }

    for (i = 0; i < f->quant_table_count; i++) {
        f->context_count[i] = read_quant_tables(c, f->quant_tables[i]);
@@ -775,6 +785,7 @@ static int read_header(FFV1Context *f)
            av_log(f->avctx, AV_LOG_ERROR, "read_quant_table error\n");
            return AVERROR_INVALIDDATA;
        }
+        f->slice_count = f->max_slice_count;
    } else if (f->version < 3) {
        f->slice_count = get_symbol(c, state, 0);
    } else {
@@ -789,8 +800,8 @@ static int read_header(FFV1Context *f)
            p -= size + trailer;
        }
    }
-    if (f->slice_count > (unsigned)MAX_SLICES || f->slice_count <= 0) {
-        av_log(f->avctx, AV_LOG_ERROR, "slice count %d is invalid\n", f->slice_count);
+    if (f->slice_count > (unsigned)MAX_SLICES || f->slice_count <= 0 || f->slice_count > f->max_slice_count) {
+        av_log(f->avctx, AV_LOG_ERROR, "slice count %d is invalid (max=%d)\n", f->slice_count, f->max_slice_count);
        return AVERROR_INVALIDDATA;
    }

@@ -932,6 +943,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac
        else                     v = buf_p - c->bytestream_start;
        if (buf_p - c->bytestream_start < v) {
            av_log(avctx, AV_LOG_ERROR, "Slice pointer chain broken\n");
+            ff_thread_report_progress(&f->picture, INT_MAX, 0);
            return AVERROR_INVALIDDATA;
        }
        buf_p -= v;
@@ -1016,6 +1028,7 @@ static int init_thread_copy(AVCodecContext *avctx)
    f->picture.f      = NULL;
    f->last_picture.f = NULL;
    f->sample_buffer  = NULL;
+    f->max_slice_count = 0;
    f->slice_count = 0;

    for (i = 0; i < f->quant_table_count; i++) {
@@ -1091,7 +1104,7 @@ static int update_thread_context(AVCodecContext *dst, const AVCodecContext *src)
        av_assert0(!fdst->sample_buffer);
    }

-    av_assert1(fdst->slice_count == fsrc->slice_count);
+    av_assert1(fdst->max_slice_count == fsrc->max_slice_count);


    ff_thread_release_buffer(dst, &fdst->picture);
@@ -977,6 +977,7 @@ slices_ok:

    if ((ret = ff_ffv1_init_slice_contexts(s)) < 0)
        return ret;
+    s->slice_count = s->max_slice_count;
    if ((ret = ff_ffv1_init_slices_state(s)) < 0)
        return ret;

@@ -986,7 +987,7 @@ slices_ok:
        if (!avctx->stats_out)
            return AVERROR(ENOMEM);
        for (i = 0; i < s->quant_table_count; i++)
-            for (j = 0; j < s->slice_count; j++) {
+            for (j = 0; j < s->max_slice_count; j++) {
                FFV1Context *sf = s->slice_context[j];
                av_assert0(!sf->rc_stat2[i]);
                sf->rc_stat2[i] = av_mallocz(s->context_count[i] *
@@ -1210,6 +1211,7 @@ static int encode_frame(AVCodecContext *avctx, AVPacket *pkt,
            for (i = 0; i < f->quant_table_count; i++)
                memset(f->rc_stat2[i], 0, f->context_count[i] * sizeof(*f->rc_stat2[i]));

+            av_assert0(f->slice_count == f->max_slice_count);
            for (j = 0; j < f->slice_count; j++) {
                FFV1Context *fs = f->slice_context[j];
                for (i = 0; i < 256; i++) {
@@ -1021,7 +1021,7 @@ static int count_frame_header(FlacEncodeContext *s)
        count += 16;

    /* explicit sample rate */
-    count += ((s->sr_code[0] == 12) + (s->sr_code[0] > 12)) * 8;
+    count += ((s->sr_code[0] == 12) + (s->sr_code[0] > 12) * 2) * 8;

    /* frame header CRC-8 */
    count += 8;
@@ -413,6 +413,10 @@ static int flashsv_decode_frame(AVCodecContext *avctx, void *data,
                }

                if (has_diff) {
+                    if (size < 3) {
+                        av_log(avctx, AV_LOG_ERROR, "size too small for diff\n");
+                        return AVERROR_INVALIDDATA;
+                    }
                    if (!s->keyframe) {
                        av_log(avctx, AV_LOG_ERROR,
                               "Inter frame without keyframe\n");
@@ -440,6 +444,10 @@ static int flashsv_decode_frame(AVCodecContext *avctx, void *data,
                    int row = get_bits(&gb, 8);
                    av_log(avctx, AV_LOG_DEBUG, "%dx%d zlibprime_curr %dx%d\n",
                           i, j, col, row);
+                    if (size < 3) {
+                        av_log(avctx, AV_LOG_ERROR, "size too small for zlibprime_curr\n");
+                        return AVERROR_INVALIDDATA;
+                    }
                    size -= 2;
                    avpriv_request_sample(avctx, "zlibprime_curr");
                    return AVERROR_PATCHWELCOME;
@@ -631,6 +631,8 @@ static int epic_decode_run_length(ePICContext *dc, int x, int y, int tile_width,
              (NN  != N)  << 1 |
              (NNW != NW);
        WWneW = ff_els_decode_bit(&dc->els_ctx, &dc->W_ctx_rung[idx]);
+        if (WWneW < 0)
+            return WWneW;
    }

    if (WWneW)
@@ -837,10 +839,13 @@ static int epic_decode_tile(ePICContext *dc, uint8_t *out, int tile_height,
                if (y < 2 || x < 2 || x == tile_width - 1) {
                    run       = 1;
                    got_pixel = epic_handle_edges(dc, x, y, curr_row, above_row, &pix);
-                } else
+                } else {
                    got_pixel = epic_decode_run_length(dc, x, y, tile_width,
                                                       curr_row, above_row,
                                                       above2_row, &pix, &run);
+                    if (got_pixel < 0)
+                        return got_pixel;
+                }

                if (!got_pixel && !epic_predict_from_NW_NE(dc, x, y, run,
                                                           tile_width, curr_row,
@@ -32,7 +32,7 @@

 /**
 * G.726 11bit float.
- * G.726 Standard uses rather odd 11bit floating point arithmentic for
+ * G.726 Standard uses rather odd 11bit floating point arithmetic for
 * numerous occasions. It's a mystery to me why they did it this way
 * instead of simply using 32bit integer arithmetic.
 */
@@ -43,6 +43,7 @@ typedef struct GIFContext {
    const AVClass *class;
    LZWState *lzw;
    uint8_t *buf;
+    int buf_size;
    AVFrame *last_frame;
    int flags;
    uint32_t palette[AVPALETTE_COUNT];  ///< local reference palette for !pal8
@@ -174,7 +175,7 @@ static int gif_image_write_image(AVCodecContext *avctx,

    bytestream_put_byte(bytestream, 0x08);

-    ff_lzw_encode_init(s->lzw, s->buf, 2 * width * height,
+    ff_lzw_encode_init(s->lzw, s->buf, s->buf_size,
                       12, FF_LZW_GIF, put_bits);

    ptr = buf + y_start*linesize + x_start;
@@ -231,7 +232,8 @@ FF_ENABLE_DEPRECATION_WARNINGS
    s->transparent_index = -1;

    s->lzw = av_mallocz(ff_lzw_encode_state_size);
-    s->buf = av_malloc(avctx->width*avctx->height*2);
+    s->buf_size = avctx->width*avctx->height*2 + 1000;
+    s->buf = av_malloc(s->buf_size);
    s->tmpl = av_malloc(avctx->width);
    if (!s->tmpl || !s->buf || !s->lzw)
        return AVERROR(ENOMEM);
@@ -321,6 +323,7 @@ static int gif_encode_close(AVCodecContext *avctx)

    av_freep(&s->lzw);
    av_freep(&s->buf);
+    s->buf_size = 0;
    av_frame_free(&s->last_frame);
    av_freep(&s->tmpl);
    return 0;
@@ -68,7 +68,7 @@ static inline int get_ue_golomb(GetBitContext *gb)
        int log = 2 * av_log2(buf) - 31;
        LAST_SKIP_BITS(re, gb, 32 - log);
        CLOSE_READER(re, gb);
-        if (CONFIG_FTRAPV && log < 0) {
+        if (log < 7) {
            av_log(NULL, AV_LOG_ERROR, "Invalid UE golomb code\n");
            return AVERROR_INVALIDDATA;
        }
@@ -2026,6 +2026,7 @@ decode_intra_mb:
        const int mb_size = ff_h264_mb_sizes[h->sps.chroma_format_idc] *
                            h->sps.bit_depth_luma >> 3;
        const uint8_t *ptr;
+        int ret;

        // We assume these blocks are very rare so we do not optimize it.
        // FIXME The two following lines get the bitstream position in the cabac
@@ -2042,7 +2043,9 @@ decode_intra_mb:
        sl->intra_pcm_ptr = ptr;
        ptr += mb_size;

-        ff_init_cabac_decoder(&sl->cabac, ptr, sl->cabac.bytestream_end - ptr);
+        ret = ff_init_cabac_decoder(&sl->cabac, ptr, sl->cabac.bytestream_end - ptr);
+        if (ret < 0)
+            return ret;

        // All blocks are present
        h->cbp_table[mb_xy] = 0xf7ef;
@@ -158,6 +158,7 @@ static void MCFUNC(hl_motion)(const H264Context *h, H264SliceContext *sl,
        }
    }

-    prefetch_motion(h, sl, 1, PIXEL_SHIFT, CHROMA_IDC);
+    if (USES_LIST(mb_type, 1))
+        prefetch_motion(h, sl, 1, PIXEL_SHIFT, CHROMA_IDC);
 }

@@ -122,7 +122,7 @@ pps:
        if (!unit_nb && !sps_done++) {
            unit_nb = *extradata++; /* number of pps unit(s) */
            if (unit_nb) {
-                ctx->pps_offset = (extradata - 1) - (avctx->extradata + 4);
+                ctx->pps_offset = total_size;
                pps_seen = 1;
            }
        }
@@ -276,7 +276,7 @@ static void h264_mp4toannexb_filter_close(AVBitStreamFilterContext *bsfc)
 {
    H264BSFContext *ctx = bsfc->priv_data;
    if (ctx->private_spspps)
-        av_free(ctx->spspps_buf);
+        av_freep(&ctx->spspps_buf);
 }

 AVBitStreamFilter ff_h264_mp4toannexb_bsf = {
@@ -122,6 +122,14 @@ static int add_sorted(H264Picture **sorted, H264Picture **src, int len, int limi
    return out_i;
 }

+static int mismatches_ref(H264Context *h, H264Picture *pic)
+{
+    AVFrame *f = pic->f;
+    return (h->cur_pic_ptr->f->width  != f->width ||
+            h->cur_pic_ptr->f->height != f->height ||
+            h->cur_pic_ptr->f->format != f->format);
+}
+
 int ff_h264_fill_default_ref_list(H264Context *h, H264SliceContext *sl)
 {
    int i, len;
@@ -193,10 +201,7 @@ int ff_h264_fill_default_ref_list(H264Context *h, H264SliceContext *sl)
    for (j = 0; j<1+(sl->slice_type_nos == AV_PICTURE_TYPE_B); j++) {
        for (i = 0; i < sl->ref_count[j]; i++) {
            if (h->default_ref_list[j][i].parent) {
-                AVFrame *f = h->default_ref_list[j][i].parent->f;
-                if (h->cur_pic_ptr->f->width  != f->width ||
-                    h->cur_pic_ptr->f->height != f->height ||
-                    h->cur_pic_ptr->f->format != f->format) {
+                if (mismatches_ref(h, h->default_ref_list[j][i].parent)) {
                    av_log(h->avctx, AV_LOG_ERROR, "Discarding mismatching reference\n");
                    memset(&h->default_ref_list[j][i], 0, sizeof(h->default_ref_list[j][i]));
                }
@@ -298,14 +303,14 @@ int ff_h264_decode_ref_pic_list_reordering(H264Context *h, H264SliceContext *sl)

                    long_idx = pic_num_extract(h, pic_id, &pic_structure);

-                    if (long_idx > 31) {
+                    if (long_idx > 31U) {
                        av_log(h->avctx, AV_LOG_ERROR,
                               "long_term_pic_idx overflow\n");
                        return AVERROR_INVALIDDATA;
                    }
                    ref = h->long_ref[long_idx];
                    assert(!(ref && !ref->reference));
-                    if (ref && (ref->reference & pic_structure)) {
+                    if (ref && (ref->reference & pic_structure) && !mismatches_ref(h, ref)) {
                        ref->pic_id = pic_id;
                        assert(ref->long_ref);
                        i = 0;
@@ -182,8 +182,6 @@ static int decode_registered_user_data_closed_caption(H264Context *h, int size)
        }
    } else {
        int i;
-        avpriv_request_sample(h->avctx, "Subtitles with data type 0x%02x",
-                              user_data_type_code);
        for (i = 0; i < size - 1; i++)
            skip_bits(&h->gb, 8);
    }
@@ -783,7 +783,7 @@ static void implicit_weight_table(const H264Context *h, H264SliceContext *sl, in
            cur_poc = h->cur_pic_ptr->field_poc[h->picture_structure - 1];
        }
        if (sl->ref_count[0] == 1 && sl->ref_count[1] == 1 && !FRAME_MBAFF(h) &&
-            sl->ref_list[0][0].poc + sl->ref_list[1][0].poc == 2 * cur_poc) {
+            sl->ref_list[0][0].poc + (int64_t)sl->ref_list[1][0].poc == 2 * cur_poc) {
            sl->use_weight        = 0;
            sl->use_weight_chroma = 0;
            return;
@@ -804,7 +804,7 @@ static void implicit_weight_table(const H264Context *h, H264SliceContext *sl, in
    sl->chroma_log2_weight_denom = 5;

    for (ref0 = ref_start; ref0 < ref_count0; ref0++) {
-        int poc0 = sl->ref_list[0][ref0].poc;
+        int64_t poc0 = sl->ref_list[0][ref0].poc;
        for (ref1 = ref_start; ref1 < ref_count1; ref1++) {
            int w = 32;
            if (!sl->ref_list[0][ref0].parent->long_ref && !sl->ref_list[1][ref1].parent->long_ref) {
@@ -1097,6 +1097,7 @@ static int h264_slice_header_init(H264Context *h)
        nb_slices = max_slices;
    }
    h->slice_context_count = nb_slices;
+    h->max_contexts = FFMIN(h->max_contexts, nb_slices);

    if (!HAVE_THREADS || !(h->avctx->active_thread_type & FF_THREAD_SLICE)) {
        ret = ff_h264_slice_context_init(h, &h->slice_ctx[0]);
@@ -1177,6 +1178,15 @@ int ff_h264_decode_slice_header(H264Context *h, H264SliceContext *sl)
                av_log(h->avctx, AV_LOG_ERROR, "Too many fields\n");
                return AVERROR_INVALIDDATA;
            }
+            if (h->max_contexts > 1) {
+                if (!h->single_decode_warning) {
+                    av_log(h->avctx, AV_LOG_WARNING, "Cannot decode multiple access units as slice threads\n");
+                    h->single_decode_warning = 1;
+                }
+                h->max_contexts = 1;
+                return SLICE_SINGLETHREAD;
+            }
+
            if (h->cur_pic_ptr && FIELD_PICTURE(h) && h->first_field) {
                ret = ff_h264_field_end(h, h->slice_ctx, 1);
                h->current_slice = 0;
@@ -1983,12 +1993,12 @@ static av_always_inline void fill_filter_caches_inter(const H264Context *h,
        if (USES_LIST(top_type, list)) {
            const int b_xy  = h->mb2b_xy[top_xy] + 3 * b_stride;
            const int b8_xy = 4 * top_xy + 2;
-            int (*ref2frm)[64] = (void*)(sl->ref2frm[h->slice_table[top_xy] & (MAX_SLICES - 1)][0] + (MB_MBAFF(sl) ? 20 : 2));
+            int *ref2frm = sl->ref2frm[h->slice_table[top_xy] & (MAX_SLICES - 1)][list] + (MB_MBAFF(sl) ? 20 : 2);
            AV_COPY128(mv_dst - 1 * 8, h->cur_pic.motion_val[list][b_xy + 0]);
            ref_cache[0 - 1 * 8] =
-            ref_cache[1 - 1 * 8] = ref2frm[list][h->cur_pic.ref_index[list][b8_xy + 0]];
+            ref_cache[1 - 1 * 8] = ref2frm[h->cur_pic.ref_index[list][b8_xy + 0]];
            ref_cache[2 - 1 * 8] =
-            ref_cache[3 - 1 * 8] = ref2frm[list][h->cur_pic.ref_index[list][b8_xy + 1]];
+            ref_cache[3 - 1 * 8] = ref2frm[h->cur_pic.ref_index[list][b8_xy + 1]];
        } else {
            AV_ZERO128(mv_dst - 1 * 8);
            AV_WN32A(&ref_cache[0 - 1 * 8], ((LIST_NOT_USED) & 0xFF) * 0x01010101u);
@@ -1998,15 +2008,15 @@ static av_always_inline void fill_filter_caches_inter(const H264Context *h,
            if (USES_LIST(left_type[LTOP], list)) {
                const int b_xy  = h->mb2b_xy[left_xy[LTOP]] + 3;
                const int b8_xy = 4 * left_xy[LTOP] + 1;
-                int (*ref2frm)[64] =(void*)( sl->ref2frm[h->slice_table[left_xy[LTOP]] & (MAX_SLICES - 1)][0] + (MB_MBAFF(sl) ? 20 : 2));
+                int *ref2frm = sl->ref2frm[h->slice_table[left_xy[LTOP]] & (MAX_SLICES - 1)][list] + (MB_MBAFF(sl) ? 20 : 2);
                AV_COPY32(mv_dst - 1 +  0, h->cur_pic.motion_val[list][b_xy + b_stride * 0]);
                AV_COPY32(mv_dst - 1 +  8, h->cur_pic.motion_val[list][b_xy + b_stride * 1]);
                AV_COPY32(mv_dst - 1 + 16, h->cur_pic.motion_val[list][b_xy + b_stride * 2]);
                AV_COPY32(mv_dst - 1 + 24, h->cur_pic.motion_val[list][b_xy + b_stride * 3]);
                ref_cache[-1 +  0] =
-                ref_cache[-1 +  8] = ref2frm[list][h->cur_pic.ref_index[list][b8_xy + 2 * 0]];
+                ref_cache[-1 +  8] = ref2frm[h->cur_pic.ref_index[list][b8_xy + 2 * 0]];
                ref_cache[-1 + 16] =
-                ref_cache[-1 + 24] = ref2frm[list][h->cur_pic.ref_index[list][b8_xy + 2 * 1]];
+                ref_cache[-1 + 24] = ref2frm[h->cur_pic.ref_index[list][b8_xy + 2 * 1]];
            } else {
                AV_ZERO32(mv_dst - 1 +  0);
                AV_ZERO32(mv_dst - 1 +  8);
@@ -2031,9 +2041,9 @@ static av_always_inline void fill_filter_caches_inter(const H264Context *h,

    {
        int8_t *ref = &h->cur_pic.ref_index[list][4 * mb_xy];
-        int (*ref2frm)[64] = (void*)(sl->ref2frm[sl->slice_num & (MAX_SLICES - 1)][0] + (MB_MBAFF(sl) ? 20 : 2));
-        uint32_t ref01 = (pack16to32(ref2frm[list][ref[0]], ref2frm[list][ref[1]]) & 0x00FF00FF) * 0x0101;
-        uint32_t ref23 = (pack16to32(ref2frm[list][ref[2]], ref2frm[list][ref[3]]) & 0x00FF00FF) * 0x0101;
+        int *ref2frm = sl->ref2frm[sl->slice_num & (MAX_SLICES - 1)][list] + (MB_MBAFF(sl) ? 20 : 2);
+        uint32_t ref01 = (pack16to32(ref2frm[ref[0]], ref2frm[ref[1]]) & 0x00FF00FF) * 0x0101;
+        uint32_t ref23 = (pack16to32(ref2frm[ref[2]], ref2frm[ref[3]]) & 0x00FF00FF) * 0x0101;
        AV_WN32A(&ref_cache[0 * 8], ref01);
        AV_WN32A(&ref_cache[1 * 8], ref01);
        AV_WN32A(&ref_cache[2 * 8], ref23);
@@ -2362,9 +2372,11 @@ static int decode_slice(struct AVCodecContext *avctx, void *arg)
        align_get_bits(&sl->gb);

        /* init cabac */
-        ff_init_cabac_decoder(&sl->cabac,
+        ret = ff_init_cabac_decoder(&sl->cabac,
                              sl->gb.buffer + get_bits_count(&sl->gb) / 8,
                              (get_bits_left(&sl->gb) + 7) / 8);
+        if (ret < 0)
+            return ret;

        ff_h264_init_cabac_states(h, sl);

@@ -744,7 +744,7 @@ static int hls_slice_header(HEVCContext *s)
            av_freep(&sh->entry_point_offset);
            av_freep(&sh->offset);
            av_freep(&sh->size);
-            sh->entry_point_offset = av_malloc_array(sh->num_entry_point_offsets, sizeof(int));
+            sh->entry_point_offset = av_malloc_array(sh->num_entry_point_offsets, sizeof(unsigned));
            sh->offset = av_malloc_array(sh->num_entry_point_offsets, sizeof(int));
            sh->size = av_malloc_array(sh->num_entry_point_offsets, sizeof(int));
            if (!sh->entry_point_offset || !sh->offset || !sh->size) {
@@ -809,6 +809,8 @@ static int hls_slice_header(HEVCContext *s)
    s->HEVClc->tu.cu_qp_offset_cb = 0;
    s->HEVClc->tu.cu_qp_offset_cr = 0;

+    s->no_rasl_output_flag = IS_IDR(s) || IS_BLA(s) || (s->nal_unit_type == NAL_CRA_NUT && s->last_eos);
+
    return 0;
 }

@@ -2438,8 +2440,8 @@ static int hls_slice_data_wpp(HEVCContext *s, const HEVCNAL *nal)
    HEVCLocalContext *lc = s->HEVClc;
    int *ret = av_malloc_array(s->sh.num_entry_point_offsets + 1, sizeof(int));
    int *arg = av_malloc_array(s->sh.num_entry_point_offsets + 1, sizeof(int));
-    int offset;
-    int startheader, cmpt = 0;
+    int64_t offset;
+    int64_t startheader, cmpt = 0;
    int i, j, res = 0;

    if (!ret || !arg) {
@@ -2448,11 +2450,18 @@ static int hls_slice_data_wpp(HEVCContext *s, const HEVCNAL *nal)
        return AVERROR(ENOMEM);
    }

+    if (s->sh.slice_ctb_addr_rs + s->sh.num_entry_point_offsets * s->ps.sps->ctb_width >= s->ps.sps->ctb_width * s->ps.sps->ctb_height) {
+        av_log(s->avctx, AV_LOG_ERROR, "WPP ctb addresses are wrong (%d %d %d %d)\n",
+            s->sh.slice_ctb_addr_rs, s->sh.num_entry_point_offsets,
+            s->ps.sps->ctb_width, s->ps.sps->ctb_height
+        );
+        res = AVERROR_INVALIDDATA;
+        goto error;
+    }
+
+    ff_alloc_entries(s->avctx, s->sh.num_entry_point_offsets + 1);

    if (!s->sList[1]) {
-        ff_alloc_entries(s->avctx, s->sh.num_entry_point_offsets + 1);
-
-
        for (i = 1; i < s->threads_number; i++) {
            s->sList[i] = av_malloc(sizeof(HEVCContext));
            memcpy(s->sList[i], s, sizeof(HEVCContext));
@@ -2485,6 +2494,11 @@ static int hls_slice_data_wpp(HEVCContext *s, const HEVCNAL *nal)
    }
    if (s->sh.num_entry_point_offsets != 0) {
        offset += s->sh.entry_point_offset[s->sh.num_entry_point_offsets - 1] - cmpt;
+        if (length < offset) {
+            av_log(s->avctx, AV_LOG_ERROR, "entry_point_offset table is corrupted\n");
+            res = AVERROR_INVALIDDATA;
+            goto error;
+        }
        s->sh.size[s->sh.num_entry_point_offsets - 1] = length - offset;
        s->sh.offset[s->sh.num_entry_point_offsets - 1] = offset;

@@ -2511,6 +2525,7 @@ static int hls_slice_data_wpp(HEVCContext *s, const HEVCNAL *nal)

    for (i = 0; i <= s->sh.num_entry_point_offsets; i++)
        res += ret[i];
+error:
    av_free(ret);
    av_free(arg);
    return res;
@@ -3135,6 +3150,7 @@ static int hevc_update_thread_context(AVCodecContext *dst,
    s->pocTid0    = s0->pocTid0;
    s->max_ra     = s0->max_ra;
    s->eos        = s0->eos;
+    s->no_rasl_output_flag = s0->no_rasl_output_flag;

    s->is_nalff        = s0->is_nalff;
    s->nal_length_size = s0->nal_length_size;
@@ -3239,6 +3255,7 @@ static av_cold int hevc_decode_init(AVCodecContext *avctx)

    s->enable_parallel_tiles = 0;
    s->picture_struct = 0;
+    s->eos = 1;

    if(avctx->active_thread_type & FF_THREAD_SLICE)
        s->threads_number = avctx->thread_count;
@@ -3280,6 +3297,7 @@ static void hevc_decode_flush(AVCodecContext *avctx)
    HEVCContext *s = avctx->priv_data;
    ff_hevc_flush_dpb(s);
    s->max_ra = INT_MAX;
+    s->eos = 1;
 }

 #define OFFSET(x) offsetof(HEVCContext, x)
@@ -622,7 +622,7 @@ typedef struct SliceHeader {

    unsigned int max_num_merge_cand; ///< 5 - 5_minus_max_num_merge_cand

-    int *entry_point_offset;
+    unsigned *entry_point_offset;
    int * offset;
    int * size;
    int num_entry_point_offsets;
@@ -866,6 +866,7 @@ typedef struct HEVCContext {
    int bs_height;

    int is_decoded;
+    int no_rasl_output_flag;

    HEVCPredContext hpc;
    HEVCDSPContext hevcdsp;
@@ -831,11 +831,13 @@ static av_always_inline int mvd_decode(HEVCContext *s)
    int k = 1;

    while (k < CABAC_MAX_BIN && get_cabac_bypass(&s->HEVClc->cc)) {
-        ret += 1 << k;
+        ret += 1U << k;
        k++;
    }
-    if (k == CABAC_MAX_BIN)
+    if (k == CABAC_MAX_BIN) {
        av_log(s->avctx, AV_LOG_ERROR, "CABAC_MAX_BIN : %d\n", k);
+        return 0;
+    }
    while (k--)
        ret += get_cabac_bypass(&s->HEVClc->cc) << k;
    return get_cabac_bypass_sign(&s->HEVClc->cc, -ret);
@@ -973,8 +975,10 @@ static av_always_inline int coeff_abs_level_remaining_decode(HEVCContext *s, int

    while (prefix < CABAC_MAX_BIN && get_cabac_bypass(&s->HEVClc->cc))
        prefix++;
-    if (prefix == CABAC_MAX_BIN)
+    if (prefix == CABAC_MAX_BIN) {
        av_log(s->avctx, AV_LOG_ERROR, "CABAC_MAX_BIN : %d\n", prefix);
+        return 0;
+    }
    if (prefix < 3) {
        for (i = 0; i < rc_rice_param; i++)
            suffix = (suffix << 1) | get_cabac_bypass(&s->HEVClc->cc);
@@ -834,6 +834,10 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id,
    }

    sps->chroma_format_idc = get_ue_golomb_long(gb);
+    if (sps->chroma_format_idc > 3U) {
+        av_log(avctx, AV_LOG_ERROR, "chroma_format_idc %d is invalid\n", sps->chroma_format_idc);
+        return AVERROR_INVALIDDATA;
+    }

    if (sps->chroma_format_idc == 3)
        sps->separate_colour_plane_flag = get_bits1(gb);
@@ -174,7 +174,7 @@ int ff_hevc_output_frame(HEVCContext *s, AVFrame *out, int flush)
        int min_poc   = INT_MAX;
        int i, min_idx, ret;

-        if (s->sh.no_output_of_prior_pics_flag == 1) {
+        if (s->sh.no_output_of_prior_pics_flag == 1 && s->no_rasl_output_flag == 1) {
            for (i = 0; i < FF_ARRAY_ELEMS(s->DPB); i++) {
                HEVCFrame *frame = &s->DPB[i];
                if (!(frame->flags & HEVC_FRAME_FLAG_BUMPING) && frame->poc != s->poc &&
@@ -417,8 +417,8 @@ static int hqx_decode_frame(AVCodecContext *avctx, void *data,

    info_tag    = AV_RL32(src);
    if (info_tag == MKTAG('I', 'N', 'F', 'O')) {
-        int info_offset = AV_RL32(src + 4);
-        if (info_offset > UINT32_MAX - 8 || info_offset + 8 > avpkt->size) {
+        unsigned info_offset = AV_RL32(src + 4);
+        if (info_offset > INT_MAX || info_offset + 8 > avpkt->size) {
            av_log(avctx, AV_LOG_ERROR,
                   "Invalid INFO header offset: 0x%08"PRIX32" is too large.\n",
                   info_offset);
@@ -38,6 +38,7 @@
 #include <stdlib.h>
 #include <string.h>

+#include "libavutil/intreadwrite.h"
 #include "avcodec.h"
 #include "bytestream.h"
 #include "hpeldsp.h"
@@ -949,7 +950,7 @@ static void ipvideo_decode_opcodes(IpvideoContext *s, AVFrame *frame)
        }
    }
    if (bytestream2_get_bytes_left(&s->stream_ptr) > 1) {
-        av_log(s->avctx, AV_LOG_ERROR,
+        av_log(s->avctx, AV_LOG_DEBUG,
               "decode finished with %d bytes left over\n",
               bytestream2_get_bytes_left(&s->stream_ptr));
    }
@@ -987,12 +988,15 @@ static int ipvideo_decode_frame(AVCodecContext *avctx,
    AVFrame *frame = data;
    int ret;

+    if (buf_size < 2)
+        return AVERROR_INVALIDDATA;
+
    /* decoding map contains 4 bits of information per 8x8 block */
-    s->decoding_map_size = avctx->width * avctx->height / (8 * 8 * 2);
+    s->decoding_map_size = AV_RL16(avpkt->data);

    /* compressed buffer needs to be large enough to at least hold an entire
     * decoding map */
-    if (buf_size < s->decoding_map_size)
+    if (buf_size < s->decoding_map_size + 2)
        return buf_size;

    if (av_packet_get_side_data(avpkt, AV_PKT_DATA_PARAM_CHANGE, NULL)) {
@@ -1000,8 +1004,8 @@ static int ipvideo_decode_frame(AVCodecContext *avctx,
        av_frame_unref(s->second_last_frame);
    }

-    s->decoding_map = buf;
-    bytestream2_init(&s->stream_ptr, buf + s->decoding_map_size,
+    s->decoding_map = buf + 2;
+    bytestream2_init(&s->stream_ptr, buf + 2 + s->decoding_map_size,
                     buf_size - s->decoding_map_size);

    if ((ret = ff_get_buffer(avctx, frame, AV_GET_BUFFER_FLAG_REF)) < 0)
@@ -45,7 +45,7 @@
 /**
 * Table of number of bits a motion vector component needs.
 */
-static uint8_t mv_penalty[MAX_FCODE+1][MAX_MV*2+1];
+static uint8_t mv_penalty[MAX_FCODE+1][MAX_DMV*2+1];

 /**
 * Minimal fcode that a motion vector component would need.
@@ -678,7 +678,7 @@ static av_cold void init_mv_penalty_and_fcode(MpegEncContext *s)
    int mv;

    for(f_code=1; f_code<=MAX_FCODE; f_code++){
-        for(mv=-MAX_MV; mv<=MAX_MV; mv++){
+        for(mv=-MAX_DMV; mv<=MAX_DMV; mv++){
            int len;

            if(mv==0) len= ff_mvtab[0][1];
@@ -699,7 +699,7 @@ static av_cold void init_mv_penalty_and_fcode(MpegEncContext *s)
                }
            }

-            mv_penalty[f_code][mv+MAX_MV]= len;
+            mv_penalty[f_code][mv+MAX_DMV]= len;
        }
    }

@@ -30,6 +30,7 @@

 #define BITSTREAM_READER_LE
 #include "libavutil/attributes.h"
+#include "libavutil/imgutils.h"
 #include "libavutil/timer.h"
 #include "avcodec.h"
 #include "get_bits.h"
@@ -310,7 +311,7 @@ av_cold int ff_ivi_init_planes(IVIPlaneDesc *planes, const IVIPicConfig *cfg,

    ivi_free_buffers(planes);

-    if (cfg->pic_width < 1 || cfg->pic_height < 1 ||
+    if (av_image_check_size(cfg->pic_width, cfg->pic_height, 0, NULL) < 0 ||
        cfg->luma_bands < 1 || cfg->chroma_bands < 1)
        return AVERROR_INVALIDDATA;

@@ -28,6 +28,7 @@
 #include "libavutil/attributes.h"
 #include "libavutil/avassert.h"
 #include "libavutil/common.h"
+#include "libavutil/imgutils.h"
 #include "libavutil/mem.h"
 #include "avcodec.h"
 #include "jpeg2000.h"
@@ -210,9 +211,17 @@ int ff_jpeg2000_init_component(Jpeg2000Component *comp,
                                   codsty->nreslevels2decode - 1,
                                   codsty->transform))
        return ret;
-    // component size comp->coord is uint16_t so ir cannot overflow
+
+    if (av_image_check_size(comp->coord[0][1] - comp->coord[0][0],
+                            comp->coord[1][1] - comp->coord[1][0], 0, avctx))
+        return AVERROR_INVALIDDATA;
    csize = (comp->coord[0][1] - comp->coord[0][0]) *
            (comp->coord[1][1] - comp->coord[1][0]);
+    if (comp->coord[0][1] - comp->coord[0][0] > 32768 ||
+        comp->coord[1][1] - comp->coord[1][0] > 32768) {
+        av_log(avctx, AV_LOG_ERROR, "component size too large\n");
+        return AVERROR_PATCHWELCOME;
+    }

    if (codsty->transform == FF_DWT97) {
        csize += AV_INPUT_BUFFER_PADDING_SIZE / sizeof(*comp->f_data);
@@ -450,7 +459,7 @@ int ff_jpeg2000_init_component(Jpeg2000Component *comp,
                    return AVERROR(ENOMEM);
                for (cblkno = 0; cblkno < nb_codeblocks; cblkno++) {
                    Jpeg2000Cblk *cblk = prec->cblk + cblkno;
-                    uint16_t Cx0, Cy0;
+                    int Cx0, Cy0;

                    /* Compute coordinates of codeblocks */
                    /* Compute Cx0*/
@@ -174,21 +174,21 @@ typedef struct Jpeg2000Cblk {
    int nb_terminationsinc;
    int data_start[JPEG2000_MAX_PASSES];
    Jpeg2000Pass passes[JPEG2000_MAX_PASSES];
-    uint16_t coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}
+    int coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}
 } Jpeg2000Cblk; // code block

 typedef struct Jpeg2000Prec {
-    uint16_t nb_codeblocks_width;
-    uint16_t nb_codeblocks_height;
+    int nb_codeblocks_width;
+    int nb_codeblocks_height;
    Jpeg2000TgtNode *zerobits;
    Jpeg2000TgtNode *cblkincl;
    Jpeg2000Cblk *cblk;
    int decoded_layers;
-    uint16_t coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}
+    int coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}
 } Jpeg2000Prec; // precinct

 typedef struct Jpeg2000Band {
-    uint16_t coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}
+    int coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}
    uint16_t log2_cblk_width, log2_cblk_height;
    int i_stepsize; // quantization stepsize
    float f_stepsize; // quantization stepsize
@@ -197,8 +197,8 @@ typedef struct Jpeg2000Band {

 typedef struct Jpeg2000ResLevel {
    uint8_t nbands;
-    uint16_t coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}
-    uint16_t num_precincts_x, num_precincts_y; // number of precincts in x/y direction
+    int coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}
+    int num_precincts_x, num_precincts_y; // number of precincts in x/y direction
    uint8_t log2_prec_width, log2_prec_height; // exponent of precinct size
    Jpeg2000Band *band;
 } Jpeg2000ResLevel; // resolution level
@@ -208,8 +208,8 @@ typedef struct Jpeg2000Component {
    DWTContext dwt;
    float *f_data;
    int *i_data;
-    uint16_t coord[2][2];   // border coordinates {{x0, x1}, {y0, y1}} -- can be reduced with lowres option
-    uint16_t coord_o[2][2]; // border coordinates {{x0, x1}, {y0, y1}} -- original values from jpeg2000 headers
+    int coord[2][2];   // border coordinates {{x0, x1}, {y0, y1}} -- can be reduced with lowres option
+    int coord_o[2][2]; // border coordinates {{x0, x1}, {y0, y1}} -- original values from jpeg2000 headers
 } Jpeg2000Component;

 /* misc tools */
@@ -30,6 +30,7 @@
 #include "libavutil/attributes.h"
 #include "libavutil/avassert.h"
 #include "libavutil/common.h"
+#include "libavutil/imgutils.h"
 #include "libavutil/opt.h"
 #include "libavutil/pixdesc.h"
 #include "avcodec.h"
@@ -279,6 +280,10 @@ static int get_siz(Jpeg2000DecoderContext *s)
        avpriv_request_sample(s->avctx, "Support for image offsets");
        return AVERROR_PATCHWELCOME;
    }
+    if (av_image_check_size(s->width, s->height, 0, s->avctx)) {
+        avpriv_request_sample(s->avctx, "Large Dimensions");
+        return AVERROR_PATCHWELCOME;
+    }

    if (ncomponents <= 0) {
        av_log(s->avctx, AV_LOG_ERROR, "Invalid number of components: %d\n",
@@ -826,10 +831,10 @@ static int init_tile(Jpeg2000DecoderContext *s, int tileno)
    if (!tile->comp)
        return AVERROR(ENOMEM);

-    tile->coord[0][0] = FFMAX(tilex       * s->tile_width  + s->tile_offset_x, s->image_offset_x);
-    tile->coord[0][1] = FFMIN((tilex + 1) * s->tile_width  + s->tile_offset_x, s->width);
-    tile->coord[1][0] = FFMAX(tiley       * s->tile_height + s->tile_offset_y, s->image_offset_y);
-    tile->coord[1][1] = FFMIN((tiley + 1) * s->tile_height + s->tile_offset_y, s->height);
+    tile->coord[0][0] = av_clip(tilex       * (int64_t)s->tile_width  + s->tile_offset_x, s->image_offset_x, s->width);
+    tile->coord[0][1] = av_clip((tilex + 1) * (int64_t)s->tile_width  + s->tile_offset_x, s->image_offset_x, s->width);
+    tile->coord[1][0] = av_clip(tiley       * (int64_t)s->tile_height + s->tile_offset_y, s->image_offset_y, s->height);
+    tile->coord[1][1] = av_clip((tiley + 1) * (int64_t)s->tile_height + s->tile_offset_y, s->image_offset_y, s->height);

    for (compno = 0; compno < s->ncomponents; compno++) {
        Jpeg2000Component *comp = tile->comp + compno;
@@ -1484,6 +1489,10 @@ static int decode_cblk(Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *codsty,
    ff_mqc_initdec(&t1->mqc, cblk->data, 0, 1);

    while (passno--) {
+        if (bpno < 0) {
+            av_log(s->avctx, AV_LOG_ERROR, "bpno became negative\n");
+            return AVERROR_INVALIDDATA;
+        }
        switch(pass_t) {
        case 0:
            decode_sigpass(t1, width, height, bpno + 1, bandpos,
@@ -1686,11 +1695,15 @@ static int jpeg2000_decode_tile(Jpeg2000DecoderContext *s, Jpeg2000Tile *tile,
    if (tile->codsty[0].mct)
        mct_decode(s, tile);

-    if (s->cdef[0] < 0) {
-        for (x = 0; x < s->ncomponents; x++)
-            s->cdef[x] = x + 1;
-        if ((s->ncomponents & 1) == 0)
-            s->cdef[s->ncomponents-1] = 0;
+    for (x = 0; x < s->ncomponents; x++) {
+        if (s->cdef[x] < 0) {
+            for (x = 0; x < s->ncomponents; x++) {
+                s->cdef[x] = x + 1;
+            }
+            if ((s->ncomponents & 1) == 0)
+                s->cdef[s->ncomponents-1] = 0;
+            break;
+        }
    }

    if (s->precision <= 8) {
@@ -1809,8 +1822,10 @@ static void jpeg2000_dec_cleanup(Jpeg2000DecoderContext *s)
    av_freep(&s->tile);
    memset(s->codsty, 0, sizeof(s->codsty));
    memset(s->qntsty, 0, sizeof(s->qntsty));
+    memset(s->properties, 0, sizeof(s->properties));
    memset(&s->poc  , 0, sizeof(s->poc));
    s->numXtiles = s->numYtiles = 0;
+    s->ncomponents = 0;
 }

 static int jpeg2000_read_main_headers(Jpeg2000DecoderContext *s)
@@ -1868,6 +1883,10 @@ static int jpeg2000_read_main_headers(Jpeg2000DecoderContext *s)

        switch (marker) {
        case JPEG2000_SIZ:
+            if (s->ncomponents) {
+                av_log(s->avctx, AV_LOG_ERROR, "Duplicate SIZ\n");
+                return AVERROR_INVALIDDATA;
+            }
            ret = get_siz(s);
            if (!s->tile)
                s->numXtiles = s->numYtiles = 0;
@@ -534,7 +534,7 @@ static void dwt_decode97_int(DWTContext *s, int32_t *t)
        data[i] = (data[i] + ((1<<I_PRESHIFT)>>1)) >> I_PRESHIFT;
 }

-int ff_jpeg2000_dwt_init(DWTContext *s, uint16_t border[2][2],
+int ff_jpeg2000_dwt_init(DWTContext *s, int border[2][2],
                         int decomp_levels, int type)
 {
    int i, j, lev = decomp_levels, maxlen,
@@ -580,6 +580,9 @@ int ff_jpeg2000_dwt_init(DWTContext *s, uint16_t border[2][2],

 int ff_dwt_encode(DWTContext *s, void *t)
 {
+    if (s->ndeclevels == 0)
+        return 0;
+
    switch(s->type){
        case FF_DWT97:
            dwt_encode97_float(s, t); break;
@@ -595,6 +598,9 @@ int ff_dwt_encode(DWTContext *s, void *t)

 int ff_dwt_decode(DWTContext *s, void *t)
 {
+    if (s->ndeclevels == 0)
+        return 0;
+
    switch (s->type) {
    case FF_DWT97:
        dwt_decode97_float(s, t);
@@ -623,7 +629,7 @@ void ff_dwt_destroy(DWTContext *s)

 #define MAX_W 256

-static int test_dwt(int *array, int *ref, uint16_t border[2][2], int decomp_levels, int type, int max_diff) {
+static int test_dwt(int *array, int *ref, int border[2][2], int decomp_levels, int type, int max_diff) {
    int ret, j;
    DWTContext s1={{{0}}}, *s= &s1;
    int64_t err2 = 0;
@@ -662,7 +668,7 @@ static int test_dwt(int *array, int *ref, uint16_t border[2][2], int decomp_leve
    return 0;
 }

-static int test_dwtf(float *array, float *ref, uint16_t border[2][2], int decomp_levels, float max_diff) {
+static int test_dwtf(float *array, float *ref, int border[2][2], int decomp_levels, float max_diff) {
    int ret, j;
    DWTContext s1={{{0}}}, *s= &s1;
    double err2 = 0;
@@ -708,7 +714,7 @@ static float reff  [MAX_W * MAX_W];
 int main(void) {
    AVLFG prng;
    int i,j;
-    uint16_t border[2][2];
+    int border[2][2];
    int ret, decomp_levels;

    av_lfg_init(&prng, 1);
@@ -42,7 +42,7 @@ enum DWTType {

 typedef struct DWTContext {
    /// line lengths { horizontal, vertical } in consecutive decomposition levels
-    uint16_t linelen[FF_DWT_MAX_DECLVLS][2];
+    int linelen[FF_DWT_MAX_DECLVLS][2];
    uint8_t mod[FF_DWT_MAX_DECLVLS][2];  ///< coordinates (x0, y0) of decomp. levels mod 2
    uint8_t ndeclevels;                  ///< number of decomposition levels
    uint8_t type;                        ///< 0 for 9/7; 1 for 5/3
@@ -57,7 +57,7 @@ typedef struct DWTContext {
 * @param decomp_levels     number of decomposition levels
 * @param type              0 for DWT 9/7; 1 for DWT 5/3
 */
-int ff_jpeg2000_dwt_init(DWTContext *s, uint16_t border[2][2],
+int ff_jpeg2000_dwt_init(DWTContext *s, int border[2][2],
                         int decomp_levels, int type);

 int ff_dwt_encode(DWTContext *s, void *t);
@@ -104,19 +104,11 @@ typedef struct VP8EncoderContext {

 /** String mappings for enum vp8e_enc_control_id */
 static const char *const ctlidstr[] = {
-    [VP8E_UPD_ENTROPY]           = "VP8E_UPD_ENTROPY",
-    [VP8E_UPD_REFERENCE]         = "VP8E_UPD_REFERENCE",
-    [VP8E_USE_REFERENCE]         = "VP8E_USE_REFERENCE",
-    [VP8E_SET_ROI_MAP]           = "VP8E_SET_ROI_MAP",
-    [VP8E_SET_ACTIVEMAP]         = "VP8E_SET_ACTIVEMAP",
-    [VP8E_SET_SCALEMODE]         = "VP8E_SET_SCALEMODE",
    [VP8E_SET_CPUUSED]           = "VP8E_SET_CPUUSED",
    [VP8E_SET_ENABLEAUTOALTREF]  = "VP8E_SET_ENABLEAUTOALTREF",
    [VP8E_SET_NOISE_SENSITIVITY] = "VP8E_SET_NOISE_SENSITIVITY",
-    [VP8E_SET_SHARPNESS]         = "VP8E_SET_SHARPNESS",
    [VP8E_SET_STATIC_THRESHOLD]  = "VP8E_SET_STATIC_THRESHOLD",
    [VP8E_SET_TOKEN_PARTITIONS]  = "VP8E_SET_TOKEN_PARTITIONS",
-    [VP8E_GET_LAST_QUANTIZER]    = "VP8E_GET_LAST_QUANTIZER",
    [VP8E_SET_ARNR_MAXFRAMES]    = "VP8E_SET_ARNR_MAXFRAMES",
    [VP8E_SET_ARNR_STRENGTH]     = "VP8E_SET_ARNR_STRENGTH",
    [VP8E_SET_ARNR_TYPE]         = "VP8E_SET_ARNR_TYPE",
@@ -164,6 +164,8 @@ static char *microdvd_load_tags(struct microdvd_tag *tags, char *s)

        /* Position */
        case 'P':
+            if (!*s)
+                break;
            tag.persistent = MICRODVD_PERSISTENT_ON;
            tag.data1 = (*s++ == '1');
            if (*s != '}')
@@ -82,11 +82,33 @@ static av_cold void h264dsp_init_msa(H264DSPContext *c,
 #endif  // #if HAVE_MSA

 #if HAVE_MMI
-static av_cold void h264dsp_init_mmi(H264DSPContext * c,
-                                     const int bit_depth,
-                                     const int chroma_format_idc)
+static av_cold void h264dsp_init_mmi(H264DSPContext * c, const int bit_depth,
+        const int chroma_format_idc)
 {
    if (bit_depth == 8) {
+        c->h264_add_pixels4_clear = ff_h264_add_pixels4_8_mmi;
+        c->h264_idct_add = ff_h264_idct_add_8_mmi;
+        c->h264_idct8_add = ff_h264_idct8_add_8_mmi;
+        c->h264_idct_dc_add = ff_h264_idct_dc_add_8_mmi;
+        c->h264_idct8_dc_add = ff_h264_idct8_dc_add_8_mmi;
+        c->h264_idct_add16 = ff_h264_idct_add16_8_mmi;
+        c->h264_idct_add16intra = ff_h264_idct_add16intra_8_mmi;
+        c->h264_idct8_add4 = ff_h264_idct8_add4_8_mmi;
+
+        if (chroma_format_idc <= 1)
+            c->h264_idct_add8 = ff_h264_idct_add8_8_mmi;
+        else
+            c->h264_idct_add8 = ff_h264_idct_add8_422_8_mmi;
+
+        c->h264_luma_dc_dequant_idct = ff_h264_luma_dc_dequant_idct_8_mmi;
+
+        if (chroma_format_idc <= 1)
+            c->h264_chroma_dc_dequant_idct =
+                ff_h264_chroma_dc_dequant_idct_8_mmi;
+        else
+            c->h264_chroma_dc_dequant_idct =
+                ff_h264_chroma422_dc_dequant_idct_8_mmi;
+
        c->weight_h264_pixels_tab[0] = ff_h264_weight_pixels16_8_mmi;
        c->weight_h264_pixels_tab[1] = ff_h264_weight_pixels8_8_mmi;
        c->weight_h264_pixels_tab[2] = ff_h264_weight_pixels4_8_mmi;
@@ -94,6 +116,21 @@ static av_cold void h264dsp_init_mmi(H264DSPContext * c,
        c->biweight_h264_pixels_tab[0] = ff_h264_biweight_pixels16_8_mmi;
        c->biweight_h264_pixels_tab[1] = ff_h264_biweight_pixels8_8_mmi;
        c->biweight_h264_pixels_tab[2] = ff_h264_biweight_pixels4_8_mmi;
+
+        c->h264_v_loop_filter_chroma       = ff_deblock_v_chroma_8_mmi;
+        c->h264_v_loop_filter_chroma_intra = ff_deblock_v_chroma_intra_8_mmi;
+
+        if (chroma_format_idc <= 1) {
+            c->h264_h_loop_filter_chroma =
+                ff_deblock_h_chroma_8_mmi;
+            c->h264_h_loop_filter_chroma_intra =
+                ff_deblock_h_chroma_intra_8_mmi;
+        }
+
+        c->h264_v_loop_filter_luma = ff_deblock_v_luma_8_mmi;
+        c->h264_v_loop_filter_luma_intra = ff_deblock_v_luma_intra_8_mmi;
+        c->h264_h_loop_filter_luma = ff_deblock_h_luma_8_mmi;
+        c->h264_h_loop_filter_luma_intra = ff_deblock_h_luma_intra_8_mmi;
    }
 }
 #endif /* HAVE_MMI */
@@ -319,6 +319,26 @@ void ff_vp8_pred8x8_129_dc_8_msa(uint8_t *src, ptrdiff_t stride);
 void ff_vp8_pred16x16_127_dc_8_msa(uint8_t *src, ptrdiff_t stride);
 void ff_vp8_pred16x16_129_dc_8_msa(uint8_t *src, ptrdiff_t stride);

+void ff_h264_add_pixels4_8_mmi(uint8_t *_dst, int16_t *_src, int stride);
+void ff_h264_idct_add_8_mmi(uint8_t *dst, int16_t *block, int stride);
+void ff_h264_idct8_add_8_mmi(uint8_t *dst, int16_t *block, int stride);
+void ff_h264_idct_dc_add_8_mmi(uint8_t *dst, int16_t *block, int stride);
+void ff_h264_idct8_dc_add_8_mmi(uint8_t *dst, int16_t *block, int stride);
+void ff_h264_idct_add16_8_mmi(uint8_t *dst, const int *block_offset,
+        int16_t *block, int stride, const uint8_t nnzc[15*8]);
+void ff_h264_idct_add16intra_8_mmi(uint8_t *dst, const int *block_offset,
+        int16_t *block, int stride, const uint8_t nnzc[15*8]);
+void ff_h264_idct8_add4_8_mmi(uint8_t *dst, const int *block_offset,
+        int16_t *block, int stride, const uint8_t nnzc[15*8]);
+void ff_h264_idct_add8_8_mmi(uint8_t **dest, const int *block_offset,
+        int16_t *block, int stride, const uint8_t nnzc[15*8]);
+void ff_h264_idct_add8_422_8_mmi(uint8_t **dest, const int *block_offset,
+        int16_t *block, int stride, const uint8_t nnzc[15*8]);
+void ff_h264_luma_dc_dequant_idct_8_mmi(int16_t *output, int16_t *input,
+        int qmul);
+void ff_h264_chroma_dc_dequant_idct_8_mmi(int16_t *block, int qmul);
+void ff_h264_chroma422_dc_dequant_idct_8_mmi(int16_t *block, int qmul);
+
 void ff_h264_weight_pixels16_8_mmi(uint8_t *block, int stride, int height,
        int log2_denom, int weight, int offset);
 void ff_h264_biweight_pixels16_8_mmi(uint8_t *dst, uint8_t *src,
@@ -335,6 +355,27 @@ void ff_h264_biweight_pixels4_8_mmi(uint8_t *dst, uint8_t *src,
        int stride, int height, int log2_denom, int weightd, int weights,
        int offset);

+void ff_deblock_v_chroma_8_mmi(uint8_t *pix, int stride, int alpha, int beta,
+        int8_t *tc0);
+void ff_deblock_v_chroma_intra_8_mmi(uint8_t *pix, int stride, int alpha,
+        int beta);
+void ff_deblock_h_chroma_8_mmi(uint8_t *pix, int stride, int alpha, int beta,
+        int8_t *tc0);
+void ff_deblock_h_chroma_intra_8_mmi(uint8_t *pix, int stride, int alpha,
+        int beta);
+void ff_deblock_v_luma_8_mmi(uint8_t *pix, int stride, int alpha, int beta,
+        int8_t *tc0);
+void ff_deblock_v_luma_intra_8_mmi(uint8_t *pix, int stride, int alpha,
+        int beta);
+void ff_deblock_h_luma_8_mmi(uint8_t *pix, int stride, int alpha, int beta,
+        int8_t *tc0);
+void ff_deblock_h_luma_intra_8_mmi(uint8_t *pix, int stride, int alpha,
+        int beta);
+void ff_deblock_v8_luma_8_mmi(uint8_t *pix, int stride, int alpha, int beta,
+        int8_t *tc0);
+void ff_deblock_v8_luma_intra_8_mmi(uint8_t *pix, int stride, int alpha,
+        int beta);
+
 void ff_put_h264_qpel16_mc00_mmi(uint8_t *dst, const uint8_t *src,
        ptrdiff_t dst_stride);
 void ff_put_h264_qpel16_mc10_mmi(uint8_t *dst, const uint8_t *src,
@@ -1915,24 +1915,24 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
    v16u8 vec0;
    HEVCLocalContext *lc = s->HEVClc;
    int i;
-    int hshift = s->sps->hshift[c_idx];
-    int vshift = s->sps->vshift[c_idx];
+    int hshift = s->ps.sps->hshift[c_idx];
+    int vshift = s->ps.sps->vshift[c_idx];
    int size_in_luma_h = 16 << hshift;
-    int size_in_tbs_h = size_in_luma_h >> s->sps->log2_min_tb_size;
+    int size_in_tbs_h = size_in_luma_h >> s->ps.sps->log2_min_tb_size;
    int size_in_luma_v = 16 << vshift;
-    int size_in_tbs_v = size_in_luma_v >> s->sps->log2_min_tb_size;
+    int size_in_tbs_v = size_in_luma_v >> s->ps.sps->log2_min_tb_size;
    int x = x0 >> hshift;
    int y = y0 >> vshift;
-    int x_tb = (x0 >> s->sps->log2_min_tb_size) & s->sps->tb_mask;
-    int y_tb = (y0 >> s->sps->log2_min_tb_size) & s->sps->tb_mask;
+    int x_tb = (x0 >> s->ps.sps->log2_min_tb_size) & s->ps.sps->tb_mask;
+    int y_tb = (y0 >> s->ps.sps->log2_min_tb_size) & s->ps.sps->tb_mask;

    int cur_tb_addr =
-        s->pps->min_tb_addr_zs[(y_tb) * (s->sps->tb_mask + 2) + (x_tb)];
+        s->ps.pps->min_tb_addr_zs[(y_tb) * (s->ps.sps->tb_mask + 2) + (x_tb)];

    ptrdiff_t stride = s->frame->linesize[c_idx] / sizeof(uint8_t);
    uint8_t *src = (uint8_t *) s->frame->data[c_idx] + x + y * stride;

-    int min_pu_width = s->sps->min_pu_width;
+    int min_pu_width = s->ps.sps->min_pu_width;

    enum IntraPredMode mode = c_idx ? lc->tu.intra_pred_mode_c :
        lc->tu.intra_pred_mode;
@@ -1948,41 +1948,41 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
    uint8_t *filtered_top = filtered_top_array + 1;
    int cand_bottom_left = lc->na.cand_bottom_left
        && cur_tb_addr >
-        s->pps->min_tb_addr_zs[((y_tb + size_in_tbs_v) & s->sps->tb_mask) *
-                               (s->sps->tb_mask + 2) + (x_tb - 1)];
+        s->ps.pps->min_tb_addr_zs[((y_tb + size_in_tbs_v) & s->ps.sps->tb_mask) *
+                               (s->ps.sps->tb_mask + 2) + (x_tb - 1)];
    int cand_left = lc->na.cand_left;
    int cand_up_left = lc->na.cand_up_left;
    int cand_up = lc->na.cand_up;
    int cand_up_right = lc->na.cand_up_right
        && cur_tb_addr >
-        s->pps->min_tb_addr_zs[(y_tb - 1) * (s->sps->tb_mask + 2) +
-                               ((x_tb + size_in_tbs_h) & s->sps->tb_mask)];
+        s->ps.pps->min_tb_addr_zs[(y_tb - 1) * (s->ps.sps->tb_mask + 2) +
+                               ((x_tb + size_in_tbs_h) & s->ps.sps->tb_mask)];

    int bottom_left_size =
        (((y0 + 2 * size_in_luma_v) >
-          (s->sps->height) ? (s->sps->height) : (y0 +
+          (s->ps.sps->height) ? (s->ps.sps->height) : (y0 +
                                                 2 * size_in_luma_v)) -
         (y0 + size_in_luma_v)) >> vshift;
    int top_right_size =
        (((x0 + 2 * size_in_luma_h) >
-          (s->sps->width) ? (s->sps->width) : (x0 + 2 * size_in_luma_h)) -
+          (s->ps.sps->width) ? (s->ps.sps->width) : (x0 + 2 * size_in_luma_h)) -
         (x0 + size_in_luma_h)) >> hshift;

-    if (s->pps->constrained_intra_pred_flag == 1) {
-        int size_in_luma_pu_v = ((size_in_luma_v) >> s->sps->log2_min_pu_size);
-        int size_in_luma_pu_h = ((size_in_luma_h) >> s->sps->log2_min_pu_size);
-        int on_pu_edge_x = !(x0 & ((1 << s->sps->log2_min_pu_size) - 1));
-        int on_pu_edge_y = !(y0 & ((1 << s->sps->log2_min_pu_size) - 1));
+    if (s->ps.pps->constrained_intra_pred_flag == 1) {
+        int size_in_luma_pu_v = ((size_in_luma_v) >> s->ps.sps->log2_min_pu_size);
+        int size_in_luma_pu_h = ((size_in_luma_h) >> s->ps.sps->log2_min_pu_size);
+        int on_pu_edge_x = !(x0 & ((1 << s->ps.sps->log2_min_pu_size) - 1));
+        int on_pu_edge_y = !(y0 & ((1 << s->ps.sps->log2_min_pu_size) - 1));
        if (!size_in_luma_pu_h)
            size_in_luma_pu_h++;
        if (cand_bottom_left == 1 && on_pu_edge_x) {
-            int x_left_pu = ((x0 - 1) >> s->sps->log2_min_pu_size);
+            int x_left_pu = ((x0 - 1) >> s->ps.sps->log2_min_pu_size);
            int y_bottom_pu =
-                ((y0 + size_in_luma_v) >> s->sps->log2_min_pu_size);
+                ((y0 + size_in_luma_v) >> s->ps.sps->log2_min_pu_size);
            int max =
                ((size_in_luma_pu_v) >
-                 (s->sps->min_pu_height -
-                  y_bottom_pu) ? (s->sps->min_pu_height -
+                 (s->ps.sps->min_pu_height -
+                  y_bottom_pu) ? (s->ps.sps->min_pu_height -
                                  y_bottom_pu) : (size_in_luma_pu_v));
            cand_bottom_left = 0;
            for (i = 0; i < max; i += 2)
@@ -1993,12 +1993,12 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                     PF_INTRA);
        }
        if (cand_left == 1 && on_pu_edge_x) {
-            int x_left_pu = ((x0 - 1) >> s->sps->log2_min_pu_size);
-            int y_left_pu = ((y0) >> s->sps->log2_min_pu_size);
+            int x_left_pu = ((x0 - 1) >> s->ps.sps->log2_min_pu_size);
+            int y_left_pu = ((y0) >> s->ps.sps->log2_min_pu_size);
            int max =
                ((size_in_luma_pu_v) >
-                 (s->sps->min_pu_height -
-                  y_left_pu) ? (s->sps->min_pu_height -
+                 (s->ps.sps->min_pu_height -
+                  y_left_pu) ? (s->ps.sps->min_pu_height -
                                y_left_pu) : (size_in_luma_pu_v));
            cand_left = 0;
            for (i = 0; i < max; i += 2)
@@ -2009,20 +2009,20 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                     PF_INTRA);
        }
        if (cand_up_left == 1) {
-            int x_left_pu = ((x0 - 1) >> s->sps->log2_min_pu_size);
-            int y_top_pu = ((y0 - 1) >> s->sps->log2_min_pu_size);
+            int x_left_pu = ((x0 - 1) >> s->ps.sps->log2_min_pu_size);
+            int y_top_pu = ((y0 - 1) >> s->ps.sps->log2_min_pu_size);
            cand_up_left =
                (s->ref->tab_mvf[(x_left_pu) +
                                 (y_top_pu) * min_pu_width]).pred_flag ==
                PF_INTRA;
        }
        if (cand_up == 1 && on_pu_edge_y) {
-            int x_top_pu = ((x0) >> s->sps->log2_min_pu_size);
-            int y_top_pu = ((y0 - 1) >> s->sps->log2_min_pu_size);
+            int x_top_pu = ((x0) >> s->ps.sps->log2_min_pu_size);
+            int y_top_pu = ((y0 - 1) >> s->ps.sps->log2_min_pu_size);
            int max =
                ((size_in_luma_pu_h) >
-                 (s->sps->min_pu_width -
-                  x_top_pu) ? (s->sps->min_pu_width -
+                 (s->ps.sps->min_pu_width -
+                  x_top_pu) ? (s->ps.sps->min_pu_width -
                               x_top_pu) : (size_in_luma_pu_h));
            cand_up = 0;
            for (i = 0; i < max; i += 2)
@@ -2032,13 +2032,13 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                                      min_pu_width]).pred_flag == PF_INTRA);
        }
        if (cand_up_right == 1 && on_pu_edge_y) {
-            int y_top_pu = ((y0 - 1) >> s->sps->log2_min_pu_size);
+            int y_top_pu = ((y0 - 1) >> s->ps.sps->log2_min_pu_size);
            int x_right_pu =
-                ((x0 + size_in_luma_h) >> s->sps->log2_min_pu_size);
+                ((x0 + size_in_luma_h) >> s->ps.sps->log2_min_pu_size);
            int max =
                ((size_in_luma_pu_h) >
-                 (s->sps->min_pu_width -
-                  x_right_pu) ? (s->sps->min_pu_width -
+                 (s->ps.sps->min_pu_width -
+                  x_right_pu) ? (s->ps.sps->min_pu_width -
                                 x_right_pu) : (size_in_luma_pu_h));
            cand_up_right = 0;
            for (i = 0; i < max; i += 2)
@@ -2093,56 +2093,56 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
        } while (0);
    }

-    if (s->pps->constrained_intra_pred_flag == 1) {
+    if (s->ps.pps->constrained_intra_pred_flag == 1) {
        if (cand_bottom_left || cand_left || cand_up_left || cand_up
            || cand_up_right) {
            int size_max_x =
                x0 + ((2 * 16) << hshift) <
-                s->sps->width ? 2 * 16 : (s->sps->width - x0) >> hshift;
+                s->ps.sps->width ? 2 * 16 : (s->ps.sps->width - x0) >> hshift;
            int size_max_y =
                y0 + ((2 * 16) << vshift) <
-                s->sps->height ? 2 * 16 : (s->sps->height - y0) >> vshift;
+                s->ps.sps->height ? 2 * 16 : (s->ps.sps->height - y0) >> vshift;
            int j = 16 + (cand_bottom_left ? bottom_left_size : 0) - 1;
            if (!cand_up_right) {
-                size_max_x = x0 + ((16) << hshift) < s->sps->width ?
-                    16 : (s->sps->width - x0) >> hshift;
+                size_max_x = x0 + ((16) << hshift) < s->ps.sps->width ?
+                    16 : (s->ps.sps->width - x0) >> hshift;
            }
            if (!cand_bottom_left) {
-                size_max_y = y0 + ((16) << vshift) < s->sps->height ?
-                    16 : (s->sps->height - y0) >> vshift;
+                size_max_y = y0 + ((16) << vshift) < s->ps.sps->height ?
+                    16 : (s->ps.sps->height - y0) >> vshift;
            }
            if (cand_bottom_left || cand_left || cand_up_left) {
                while (j > -1
                       &&
                       !((s->ref->tab_mvf[(((x0 +
-                                             ((-1) << hshift)) >> s->sps->
+                                             ((-1) << hshift)) >> s->ps.sps->
                                            log2_min_pu_size)) + (((y0 +
                                                                    ((j) <<
                                                                     vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                   log2_min_pu_size))
                                          * min_pu_width]).pred_flag ==
                         PF_INTRA))
                    j--;
                if (!
                    ((s->ref->tab_mvf[(((x0 +
-                                         ((-1) << hshift)) >> s->sps->
+                                         ((-1) << hshift)) >> s->ps.sps->
                                        log2_min_pu_size)) + (((y0 + ((j)
                                                                      <<
                                                                      vshift))
-                                                               >> s->sps->
+                                                               >> s->ps.sps->
                                                               log2_min_pu_size))
                                      * min_pu_width]).pred_flag == PF_INTRA)) {
                    j = 0;
                    while (j < size_max_x
                           &&
                           !((s->ref->tab_mvf[(((x0 +
-                                                 ((j) << hshift)) >> s->sps->
+                                                 ((j) << hshift)) >> s->ps.sps->
                                                log2_min_pu_size)) + (((y0 +
                                                                        ((-1) <<
                                                                         vshift))
                                                                       >> s->
-                                                                       sps->
+                                                                       ps.sps->
                                                                       log2_min_pu_size))
                                              * min_pu_width]).pred_flag ==
                             PF_INTRA))
@@ -2151,12 +2151,12 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                        if (!
                            ((s->ref->tab_mvf[(((x0 +
                                                 ((i -
-                                                   1) << hshift)) >> s->sps->
+                                                   1) << hshift)) >> s->ps.sps->
                                                log2_min_pu_size)) + (((y0 +
                                                                        ((-1) <<
                                                                         vshift))
                                                                       >> s->
-                                                                       sps->
+                                                                       ps.sps->
                                                                       log2_min_pu_size))
                                              * min_pu_width]).pred_flag ==
                             PF_INTRA))
@@ -2168,11 +2168,11 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                while (j < size_max_x
                       &&
                       !((s->ref->tab_mvf[(((x0 +
-                                             ((j) << hshift)) >> s->sps->
+                                             ((j) << hshift)) >> s->ps.sps->
                                            log2_min_pu_size)) + (((y0 + ((-1)
                                                                          <<
                                                                          vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                   log2_min_pu_size))
                                          * min_pu_width]).pred_flag ==
                         PF_INTRA))
@@ -2184,11 +2184,11 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                                ((s->ref->tab_mvf[(((x0 +
                                                     ((i -
                                                       1) << hshift)) >>
-                                                    s->sps->log2_min_pu_size))
+                                                    s->ps.sps->log2_min_pu_size))
                                                  + (((y0 + ((-1)
                                                             << vshift))
                                                      >>
-                                                      s->sps->log2_min_pu_size))
+                                                      s->ps.sps->log2_min_pu_size))
                                                  *
                                                  min_pu_width]).pred_flag ==
                                 PF_INTRA))
@@ -2199,11 +2199,11 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                                ((s->ref->tab_mvf[(((x0 +
                                                     ((i -
                                                       1) << hshift)) >>
-                                                    s->sps->log2_min_pu_size))
+                                                    s->ps.sps->log2_min_pu_size))
                                                  + (((y0 + ((-1)
                                                             << vshift))
                                                      >>
-                                                      s->sps->log2_min_pu_size))
+                                                      s->ps.sps->log2_min_pu_size))
                                                  *
                                                  min_pu_width]).pred_flag ==
                                 PF_INTRA))
@@ -2218,11 +2218,11 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                for (i = 0; i < (0) + (size_max_y); i += 4)
                    if (!
                        ((s->ref->tab_mvf[(((x0 +
-                                             ((-1) << hshift)) >> s->sps->
+                                             ((-1) << hshift)) >> s->ps.sps->
                                            log2_min_pu_size)) + (((y0 +
                                                                    ((i) <<
                                                                     vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                   log2_min_pu_size))
                                          * min_pu_width]).pred_flag ==
                         PF_INTRA))
@@ -2247,12 +2247,12 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                     i > (size_max_y - 1) - (size_max_y); i -= 4)
                    if (!
                        ((s->ref->tab_mvf[(((x0 +
-                                             ((-1) << hshift)) >> s->sps->
+                                             ((-1) << hshift)) >> s->ps.sps->
                                            log2_min_pu_size)) + (((y0 +
                                                                    ((i -
                                                                      3) <<
                                                                     vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                   log2_min_pu_size))
                                          * min_pu_width]).pred_flag ==
                         PF_INTRA))
@@ -2261,11 +2261,11 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                        a = ((left[i - 3]) * 0x01010101U);
                if (!
                    ((s->ref->tab_mvf[(((x0 +
-                                         ((-1) << hshift)) >> s->sps->
+                                         ((-1) << hshift)) >> s->ps.sps->
                                        log2_min_pu_size)) + (((y0 + ((-1)
                                                                      <<
                                                                      vshift))
-                                                               >> s->sps->
+                                                               >> s->ps.sps->
                                                               log2_min_pu_size))
                                      * min_pu_width]).pred_flag == PF_INTRA))
                    left[-1] = left[0];
@@ -2281,12 +2281,12 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                     i > (size_max_y - 1) - (size_max_y); i -= 4)
                    if (!
                        ((s->ref->tab_mvf[(((x0 +
-                                             ((-1) << hshift)) >> s->sps->
+                                             ((-1) << hshift)) >> s->ps.sps->
                                            log2_min_pu_size)) + (((y0 +
                                                                    ((i -
                                                                      3) <<
                                                                     vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                   log2_min_pu_size))
                                          * min_pu_width]).pred_flag ==
                         PF_INTRA))
@@ -2300,11 +2300,11 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
                for (i = 0; i < (0) + (size_max_x); i += 4)
                    if (!
                        ((s->ref->tab_mvf[(((x0 +
-                                             ((i) << hshift)) >> s->sps->
+                                             ((i) << hshift)) >> s->ps.sps->
                                            log2_min_pu_size)) + (((y0 + ((-1)
                                                                          <<
                                                                          vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                   log2_min_pu_size))
                                          * min_pu_width]).pred_flag ==
                         PF_INTRA))
@@ -2376,8 +2376,8 @@ void ff_intra_pred_8_16x16_msa(HEVCContext *s, int x0, int y0, int c_idx)
    top[-1] = left[-1];


-    if (!s->sps->intra_smoothing_disabled_flag
-        && (c_idx == 0 || s->sps->chroma_format_idc == 3)) {
+    if (!s->ps.sps->intra_smoothing_disabled_flag
+        && (c_idx == 0 || s->ps.sps->chroma_format_idc == 3)) {
        if (mode != INTRA_DC && 16 != 4) {
            int intra_hor_ver_dist_thresh[] = { 7, 1, 0 };
            int min_dist_vert_hor =
@@ -2432,24 +2432,24 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
    v8i16 mul_val1 = { 1, 2, 3, 4, 5, 6, 7, 8 };
    HEVCLocalContext *lc = s->HEVClc;
    int i;
-    int hshift = s->sps->hshift[c_idx];
-    int vshift = s->sps->vshift[c_idx];
+    int hshift = s->ps.sps->hshift[c_idx];
+    int vshift = s->ps.sps->vshift[c_idx];
    int size_in_luma_h = 32 << hshift;
-    int size_in_tbs_h = size_in_luma_h >> s->sps->log2_min_tb_size;
+    int size_in_tbs_h = size_in_luma_h >> s->ps.sps->log2_min_tb_size;
    int size_in_luma_v = 32 << vshift;
-    int size_in_tbs_v = size_in_luma_v >> s->sps->log2_min_tb_size;
+    int size_in_tbs_v = size_in_luma_v >> s->ps.sps->log2_min_tb_size;
    int x = x0 >> hshift;
    int y = y0 >> vshift;
-    int x_tb = (x0 >> s->sps->log2_min_tb_size) & s->sps->tb_mask;
-    int y_tb = (y0 >> s->sps->log2_min_tb_size) & s->sps->tb_mask;
+    int x_tb = (x0 >> s->ps.sps->log2_min_tb_size) & s->ps.sps->tb_mask;
+    int y_tb = (y0 >> s->ps.sps->log2_min_tb_size) & s->ps.sps->tb_mask;

    int cur_tb_addr =
-        s->pps->min_tb_addr_zs[(y_tb) * (s->sps->tb_mask + 2) + (x_tb)];
+        s->ps.pps->min_tb_addr_zs[(y_tb) * (s->ps.sps->tb_mask + 2) + (x_tb)];

    ptrdiff_t stride = s->frame->linesize[c_idx] / sizeof(uint8_t);
    uint8_t *src = (uint8_t *) s->frame->data[c_idx] + x + y * stride;

-    int min_pu_width = s->sps->min_pu_width;
+    int min_pu_width = s->ps.sps->min_pu_width;

    enum IntraPredMode mode = c_idx ? lc->tu.intra_pred_mode_c :
        lc->tu.intra_pred_mode;
@@ -2465,41 +2465,41 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
    uint8_t *filtered_top = filtered_top_array + 1;
    int cand_bottom_left = lc->na.cand_bottom_left
        && cur_tb_addr >
-        s->pps->min_tb_addr_zs[((y_tb + size_in_tbs_v) & s->sps->tb_mask) *
-                               (s->sps->tb_mask + 2) + (x_tb - 1)];
+        s->ps.pps->min_tb_addr_zs[((y_tb + size_in_tbs_v) & s->ps.sps->tb_mask) *
+                               (s->ps.sps->tb_mask + 2) + (x_tb - 1)];
    int cand_left = lc->na.cand_left;
    int cand_up_left = lc->na.cand_up_left;
    int cand_up = lc->na.cand_up;
    int cand_up_right = lc->na.cand_up_right
        && cur_tb_addr >
-        s->pps->min_tb_addr_zs[(y_tb - 1) * (s->sps->tb_mask + 2) +
-                               ((x_tb + size_in_tbs_h) & s->sps->tb_mask)];
+        s->ps.pps->min_tb_addr_zs[(y_tb - 1) * (s->ps.sps->tb_mask + 2) +
+                               ((x_tb + size_in_tbs_h) & s->ps.sps->tb_mask)];

    int bottom_left_size =
        (((y0 + 2 * size_in_luma_v) >
-          (s->sps->height) ? (s->sps->height) : (y0 +
+          (s->ps.sps->height) ? (s->ps.sps->height) : (y0 +
                                                 2 * size_in_luma_v)) -
         (y0 + size_in_luma_v)) >> vshift;
    int top_right_size =
        (((x0 + 2 * size_in_luma_h) >
-          (s->sps->width) ? (s->sps->width) : (x0 + 2 * size_in_luma_h)) -
+          (s->ps.sps->width) ? (s->ps.sps->width) : (x0 + 2 * size_in_luma_h)) -
         (x0 + size_in_luma_h)) >> hshift;

-    if (s->pps->constrained_intra_pred_flag == 1) {
-        int size_in_luma_pu_v = ((size_in_luma_v) >> s->sps->log2_min_pu_size);
-        int size_in_luma_pu_h = ((size_in_luma_h) >> s->sps->log2_min_pu_size);
-        int on_pu_edge_x = !(x0 & ((1 << s->sps->log2_min_pu_size) - 1));
-        int on_pu_edge_y = !(y0 & ((1 << s->sps->log2_min_pu_size) - 1));
+    if (s->ps.pps->constrained_intra_pred_flag == 1) {
+        int size_in_luma_pu_v = ((size_in_luma_v) >> s->ps.sps->log2_min_pu_size);
+        int size_in_luma_pu_h = ((size_in_luma_h) >> s->ps.sps->log2_min_pu_size);
+        int on_pu_edge_x = !(x0 & ((1 << s->ps.sps->log2_min_pu_size) - 1));
+        int on_pu_edge_y = !(y0 & ((1 << s->ps.sps->log2_min_pu_size) - 1));
        if (!size_in_luma_pu_h)
            size_in_luma_pu_h++;
        if (cand_bottom_left == 1 && on_pu_edge_x) {
-            int x_left_pu = ((x0 - 1) >> s->sps->log2_min_pu_size);
+            int x_left_pu = ((x0 - 1) >> s->ps.sps->log2_min_pu_size);
            int y_bottom_pu =
-                ((y0 + size_in_luma_v) >> s->sps->log2_min_pu_size);
+                ((y0 + size_in_luma_v) >> s->ps.sps->log2_min_pu_size);
            int max =
                ((size_in_luma_pu_v) >
-                 (s->sps->min_pu_height -
-                  y_bottom_pu) ? (s->sps->min_pu_height -
+                 (s->ps.sps->min_pu_height -
+                  y_bottom_pu) ? (s->ps.sps->min_pu_height -
                                  y_bottom_pu) : (size_in_luma_pu_v));
            cand_bottom_left = 0;
            for (i = 0; i < max; i += 2)
@@ -2510,12 +2510,12 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                     PF_INTRA);
        }
        if (cand_left == 1 && on_pu_edge_x) {
-            int x_left_pu = ((x0 - 1) >> s->sps->log2_min_pu_size);
-            int y_left_pu = ((y0) >> s->sps->log2_min_pu_size);
+            int x_left_pu = ((x0 - 1) >> s->ps.sps->log2_min_pu_size);
+            int y_left_pu = ((y0) >> s->ps.sps->log2_min_pu_size);
            int max =
                ((size_in_luma_pu_v) >
-                 (s->sps->min_pu_height -
-                  y_left_pu) ? (s->sps->min_pu_height -
+                 (s->ps.sps->min_pu_height -
+                  y_left_pu) ? (s->ps.sps->min_pu_height -
                                y_left_pu) : (size_in_luma_pu_v));
            cand_left = 0;
            for (i = 0; i < max; i += 2)
@@ -2526,20 +2526,20 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                     PF_INTRA);
        }
        if (cand_up_left == 1) {
-            int x_left_pu = ((x0 - 1) >> s->sps->log2_min_pu_size);
-            int y_top_pu = ((y0 - 1) >> s->sps->log2_min_pu_size);
+            int x_left_pu = ((x0 - 1) >> s->ps.sps->log2_min_pu_size);
+            int y_top_pu = ((y0 - 1) >> s->ps.sps->log2_min_pu_size);
            cand_up_left =
                (s->ref->tab_mvf[(x_left_pu) +
                                 (y_top_pu) * min_pu_width]).pred_flag ==
                PF_INTRA;
        }
        if (cand_up == 1 && on_pu_edge_y) {
-            int x_top_pu = ((x0) >> s->sps->log2_min_pu_size);
-            int y_top_pu = ((y0 - 1) >> s->sps->log2_min_pu_size);
+            int x_top_pu = ((x0) >> s->ps.sps->log2_min_pu_size);
+            int y_top_pu = ((y0 - 1) >> s->ps.sps->log2_min_pu_size);
            int max =
                ((size_in_luma_pu_h) >
-                 (s->sps->min_pu_width -
-                  x_top_pu) ? (s->sps->min_pu_width -
+                 (s->ps.sps->min_pu_width -
+                  x_top_pu) ? (s->ps.sps->min_pu_width -
                               x_top_pu) : (size_in_luma_pu_h));
            cand_up = 0;
            for (i = 0; i < max; i += 2)
@@ -2549,13 +2549,13 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                                      min_pu_width]).pred_flag == PF_INTRA);
        }
        if (cand_up_right == 1 && on_pu_edge_y) {
-            int y_top_pu = ((y0 - 1) >> s->sps->log2_min_pu_size);
+            int y_top_pu = ((y0 - 1) >> s->ps.sps->log2_min_pu_size);
            int x_right_pu =
-                ((x0 + size_in_luma_h) >> s->sps->log2_min_pu_size);
+                ((x0 + size_in_luma_h) >> s->ps.sps->log2_min_pu_size);
            int max =
                ((size_in_luma_pu_h) >
-                 (s->sps->min_pu_width -
-                  x_right_pu) ? (s->sps->min_pu_width -
+                 (s->ps.sps->min_pu_width -
+                  x_right_pu) ? (s->ps.sps->min_pu_width -
                                 x_right_pu) : (size_in_luma_pu_h));
            cand_up_right = 0;
            for (i = 0; i < max; i += 2)
@@ -2608,56 +2608,56 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
        } while (0);
    }

-    if (s->pps->constrained_intra_pred_flag == 1) {
+    if (s->ps.pps->constrained_intra_pred_flag == 1) {
        if (cand_bottom_left || cand_left || cand_up_left || cand_up
            || cand_up_right) {
            int size_max_x =
                x0 + ((2 * 32) << hshift) <
-                s->sps->width ? 2 * 32 : (s->sps->width - x0) >> hshift;
+                s->ps.sps->width ? 2 * 32 : (s->ps.sps->width - x0) >> hshift;
            int size_max_y =
                y0 + ((2 * 32) << vshift) <
-                s->sps->height ? 2 * 32 : (s->sps->height - y0) >> vshift;
+                s->ps.sps->height ? 2 * 32 : (s->ps.sps->height - y0) >> vshift;
            int j = 32 + (cand_bottom_left ? bottom_left_size : 0) - 1;
            if (!cand_up_right) {
-                size_max_x = x0 + ((32) << hshift) < s->sps->width ?
-                    32 : (s->sps->width - x0) >> hshift;
+                size_max_x = x0 + ((32) << hshift) < s->ps.sps->width ?
+                    32 : (s->ps.sps->width - x0) >> hshift;
            }
            if (!cand_bottom_left) {
-                size_max_y = y0 + ((32) << vshift) < s->sps->height ?
-                    32 : (s->sps->height - y0) >> vshift;
+                size_max_y = y0 + ((32) << vshift) < s->ps.sps->height ?
+                    32 : (s->ps.sps->height - y0) >> vshift;
            }
            if (cand_bottom_left || cand_left || cand_up_left) {
                while (j > -1
                       &&
                       !((s->ref->tab_mvf[(((x0 +
-                                             ((-1) << hshift)) >> s->sps->
+                                             ((-1) << hshift)) >> s->ps.sps->
                                            log2_min_pu_size)) + (((y0 +
                                                                    ((j) <<
                                                                     vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                   log2_min_pu_size))
                                          * min_pu_width]).pred_flag ==
                         PF_INTRA))
                    j--;
                if (!
                    ((s->ref->tab_mvf[(((x0 +
-                                         ((-1) << hshift)) >> s->sps->
+                                         ((-1) << hshift)) >> s->ps.sps->
                                        log2_min_pu_size)) + (((y0 + ((j)
                                                                      <<
                                                                      vshift))
-                                                               >> s->sps->
+                                                               >> s->ps.sps->
                                                               log2_min_pu_size))
                                      * min_pu_width]).pred_flag == PF_INTRA)) {
                    j = 0;
                    while (j < size_max_x
                           &&
                           !((s->ref->tab_mvf[(((x0 +
-                                                 ((j) << hshift)) >> s->sps->
+                                                 ((j) << hshift)) >> s->ps.sps->
                                                log2_min_pu_size)) + (((y0 +
                                                                        ((-1) <<
                                                                         vshift))
                                                                       >> s->
-                                                                       sps->
+                                                                       ps.sps->
                                                                       log2_min_pu_size))
                                              * min_pu_width]).pred_flag ==
                             PF_INTRA))
@@ -2666,12 +2666,12 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                        if (!
                            ((s->ref->tab_mvf[(((x0 +
                                                 ((i -
-                                                   1) << hshift)) >> s->sps->
+                                                   1) << hshift)) >> s->ps.sps->
                                                log2_min_pu_size)) + (((y0 +
                                                                        ((-1) <<
                                                                         vshift))
                                                                       >> s->
-                                                                       sps->
+                                                                       ps.sps->
                                                                       log2_min_pu_size))
                                              * min_pu_width]).pred_flag ==
                             PF_INTRA))
@@ -2683,11 +2683,11 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                while (j < size_max_x
                       &&
                       !((s->ref->tab_mvf[(((x0 +
-                                             ((j) << hshift)) >> s->sps->
+                                             ((j) << hshift)) >> s->ps.sps->
                                            log2_min_pu_size)) + (((y0 + ((-1)
                                                                          <<
                                                                          vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                   log2_min_pu_size))
                                          * min_pu_width]).pred_flag ==
                         PF_INTRA))
@@ -2699,11 +2699,11 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                                ((s->ref->tab_mvf[(((x0 +
                                                     ((i -
                                                       1) << hshift)) >>
-                                                    s->sps->log2_min_pu_size))
+                                                    s->ps.sps->log2_min_pu_size))
                                                  + (((y0 + ((-1)
                                                             << vshift))
                                                      >>
-                                                      s->sps->log2_min_pu_size))
+                                                      s->ps.sps->log2_min_pu_size))
                                                  *
                                                  min_pu_width]).pred_flag ==
                                 PF_INTRA))
@@ -2714,11 +2714,11 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                                ((s->ref->tab_mvf[(((x0 +
                                                     ((i -
                                                       1) << hshift)) >>
-                                                    s->sps->log2_min_pu_size))
+                                                    s->ps.sps->log2_min_pu_size))
                                                  + (((y0 + ((-1)
                                                             << vshift))
                                                      >>
-                                                      s->sps->log2_min_pu_size))
+                                                      s->ps.sps->log2_min_pu_size))
                                                  *
                                                  min_pu_width]).pred_flag ==
                                 PF_INTRA))
@@ -2733,11 +2733,11 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                for (i = 0; i < (0) + (size_max_y); i += 4)
                    if (!
                        ((s->ref->tab_mvf[(((x0 +
-                                             ((-1) << hshift)) >> s->sps->
+                                             ((-1) << hshift)) >> s->ps.sps->
                                            log2_min_pu_size)) + (((y0 +
                                                                    ((i) <<
                                                                     vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                   log2_min_pu_size))
                                          * min_pu_width]).pred_flag ==
                         PF_INTRA))
@@ -2761,12 +2761,12 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                     i > (size_max_y - 1) - (size_max_y); i -= 4)
                    if (!
                        ((s->ref->tab_mvf[(((x0 +
-                                             ((-1) << hshift)) >> s->sps->
+                                             ((-1) << hshift)) >> s->ps.sps->
                                            log2_min_pu_size)) + (((y0 +
                                                                    ((i -
                                                                      3) <<
                                                                     vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                   log2_min_pu_size))
                                          * min_pu_width]).pred_flag ==
                         PF_INTRA))
@@ -2775,11 +2775,11 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                        a = ((left[i - 3]) * 0x01010101U);
                if (!
                    ((s->ref->tab_mvf[(((x0 +
-                                         ((-1) << hshift)) >> s->sps->
+                                         ((-1) << hshift)) >> s->ps.sps->
                                        log2_min_pu_size)) + (((y0 + ((-1)
                                                                      <<
                                                                      vshift))
-                                                               >> s->sps->
+                                                               >> s->ps.sps->
                                                               log2_min_pu_size))
                                      * min_pu_width]).pred_flag == PF_INTRA))
                    left[-1] = left[0];
@@ -2795,12 +2795,12 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                     i > (size_max_y - 1) - (size_max_y); i -= 4)
                    if (!
                        ((s->ref->tab_mvf[(((x0 +
-                                             ((-1) << hshift)) >> s->sps->
+                                             ((-1) << hshift)) >> s->ps.sps->
                                            log2_min_pu_size)) + (((y0 +
                                                                    ((i -
                                                                      3) <<
                                                                     vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                   log2_min_pu_size))
                                          * min_pu_width]).pred_flag ==
                         PF_INTRA))
@@ -2814,11 +2814,11 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                for (i = 0; i < (0) + (size_max_x); i += 4)
                    if (!
                        ((s->ref->tab_mvf[(((x0 +
-                                             ((i) << hshift)) >> s->sps->
+                                             ((i) << hshift)) >> s->ps.sps->
                                            log2_min_pu_size)) + (((y0 + ((-1)
                                                                          <<
                                                                          vshift))
-                                                                   >> s->sps->
+                                                                   >> s->ps.sps->
                                                                   log2_min_pu_size))
                                          * min_pu_width]).pred_flag ==
                         PF_INTRA))
@@ -2893,8 +2893,8 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
    top[-1] = left[-1];


-    if (!s->sps->intra_smoothing_disabled_flag
-        && (c_idx == 0 || s->sps->chroma_format_idc == 3)) {
+    if (!s->ps.sps->intra_smoothing_disabled_flag
+        && (c_idx == 0 || s->ps.sps->chroma_format_idc == 3)) {
        if (mode != INTRA_DC && 32 != 4) {
            int intra_hor_ver_dist_thresh[] = { 7, 1, 0 };
            int min_dist_vert_hor =
@@ -2908,7 +2908,7 @@ void ff_intra_pred_8_32x32_msa(HEVCContext *s, int x0, int y0, int c_idx)
                     0 ? ((int) (mode - 26U)) : (-((int) (mode - 26U))))));
            if (min_dist_vert_hor > intra_hor_ver_dist_thresh[5 - 3]) {
                int threshold = 1 << (8 - 5);
-                if (s->sps->sps_strong_intra_smoothing_enable_flag
+                if (s->ps.sps->sps_strong_intra_smoothing_enable_flag
                    && c_idx == 0
                    && ((top[-1] + top[63] - 2 * top[31]) >=
                        0 ? (top[-1] + top[63] -
@@ -49,8 +49,6 @@ static av_cold void idctdsp_init_mmi(IDCTDSPContext *c, AVCodecContext *avctx,
        (avctx->bits_per_raw_sample != 10) &&
        (avctx->bits_per_raw_sample != 12) &&
        (avctx->idct_algo == FF_IDCT_AUTO)) {
-                c->idct_put = ff_simple_idct_put_mmi;
-                c->idct_add = ff_simple_idct_add_mmi;
                c->idct = ff_simple_idct_mmi;
                c->perm_type = FF_IDCT_PERM_NONE;
    }
@@ -54,7 +54,7 @@ DECLARE_ALIGNED(8, static const int16_t, coeffs)[]= {
                  C3, -C1,               C3, -C1
 };

-static void simple_idct_mmi(int16_t *block)
+void ff_simple_idct_mmi(int16_t *block)
 {
        DECLARE_ALIGNED(8, int64_t, align_tmp)[16];
        int16_t * const temp= (int16_t*)align_tmp;
@@ -814,20 +814,3 @@ static void simple_idct_mmi(int16_t *block)
        : "$10","$11"
    );
 }
-
-void ff_simple_idct_mmi(int16_t *block)
-{
-    simple_idct_mmi(block);
-}
-
-void ff_simple_idct_put_mmi(uint8_t *dest, int32_t line_size, int16_t *block)
-{
-    simple_idct_mmi(block);
-    ff_put_pixels_clamped_mmi(block, dest, line_size);
-}
-
-void ff_simple_idct_add_mmi(uint8_t *dest, int32_t line_size, int16_t *block)
-{
-    simple_idct_mmi(block);
-    ff_add_pixels_clamped_mmi(block, dest, line_size);
-}
@@ -259,7 +259,7 @@
    mask_out = __msa_xori_b(mask_out, 0xff);                       \
 }

-void ff_loop_filter_v_4_8_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_v_4_8_msa(uint8_t *src, ptrdiff_t pitch,
                              int32_t b_limit_ptr,
                              int32_t limit_ptr,
                              int32_t thresh_ptr)
@@ -288,7 +288,7 @@ void ff_loop_filter_v_4_8_msa(uint8_t *src, int32_t pitch,
 }


-void ff_loop_filter_v_44_16_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_v_44_16_msa(uint8_t *src, ptrdiff_t pitch,
                                int32_t b_limit_ptr,
                                int32_t limit_ptr,
                                int32_t thresh_ptr)
@@ -318,7 +318,7 @@ void ff_loop_filter_v_44_16_msa(uint8_t *src, int32_t pitch,
    ST_UB4(p1, p0, q0, q1, (src - 2 * pitch), pitch);
 }

-void ff_loop_filter_v_8_8_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_v_8_8_msa(uint8_t *src, ptrdiff_t pitch,
                              int32_t b_limit_ptr,
                              int32_t limit_ptr,
                              int32_t thresh_ptr)
@@ -392,7 +392,7 @@ void ff_loop_filter_v_8_8_msa(uint8_t *src, int32_t pitch,
    }
 }

-void ff_loop_filter_v_88_16_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_v_88_16_msa(uint8_t *src, ptrdiff_t pitch,
                                int32_t b_limit_ptr,
                                int32_t limit_ptr,
                                int32_t thresh_ptr)
@@ -471,7 +471,7 @@ void ff_loop_filter_v_88_16_msa(uint8_t *src, int32_t pitch,
    }
 }

-void ff_loop_filter_v_84_16_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_v_84_16_msa(uint8_t *src, ptrdiff_t pitch,
                                int32_t b_limit_ptr,
                                int32_t limit_ptr,
                                int32_t thresh_ptr)
@@ -542,7 +542,7 @@ void ff_loop_filter_v_84_16_msa(uint8_t *src, int32_t pitch,
    }
 }

-void ff_loop_filter_v_48_16_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_v_48_16_msa(uint8_t *src, ptrdiff_t pitch,
                                int32_t b_limit_ptr,
                                int32_t limit_ptr,
                                int32_t thresh_ptr)
@@ -614,7 +614,7 @@ void ff_loop_filter_v_48_16_msa(uint8_t *src, int32_t pitch,
    }
 }

-static int32_t vp9_hz_lpf_t4_and_t8_16w(uint8_t *src, int32_t pitch,
+static int32_t vp9_hz_lpf_t4_and_t8_16w(uint8_t *src, ptrdiff_t pitch,
                                        uint8_t *filter48,
                                        int32_t b_limit_ptr,
                                        int32_t limit_ptr,
@@ -689,7 +689,7 @@ static int32_t vp9_hz_lpf_t4_and_t8_16w(uint8_t *src, int32_t pitch,
    }
 }

-static void vp9_hz_lpf_t16_16w(uint8_t *src, int32_t pitch, uint8_t *filter48)
+static void vp9_hz_lpf_t16_16w(uint8_t *src, ptrdiff_t pitch, uint8_t *filter48)
 {
    v16u8 flat, flat2, filter8;
    v16i8 zero = { 0 };
@@ -1021,7 +1021,7 @@ static void vp9_hz_lpf_t16_16w(uint8_t *src, int32_t pitch, uint8_t *filter48)
    }
 }

-void ff_loop_filter_v_16_16_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_v_16_16_msa(uint8_t *src, ptrdiff_t pitch,
                                int32_t b_limit_ptr,
                                int32_t limit_ptr,
                                int32_t thresh_ptr)
@@ -1037,7 +1037,7 @@ void ff_loop_filter_v_16_16_msa(uint8_t *src, int32_t pitch,
    }
 }

-void ff_loop_filter_v_16_8_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_v_16_8_msa(uint8_t *src, ptrdiff_t pitch,
                               int32_t b_limit_ptr,
                               int32_t limit_ptr,
                               int32_t thresh_ptr)
@@ -1261,7 +1261,7 @@ void ff_loop_filter_v_16_8_msa(uint8_t *src, int32_t pitch,
    }
 }

-void ff_loop_filter_h_4_8_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_h_4_8_msa(uint8_t *src, ptrdiff_t pitch,
                              int32_t b_limit_ptr,
                              int32_t limit_ptr,
                              int32_t thresh_ptr)
@@ -1290,7 +1290,7 @@ void ff_loop_filter_h_4_8_msa(uint8_t *src, int32_t pitch,
    ST4x4_UB(vec3, vec3, 0, 1, 2, 3, src, pitch);
 }

-void ff_loop_filter_h_44_16_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_h_44_16_msa(uint8_t *src, ptrdiff_t pitch,
                                int32_t b_limit_ptr,
                                int32_t limit_ptr,
                                int32_t thresh_ptr)
@@ -1337,7 +1337,7 @@ void ff_loop_filter_h_44_16_msa(uint8_t *src, int32_t pitch,
    ST4x8_UB(tmp4, tmp5, src, pitch);
 }

-void ff_loop_filter_h_8_8_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_h_8_8_msa(uint8_t *src, ptrdiff_t pitch,
                              int32_t b_limit_ptr,
                              int32_t limit_ptr,
                              int32_t thresh_ptr)
@@ -1417,7 +1417,7 @@ void ff_loop_filter_h_8_8_msa(uint8_t *src, int32_t pitch,
    }
 }

-void ff_loop_filter_h_88_16_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_h_88_16_msa(uint8_t *src, ptrdiff_t pitch,
                                int32_t b_limit_ptr,
                                int32_t limit_ptr,
                                int32_t thresh_ptr)
@@ -1531,7 +1531,7 @@ void ff_loop_filter_h_88_16_msa(uint8_t *src, int32_t pitch,
    }
 }

-void ff_loop_filter_h_84_16_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_h_84_16_msa(uint8_t *src, ptrdiff_t pitch,
                                int32_t b_limit_ptr,
                                int32_t limit_ptr,
                                int32_t thresh_ptr)
@@ -1635,7 +1635,7 @@ void ff_loop_filter_h_84_16_msa(uint8_t *src, int32_t pitch,
    }
 }

-void ff_loop_filter_h_48_16_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_h_48_16_msa(uint8_t *src, ptrdiff_t pitch,
                                int32_t b_limit_ptr,
                                int32_t limit_ptr,
                                int32_t thresh_ptr)
@@ -1912,7 +1912,7 @@ static int32_t vp9_vt_lpf_t4_and_t8_8w(uint8_t *src, uint8_t *filter48,
    }
 }

-static int32_t vp9_vt_lpf_t16_8w(uint8_t *src, uint8_t *src_org, int32_t pitch,
+static int32_t vp9_vt_lpf_t16_8w(uint8_t *src, uint8_t *src_org, ptrdiff_t pitch,
                                 uint8_t *filter48)
 {
    v16i8 zero = { 0 };
@@ -2136,7 +2136,7 @@ static int32_t vp9_vt_lpf_t16_8w(uint8_t *src, uint8_t *src_org, int32_t pitch,
    }
 }

-void ff_loop_filter_h_16_8_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_h_16_8_msa(uint8_t *src, ptrdiff_t pitch,
                               int32_t b_limit_ptr,
                               int32_t limit_ptr,
                               int32_t thresh_ptr)
@@ -2162,7 +2162,7 @@ void ff_loop_filter_h_16_8_msa(uint8_t *src, int32_t pitch,
 }

 static int32_t vp9_vt_lpf_t4_and_t8_16w(uint8_t *src, uint8_t *filter48,
-                                        uint8_t *src_org, int32_t pitch,
+                                        uint8_t *src_org, ptrdiff_t pitch,
                                        int32_t b_limit_ptr,
                                        int32_t limit_ptr,
                                        int32_t thresh_ptr)
@@ -2246,7 +2246,7 @@ static int32_t vp9_vt_lpf_t4_and_t8_16w(uint8_t *src, uint8_t *filter48,
    }
 }

-static int32_t vp9_vt_lpf_t16_16w(uint8_t *src, uint8_t *src_org, int32_t pitch,
+static int32_t vp9_vt_lpf_t16_16w(uint8_t *src, uint8_t *src_org, ptrdiff_t pitch,
                                  uint8_t *filter48)
 {
    v16u8 flat, flat2, filter8;
@@ -2573,7 +2573,7 @@ static int32_t vp9_vt_lpf_t16_16w(uint8_t *src, uint8_t *src_org, int32_t pitch,
    }
 }

-void ff_loop_filter_h_16_16_msa(uint8_t *src, int32_t pitch,
+void ff_loop_filter_h_16_16_msa(uint8_t *src, ptrdiff_t pitch,
                                int32_t b_limit_ptr,
                                int32_t limit_ptr,
                                int32_t thresh_ptr)
@@ -98,6 +98,15 @@ static void parse_avid(MJpegDecodeContext *s, uint8_t *buf, int len)
        av_log(s->avctx, AV_LOG_INFO, "AVID: len:%d %d\n", len, len > 14 ? buf[12] : -1);
 }

+static void init_idct(AVCodecContext *avctx)
+{
+    MJpegDecodeContext *s = avctx->priv_data;
+
+    ff_idctdsp_init(&s->idsp, avctx);
+    ff_init_scantable(s->idsp.idct_permutation, &s->scantable,
+                      ff_zigzag_direct);
+}
+
 av_cold int ff_mjpeg_decode_init(AVCodecContext *avctx)
 {
    MJpegDecodeContext *s = avctx->priv_data;
@@ -112,9 +121,7 @@ av_cold int ff_mjpeg_decode_init(AVCodecContext *avctx)
    s->avctx = avctx;
    ff_blockdsp_init(&s->bdsp, avctx);
    ff_hpeldsp_init(&s->hdsp, avctx->flags);
-    ff_idctdsp_init(&s->idsp, avctx);
-    ff_init_scantable(s->idsp.idct_permutation, &s->scantable,
-                      ff_zigzag_direct);
+    init_idct(avctx);
    s->buffer_size   = 0;
    s->buffer        = NULL;
    s->start_code    = -1;
@@ -267,7 +274,6 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)

    /* XXX: verify len field validity */
    len     = get_bits(&s->gb, 16);
-    s->avctx->bits_per_raw_sample =
    bits    = get_bits(&s->gb, 8);

    if (bits > 16 || bits < 1) {
@@ -275,6 +281,11 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
        return AVERROR_INVALIDDATA;
    }

+    if (s->avctx->bits_per_raw_sample != bits) {
+        av_log(s->avctx, AV_LOG_INFO, "Changeing bps to %d\n", bits);
+        s->avctx->bits_per_raw_sample = bits;
+        init_idct(s->avctx);
+    }
    if (s->pegasus_rct)
        bits = 9;
    if (bits == 9 && !s->pegasus_rct)
@@ -621,7 +632,8 @@ unk_pixfmt:
        av_log(s->avctx, AV_LOG_DEBUG, "decode_sof0: error, len(%d) mismatch\n", len);
    }

-    if (s->rgb && !s->lossless && !s->ls) {
+    if ((s->rgb && !s->lossless && !s->ls) ||
+        (!s->rgb && s->ls && s->nb_components > 1)) {
        av_log(s->avctx, AV_LOG_ERROR, "Unsupported coding and pixel format combination\n");
        return AVERROR_PATCHWELCOME;
    }
@@ -987,7 +999,7 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int nb_components, int p
                    return -1;

                left[i] = buffer[mb_x][i] =
-                    mask & (pred + (dc << point_transform));
+                    mask & (pred + (dc * (1 << point_transform)));
            }

            if (s->restart_interval && !--s->restart_count) {
@@ -995,7 +1007,14 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int nb_components, int p
                skip_bits(&s->gb, 16); /* skip RSTn */
            }
        }
-        if (s->nb_components == 4) {
+        if (s->rct && s->nb_components == 4) {
+            for (mb_x = 0; mb_x < s->mb_width; mb_x++) {
+                ptr[4*mb_x + 2] = buffer[mb_x][0] - ((buffer[mb_x][1] + buffer[mb_x][2] - 0x200) >> 2);
+                ptr[4*mb_x + 1] = buffer[mb_x][1] + ptr[4*mb_x + 2];
+                ptr[4*mb_x + 3] = buffer[mb_x][2] + ptr[4*mb_x + 2];
+                ptr[4*mb_x + 0] = buffer[mb_x][3];
+            }
+        } else if (s->nb_components == 4) {
            for(i=0; i<nb_components; i++) {
                int c= s->comp_index[i];
                if (s->bits <= 8) {
@@ -1086,7 +1105,10 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor,
                        dc = mjpeg_decode_dc(s, s->dc_index[i]);
                        if(dc == 0xFFFFF)
                            return -1;
-                        if(bits<=8){
+                        if (   h * mb_x + x >= s->width
+                            || v * mb_y + y >= s->height) {
+                            // Nothing to do
+                        } else if (bits<=8) {
                        ptr = s->picture_ptr->data[c] + (linesize * (v * mb_y + y)) + (h * mb_x + x); //FIXME optimize this crap
                        if(y==0 && toprow){
                            if(x==0 && leftcol){
@@ -1154,7 +1176,10 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor,
                        dc = mjpeg_decode_dc(s, s->dc_index[i]);
                        if(dc == 0xFFFFF)
                            return -1;
-                        if(bits<=8){
+                        if (   h * mb_x + x >= s->width
+                            || v * mb_y + y >= s->height) {
+                            // Nothing to do
+                        } else if (bits<=8) {
                            ptr = s->picture_ptr->data[c] +
                              (linesize * (v * mb_y + y)) +
                              (h * mb_x + x); //FIXME optimize this crap
@@ -1222,7 +1247,7 @@ static int mjpeg_decode_scan(MJpegDecodeContext *s, int nb_components, int Ah,
                             int mb_bitmask_size,
                             const AVFrame *reference)
 {
-    int i, mb_x, mb_y;
+    int i, mb_x, mb_y, chroma_h_shift, chroma_v_shift, chroma_width, chroma_height;
    uint8_t *data[MAX_COMPONENTS];
    const uint8_t *reference_data[MAX_COMPONENTS];
    int linesize[MAX_COMPONENTS];
@@ -1239,6 +1264,11 @@ static int mjpeg_decode_scan(MJpegDecodeContext *s, int nb_components, int Ah,

    s->restart_count = 0;

+    av_pix_fmt_get_chroma_sub_sample(s->avctx->pix_fmt, &chroma_h_shift,
+                                     &chroma_v_shift);
+    chroma_width  = FF_CEIL_RSHIFT(s->width,  chroma_h_shift);
+    chroma_height = FF_CEIL_RSHIFT(s->height, chroma_v_shift);
+
    for (i = 0; i < nb_components; i++) {
        int c   = s->comp_index[i];
        data[c] = s->picture_ptr->data[c];
@@ -1275,8 +1305,8 @@ static int mjpeg_decode_scan(MJpegDecodeContext *s, int nb_components, int Ah,

                    if (s->interlaced && s->bottom_field)
                        block_offset += linesize[c] >> 1;
-                    if (   8*(h * mb_x + x) < s->width
-                        && 8*(v * mb_y + y) < s->height) {
+                    if (   8*(h * mb_x + x) < ((c == 1) || (c == 2) ? chroma_width  : s->width)
+                        && 8*(v * mb_y + y) < ((c == 1) || (c == 2) ? chroma_height : s->height)) {
                        ptr = data[c] + block_offset;
                    } else
                        ptr = NULL;
@@ -1938,7 +1968,7 @@ int ff_mjpeg_find_marker(MJpegDecodeContext *s,
        while (b < t) {
            uint8_t x = src[b++];
            put_bits(&pb, 8, x);
-            if (x == 0xFF) {
+            if (x == 0xFF && b < t) {
                x = src[b++];
                if (x & 0x80) {
                    av_log(s->avctx, AV_LOG_WARNING, "Invalid escape sequence\n");
@@ -923,7 +923,7 @@ void ff_estimate_p_frame_motion(MpegEncContext * s,
    c->penalty_factor    = get_penalty_factor(s->lambda, s->lambda2, c->avctx->me_cmp);
    c->sub_penalty_factor= get_penalty_factor(s->lambda, s->lambda2, c->avctx->me_sub_cmp);
    c->mb_penalty_factor = get_penalty_factor(s->lambda, s->lambda2, c->avctx->mb_cmp);
-    c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_MV;
+    c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_DMV;

    get_limits(s, 16*mb_x, 16*mb_y);
    c->skip=0;
@@ -1090,7 +1090,7 @@ int ff_pre_estimate_p_frame_motion(MpegEncContext * s,
    av_assert0(s->quarter_sample==0 || s->quarter_sample==1);

    c->pre_penalty_factor    = get_penalty_factor(s->lambda, s->lambda2, c->avctx->me_pre_cmp);
-    c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_MV;
+    c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_DMV;

    get_limits(s, 16*mb_x, 16*mb_y);
    c->skip=0;
@@ -1139,7 +1139,7 @@ static int estimate_motion_b(MpegEncContext *s, int mb_x, int mb_y,
    const int shift= 1+s->quarter_sample;
    const int mot_stride = s->mb_stride;
    const int mot_xy = mb_y*mot_stride + mb_x;
-    uint8_t * const mv_penalty= c->mv_penalty[f_code] + MAX_MV;
+    uint8_t * const mv_penalty= c->mv_penalty[f_code] + MAX_DMV;
    int mv_scale;

    c->penalty_factor    = get_penalty_factor(s->lambda, s->lambda2, c->avctx->me_cmp);
@@ -1203,8 +1203,8 @@ static inline int check_bidir_mv(MpegEncContext * s,
    //FIXME better f_code prediction (max mv & distance)
    //FIXME pointers
    MotionEstContext * const c= &s->me;
-    uint8_t * const mv_penalty_f= c->mv_penalty[s->f_code] + MAX_MV; // f_code of the prev frame
-    uint8_t * const mv_penalty_b= c->mv_penalty[s->b_code] + MAX_MV; // f_code of the prev frame
+    uint8_t * const mv_penalty_f= c->mv_penalty[s->f_code] + MAX_DMV; // f_code of the prev frame
+    uint8_t * const mv_penalty_b= c->mv_penalty[s->b_code] + MAX_DMV; // f_code of the prev frame
    int stride= c->stride;
    uint8_t *dest_y = c->scratchpad;
    uint8_t *ptr;
@@ -1417,7 +1417,7 @@ static inline int direct_search(MpegEncContext * s, int mb_x, int mb_y)
    int mx, my, xmin, xmax, ymin, ymax;
    int16_t (*mv_table)[2]= s->b_direct_mv_table;

-    c->current_mv_penalty= c->mv_penalty[1] + MAX_MV;
+    c->current_mv_penalty= c->mv_penalty[1] + MAX_DMV;
    ymin= xmin=(-32)>>shift;
    ymax= xmax=   31>>shift;

@@ -1553,11 +1553,11 @@ void ff_estimate_b_frame_motion(MpegEncContext * s,
    if (s->avctx->flags & AV_CODEC_FLAG_INTERLACED_ME) {
 //FIXME mb type penalty
        c->skip=0;
-        c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_MV;
+        c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_DMV;
        fimin= interlaced_search(s, 0,
                                 s->b_field_mv_table[0], s->b_field_select_table[0],
                                 s->b_forw_mv_table[xy][0], s->b_forw_mv_table[xy][1], 0);
-        c->current_mv_penalty= c->mv_penalty[s->b_code] + MAX_MV;
+        c->current_mv_penalty= c->mv_penalty[s->b_code] + MAX_DMV;
        bimin= interlaced_search(s, 2,
                                 s->b_field_mv_table[1], s->b_field_select_table[1],
                                 s->b_back_mv_table[xy][0], s->b_back_mv_table[xy][1], 0);
@@ -30,6 +30,7 @@
 struct MpegEncContext;

 #define MAX_MV 4096
+#define MAX_DMV (2*MAX_MV)

 #define FF_ME_ZERO 0
 #define FF_ME_EPZS 1
@@ -84,7 +85,7 @@ typedef struct MotionEstContext {
    op_pixels_func(*hpel_avg)[4];
    qpel_mc_func(*qpel_put)[16];
    qpel_mc_func(*qpel_avg)[16];
-    uint8_t (*mv_penalty)[MAX_MV * 2 + 1]; ///< bit amount needed to encode a MV
+    uint8_t (*mv_penalty)[MAX_DMV * 2 + 1]; ///< bit amount needed to encode a MV
    uint8_t *current_mv_penalty;
    int (*sub_motion_search)(struct MpegEncContext *s,
                             int *mx_ptr, int *my_ptr, int dmin,
@@ -1953,7 +1953,7 @@ static int mpeg_decode_slice(MpegEncContext *s, int mb_y,
                    (left && show_bits(&s->gb, FFMIN(left, 23)) && !is_d10) ||
                    ((avctx->err_recognition & (AV_EF_BITSTREAM | AV_EF_AGGRESSIVE)) && left > 8)) {
                    av_log(avctx, AV_LOG_ERROR, "end mismatch left=%d %0X\n",
-                           left, show_bits(&s->gb, FFMIN(left, 23)));
+                           left, left>0 ? show_bits(&s->gb, FFMIN(left, 23)) : 0);
                    return AVERROR_INVALIDDATA;
                } else
                    goto eos;
@@ -53,7 +53,7 @@ static const uint8_t svcd_scan_offset_placeholder[] = {
    0x81, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 };

-static uint8_t mv_penalty[MAX_FCODE + 1][MAX_MV * 2 + 1];
+static uint8_t mv_penalty[MAX_FCODE + 1][MAX_DMV * 2 + 1];
 static uint8_t fcode_tab[MAX_MV * 2 + 1];

 static uint8_t uni_mpeg1_ac_vlc_len[64 * 64 * 2];
@@ -145,9 +145,6 @@ static av_cold int encode_init(AVCodecContext *avctx)
 {
    MpegEncContext *s = avctx->priv_data;

-    if (avctx->codec_id == AV_CODEC_ID_MPEG1VIDEO && avctx->height > 2800)
-        avctx->thread_count = 1;
-
    if (ff_mpv_encode_init(avctx) < 0)
        return -1;

@@ -1053,7 +1050,7 @@ av_cold void ff_mpeg1_encode_init(MpegEncContext *s)
        }

        for (f_code = 1; f_code <= MAX_FCODE; f_code++)
-            for (mv = -MAX_MV; mv <= MAX_MV; mv++) {
+            for (mv = -MAX_DMV; mv <= MAX_DMV; mv++) {
                int len;

                if (mv == 0) {
@@ -1076,7 +1073,7 @@ av_cold void ff_mpeg1_encode_init(MpegEncContext *s)
                              2 + bit_size;
                }

-                mv_penalty[f_code][mv + MAX_MV] = len;
+                mv_penalty[f_code][mv + MAX_DMV] = len;
            }


@@ -140,7 +140,7 @@ void ff_mpeg4_encode_mb(MpegEncContext *s,
 void ff_mpeg4_pred_ac(MpegEncContext *s, int16_t *block, int n,
                      int dir);
 void ff_set_mpeg4_time(MpegEncContext *s);
-void ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number);
+int ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number);

 int ff_mpeg4_decode_picture_header(Mpeg4DecContext *ctx, GetBitContext *gb);
 void ff_mpeg4_encode_video_packet_header(MpegEncContext *s);
@@ -883,7 +883,7 @@ int ff_mpeg4_decode_partitions(Mpeg4DecContext *ctx)
    const int part_a_end   = s->pict_type == AV_PICTURE_TYPE_I ? (ER_DC_END   | ER_MV_END)   : ER_MV_END;

    mb_num = mpeg4_decode_partition_a(ctx);
-    if (mb_num < 0) {
+    if (mb_num <= 0) {
        ff_er_add_slice(&s->er, s->resync_mb_x, s->resync_mb_y,
                        s->mb_x, s->mb_y, part_a_error);
        return -1;
@@ -1881,6 +1881,10 @@ static int decode_vol_header(Mpeg4DecContext *ctx, GetBitContext *gb)
                int last = 0;
                for (i = 0; i < 64; i++) {
                    int j;
+                    if (get_bits_left(gb) < 8) {
+                        av_log(s->avctx, AV_LOG_ERROR, "insufficient data for custom matrix\n");
+                        return AVERROR_INVALIDDATA;
+                    }
                    v = get_bits(gb, 8);
                    if (v == 0)
                        break;
@@ -1904,6 +1908,10 @@ static int decode_vol_header(Mpeg4DecContext *ctx, GetBitContext *gb)
                int last = 0;
                for (i = 0; i < 64; i++) {
                    int j;
+                    if (get_bits_left(gb) < 8) {
+                        av_log(s->avctx, AV_LOG_ERROR, "insufficient data for custom matrix\n");
+                        return AVERROR_INVALIDDATA;
+                    }
                    v = get_bits(gb, 8);
                    if (v == 0)
                        break;
@@ -1086,7 +1086,7 @@ static void mpeg4_encode_vol_header(MpegEncContext *s,
 }

 /* write mpeg4 VOP header */
-void ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number)
+int ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number)
 {
    int time_incr;
    int time_div, time_mod;
@@ -1112,6 +1112,12 @@ void ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number)
    time_mod  = FFUMOD(s->time, s->avctx->time_base.den);
    time_incr = time_div - s->last_time_base;
    av_assert0(time_incr >= 0);
+
+    // This limits the frame duration to max 1 hour
+    if (time_incr > 3600) {
+        av_log(s->avctx, AV_LOG_ERROR, "time_incr %d too large\n", time_incr);
+        return AVERROR(EINVAL);
+    }
    while (time_incr--)
        put_bits(&s->pb, 1, 1);

@@ -1137,6 +1143,8 @@ void ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number)
        put_bits(&s->pb, 3, s->f_code);  /* fcode_for */
    if (s->pict_type == AV_PICTURE_TYPE_B)
        put_bits(&s->pb, 3, s->b_code);  /* fcode_back */
+
+    return 0;
 }

 static av_cold void init_uni_dc_tab(void)
@@ -1657,9 +1657,11 @@ static int decode_frame(AVCodecContext * avctx, void *data, int *got_frame_ptr,
    uint32_t header;
    int ret;

+    int skipped = 0;
    while(buf_size && !*buf){
        buf++;
        buf_size--;
+        skipped++;
    }

    if (buf_size < HEADER_SIZE)
@@ -1714,7 +1716,7 @@ static int decode_frame(AVCodecContext * avctx, void *data, int *got_frame_ptr,
            return ret;
    }
    s->frame_size = 0;
-    return buf_size;
+    return buf_size + skipped;
 }

 static void mp_flush(MPADecodeContext *ctx)
@@ -815,6 +815,7 @@ static void clear_context(MpegEncContext *s)

    s->parse_context.buffer = NULL;
    s->parse_context.buffer_size = 0;
+    s->parse_context.overread = 0;
    s->bitstream_buffer = NULL;
    s->allocated_bitstream_buffer_size = 0;
    s->picture          = NULL;
@@ -20,6 +20,8 @@
 * You should have received a copy of the GNU Lesser General Public
 * License along with FFmpeg; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ *
+ * non linear quantizers with large QPs and VBV with restrictive qmin fixes sponsored by NOA GmbH
 */

 /**
@@ -74,7 +76,7 @@ static int sse_mb(MpegEncContext *s);
 static void denoise_dct_c(MpegEncContext *s, int16_t *block);
 static int dct_quantize_trellis_c(MpegEncContext *s, int16_t *block, int n, int qscale, int *overflow);

-static uint8_t default_mv_penalty[MAX_FCODE + 1][MAX_MV * 2 + 1];
+static uint8_t default_mv_penalty[MAX_FCODE + 1][MAX_DMV * 2 + 1];
 static uint8_t default_fcode_tab[MAX_MV * 2 + 1];

 const AVOption ff_mpv_generic_options[] = {
@@ -340,6 +342,7 @@ av_cold int ff_mpv_encode_init(AVCodecContext *avctx)
        break;
    }

+    avctx->bits_per_raw_sample = av_clip(avctx->bits_per_raw_sample, 0, 8);
    s->bit_rate = avctx->bit_rate;
    s->width    = avctx->width;
    s->height   = avctx->height;
@@ -2780,6 +2783,11 @@ int ff_mpv_reallocate_putbitbuffer(MpegEncContext *s, size_t threshold, size_t s
        uint8_t *new_buffer = NULL;
        int new_buffer_size = 0;

+        if ((s->avctx->internal->byte_buffer_size + size_increase) >= INT_MAX/8) {
+            av_log(s->avctx, AV_LOG_ERROR, "Cannot reallocate putbit buffer\n");
+            return AVERROR(ENOMEM);
+        }
+
        av_fast_padded_malloc(&new_buffer, &new_buffer_size,
                              s->avctx->internal->byte_buffer_size + size_increase);
        if (!new_buffer)
@@ -3763,9 +3771,11 @@ static int encode_picture(MpegEncContext *s, int picture_number)
            ff_wmv2_encode_picture_header(s, picture_number);
        else if (CONFIG_MSMPEG4_ENCODER && s->msmpeg4_version)
            ff_msmpeg4_encode_picture_header(s, picture_number);
-        else if (CONFIG_MPEG4_ENCODER && s->h263_pred)
-            ff_mpeg4_encode_picture_header(s, picture_number);
-        else if (CONFIG_RV10_ENCODER && s->codec_id == AV_CODEC_ID_RV10) {
+        else if (CONFIG_MPEG4_ENCODER && s->h263_pred) {
+            ret = ff_mpeg4_encode_picture_header(s, picture_number);
+            if (ret < 0)
+                return ret;
+        } else if (CONFIG_RV10_ENCODER && s->codec_id == AV_CODEC_ID_RV10) {
            ret = ff_rv10_encode_picture_header(s, picture_number);
            if (ret < 0)
                return ret;
@@ -210,8 +210,13 @@ static int decode_555(GetByteContext *gB, uint16_t *dst, int stride,
                    last_symbol = b << 8 | bytestream2_get_byte(gB);
                else if (b > 129) {
                    repeat = 0;
-                    while (b-- > 130)
+                    while (b-- > 130) {
+                        if (repeat >= (INT_MAX >> 8) - 1) {
+                            av_log(NULL, AV_LOG_ERROR, "repeat overflow\n");
+                            return AVERROR_INVALIDDATA;
+                        }
                        repeat = (repeat << 8) + bytestream2_get_byte(gB) + 1;
+                    }
                    if (last_symbol == -2) {
                        int skip = FFMIN((unsigned)repeat, dst + w - p);
                        repeat -= skip;
@@ -211,9 +211,16 @@ static inline int get_egolomb(GetBitContext *gb)
 {
    int v = 4;

-    while (get_bits1(gb)) v++;
+    while (get_bits1(gb)) {
+        v++;
+        if (v > 30) {
+            av_log(NULL, AV_LOG_WARNING, "Too large golomb code in get_egolomb.\n");
+            v = 30;
+            break;
+        }
+    }

-    return (1 << v) + get_bits(gb, v);
+    return (1 << v) + get_bits_long(gb, v);
 }

 static int on2avc_decode_pairs(On2AVCContext *c, GetBitContext *gb, float *dst,
@@ -824,7 +824,7 @@ static inline void silk_stabilize_lsf(int16_t nlsf[16], int order, const uint16_

            /* upper extent */
            for (i = order; i > k; i--)
-                max_center -= min_delta[k];
+                max_center -= min_delta[i];
            max_center -= min_delta[k] >> 1;

            /* move apart */
@@ -565,8 +565,8 @@ static int opus_decode_packet(AVCodecContext *avctx, void *data,
        if (buffer_samples) {
            float *buf[2] = { c->out[2 * i + 0] ? c->out[2 * i + 0] : (float*)frame->extended_data[0],
                              c->out[2 * i + 1] ? c->out[2 * i + 1] : (float*)frame->extended_data[0] };
-            buf[0] += buffer_samples;
-            buf[1] += buffer_samples;
+            buf[0] += decoded_samples;
+            buf[1] += decoded_samples;
            ret = av_audio_fifo_write(c->sync_buffers[i], (void**)buf, buffer_samples);
            if (ret < 0)
                return ret;
@@ -585,7 +585,7 @@ static int opus_decode_packet(AVCodecContext *avctx, void *data,
            memset(frame->extended_data[i], 0, frame->linesize[0]);
        }

-        if (c->gain_i) {
+        if (c->gain_i && decoded_samples > 0) {
            c->fdsp->vector_fmul_scalar((float*)frame->extended_data[i],
                                       (float*)frame->extended_data[i],
                                       c->gain, FFALIGN(decoded_samples, 8));
@@ -33,7 +33,7 @@
 #include "libavutil/imgutils.h"
 #include "libavutil/opt.h"

-#define RGBA(r,g,b,a) (((a) << 24) | ((r) << 16) | ((g) << 8) | (b))
+#define RGBA(r,g,b,a) (((unsigned)(a) << 24) | ((r) << 16) | ((g) << 8) | (b))
 #define MAX_EPOCH_PALETTES 8   // Max 8 allowed per PGS epoch
 #define MAX_EPOCH_OBJECTS  64  // Max 64 allowed per PGS epoch
 #define MAX_OBJECT_REFS    2   // Max objects per display set
@@ -663,7 +663,10 @@ static int decode_idat_chunk(AVCodecContext *avctx, PNGDecContext *s,
                break;

            default:
-                av_assert0(0);
+                avpriv_request_sample(avctx, "bit depth %d "
+                        "and color type %d with TRNS",
+                        s->bit_depth, s->color_type);
+                return AVERROR_INVALIDDATA;
            }

            s->bpp += byte_depth;
@@ -912,6 +915,11 @@ static int decode_fctl_chunk(AVCodecContext *avctx, PNGDecContext *s,
        cur_w > s->width - x_offset|| cur_h > s->height - y_offset)
            return AVERROR_INVALIDDATA;

+    if (blend_op != APNG_BLEND_OP_OVER && blend_op != APNG_BLEND_OP_SOURCE) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid blend_op %d\n", blend_op);
+        return AVERROR_INVALIDDATA;
+    }
+
    if (sequence_number == 0 && dispose_op == APNG_DISPOSE_OP_PREVIOUS) {
        // No previous frame to revert to for the first frame
        // Spec says to just treat it as a APNG_DISPOSE_OP_BACKGROUND
@@ -1007,7 +1015,7 @@ static int handle_p_frame_apng(AVCodecContext *avctx, PNGDecContext *s,
            for (x = s->x_offset; x < s->x_offset + s->cur_w; ++x, foreground += s->bpp, background += s->bpp) {
                size_t b;
                uint8_t foreground_alpha, background_alpha, output_alpha;
-                uint8_t output[4];
+                uint8_t output[10];

                // Since we might be blending alpha onto alpha, we use the following equations:
                // output_alpha = foreground_alpha + (1 - foreground_alpha) * background_alpha
@@ -1047,6 +1055,8 @@ static int handle_p_frame_apng(AVCodecContext *avctx, PNGDecContext *s,

                output_alpha = foreground_alpha + FAST_DIV255((255 - foreground_alpha) * background_alpha);

+                av_assert0(s->bpp <= 10);
+
                for (b = 0; b < s->bpp - 1; ++b) {
                    if (output_alpha == 0) {
                        output[b] = 0;
@@ -1254,7 +1264,7 @@ static int decode_frame_png(AVCodecContext *avctx,
        return AVERROR_INVALIDDATA;
    }

-    s->y = s->state = 0;
+    s->y = s->state = s->has_trns = 0;

    /* init the zlib */
    s->zstream.zalloc = ff_png_zalloc;
@@ -747,12 +747,11 @@ static int apng_encode_frame(AVCodecContext *avctx, const AVFrame *pict,

            // Do disposal
            if (last_fctl_chunk.dispose_op != APNG_DISPOSE_OP_PREVIOUS) {
-                memcpy(diffFrame->data[0], s->last_frame->data[0],
-                       s->last_frame->linesize[0] * s->last_frame->height);
+                av_frame_copy(diffFrame, s->last_frame);

                if (last_fctl_chunk.dispose_op == APNG_DISPOSE_OP_BACKGROUND) {
                    for (y = last_fctl_chunk.y_offset; y < last_fctl_chunk.y_offset + last_fctl_chunk.height; ++y) {
-                        size_t row_start = s->last_frame->linesize[0] * y + bpp * last_fctl_chunk.x_offset;
+                        size_t row_start = diffFrame->linesize[0] * y + bpp * last_fctl_chunk.x_offset;
                        memset(diffFrame->data[0] + row_start, 0, bpp * last_fctl_chunk.width);
                    }
                }
@@ -760,8 +759,7 @@ static int apng_encode_frame(AVCodecContext *avctx, const AVFrame *pict,
                if (!s->prev_frame)
                    continue;

-                memcpy(diffFrame->data[0], s->prev_frame->data[0],
-                       s->prev_frame->linesize[0] * s->prev_frame->height);
+                av_frame_copy(diffFrame, s->prev_frame);
            }

            // Do inverse blending
@@ -923,13 +921,12 @@ static int encode_apng(AVCodecContext *avctx, AVPacket *pkt,
            }

            // Do disposal, but not blending
-            memcpy(s->prev_frame->data[0], s->last_frame->data[0],
-                   s->last_frame->linesize[0] * s->last_frame->height);
+            av_frame_copy(s->prev_frame, s->last_frame);
            if (s->last_frame_fctl.dispose_op == APNG_DISPOSE_OP_BACKGROUND) {
                uint32_t y;
                uint8_t bpp = (s->bits_per_pixel + 7) >> 3;
                for (y = s->last_frame_fctl.y_offset; y < s->last_frame_fctl.y_offset + s->last_frame_fctl.height; ++y) {
-                    size_t row_start = s->last_frame->linesize[0] * y + bpp * s->last_frame_fctl.x_offset;
+                    size_t row_start = s->prev_frame->linesize[0] * y + bpp * s->last_frame_fctl.x_offset;
                    memset(s->prev_frame->data[0] + row_start, 0, bpp * s->last_frame_fctl.width);
                }
            }
@@ -193,6 +193,12 @@ int ff_slice_thread_init(AVCodecContext *avctx)
    w32thread_init();
 #endif

+    // We cannot do this in the encoder init as the threads are created before
+    if (av_codec_is_encoder(avctx->codec) &&
+        avctx->codec_id == AV_CODEC_ID_MPEG1VIDEO &&
+        avctx->height > 2800)
+        thread_count = avctx->thread_count = 1;
+
    if (!thread_count) {
        int nb_cpus = av_cpu_count();
        if  (avctx->height)
@@ -105,7 +105,7 @@ static inline void flush_put_bits(PutBitContext *s)
        s->bit_buf <<= s->bit_left;
 #endif
    while (s->bit_left < 32) {
-        /* XXX: should test end of buffer */
+        av_assert0(s->buf_ptr < s->buf_end);
 #ifdef BITSTREAM_WRITER_LE
        *s->buf_ptr++ = s->bit_buf;
        s->bit_buf  >>= 8;
@@ -163,9 +163,13 @@ static inline void put_bits(PutBitContext *s, int n, unsigned int value)
 #ifdef BITSTREAM_WRITER_LE
    bit_buf |= value << (32 - bit_left);
    if (n >= bit_left) {
-        av_assert2(s->buf_ptr+3<s->buf_end);
-        AV_WL32(s->buf_ptr, bit_buf);
-        s->buf_ptr += 4;
+        if (3 < s->buf_end - s->buf_ptr) {
+            AV_WL32(s->buf_ptr, bit_buf);
+            s->buf_ptr += 4;
+        } else {
+            av_log(NULL, AV_LOG_ERROR, "Internal error, put_bits buffer too small\n");
+            av_assert2(0);
+        }
        bit_buf     = value >> bit_left;
        bit_left   += 32;
    }
@@ -177,9 +181,13 @@ static inline void put_bits(PutBitContext *s, int n, unsigned int value)
    } else {
        bit_buf   <<= bit_left;
        bit_buf    |= value >> (n - bit_left);
-        av_assert2(s->buf_ptr+3<s->buf_end);
-        AV_WB32(s->buf_ptr, bit_buf);
-        s->buf_ptr += 4;
+        if (3 < s->buf_end - s->buf_ptr) {
+            AV_WB32(s->buf_ptr, bit_buf);
+            s->buf_ptr += 4;
+        } else {
+            av_log(NULL, AV_LOG_ERROR, "Internal error, put_bits buffer too small\n");
+            av_assert2(0);
+        }
        bit_left   += 32 - n;
        bit_buf     = value;
    }
@@ -258,7 +258,7 @@ static int raw_decode(AVCodecContext *avctx, void *data, int *got_frame,
        buf += buf_size - context->frame_size;

    len = context->frame_size - (avctx->pix_fmt==AV_PIX_FMT_PAL8 ? AVPALETTE_SIZE : 0);
-    if (buf_size < len && (avctx->codec_tag & 0xFFFFFF) != MKTAG('B','I','T', 0)) {
+    if (buf_size < len && ((avctx->codec_tag & 0xFFFFFF) != MKTAG('B','I','T', 0) || !need_copy)) {
        av_log(avctx, AV_LOG_ERROR, "Invalid buffer size, packet size %d < expected frame_size %d\n", buf_size, len);
        av_buffer_unref(&frame->buf[0]);
        return AVERROR(EINVAL);
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .7.git
 .8.6