@@ -1,4 +1,9 @@

 -------------------------------------------------------------------

+Mon Jul 20 2015 - joerg.lorenzen@ki.tng.de

+

+- update internal ffmpeg to version 2.7.2

+

+-------------------------------------------------------------------

 Sat Jul 11 2015 - joerg.lorenzen@ki.tng.de

 - Update to version 2.6.10

​

@@ -16,7 +16,7 @@

 #

-%define         ffmpeg_version 2.7.1

+%define         ffmpeg_version 2.7.2

 Name:           avidemux3

 Summary:        Graphical video editing and transcoding tool

​

@@ -3,6 +3,72 @@

 version <next>:

+version 2.7.2:

+- imc: use correct position for flcoeffs2 calculation

+- hevc: check slice address length

+- snow: remove an obsolete av_assert2

+- webp: fix infinite loop in webp_decode_frame

+- wavpack: limit extra_bits to 32 and use get_bits_long

+- ffmpeg: only count got_output/errors in decode_error_stat

+- ffmpeg: exit_on_error if decoding a packet failed

+- pthread_frame: forward error codes when flushing

+- huffyuvdec: validate image size

+- wavpack: use get_bits_long to read up to 32 bits

+- nutdec: check maxpos in read_sm_data before returning success

+- s302m: fix arithmetic exception

+- vc1dec: use get_bits_long and limit the read bits to 32

+- mpegaudiodec: copy AVFloatDSPContext from first context to all contexts

+- avcodec/vp8: Check buffer size in vp8_decode_frame_header()

+- avcodec/vp8: Fix null pointer dereference in ff_vp8_decode_free()

+- avcodec/diracdec: Check for hpel_base allocation failure

+- avcodec/rv34: Clear pointers in ff_rv34_decode_init_thread_copy()

+- avfilter/af_aresample: Check ff_all_* for allocation failures

+- avcodec/pthread_frame: clear priv_data, avoid stale pointer in error case

+- swscale/utils: Clear pix buffers

+- avutil/fifo: Fix the case where func() returns less bytes than requested in av_fifo_generic_write()

+- ffmpeg: Fix cleanup after failed allocation of output_files

+- avformat/mov: Fix deallocation when MOVStreamContext failed to allocate

+- ffmpeg: Fix crash with ost->last_frame allocation failure

+- ffmpeg: Fix cleanup with ost = NULL

+- avcodec/pthread_frame: check avctx on deallocation

+- avcodec/sanm: Reset sizes in destroy_buffers()

+- avcodec/alac: Clear pointers in allocate_buffers()

+- bytestream2: set the reader to the end when reading more than available

+- avcodec/utils: use a minimum 32pixel width in  avcodec_align_dimensions2() for H.264

+- avcodec/mpegvideo: Clear pointers in ff_mpv_common_init()

+- oggparsedirac: check return value of init_get_bits

+- wmalosslessdec: reset frame->nb_samples on packet loss

+- wmalosslessdec: avoid reading 0 bits with get_bits

+- Put a space between string literals and macros.

+- avcodec/rawenc: Use ff_alloc_packet() instead of ff_alloc_packet2()

+- avcodec/aacsbr: check that the element type matches before applying SBR

+- avcodec/h264_slice: Use w/h from the AVFrame instead of mb_w/h

+- vp9/update_prob: prevent out of bounds table read

+- avfilter/vf_transpose: Fix rounding error

+- avcodec/h264_refs: discard mismatching references

+- avcodec/mjpegdec: Fix small picture upscale

+- avcodec/pngdec: Check values before updating context in decode_fctl_chunk()

+- avcodec/pngdec: Copy IHDR & plte state from last thread

+- avcodec/pngdec: Require a IHDR chunk before fctl

+- avcodec/pngdec: Only allow one IHDR chunk

+- wmavoice: limit wmavoice_decode_packet return value to packet size

+- swscale/swscale_unscaled: Fix rounding difference with RGBA output between little and big endian

+- ffmpeg: Do not use the data/size of a bitstream filter after failure

+- swscale/x86/rgb2rgb_template: fix signedness of v in shuffle_bytes_2103_{mmx,mmxext}

+- vda: unlock the pixel buffer base address.

+- swscale/rgb2rgb_template: Fix signedness of v in shuffle_bytes_2103_c()

+- swscale/rgb2rgb_template: Implement shuffle_bytes_0321_c and fix shuffle_bytes_2103_c on BE

+- swscale/rgb2rgb_template: Disable shuffle_bytes_2103_c on big endian

+- swr: Remember previously set int_sample_format from user

+- swresample: soxr implementation for swr_get_out_samples()

+- avformat/swfdec: Do not error out on pixel format changes

+- ffmpeg_opt: Fix forcing fourccs

+- configure: Check for x265_api_get

+- swscale/x86/rgb2rgb_template: don't call emms on sse2/avx functions

+- swscale/x86/rgb2rgb_template: add missing xmm clobbers

+- library.mak: Workaround SDL redefining main and breaking fate tests on mingw

+- vaapi_h264: fix RefPicList[] field flags.

+

 version 2.7.1:

 - postproc: fix unaligned access

 - avformat: clarify what package needs to be compiled with SSL support

​

@@ -1,1 +1,1 @@

-2.7.1

+2.7.2

​

@@ -1,1 +1,1 @@

-2.7.1

+2.7.2

​

@@ -5157,7 +5157,7 @@

                                  warn "using libx264 without pkg-config"; } } &&

                              { check_cpp_condition x264.h "X264_BUILD >= 118" ||

                                die "ERROR: libx264 must be installed and version must be >= 0.118."; }

-enabled libx265           && require_pkg_config x265 x265.h x265_encoder_encode &&

+enabled libx265           && require_pkg_config x265 x265.h x265_api_get &&

                              { check_cpp_condition x265.h "X265_BUILD >= 57" ||

                                die "ERROR: libx265 version must be >= 57."; }

 enabled libxavs           && require libxavs xavs.h xavs_encoder_encode -lxavs

​

@@ -31,7 +31,7 @@

 # This could be handy for archiving the generated documentation or

 # if some version control system is used.

-PROJECT_NUMBER         = 2.7.1

+PROJECT_NUMBER         = 2.7.2

 # With the PROJECT_LOGO tag one can specify a logo or icon that is included

 # in the documentation. The maximum height of the logo should not exceed 55

​

@@ -456,7 +456,10 @@

     /* close files */

     for (i = 0; i < nb_output_files; i++) {

         OutputFile *of = output_files[i];

-        AVFormatContext *s = of->ctx;

+        AVFormatContext *s;

+        if (!of)

+            continue;

+        s = of->ctx;

         if (s && s->oformat && !(s->oformat->flags & AVFMT_NOFILE))

             avio_closep(&s->pb);

         avformat_free_context(s);

@@ -466,7 +469,12 @@

     }

     for (i = 0; i < nb_output_streams; i++) {

         OutputStream *ost = output_streams[i];

-        AVBitStreamFilterContext *bsfc = ost->bitstream_filters;

+        AVBitStreamFilterContext *bsfc;

+

+        if (!ost)

+            continue;

+

+        bsfc = ost->bitstream_filters;

         while (bsfc) {

             AVBitStreamFilterContext *next = bsfc->next;

             av_bitstream_filter_close(bsfc);

@@ -650,6 +658,7 @@

             if (!new_pkt.buf)

                 exit_program(1);

         } else if (a < 0) {

+            new_pkt = *pkt;

             av_log(NULL, AV_LOG_ERROR, "Failed to open bitstream filter %s for stream %d with codec %s",

                    bsfc->filter->name, pkt->stream_index,

                    avctx->codec ? avctx->codec->name : "copy");

@@ -1176,7 +1185,7 @@

     if (!ost->last_frame)

         ost->last_frame = av_frame_alloc();

     av_frame_unref(ost->last_frame);

-    if (next_picture)

+    if (next_picture && ost->last_frame)

         av_frame_ref(ost->last_frame, next_picture);

     else

         av_frame_free(&ost->last_frame);

@@ -1865,9 +1874,12 @@

         ret = AVERROR_INVALIDDATA;

     }

-    if (*got_output || ret<0 || pkt->size)

+    if (*got_output || ret<0)

         decode_error_stat[ret<0] ++;

+    if (ret < 0 && exit_on_error)

+        exit_program(1);

+

     if (!*got_output || ret < 0) {

         if (!pkt->size) {

             for (i = 0; i < ist->nb_filters; i++)

@@ -2010,9 +2022,12 @@

             );

     }

-    if (*got_output || ret<0 || pkt->size)

+    if (*got_output || ret<0)

         decode_error_stat[ret<0] ++;

+    if (ret < 0 && exit_on_error)

+        exit_program(1);

+

     if (*got_output && ret >= 0) {

         if (ist->dec_ctx->width  != decoded_frame->width ||

             ist->dec_ctx->height != decoded_frame->height ||

@@ -2128,9 +2143,12 @@

     int i, ret = avcodec_decode_subtitle2(ist->dec_ctx,

                                           &subtitle, got_output, pkt);

-    if (*got_output || ret<0 || pkt->size)

+    if (*got_output || ret<0)

         decode_error_stat[ret<0] ++;

+    if (ret < 0 && exit_on_error)

+        exit_program(1);

+

     if (ret < 0 || !*got_output) {

         if (!pkt->size)

             sub2video_flush(ist);

​

@@ -1203,6 +1203,7 @@

         uint32_t tag = strtol(codec_tag, &next, 0);

         if (*next)

             tag = AV_RL32(codec_tag);

+        ost->st->codec->codec_tag =

         ost->enc_ctx->codec_tag = tag;

     }

​

@@ -77,6 +77,8 @@

                   frame->width, frame->height);

     ret = av_frame_copy_props(vda->tmp_frame, frame);

+    CVPixelBufferUnlockBaseAddress(pixbuf, kCVPixelBufferLock_ReadOnly);

+

     if (ret < 0)

         return ret;

​

@@ -1019,6 +1019,8 @@

 {

     unsigned int cnt = get_bits_count(gb);

+    sbr->id_aac = id_aac;

+

     if (id_aac == TYPE_SCE || id_aac == TYPE_CCE) {

         if (read_sbr_single_channel_element(ac, sbr, gb)) {

             sbr_turnoff(sbr);

@@ -1695,6 +1697,12 @@

     int nch = (id_aac == TYPE_CPE) ? 2 : 1;

     int err;

+    if (id_aac != sbr->id_aac) {

+        av_log(ac->avctx, AV_LOG_ERROR,

+            "element type mismatch %d != %d\n", id_aac, sbr->id_aac);

+        sbr_turnoff(sbr);

+    }

+

     if (!sbr->kx_and_m_pushed) {

         sbr->kx[0] = sbr->kx[1];

         sbr->m[0] = sbr->m[1];

@@ -1718,6 +1726,7 @@

             sbr->c.sbr_hf_inverse_filter(&sbr->dsp, sbr->alpha0, sbr->alpha1,

                                          (const float (*)[40][2]) sbr->X_low, sbr->k[0]);

             sbr_chirp(sbr, &sbr->data[ch]);

+            av_assert0(sbr->data[ch].bs_num_env > 0);

             sbr_hf_gen(ac, sbr, sbr->X_high,

                        (const float (*)[40][2]) sbr->X_low,

                        (const float (*)[2]) sbr->alpha0,

​

@@ -534,6 +534,12 @@

     int ch;

     int buf_size = alac->max_samples_per_frame * sizeof(int32_t);

+    for (ch = 0; ch < 2; ch++) {

+        alac->predict_error_buffer[ch]  = NULL;

+        alac->output_samples_buffer[ch] = NULL;

+        alac->extra_bits_buffer[ch]     = NULL;

+    }

+

     for (ch = 0; ch < FFMIN(alac->channels, 2); ch++) {

         FF_ALLOC_OR_GOTO(alac->avctx, alac->predict_error_buffer[ch],

                          buf_size, buf_alloc_fail);

​

@@ -71,8 +71,10 @@

 }                                                                              \

 static av_always_inline type bytestream2_get_ ## name(GetByteContext *g)       \

 {                                                                              \

-    if (g->buffer_end - g->buffer < bytes)                                     \

+    if (g->buffer_end - g->buffer < bytes) {                                   \

+        g->buffer = g->buffer_end;                                             \

         return 0;                                                              \

+    }                                                                          \

     return bytestream2_get_ ## name ## u(g);                                   \

 }                                                                              \

 static av_always_inline type bytestream2_peek_ ## name(GetByteContext *g)      \

​

@@ -1563,7 +1563,7 @@

     }

 }

-static void interpolate_refplane(DiracContext *s, DiracFrame *ref, int plane, int width, int height)

+static int interpolate_refplane(DiracContext *s, DiracFrame *ref, int plane, int width, int height)

 {

     /* chroma allocates an edge of 8 when subsampled

        which for 4:2:2 means an h edge of 16 and v edge of 8

@@ -1575,11 +1575,14 @@

     /* no need for hpel if we only have fpel vectors */

     if (!s->mv_precision)

-        return;

+        return 0;

     for (i = 1; i < 4; i++) {

         if (!ref->hpel_base[plane][i])

             ref->hpel_base[plane][i] = av_malloc((height+2*edge) * ref->avframe->linesize[plane] + 32);

+        if (!ref->hpel_base[plane][i]) {

+            return AVERROR(ENOMEM);

+        }

         /* we need to be 16-byte aligned even for chroma */

         ref->hpel[plane][i] = ref->hpel_base[plane][i] + edge*ref->avframe->linesize[plane] + 16;

     }

@@ -1593,6 +1596,8 @@

         s->mpvencdsp.draw_edges(ref->hpel[plane][3], ref->avframe->linesize[plane], width, height, edge, edge, EDGE_TOP | EDGE_BOTTOM);

     }

     ref->interpolated[plane] = 1;

+

+    return 0;

 }

 /**

@@ -1646,8 +1651,11 @@

             select_dsp_funcs(s, p->width, p->height, p->xblen, p->yblen);

-            for (i = 0; i < s->num_refs; i++)

-                interpolate_refplane(s, s->ref_pics[i], comp, p->width, p->height);

+            for (i = 0; i < s->num_refs; i++) {

+                int ret = interpolate_refplane(s, s->ref_pics[i], comp, p->width, p->height);

+                if (ret < 0)

+                    return ret;

+            }

             memset(s->mctmp, 0, 4*p->yoffset*p->stride);

​

@@ -125,6 +125,7 @@

 int ff_h264_fill_default_ref_list(H264Context *h, H264SliceContext *sl)

 {

     int i, len;

+    int j;

     if (sl->slice_type_nos == AV_PICTURE_TYPE_B) {

         H264Picture *sorted[32];

@@ -188,6 +189,21 @@

         }

     }

 #endif

+

+    for (j = 0; j<1+(sl->slice_type_nos == AV_PICTURE_TYPE_B); j++) {

+        for (i = 0; i < sl->ref_count[j]; i++) {

+            if (h->default_ref_list[j][i].parent) {

+                AVFrame *f = h->default_ref_list[j][i].parent->f;

+                if (h->cur_pic_ptr->f->width  != f->width ||

+                    h->cur_pic_ptr->f->height != f->height ||

+                    h->cur_pic_ptr->f->format != f->format) {

+                    av_log(h->avctx, AV_LOG_ERROR, "Discarding mismatching reference\n");

+                    memset(&h->default_ref_list[j][i], 0, sizeof(h->default_ref_list[j][i]));

+                }

+            }

+        }

+    }

+

     return 0;

 }

​

@@ -1558,8 +1558,8 @@

                                   (const uint8_t **)prev->f->data,

                                   prev->f->linesize,

                                   prev->f->format,

-                                  h->mb_width  * 16,

-                                  h->mb_height * 16);

+                                  prev->f->width,

+                                  prev->f->height);

                     h->short_ref[0]->poc = prev->poc + 2;

                 }

                 h->short_ref[0]->frame_num = h->prev_frame_num;

​

@@ -456,7 +456,7 @@

         slice_address_length = av_ceil_log2(s->sps->ctb_width *

                                             s->sps->ctb_height);

-        sh->slice_segment_addr = get_bits(gb, slice_address_length);

+        sh->slice_segment_addr = slice_address_length ? get_bits(gb, slice_address_length) : 0;

         if (sh->slice_segment_addr >= s->sps->ctb_width * s->sps->ctb_height) {

             av_log(s->avctx, AV_LOG_ERROR,

                    "Invalid slice segment address: %u.\n",

​

@@ -200,7 +200,7 @@

                 slice_address_length = av_ceil_log2_c(h->sps->ctb_width *

                                                       h->sps->ctb_height);

-                sh->slice_segment_addr = get_bits(gb, slice_address_length);

+                sh->slice_segment_addr = slice_address_length ? get_bits(gb, slice_address_length) : 0;

                 if (sh->slice_segment_addr >= h->sps->ctb_width * h->sps->ctb_height) {

                     av_log(h->avctx, AV_LOG_ERROR, "Invalid slice segment address: %u.\n",

                            sh->slice_segment_addr);

​

@@ -37,6 +37,7 @@

 #include "huffyuv.h"

 #include "huffyuvdsp.h"

 #include "thread.h"

+#include "libavutil/imgutils.h"

 #include "libavutil/pixdesc.h"

 #define classic_shift_luma_table_size 42

@@ -291,6 +292,10 @@

     HYuvContext *s = avctx->priv_data;

     int ret;

+    ret = av_image_check_size(avctx->width, avctx->height, 0, avctx);

+    if (ret < 0)

+        return ret;

+

     ff_huffyuvdsp_init(&s->hdsp);

     memset(s->vlc, 0, 4 * sizeof(VLC));

​

@@ -426,7 +426,7 @@

     pos = q->coef0_pos;

     flcoeffs1[pos] = 20000.0 / pow (2, levlCoeffBuf[0] * 0.18945); // 0.18945 = log2(10) * 0.05703125

-    flcoeffs2[pos] = log2f(flcoeffs1[0]);

+    flcoeffs2[pos] = log2f(flcoeffs1[pos]);

     tmp  = flcoeffs1[pos];

     tmp2 = flcoeffs2[pos];

​

@@ -2192,11 +2192,13 @@

                     }

                 } else if (s->upscale_h[p] == 2) {

                     if (is16bit) {

-                        ((uint16_t*)line)[w - 1] =

-                        ((uint16_t*)line)[w - 2] = ((uint16_t*)line)[(w - 1) / 3];

+                        ((uint16_t*)line)[w - 1] = ((uint16_t*)line)[(w - 1) / 3];

+                        if (w > 1)

+                            ((uint16_t*)line)[w - 2] = ((uint16_t*)line)[w - 1];

                     } else {

-                        line[w - 1] =

-                        line[w - 2] = line[(w - 1) / 3];

+                        line[w - 1] = line[(w - 1) / 3];

+                        if (w > 1)

+                            line[w - 2] = line[w - 1];

                     }

                     for (index = w - 3; index > 0; index--) {

                         line[index] = (line[index / 3] + line[(index + 1) / 3] + line[(index + 2) / 3] + 1) / 3;

​

@@ -1893,6 +1893,7 @@

         s->mp3decctx[i]->adu_mode = 1;

         s->mp3decctx[i]->avctx = avctx;

         s->mp3decctx[i]->mpadsp = s->mp3decctx[0]->mpadsp;

+        s->mp3decctx[i]->fdsp = s->mp3decctx[0]->fdsp;

     }

     return 0;

​

@@ -1227,6 +1227,82 @@

     return AVERROR(ENOMEM);

 }

+static void clear_context(MpegEncContext *s)

+{

+    int i, j, k;

+

+    memset(&s->next_picture, 0, sizeof(s->next_picture));

+    memset(&s->last_picture, 0, sizeof(s->last_picture));

+    memset(&s->current_picture, 0, sizeof(s->current_picture));

+    memset(&s->new_picture, 0, sizeof(s->new_picture));

+

+    memset(s->thread_context, 0, sizeof(s->thread_context));

+

+    s->me.map = NULL;

+    s->me.score_map = NULL;

+    s->dct_error_sum = NULL;

+    s->block = NULL;

+    s->blocks = NULL;

+    memset(s->pblocks, 0, sizeof(s->pblocks));

+    s->ac_val_base = NULL;

+    s->ac_val[0] =

+    s->ac_val[1] =

+    s->ac_val[2] =NULL;

+    s->sc.edge_emu_buffer = NULL;

+    s->me.scratchpad = NULL;

+    s->me.temp =

+    s->sc.rd_scratchpad =

+    s->sc.b_scratchpad =

+    s->sc.obmc_scratchpad = NULL;

+

+    s->parse_context.buffer = NULL;

+    s->parse_context.buffer_size = 0;

+    s->bitstream_buffer = NULL;

+    s->allocated_bitstream_buffer_size = 0;

+    s->picture          = NULL;

+    s->mb_type          = NULL;

+    s->p_mv_table_base  = NULL;

+    s->b_forw_mv_table_base = NULL;

+    s->b_back_mv_table_base = NULL;

+    s->b_bidir_forw_mv_table_base = NULL;

+    s->b_bidir_back_mv_table_base = NULL;

+    s->b_direct_mv_table_base = NULL;

+    s->p_mv_table            = NULL;

+    s->b_forw_mv_table       = NULL;

+    s->b_back_mv_table       = NULL;

+    s->b_bidir_forw_mv_table = NULL;

+    s->b_bidir_back_mv_table = NULL;

+    s->b_direct_mv_table     = NULL;

+    for (i = 0; i < 2; i++) {

+        for (j = 0; j < 2; j++) {

+            for (k = 0; k < 2; k++) {

+                s->b_field_mv_table_base[i][j][k] = NULL;

+                s->b_field_mv_table[i][j][k] = NULL;

+            }

+            s->b_field_select_table[i][j] = NULL;

+            s->p_field_mv_table_base[i][j] = NULL;

+            s->p_field_mv_table[i][j] = NULL;

+        }

+        s->p_field_select_table[i] = NULL;

+    }

+

+    s->dc_val_base = NULL;

+    s->coded_block_base = NULL;

+    s->mbintra_table = NULL;

+    s->cbp_table = NULL;

+    s->pred_dir_table = NULL;

+

+    s->mbskip_table = NULL;

+

+    s->er.error_status_table = NULL;

+    s->er.er_temp_buffer = NULL;

+    s->mb_index2xy = NULL;

+    s->lambda_table = NULL;

+

+    s->cplx_tab = NULL;

+    s->bits_tab = NULL;

+}

+

 /**

  * init common structure for both encoder and decoder.

  * this assumes that some variables like width/height are already set

@@ -1238,6 +1314,8 @@

                      s->avctx->active_thread_type & FF_THREAD_SLICE) ?

                     s->avctx->thread_count : 1;

+    clear_context(s);

+

     if (s->encoding && s->avctx->slices)

         nb_slices = s->avctx->slices;

@@ -1282,10 +1360,6 @@

         if (!s->picture[i].f)

             goto fail;

     }

-    memset(&s->next_picture, 0, sizeof(s->next_picture));

-    memset(&s->last_picture, 0, sizeof(s->last_picture));

-    memset(&s->current_picture, 0, sizeof(s->current_picture));

-    memset(&s->new_picture, 0, sizeof(s->new_picture));

     s->next_picture.f = av_frame_alloc();

     if (!s->next_picture.f)

         goto fail;

​

@@ -542,18 +542,18 @@

         return AVERROR_INVALIDDATA;

     }

-    s->width  = bytestream2_get_be32(&s->gb);

-    s->height = bytestream2_get_be32(&s->gb);

+    if (s->state & PNG_IHDR) {

+        av_log(avctx, AV_LOG_ERROR, "Multiple IHDR\n");

+        return AVERROR_INVALIDDATA;

+    }

+

+    s->width  = s->cur_w = bytestream2_get_be32(&s->gb);

+    s->height = s->cur_h = bytestream2_get_be32(&s->gb);

     if (av_image_check_size(s->width, s->height, 0, avctx)) {

-        s->width = s->height = 0;

+        s->cur_w = s->cur_h = s->width = s->height = 0;

         av_log(avctx, AV_LOG_ERROR, "Invalid image size\n");

         return AVERROR_INVALIDDATA;

     }

-    if (s->cur_w == 0 && s->cur_h == 0) {

-        // Only set cur_w/h if update_thread_context() has not set it

-        s->cur_w = s->width;

-        s->cur_h = s->height;

-    }

     s->bit_depth        = bytestream2_get_byte(&s->gb);

     s->color_type       = bytestream2_get_byte(&s->gb);

     s->compression_type = bytestream2_get_byte(&s->gb);

@@ -815,10 +815,16 @@

                              uint32_t length)

 {

     uint32_t sequence_number;

+    int cur_w, cur_h, x_offset, y_offset, dispose_op, blend_op;

     if (length != 26)

         return AVERROR_INVALIDDATA;

+    if (!(s->state & PNG_IHDR)) {

+        av_log(avctx, AV_LOG_ERROR, "fctl before IHDR\n");

+        return AVERROR_INVALIDDATA;

+    }

+

     s->last_w = s->cur_w;

     s->last_h = s->cur_h;

     s->last_x_offset = s->x_offset;

@@ -826,23 +832,23 @@

     s->last_dispose_op = s->dispose_op;

     sequence_number = bytestream2_get_be32(&s->gb);

-    s->cur_w        = bytestream2_get_be32(&s->gb);

-    s->cur_h        = bytestream2_get_be32(&s->gb);

-    s->x_offset     = bytestream2_get_be32(&s->gb);

-    s->y_offset     = bytestream2_get_be32(&s->gb);

+    cur_w           = bytestream2_get_be32(&s->gb);

+    cur_h           = bytestream2_get_be32(&s->gb);

+    x_offset        = bytestream2_get_be32(&s->gb);

+    y_offset        = bytestream2_get_be32(&s->gb);

     bytestream2_skip(&s->gb, 4); /* delay_num (2), delay_den (2) */

-    s->dispose_op   = bytestream2_get_byte(&s->gb);

-    s->blend_op     = bytestream2_get_byte(&s->gb);

+    dispose_op      = bytestream2_get_byte(&s->gb);

+    blend_op        = bytestream2_get_byte(&s->gb);

     bytestream2_skip(&s->gb, 4); /* crc */

     if (sequence_number == 0 &&

-        (s->cur_w != s->width ||

-         s->cur_h != s->height ||

-         s->x_offset != 0 ||

-         s->y_offset != 0) ||

-        s->cur_w <= 0 || s->cur_h <= 0 ||

-        s->x_offset < 0 || s->y_offset < 0 ||

-        s->cur_w > s->width - s->x_offset|| s->cur_h > s->height - s->y_offset)

+        (cur_w != s->width ||

+         cur_h != s->height ||

+         x_offset != 0 ||

+         y_offset != 0) ||

+        cur_w <= 0 || cur_h <= 0 ||

+        x_offset < 0 || y_offset < 0 ||

+        cur_w > s->width - x_offset|| cur_h > s->height - y_offset)

             return AVERROR_INVALIDDATA;

     if (sequence_number == 0 && s->dispose_op == APNG_DISPOSE_OP_PREVIOUS) {

@@ -863,6 +869,13 @@

         s->dispose_op = APNG_BLEND_OP_SOURCE;

     }

+    s->cur_w      = cur_w;

+    s->cur_h      = cur_h;

+    s->x_offset   = x_offset;

+    s->y_offset   = y_offset;

+    s->dispose_op = dispose_op;

+    s->blend_op   = blend_op;

+

     return 0;

 }

@@ -1259,12 +1272,24 @@

         (ret = ff_thread_ref_frame(&pdst->picture, &psrc->picture)) < 0)

         return ret;

     if (CONFIG_APNG_DECODER && dst->codec_id == AV_CODEC_ID_APNG) {

+        pdst->width             = psrc->width;

+        pdst->height            = psrc->height;

+        pdst->bit_depth         = psrc->bit_depth;

+        pdst->color_type        = psrc->color_type;

+        pdst->compression_type  = psrc->compression_type;

+        pdst->interlace_type    = psrc->interlace_type;

+        pdst->filter_type       = psrc->filter_type;

         pdst->cur_w = psrc->cur_w;

         pdst->cur_h = psrc->cur_h;

         pdst->x_offset = psrc->x_offset;

         pdst->y_offset = psrc->y_offset;

+

         pdst->dispose_op = psrc->dispose_op;

+        memcpy(pdst->palette, psrc->palette, sizeof(pdst->palette));

+

+        pdst->state |= psrc->state & (PNG_IHDR | PNG_PLTE);

+

         ff_thread_release_buffer(dst, &pdst->last_picture);

         if (psrc->last_picture.f->data[0])

             return ff_thread_ref_frame(&pdst->last_picture, &psrc->last_picture);

​

@@ -454,6 +454,9 @@

         *got_picture_ptr = p->got_frame;

         picture->pkt_dts = p->avpkt.dts;

+        if (p->result < 0)

+            err = p->result;

+

         /*

          * A later call with avkpt->size == 0 may loop over all threads,

          * including this one, searching for a frame to return before being

@@ -471,6 +474,14 @@

     fctx->next_finished = finished;

+    /*

+     * When no frame was found while flushing, but an error occured in

+     * any thread, return it instead of 0.

+     * Otherwise the error can get lost.

+     */

+    if (!avpkt->size && !*got_picture_ptr)

+        return err;

+

     /* return the size of the consumed packet if no error occurred */

     return (p->result >= 0) ? avpkt->size : p->result;

 }

@@ -572,7 +583,7 @@

             pthread_join(p->thread, NULL);

         p->thread_init=0;

-        if (codec->close)

+        if (codec->close && p->avctx)

             codec->close(p->avctx);

         release_delayed_buffers(p);

@@ -590,12 +601,13 @@

         av_packet_unref(&p->avpkt);

         av_freep(&p->released_buffers);

-        if (i) {

+        if (i && p->avctx) {

             av_freep(&p->avctx->priv_data);

             av_freep(&p->avctx->slice_offset);

         }

-        av_freep(&p->avctx->internal);

+        if (p->avctx)

+            av_freep(&p->avctx->internal);

         av_freep(&p->avctx);

     }

@@ -678,6 +690,7 @@

         copy->internal = av_malloc(sizeof(AVCodecInternal));

         if (!copy->internal) {

+            copy->priv_data = NULL;

             err = AVERROR(ENOMEM);

             goto error;

         }

​

@@ -54,7 +54,7 @@

     if (ret < 0)

         return ret;

-    if ((ret = ff_alloc_packet2(avctx, pkt, ret)) < 0)

+    if ((ret = ff_alloc_packet(pkt, ret)) < 0)

         return ret;

     if ((ret = avpicture_layout((const AVPicture *)frame, avctx->pix_fmt, avctx->width,

                                 avctx->height, pkt->data, pkt->size)) < 0)

​

@@ -1534,7 +1534,14 @@

     if (avctx->internal->is_copy) {

         r->tmp_b_block_base = NULL;

+        r->cbp_chroma       = NULL;

+        r->cbp_luma         = NULL;

+        r->deblock_coefs    = NULL;

+        r->intra_types_hist = NULL;

+        r->mb_type          = NULL;

+

         ff_mpv_idct_init(&r->s);

+

         if ((err = ff_mpv_common_init(&r->s)) < 0)

             return err;

         if ((err = rv34_decoder_alloc(r)) < 0) {

​

@@ -85,10 +85,6 @@

         case 8:

             avctx->channel_layout = AV_CH_LAYOUT_5POINT1_BACK | AV_CH_LAYOUT_STEREO_DOWNMIX;

     }

-    avctx->bit_rate    = 48000 * avctx->channels * (avctx->bits_per_raw_sample + 4) +

-                         32 * (48000 / (buf_size * 8 /

-                                        (avctx->channels *

-                                         (avctx->bits_per_raw_sample + 4))));

     return frame_size;

 }

@@ -117,6 +113,8 @@

     if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)

         return ret;

+    avctx->bit_rate = 48000 * avctx->channels * (avctx->bits_per_raw_sample + 4) +

+                      32 * 48000 / frame->nb_samples;

     buf_size = (frame->nb_samples * avctx->channels / 2) * block_size;

     if (avctx->bits_per_raw_sample == 24) {

​

@@ -457,6 +457,7 @@

     ctx->frm0_size =

     ctx->frm1_size =

     ctx->frm2_size = 0;

+    init_sizes(ctx, 0, 0);

 }

 static av_cold int init_buffers(SANMVideoContext *ctx)

​

@@ -137,6 +137,7 @@

 struct SpectralBandReplication {

     int                sample_rate;

     int                start;

+    int                id_aac;

     int                reset;

     SpectrumParameters spectrum_params;

     int                bs_amp_res_header;

​

@@ -304,6 +304,8 @@

     BlockNode *lb= lt+b_stride;

     BlockNode *rb= lb+1;

     uint8_t *block[4];

+    // When src_stride is large enough, it is possible to interleave the blocks.

+    // Otherwise the blocks are written sequentially in the tmp buffer.

     int tmp_step= src_stride >= 7*MB_SIZE ? MB_SIZE : MB_SIZE*src_stride;

     uint8_t *tmp = s->scratchbuf;

     uint8_t *ptmp;

@@ -347,8 +349,6 @@

     if(b_w<=0 || b_h<=0) return;

-    av_assert2(src_stride > 2*MB_SIZE + 5);

-

     if(!sliced && offset_dst)

         dst += src_x + src_y*dst_stride;

     dst8+= src_x + src_y*src_stride;

​

@@ -428,10 +428,12 @@

     *width  = FFALIGN(*width, w_align);

     *height = FFALIGN(*height, h_align);

-    if (s->codec_id == AV_CODEC_ID_H264 || s->lowres)

+    if (s->codec_id == AV_CODEC_ID_H264 || s->lowres) {

         // some of the optimized chroma MC reads one line too much

         // which is also done in mpeg decoders with lowres > 0

         *height += 2;

+        *width = FFMAX(*width, 32);

+    }

     for (i = 0; i < 4; i++)

         linesize_align[i] = STRIDE_ALIGN;

​

@@ -162,7 +162,8 @@

     unsigned int i, n = 0;

     for (i = 0; i < ref_count; i++)

         if (ref_list[i].reference)

-            fill_vaapi_pic(&RefPicList[n++], ref_list[i].parent, 0);

+            fill_vaapi_pic(&RefPicList[n++], ref_list[i].parent,

+                           ref_list[i].reference);

     for (; n < 32; n++)

         init_vaapi_pic(&RefPicList[n]);

​

@@ -469,7 +469,7 @@

         count = avctx->extradata_size*8 - get_bits_count(&gb);

         if (count > 0) {

             av_log(avctx, AV_LOG_INFO, "Extra data: %i bits left, value: %X\n",

-                   count, get_bits(&gb, count));

+                   count, get_bits_long(&gb, FFMIN(count, 32)));

         } else if (count < 0) {

             av_log(avctx, AV_LOG_INFO, "Read %i bits in overflow\n", -count);

         }

​

@@ -639,6 +639,11 @@

     int width  = s->avctx->width;

     int height = s->avctx->height;

+    if (buf_size < 3) {

+        av_log(s->avctx, AV_LOG_ERROR, "Insufficent data (%d) for header\n", buf_size);

+        return AVERROR_INVALIDDATA;

+    }

+

     s->keyframe  = !(buf[0] & 1);

     s->profile   =  (buf[0]>>1) & 7;

     s->invisible = !(buf[0] & 0x10);

@@ -2689,6 +2694,9 @@

     VP8Context *s = avctx->priv_data;

     int i;

+    if (!s)

+        return 0;

+

     vp8_decode_flush_impl(avctx, 1);

     for (i = 0; i < FF_ARRAY_ELEMS(s->frames); i++)

         av_frame_free(&s->frames[i].tf.f);

​

@@ -425,7 +425,7 @@

 // differential forward probability updates

 static int update_prob(VP56RangeCoder *c, int p)

 {

-    static const int inv_map_table[254] = {

+    static const int inv_map_table[255] = {

           7,  20,  33,  46,  59,  72,  85,  98, 111, 124, 137, 150, 163, 176,

         189, 202, 215, 228, 241, 254,   1,   2,   3,   4,   5,   6,   8,   9,

          10,  11,  12,  13,  14,  15,  16,  17,  18,  19,  21,  22,  23,  24,

@@ -444,7 +444,7 @@

         207, 208, 209, 210, 211, 212, 213, 214, 216, 217, 218, 219, 220, 221,

         222, 223, 224, 225, 226, 227, 229, 230, 231, 232, 233, 234, 235, 236,

         237, 238, 239, 240, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251,

-        252, 253,

+        252, 253, 253,

     };

     int d;

@@ -474,6 +474,7 @@

         if (d >= 65)

             d = (d << 1) - 65 + vp8_rac_get(c);

         d += 64;

+        av_assert2(d < FF_ARRAY_ELEMS(inv_map_table));

     }

     return p <= 128 ? 1 + inv_recenter_nonneg(inv_map_table[d], p - 1) :

​

@@ -155,7 +155,7 @@

             if (t >= 2) {

                 if (get_bits_left(gb) < t - 1)

                     goto error;

-                t = get_bits(gb, t - 1) | (1 << (t - 1));

+                t = get_bits_long(gb, t - 1) | (1 << (t - 1));

             } else {

                 if (get_bits_left(gb) < 0)

                     goto error;

@@ -186,7 +186,7 @@

             } else {

                 if (get_bits_left(gb) < t2 - 1)

                     goto error;

-                t += get_bits(gb, t2 - 1) | (1 << (t2 - 1));

+                t += get_bits_long(gb, t2 - 1) | (1 << (t2 - 1));

             }

         }

@@ -271,7 +271,7 @@

         if (s->got_extra_bits &&

             get_bits_left(&s->gb_extra_bits) >= s->extra_bits) {

-            S   |= get_bits(&s->gb_extra_bits, s->extra_bits);

+            S   |= get_bits_long(&s->gb_extra_bits, s->extra_bits);

             *crc = *crc * 9 + (S & 0xffff) * 3 + ((unsigned)S >> 16);

         }

     }

@@ -835,7 +835,11 @@

                 continue;

             }

             bytestream2_get_buffer(&gb, val, 4);

-            if (val[0]) {

+            if (val[0] > 32) {

+                av_log(avctx, AV_LOG_ERROR,

+                       "Invalid INT32INFO, extra_bits = %d (> 32)\n", val[0]);

+                continue;

+            } else if (val[0]) {

                 s->extra_bits = val[0];

             } else if (val[1]) {

                 s->shift = val[1];

​

@@ -1387,7 +1387,7 @@

     }

     av_dict_free(&s->exif_metadata);

-    while (bytestream2_get_bytes_left(&gb) > 0) {

+    while (bytestream2_get_bytes_left(&gb) > 8) {

         char chunk_str[5] = { 0 };

         chunk_type = bytestream2_get_le32(&gb);

​

@@ -488,7 +488,7 @@

                 if ((1 << cbits) < s->cdlms[c][i].scaling + 1)

                     cbits++;

-                s->cdlms[c][i].bitsend = get_bits(&s->gb, cbits) + 2;

+                s->cdlms[c][i].bitsend = (cbits ? get_bits(&s->gb, cbits) : 0) + 2;

                 shift_l = 32 - s->cdlms[c][i].bitsend;

                 shift_r = 32 - s->cdlms[c][i].scaling - 2;

                 for (j = 0; j < s->cdlms[c][i].coefsend; j++)

@@ -1005,6 +1005,7 @@

     if ((ret = ff_get_buffer(s->avctx, s->frame, 0)) < 0) {

         /* return an error if no frame could be decoded at all */

         s->packet_loss = 1;

+        s->frame->nb_samples = 0;

         return ret;

     }

     for (i = 0; i < s->num_channels; i++) {

​

@@ -1982,7 +1982,14 @@

                     *got_frame_ptr) {

                     cnt += s->spillover_nbits;

                     s->skip_bits_next = cnt & 7;

-                    return cnt >> 3;

+                    res = cnt >> 3;

+                    if (res > avpkt->size) {

+                        av_log(ctx, AV_LOG_ERROR,

+                               "Trying to skip %d bytes in packet of size %d\n",

+                               res, avpkt->size);

+                        return AVERROR_INVALIDDATA;

+                    }

+                    return res;

                 } else

                     skip_bits_long (gb, s->spillover_nbits - cnt +

                                     get_bits_count(gb)); // resync

@@ -2001,7 +2008,14 @@

     } else if (*got_frame_ptr) {

         int cnt = get_bits_count(gb);

         s->skip_bits_next = cnt & 7;

-        return cnt >> 3;

+        res = cnt >> 3;

+        if (res > avpkt->size) {

+            av_log(ctx, AV_LOG_ERROR,

+                   "Trying to skip %d bytes in packet of size %d\n",

+                   res, avpkt->size);

+            return AVERROR_INVALIDDATA;

+        }

+        return res;

     } else if ((s->sframe_cache_size = pos) > 0) {

         /* rewind bit reader to start of last (incomplete) superframe... */

         init_get_bits(gb, avpkt->data, size << 3);

​

@@ -87,15 +87,24 @@

     AVFilterLink *inlink  = ctx->inputs[0];

     AVFilterLink *outlink = ctx->outputs[0];

-    AVFilterFormats        *in_formats      = ff_all_formats(AVMEDIA_TYPE_AUDIO);

-    AVFilterFormats        *out_formats;

-    AVFilterFormats        *in_samplerates  = ff_all_samplerates();

-    AVFilterFormats        *out_samplerates;

-    AVFilterChannelLayouts *in_layouts      = ff_all_channel_counts();

-    AVFilterChannelLayouts *out_layouts;

+    AVFilterFormats        *in_formats, *out_formats;

+    AVFilterFormats        *in_samplerates, *out_samplerates;

+    AVFilterChannelLayouts *in_layouts, *out_layouts;

+

+    in_formats      = ff_all_formats(AVMEDIA_TYPE_AUDIO);

+    if (!in_formats)

+        return AVERROR(ENOMEM);

     ff_formats_ref  (in_formats,      &inlink->out_formats);

+

+    in_samplerates  = ff_all_samplerates();

+    if (!in_samplerates)

+        return AVERROR(ENOMEM);

     ff_formats_ref  (in_samplerates,  &inlink->out_samplerates);

+

+    in_layouts      = ff_all_channel_counts();

+    if (!in_layouts)

+         return AVERROR(ENOMEM);

     ff_channel_layouts_ref(in_layouts,      &inlink->out_channel_layouts);

     if(out_rate > 0) {

​

@@ -151,7 +151,7 @@

         int hsub    = plane == 1 || plane == 2 ? trans->hsub : 0;

         int vsub    = plane == 1 || plane == 2 ? trans->vsub : 0;

         int pixstep = trans->pixsteps[plane];

-        int inh     = in->height  >> vsub;

+        int inh     = FF_CEIL_RSHIFT(in->height, vsub);

         int outw    = FF_CEIL_RSHIFT(out->width,  hsub);

         int outh    = FF_CEIL_RSHIFT(out->height, vsub);

         int start   = (outh *  jobnr   ) / nb_jobs;

​

@@ -3964,6 +3964,9 @@

         AVStream *st = s->streams[i];

         MOVStreamContext *sc = st->priv_data;

+        if (!sc)

+            continue;

+

         av_freep(&sc->ctts_data);

         for (j = 0; j < sc->drefs_count; j++) {

             av_freep(&sc->drefs[j].path);

​

@@ -1005,6 +1005,9 @@

         AV_WL32(dst+4, skip_end);

     }

+    if (avio_tell(bc) >= maxpos)

+        return AVERROR_INVALIDDATA;

+

     return 0;

 }

​