Request 222 (accepted)

ffmpeg.changes Changed

ffmpeg.spec Changed

ffmpeg-0.10.2.tar.bz2/Changelog -> ffmpeg-0.10.3.tar.bz2/Changelog Changed

ffmpeg-0.10.2.tar.bz2/Doxyfile -> ffmpeg-0.10.3.tar.bz2/Doxyfile Changed

ffmpeg-0.10.2.tar.bz2/RELEASE -> ffmpeg-0.10.3.tar.bz2/RELEASE Changed

ffmpeg-0.10.2.tar.bz2/VERSION -> ffmpeg-0.10.3.tar.bz2/VERSION Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/aacps.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/aacps.c Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/apedec.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/apedec.c Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/bytestream.h -> ffmpeg-0.10.3.tar.bz2/libavcodec/bytestream.h Changed

@@ -1,6 +1,7 @@
 /*
  * Bytestream functions
  * copyright (c) 2006 Baptiste Coudurier <baptiste.coudurier@free.fr>
+ * Copyright (c) 2012 Aneesh Dogra (lionaneesh) <lionaneesh@gmail.com>
  *
  * This file is part of FFmpeg.
  *
@@ -23,6 +24,7 @@
 #define AVCODEC_BYTESTREAM_H
 
 #include <string.h>
+
 #include "libavutil/common.h"
 #include "libavutil/intreadwrite.h"
 
@@ -30,35 +32,57 @@
     const uint8_t *buffer, *buffer_end, *buffer_start;
 } GetByteContext;
 
-#define DEF_T(type, name, bytes, read, write)                             \
-static av_always_inline type bytestream_get_ ## name(const uint8_t **b){\
-    (*b) += bytes;\
-    return read(*b - bytes);\
-}\
-static av_always_inline void bytestream_put_ ##name(uint8_t **b, const type value){\
-    write(*b, value);\
-    (*b) += bytes;\
-}\
-static av_always_inline type bytestream2_get_ ## name ## u(GetByteContext *g)\
-{\
-    return bytestream_get_ ## name(&g->buffer);\
-}\
-static av_always_inline type bytestream2_get_ ## name(GetByteContext *g)\
-{\
-    if (g->buffer_end - g->buffer < bytes)\
-        return 0;\
-    return bytestream2_get_ ## name ## u(g);\
-}\
-static av_always_inline type bytestream2_peek_ ## name(GetByteContext *g)\
-{\
-    if (g->buffer_end - g->buffer < bytes)\
-        return 0;\
-    return read(g->buffer);\
-}
-
-#define DEF(name, bytes, read, write) \
+typedef struct {
+    uint8_t *buffer, *buffer_end, *buffer_start;
+    int eof;
+} PutByteContext;
+
+#define DEF_T(type, name, bytes, read, write)                                  \
+static av_always_inline type bytestream_get_ ## name(const uint8_t **b)        \
+{                                                                              \
+    (*b) += bytes;                                                             \
+    return read(*b - bytes);                                                   \
+}                                                                              \
+static av_always_inline void bytestream_put_ ## name(uint8_t **b,              \
+                                                     const type value)         \
+{                                                                              \
+    write(*b, value);                                                          \
+    (*b) += bytes;                                                             \
+}                                                                              \
+static av_always_inline void bytestream2_put_ ## name ## u(PutByteContext *p,  \
+                                                           const type value)   \
+{                                                                              \
+    bytestream_put_ ## name(&p->buffer, value);                                \
+}                                                                              \
+static av_always_inline void bytestream2_put_ ## name(PutByteContext *p,       \
+                                                      const type value)        \
+{                                                                              \
+    if (!p->eof && (p->buffer_end - p->buffer >= bytes)) {                     \
+        write(p->buffer, value);                                               \
+        p->buffer += bytes;                                                    \
+    } else                                                                     \
+        p->eof = 1;                                                            \
+}                                                                              \
+static av_always_inline type bytestream2_get_ ## name ## u(GetByteContext *g)  \
+{                                                                              \
+    return bytestream_get_ ## name(&g->buffer);                                \
+}                                                                              \
+static av_always_inline type bytestream2_get_ ## name(GetByteContext *g)       \
+{                                                                              \
+    if (g->buffer_end - g->buffer < bytes)                                     \
+        return 0;                                                              \
+    return bytestream2_get_ ## name ## u(g);                                   \
+}                                                                              \
+static av_always_inline type bytestream2_peek_ ## name(GetByteContext *g)      \
+{                                                                              \
+    if (g->buffer_end - g->buffer < bytes)                                     \
+        return 0;                                                              \
+    return read(g->buffer);                                                    \
+}
+
+#define DEF(name, bytes, read, write)                                          \
     DEF_T(unsigned int, name, bytes, read, write)
-#define DEF64(name, bytes, read, write) \
+#define DEF64(name, bytes, read, write)                                        \
     DEF_T(uint64_t, name, bytes, read, write)
 
 DEF64(le64, 8, AV_RL64, AV_WL64)
@@ -112,11 +136,22 @@
 #endif
 
 static av_always_inline void bytestream2_init(GetByteContext *g,
-                                              const uint8_t *buf, int buf_size)
+                                              const uint8_t *buf,
+                                              int buf_size)
 {
-    g->buffer =  buf;
+    g->buffer       = buf;
     g->buffer_start = buf;
-    g->buffer_end = buf + buf_size;
+    g->buffer_end   = buf + buf_size;
+}
+
+static av_always_inline void bytestream2_init_writer(PutByteContext *p,
+                                                     uint8_t *buf,
+                                                     int buf_size)
+{
+    p->buffer       = buf;
+    p->buffer_start = buf;
+    p->buffer_end   = buf + buf_size;
+    p->eof          = 0;
 }
 
 static av_always_inline unsigned int bytestream2_get_bytes_left(GetByteContext *g)
@@ -124,32 +159,61 @@
     return g->buffer_end - g->buffer;
 }
 
+static av_always_inline unsigned int bytestream2_get_bytes_left_p(PutByteContext *p)
+{
+    return p->buffer_end - p->buffer;
+}
+
 static av_always_inline void bytestream2_skip(GetByteContext *g,
                                               unsigned int size)
 {
     g->buffer += FFMIN(g->buffer_end - g->buffer, size);
 }
 
+static av_always_inline void bytestream2_skipu(GetByteContext *g,
+                                               unsigned int size)
+{
+    g->buffer += size;
+}
+
+static av_always_inline void bytestream2_skip_p(PutByteContext *p,
+                                                unsigned int size)
+{
+    int size2;
+    if (p->eof)
+        return;
+    size2 = FFMIN(p->buffer_end - p->buffer, size);
+    if (size2 != size)
+        p->eof = 1;
+    p->buffer += size2;
+}
+
 static av_always_inline int bytestream2_tell(GetByteContext *g)
 {
     return (int)(g->buffer - g->buffer_start);
 }
 
-static av_always_inline int bytestream2_seek(GetByteContext *g, int offset,
+static av_always_inline int bytestream2_tell_p(PutByteContext *p)
+{
+    return (int)(p->buffer - p->buffer_start);
+}
+
+static av_always_inline int bytestream2_seek(GetByteContext *g,
+                                             int offset,
                                              int whence)
 {
     switch (whence) {
     case SEEK_CUR:
-        offset = av_clip(offset, -(g->buffer - g->buffer_start),
-                         g->buffer_end - g->buffer);
+        offset     = av_clip(offset, -(g->buffer - g->buffer_start),
+                             g->buffer_end - g->buffer);
         g->buffer += offset;
         break;
     case SEEK_END:
-        offset = av_clip(offset, -(g->buffer_end - g->buffer_start), 0);
+        offset    = av_clip(offset, -(g->buffer_end - g->buffer_start), 0);
         g->buffer = g->buffer_end + offset;
         break;
     case SEEK_SET:
-        offset = av_clip(offset, 0, g->buffer_end - g->buffer_start);
+        offset    = av_clip(offset, 0, g->buffer_end - g->buffer_start);
         g->buffer = g->buffer_start + offset;
         break;
     default:
@@ -158,6 +222,37 @@
     return bytestream2_tell(g);
 }
 
+static av_always_inline int bytestream2_seek_p(PutByteContext *p,
+                                               int offset,
+                                               int whence)
+{
+    p->eof = 0;
+    switch (whence) {
+    case SEEK_CUR:
+        if (p->buffer_end - p->buffer < offset)
+            p->eof = 1;
+        offset     = av_clip(offset, -(p->buffer - p->buffer_start),
+                             p->buffer_end - p->buffer);
+        p->buffer += offset;
+        break;
+    case SEEK_END:
+        if (offset > 0)
+            p->eof = 1;
+        offset    = av_clip(offset, -(p->buffer_end - p->buffer_start), 0);
+        p->buffer = p->buffer_end + offset;
+        break;
+    case SEEK_SET:
+        if (p->buffer_end - p->buffer_start < offset)
+            p->eof = 1;
+        offset    = av_clip(offset, 0, p->buffer_end - p->buffer_start);
+        p->buffer = p->buffer_start + offset;
+        break;
+    default:
+        return AVERROR(EINVAL);
+    }
+    return bytestream2_tell_p(p);
+}
+
 static av_always_inline unsigned int bytestream2_get_buffer(GetByteContext *g,
                                                             uint8_t *dst,
                                                             unsigned int size)
@@ -168,14 +263,78 @@
     return size2;
 }
 
-static av_always_inline unsigned int bytestream_get_buffer(const uint8_t **b, uint8_t *dst, unsigned int size)
+static av_always_inline unsigned int bytestream2_get_bufferu(GetByteContext *g,
+                                                             uint8_t *dst,
+                                                             unsigned int size)
+{
+    memcpy(dst, g->buffer, size);
+    g->buffer += size;
+    return size;
+}
+
+static av_always_inline unsigned int bytestream2_put_buffer(PutByteContext *p,
+                                                            const uint8_t *src,
+                                                            unsigned int size)
+{
+    int size2;
+    if (p->eof)
+        return 0;
+    size2 = FFMIN(p->buffer_end - p->buffer, size);
+    if (size2 != size)
+        p->eof = 1;
+    memcpy(p->buffer, src, size2);
+    p->buffer += size2;
+    return size2;
+}
+
+static av_always_inline unsigned int bytestream2_put_bufferu(PutByteContext *p,
+                                                             const uint8_t *src,
+                                                             unsigned int size)
+{
+    memcpy(p->buffer, src, size);
+    p->buffer += size;
+    return size;
+}
+
+static av_always_inline void bytestream2_set_buffer(PutByteContext *p,
+                                                    const uint8_t c,
+                                                    unsigned int size)
+{
+    int size2;
+    if (p->eof)
+        return;
+    size2 = FFMIN(p->buffer_end - p->buffer, size);
+    if (size2 != size)
+        p->eof = 1;
+    memset(p->buffer, c, size2);
+    p->buffer += size2;
+}
+
+static av_always_inline void bytestream2_set_bufferu(PutByteContext *p,
+                                                     const uint8_t c,
+                                                     unsigned int size)
+{
+    memset(p->buffer, c, size);
+    p->buffer += size;
+}
+
+static av_always_inline unsigned int bytestream2_get_eof(PutByteContext *p)
+{
+    return p->eof;
+}
+
+static av_always_inline unsigned int bytestream_get_buffer(const uint8_t **b,
+                                                           uint8_t *dst,
+                                                           unsigned int size)
 {
     memcpy(dst, *b, size);
     (*b) += size;
     return size;
 }
 
-static av_always_inline void bytestream_put_buffer(uint8_t **b, const uint8_t *src, unsigned int size)
+static av_always_inline void bytestream_put_buffer(uint8_t **b,
+                                                   const uint8_t *src,
+                                                   unsigned int size)
 {
     memcpy(*b, src, size);
     (*b) += size;

ffmpeg-0.10.2.tar.bz2/libavcodec/celp_filters.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/celp_filters.c Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/cook.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/cook.c Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/h261dec.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/h261dec.c Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/h263dec.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/h263dec.c Changed

@@ -444,6 +444,13 @@
     if (ret < 0){
         av_log(s->avctx, AV_LOG_ERROR, "header damaged\n");
         return -1;
+    } else if ((s->width  != avctx->coded_width  ||
+                s->height != avctx->coded_height ||
+                (s->width  + 15) >> 4 != s->mb_width ||
+                (s->height + 15) >> 4 != s->mb_height) &&
+               (HAVE_THREADS && (s->avctx->active_thread_type & FF_THREAD_FRAME))) {
+        av_log_missing_feature(s->avctx, "Width/height/bit depth/chroma idc changing with threads is", 0);
+        return AVERROR_PATCHWELCOME;   // width / height changed during parallelized decoding
     }
 
     avctx->has_b_frames= !s->low_delay;
@@ -571,7 +578,6 @@
     if (s->codec_id == CODEC_ID_MPEG4 && s->xvid_build>=0 && avctx->idct_algo == FF_IDCT_AUTO && (av_get_cpu_flags() & AV_CPU_FLAG_MMX)) {
         avctx->idct_algo= FF_IDCT_XVIDMMX;
         ff_dct_common_init(s);
-        s->picture_number=0;
     }
 #endif
 
@@ -585,11 +591,6 @@
         /* H.263 could change picture size any time */
         ParseContext pc= s->parse_context; //FIXME move these demuxng hack to avformat
 
-        if (HAVE_THREADS && (s->avctx->active_thread_type&FF_THREAD_FRAME)) {
-            av_log_missing_feature(s->avctx, "Width/height/bit depth/chroma idc changing with threads is", 0);
-            return -1;   // width / height changed during parallelized decoding
-        }
-
         s->parse_context.buffer=0;
         MPV_common_end(s);
         s->parse_context= pc;

ffmpeg-0.10.2.tar.bz2/libavcodec/h264.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/h264.c Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/h264_ps.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/h264_ps.c Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/h264_refs.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/h264_refs.c Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/iff.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/iff.c Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/indeo4.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/indeo4.c Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/lagarith.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/lagarith.c Changed

@@ -247,24 +247,26 @@
 {
     int L, TL;
 
-    /* Left pixel is actually prev_rowwidth */
-    L = bufwidth - stride - 1;
     if (!line) {
         /* Left prediction only for first line */
         L = l->dsp.add_hfyu_left_prediction(buf + 1, buf + 1,
                                             width - 1, buf0);
-        return;
-    } else if (line == 1) {
-        /* Second line, left predict first pixel, the rest of the line is median predicted
-         * NOTE: In the case of RGB this pixel is top predicted */
-        TL = l->avctx->pix_fmt == PIX_FMT_YUV420P ? buf-stride : L;
     } else {
-        /* Top left is 2 rows back, last pixel */
-        TL = bufwidth - (2 * stride) - 1;
-    }
+        /* Left pixel is actually prev_rowwidth */
+        L = bufwidth - stride - 1;
+
+        if (line == 1) {
+            /* Second line, left predict first pixel, the rest of the line is median predicted
+             * NOTE: In the case of RGB this pixel is top predicted */
+            TL = l->avctx->pix_fmt == PIX_FMT_YUV420P ? buf-stride : L;
+        } else {
+            /* Top left is 2 rows back, last pixel */
+            TL = bufwidth - (2 * stride) - 1;
+        }
 
-    add_lag_median_prediction(buf, buf - stride, buf,
-                              width, &L, &TL);
+        add_lag_median_prediction(buf, buf - stride, buf,
+                                  width, &L, &TL);
+    }
 }
 
 static int lag_decode_line(LagarithContext *l, lag_rac *rac,
@@ -310,13 +312,13 @@
 }
 
 static int lag_decode_zero_run_line(LagarithContext *l, uint8_t *dst,
-                                    const uint8_t *src, int width,
-                                    int esc_count)
+                                    const uint8_t *src, const uint8_t *src_end,
+                                    int width, int esc_count)
 {
     int i = 0;
     int count;
     uint8_t zero_run = 0;
-    const uint8_t *start = src;
+    const uint8_t *src_start = src;
     uint8_t mask1 = -(esc_count < 2);
     uint8_t mask2 = -(esc_count < 3);
     uint8_t *end = dst + (width - 2);
@@ -333,6 +335,8 @@
         i = 0;
         while (!zero_run && dst + i < end) {
             i++;
+            if (src + i >= src_end)
+                return AVERROR_INVALIDDATA;
             zero_run =
                 !(srci | (srci + 1 & mask1) | (srci + 2 & mask2));
         }
@@ -348,9 +352,10 @@
         } else {
             memcpy(dst, src, i);
             src += i;
+            dst += i;
         }
     }
-    return start - src;
+    return src_start - src;
 }
 
 
@@ -366,6 +371,7 @@
     int esc_count = src0;
     GetBitContext gb;
     lag_rac rac;
+    const uint8_t *src_end = src + src_size;
 
     rac.avctx = l->avctx;
     l->zeros = 0;
@@ -396,10 +402,16 @@
         esc_count -= 4;
         if (esc_count > 0) {
             /* Zero run coding only, no range coding. */
-            for (i = 0; i < height; i++)
-                src += lag_decode_zero_run_line(l, dst + (i * stride), src,
-                                                width, esc_count);
+            for (i = 0; i < height; i++) {
+                int res = lag_decode_zero_run_line(l, dst + (i * stride), src,
+                                                   src_end, width, esc_count);
+                if (res < 0)
+                    return res;
+                src += res;
+            }
         } else {
+            if (src_size < width * height)
+                return AVERROR_INVALIDDATA; // buffer not big enough
             /* Plane is stored uncompressed */
             for (i = 0; i < height; i++) {
                 memcpy(dst + (i * stride), src, width);
@@ -500,11 +512,19 @@
         }
         for (i = 0; i < 4; i++)
             srcsi = l->rgb_planes + (i + 1) * l->rgb_stride * avctx->height - l->rgb_stride;
+        if (offset_ry >= buf_size ||
+            offset_gu >= buf_size ||
+            offset_bv >= buf_size ||
+            offs3 >= buf_size) {
+            av_log(avctx, AV_LOG_ERROR,
+                    "Invalid frame offsets\n");
+            return AVERROR_INVALIDDATA;
+        }
         for (i = 0; i < 4; i++)
             lag_decode_arith_plane(l, srcsi,
                                    avctx->width, avctx->height,
                                    -l->rgb_stride, buf + offsi,
-                                   buf_size);
+                                   buf_size - offsi);
         dst = p->data0;
         for (i = 0; i < 4; i++)
             srcsi = l->rgb_planes + i * l->rgb_stride * avctx->height;
@@ -576,15 +596,23 @@
             return -1;
         }
 
+        if (offset_ry >= buf_size ||
+            offset_gu >= buf_size ||
+            offset_bv >= buf_size) {
+            av_log(avctx, AV_LOG_ERROR,
+                   "Invalid frame offsets\n");
+            return AVERROR_INVALIDDATA;
+        }
+
         lag_decode_arith_plane(l, p->data0, avctx->width, avctx->height,
                                p->linesize0, buf + offset_ry,
-                               buf_size);
+                               buf_size - offset_ry);
         lag_decode_arith_plane(l, p->data2, avctx->width / 2,
                                avctx->height / 2, p->linesize2,
-                               buf + offset_gu, buf_size);
+                               buf + offset_gu, buf_size - offset_gu);
         lag_decode_arith_plane(l, p->data1, avctx->width / 2,
                                avctx->height / 2, p->linesize1,
-                               buf + offset_bv, buf_size);
+                               buf + offset_bv, buf_size - offset_bv);
         break;
     default:
         av_log(avctx, AV_LOG_ERROR,

ffmpeg-0.10.2.tar.bz2/libavcodec/lagarithrac.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/lagarithrac.c Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/lzw.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/lzw.c Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/mimic.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/mimic.c Changed

@@ -259,8 +259,8 @@
                         int index = (ctx->cur_index+backref)&15;
                         uint8_t *p = ctx->flipped_ptrsindex.data0;
 
-                        ff_thread_await_progress(&ctx->buf_ptrsindex, cur_row, 0);
-                        if(p) {
+                        if (index != ctx->cur_index && p) {
+                            ff_thread_await_progress(&ctx->buf_ptrsindex, cur_row, 0);
                             p += src -
                                 ctx->flipped_ptrsctx->prev_index.dataplane;
                             ctx->dsp.put_pixels_tab10(dst, p, stride, 8);
@@ -310,6 +310,7 @@
     int width, height;
     int quality, num_coeffs;
     int swap_buf_size = buf_size - MIMIC_HEADER_SIZE;
+    int res;
 
     if(buf_size < MIMIC_HEADER_SIZE) {
         av_log(avctx, AV_LOG_ERROR, "insufficient data\n");
@@ -376,10 +377,10 @@
                         swap_buf_size>>2);
     init_get_bits(&ctx->gb, ctx->swap_buf, swap_buf_size << 3);
 
-    if(!decode(ctx, quality, num_coeffs, !is_pframe)) {
-        if (avctx->active_thread_type&FF_THREAD_FRAME)
-            ff_thread_report_progress(&ctx->buf_ptrsctx->cur_index, INT_MAX, 0);
-        else {
+    res = decode(ctx, quality, num_coeffs, !is_pframe);
+    ff_thread_report_progress(&ctx->buf_ptrsctx->cur_index, INT_MAX, 0);
+    if (!res) {
+        if (!(avctx->active_thread_type & FF_THREAD_FRAME)) {
             ff_thread_release_buffer(avctx, &ctx->buf_ptrsctx->cur_index);
             return -1;
         }

ffmpeg-0.10.2.tar.bz2/libavcodec/mjpegdec.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/mjpegdec.c Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/motionpixels.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/motionpixels.c Changed

@@ -191,10 +191,13 @@
             p = mp_get_yuv_from_rgb(mp, x - 1, y);
         } else {
             p.y += mp_gradient(mp, 0, mp_get_vlc(mp, gb));
+            p.y = av_clip(p.y, 0, 31);
             if ((x & 3) == 0) {
                 if ((y & 3) == 0) {
                     p.v += mp_gradient(mp, 1, mp_get_vlc(mp, gb));
+                    p.v = av_clip(p.v, -32, 31);
                     p.u += mp_gradient(mp, 2, mp_get_vlc(mp, gb));
+                    p.u = av_clip(p.u, -32, 31);
                     mp->hpt((y / 4) * mp->avctx->width + x) / 4 = p;
                 } else {
                     p.v = mp->hpt((y / 4) * mp->avctx->width + x) / 4.v;
@@ -218,9 +221,12 @@
             p = mp_get_yuv_from_rgb(mp, 0, y);
         } else {
             p.y += mp_gradient(mp, 0, mp_get_vlc(mp, gb));
+            p.y = av_clip(p.y, 0, 31);
             if ((y & 3) == 0) {
                 p.v += mp_gradient(mp, 1, mp_get_vlc(mp, gb));
+                p.v = av_clip(p.v, -32, 31);
                 p.u += mp_gradient(mp, 2, mp_get_vlc(mp, gb));
+                p.u = av_clip(p.u, -32, 31);
             }
             mp->vpty = p;
             mp_set_rgb_from_yuv(mp, 0, y, &p);

ffmpeg-0.10.2.tar.bz2/libavcodec/mpegvideo.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/mpegvideo.c Changed

@@ -422,12 +422,12 @@
     // edge emu needs blocksize + filter length - 1
     // (= 17x17 for  halfpel / 21x21 for  h264)
     FF_ALLOCZ_OR_GOTO(s->avctx, s->edge_emu_buffer,
-                      (s->width + 64) * 2 * 21 * 2, fail);    // (width + edge + align)*interlaced*MBsize*tolerance
+                      (s->width + 95) * 2 * 21 * 4, fail);    // (width + edge + align)*interlaced*MBsize*tolerance
 
     // FIXME should be linesize instead of s->width * 2
     // but that is not known before get_buffer()
     FF_ALLOCZ_OR_GOTO(s->avctx, s->me.scratchpad,
-                      (s->width + 64) * 4 * 16 * 2 * sizeof(uint8_t), fail)
+                      (s->width + 95) * 4 * 16 * 2 * sizeof(uint8_t), fail)
     s->me.temp         = s->me.scratchpad;
     s->rd_scratchpad   = s->me.scratchpad;
     s->b_scratchpad    = s->me.scratchpad;
@@ -1394,8 +1394,7 @@
     s->avctx->coded_frame = (AVFrame *) s->current_picture_ptr;
 
     if (s->codec_id != CODEC_ID_H264 && s->current_picture.f.reference) {
-        ff_thread_report_progress((AVFrame *) s->current_picture_ptr,
-                                  s->mb_height - 1, 0);
+        ff_thread_report_progress((AVFrame *) s->current_picture_ptr, INT_MAX, 0);
     }
 }

ffmpeg-0.10.2.tar.bz2/libavcodec/pngenc.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/pngenc.c Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/rawdec.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/rawdec.c Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/smacker.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/smacker.c Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/truemotion2.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/truemotion2.c Changed

@@ -25,6 +25,7 @@
  */
 
 #include "avcodec.h"
+#include "bytestream.h"
 #include "get_bits.h"
 #include "dsputil.h"
 
@@ -59,7 +60,9 @@
     int *clast;
 
     /* data for current and previous frame */
+    int *Y1_base, *U1_base, *V1_base, *Y2_base, *U2_base, *V2_base;
     int *Y1, *U1, *V1, *Y2, *U2, *V2;
+    int y_stride, uv_stride;
     int cur;
 } TM2Context;
 
@@ -130,7 +133,7 @@
 
     /* check for correct codes parameters */
     if((huff.val_bits < 1) || (huff.val_bits > 32) ||
-       (huff.max_bits < 0) || (huff.max_bits > 32)) {
+       (huff.max_bits < 0) || (huff.max_bits > 25)) {
         av_log(ctx->avctx, AV_LOG_ERROR, "Incorrect tree parameters - literal length: %i, max code length: %i\n",
                huff.val_bits, huff.max_bits);
         return -1;
@@ -251,13 +254,14 @@
 static int tm2_read_stream(TM2Context *ctx, const uint8_t *buf, int stream_id, int buf_size)
 {
     int i;
-    int cur = 0;
     int skip = 0;
-    int len, toks;
+    int len, toks, pos;
     TM2Codes codes;
+    GetByteContext gb;
 
     /* get stream length in dwords */
-    len = AV_RB32(buf); buf += 4; cur += 4;
+    bytestream2_init(&gb, buf, buf_size);
+    len  = bytestream2_get_be32(&gb);
     skip = len * 4 + 4;
 
     if(len == 0)
@@ -268,36 +272,37 @@
         return -1;
     }
 
-    toks = AV_RB32(buf); buf += 4; cur += 4;
+    toks = bytestream2_get_be32(&gb);
     if(toks & 1) {
-        len = AV_RB32(buf); buf += 4; cur += 4;
+        len = bytestream2_get_be32(&gb);
         if(len == TM2_ESCAPE) {
-            len = AV_RB32(buf); buf += 4; cur += 4;
+            len = bytestream2_get_be32(&gb);
         }
         if(len > 0) {
-            if (skip <= cur)
+            pos = bytestream2_tell(&gb);
+            if (skip <= pos)
                 return -1;
-            init_get_bits(&ctx->gb, buf, (skip - cur) * 8);
+            init_get_bits(&ctx->gb, buf + pos, (skip - pos) * 8);
             if(tm2_read_deltas(ctx, stream_id) == -1)
                 return -1;
-            buf += ((get_bits_count(&ctx->gb) + 31) >> 5) << 2;
-            cur += ((get_bits_count(&ctx->gb) + 31) >> 5) << 2;
+            bytestream2_skip(&gb, ((get_bits_count(&ctx->gb) + 31) >> 5) << 2);
         }
     }
     /* skip unused fields */
-    if(AV_RB32(buf) == TM2_ESCAPE) {
-        buf += 4; cur += 4; /* some unknown length - could be escaped too */
+    len = bytestream2_get_be32(&gb);
+    if(len == TM2_ESCAPE) { /* some unknown length - could be escaped too */
+        bytestream2_skip(&gb, 8); /* unused by decoder */
+    } else {
+        bytestream2_skip(&gb, 4); /* unused by decoder */
     }
-    buf += 4; cur += 4;
-    buf += 4; cur += 4; /* unused by decoder */
 
-    if (skip <= cur)
+    pos = bytestream2_tell(&gb);
+    if (skip <= pos)
         return -1;
-    init_get_bits(&ctx->gb, buf, (skip - cur) * 8);
+    init_get_bits(&ctx->gb, buf + pos, (skip - pos) * 8);
     if(tm2_build_huff_table(ctx, &codes) == -1)
         return -1;
-    buf += ((get_bits_count(&ctx->gb) + 31) >> 5) << 2;
-    cur += ((get_bits_count(&ctx->gb) + 31) >> 5) << 2;
+    bytestream2_skip(&gb, ((get_bits_count(&ctx->gb) + 31) >> 5) << 2);
 
     toks >>= 1;
     /* check if we have sane number of tokens */
@@ -308,21 +313,33 @@
     }
     ctx->tokensstream_id = av_realloc(ctx->tokensstream_id, toks * sizeof(int));
     ctx->tok_lensstream_id = toks;
-    len = AV_RB32(buf); buf += 4; cur += 4;
+    len = bytestream2_get_be32(&gb);
     if(len > 0) {
-        if (skip <= cur)
+        pos = bytestream2_tell(&gb);
+        if (skip <= pos)
             return -1;
-        init_get_bits(&ctx->gb, buf, (skip - cur) * 8);
+        init_get_bits(&ctx->gb, buf + pos, (skip - pos) * 8);
         for(i = 0; i < toks; i++) {
             if (get_bits_left(&ctx->gb) <= 0) {
                 av_log(ctx->avctx, AV_LOG_ERROR, "Incorrect number of tokens: %i\n", toks);
                 return -1;
             }
             ctx->tokensstream_idi = tm2_get_token(&ctx->gb, &codes);
+            if (stream_id <= TM2_MOT && ctx->tokensstream_idi >= TM2_DELTAS) {
+                av_log(ctx->avctx, AV_LOG_ERROR, "Invalid delta token index %d for type %d, n=%d\n",
+                       ctx->tokensstream_idi, stream_id, i);
+                return AVERROR_INVALIDDATA;
+            }
         }
     } else {
-        for(i = 0; i < toks; i++)
+        for(i = 0; i < toks; i++) {
             ctx->tokensstream_idi = codes.recode0;
+            if (stream_id <= TM2_MOT && ctx->tokensstream_idi >= TM2_DELTAS) {
+                av_log(ctx->avctx, AV_LOG_ERROR, "Invalid delta token index %d for type %d, n=%d\n",
+                       ctx->tokensstream_idi, stream_id, i);
+                return AVERROR_INVALIDDATA;
+            }
+        }
     }
     tm2_free_codes(&codes);
 
@@ -347,9 +364,9 @@
     int *Y, *U, *V;\
     int Ystride, Ustride, Vstride;\
 \
-    Ystride = ctx->avctx->width;\
-    Vstride = (ctx->avctx->width + 1) >> 1;\
-    Ustride = (ctx->avctx->width + 1) >> 1;\
+    Ystride = ctx->y_stride;\
+    Vstride = ctx->uv_stride;\
+    Ustride = ctx->uv_stride;\
     Y = (ctx->cur?ctx->Y2:ctx->Y1) + by * 4 * Ystride + bx * 4;\
     V = (ctx->cur?ctx->V2:ctx->V1) + by * 2 * Vstride + bx * 2;\
     U = (ctx->cur?ctx->U2:ctx->U1) + by * 2 * Ustride + bx * 2;\
@@ -637,6 +654,8 @@
 
     mx = GET_TOK(ctx, TM2_MOT);
     my = GET_TOK(ctx, TM2_MOT);
+    mx = av_clip(mx, -(bx * 4 + 4), ctx->avctx->width  - bx * 4);
+    my = av_clip(my, -(by * 4 + 4), ctx->avctx->height - by * 4);
 
     Yo += my * oYstride + mx;
     Uo += (my >> 1) * oUstride + (mx >> 1);
@@ -677,15 +696,12 @@
 static int tm2_decode_blocks(TM2Context *ctx, AVFrame *p)
 {
     int i, j;
-    int bw, bh;
+    int w = ctx->avctx->width, h = ctx->avctx->height, bw = w >> 2, bh = h >> 2, cw = w >> 1;
     int type;
     int keyframe = 1;
     int *Y, *U, *V;
     uint8_t *dst;
 
-    bw = ctx->avctx->width >> 2;
-    bh = ctx->avctx->height >> 2;
-
     for(i = 0; i < TM2_NUM_STREAMS; i++)
         ctx->tok_ptrsi = 0;
 
@@ -738,17 +754,54 @@
     U = (ctx->cur?ctx->U2:ctx->U1);
     V = (ctx->cur?ctx->V2:ctx->V1);
     dst = p->data0;
-    for(j = 0; j < ctx->avctx->height; j++){
-        for(i = 0; i < ctx->avctx->width; i++){
+    for(j = 0; j < h; j++){
+        for(i = 0; i < w; i++){
             int y = Yi, u = Ui >> 1, v = Vi >> 1;
             dst3*i+0 = av_clip_uint8(y + v);
             dst3*i+1 = av_clip_uint8(y);
             dst3*i+2 = av_clip_uint8(y + u);
         }
-        Y += ctx->avctx->width;
+
+        /* horizontal edge extension */
+        Y-4    = Y-3    = Y-2    = Y-1 = Y0;
+        Yw + 3 = Yw + 2 = Yw + 1 = Yw  = Yw - 1;
+
+        /* vertical edge extension */
+        if (j == 0) {
+            memcpy(Y - 4 - 1 * ctx->y_stride, Y - 4, ctx->y_stride);
+            memcpy(Y - 4 - 2 * ctx->y_stride, Y - 4, ctx->y_stride);
+            memcpy(Y - 4 - 3 * ctx->y_stride, Y - 4, ctx->y_stride);
+            memcpy(Y - 4 - 4 * ctx->y_stride, Y - 4, ctx->y_stride);
+        } else if (j == h - 1) {
+            memcpy(Y - 4 + 1 * ctx->y_stride, Y - 4, ctx->y_stride);
+            memcpy(Y - 4 + 2 * ctx->y_stride, Y - 4, ctx->y_stride);
+            memcpy(Y - 4 + 3 * ctx->y_stride, Y - 4, ctx->y_stride);
+            memcpy(Y - 4 + 4 * ctx->y_stride, Y - 4, ctx->y_stride);
+        }
+
+        Y += ctx->y_stride;
         if (j & 1) {
-            U += ctx->avctx->width >> 1;
-            V += ctx->avctx->width >> 1;
+            /* horizontal edge extension */
+            U-2     = U-1 = U0;
+            V-2     = V-1 = V0;
+            Ucw + 1 = Ucw = Ucw - 1;
+            Vcw + 1 = Vcw = Vcw - 1;
+
+            /* vertical edge extension */
+            if (j == 1) {
+                memcpy(U - 2 - 1 * ctx->uv_stride, U - 2, ctx->uv_stride);
+                memcpy(V - 2 - 1 * ctx->uv_stride, V - 2, ctx->uv_stride);
+                memcpy(U - 2 - 2 * ctx->uv_stride, U - 2, ctx->uv_stride);
+                memcpy(V - 2 - 2 * ctx->uv_stride, V - 2, ctx->uv_stride);
+            } else if (j == h - 1) {
+                memcpy(U - 2 + 1 * ctx->uv_stride, U - 2, ctx->uv_stride);
+                memcpy(V - 2 + 1 * ctx->uv_stride, V - 2, ctx->uv_stride);
+                memcpy(U - 2 + 2 * ctx->uv_stride, U - 2, ctx->uv_stride);
+                memcpy(V - 2 + 2 * ctx->uv_stride, V - 2, ctx->uv_stride);
+            }
+
+            U += ctx->uv_stride;
+            V += ctx->uv_stride;
         }
         dst += p->linesize0;
     }
@@ -765,7 +818,7 @@
                         AVPacket *avpkt)
 {
     const uint8_t *buf = avpkt->data;
-    int buf_size = avpkt->size;
+    int buf_size = avpkt->size & ~3;
     TM2Context * const l = avctx->priv_data;
     AVFrame * const p= (AVFrame*)&l->pic;
     int i, skip, t;
@@ -790,9 +843,12 @@
     }
 
     for(i = 0; i < TM2_NUM_STREAMS; i++){
-        t = tm2_read_stream(l, l->buffer + skip, tm2_stream_orderi, buf_size);
-        if(t == -1){
-            return -1;
+        if (skip >= buf_size) {
+            return AVERROR_INVALIDDATA;
+        }
+        t = tm2_read_stream(l, l->buffer + skip, tm2_stream_orderi, buf_size - skip);
+        if(t < 0){
+            return t;
         }
         skip += t;
     }
@@ -811,7 +867,7 @@
 
 static av_cold int decode_init(AVCodecContext *avctx){
     TM2Context * const l = avctx->priv_data;
-    int i;
+    int i, w = avctx->width, h = avctx->height;
 
     if((avctx->width & 3) || (avctx->height & 3)){
         av_log(avctx, AV_LOG_ERROR, "Width and height must be multiple of 4\n");
@@ -825,21 +881,46 @@
 
     dsputil_init(&l->dsp, avctx);
 
-    l->last = av_malloc(4 * sizeof(int) * (avctx->width >> 2));
-    l->clast = av_malloc(4 * sizeof(int) * (avctx->width >> 2));
+    l->last  = av_malloc(4 * sizeof(*l->last)  * (w >> 2));
+    l->clast = av_malloc(4 * sizeof(*l->clast) * (w >> 2));
 
     for(i = 0; i < TM2_NUM_STREAMS; i++) {
         l->tokensi = NULL;
         l->tok_lensi = 0;
     }
 
-    l->Y1 = av_malloc(sizeof(int) * avctx->width * avctx->height);
-    l->U1 = av_malloc(sizeof(int) * ((avctx->width + 1) >> 1) * ((avctx->height + 1) >> 1));
-    l->V1 = av_malloc(sizeof(int) * ((avctx->width + 1) >> 1) * ((avctx->height + 1) >> 1));
-    l->Y2 = av_malloc(sizeof(int) * avctx->width * avctx->height);
-    l->U2 = av_malloc(sizeof(int) * ((avctx->width + 1) >> 1) * ((avctx->height + 1) >> 1));
-    l->V2 = av_malloc(sizeof(int) * ((avctx->width + 1) >> 1) * ((avctx->height + 1) >> 1));
+    w += 8;
+    h += 8;
+    l->Y1_base = av_malloc(sizeof(*l->Y1_base) * w * h);
+    l->Y2_base = av_malloc(sizeof(*l->Y2_base) * w * h);
+    l->y_stride = w;
+    w = (w + 1) >> 1;
+    h = (h + 1) >> 1;
+    l->U1_base = av_malloc(sizeof(*l->U1_base) * w * h);
+    l->V1_base = av_malloc(sizeof(*l->V1_base) * w * h);
+    l->U2_base = av_malloc(sizeof(*l->U2_base) * w * h);
+    l->V2_base = av_malloc(sizeof(*l->V1_base) * w * h);
+    l->uv_stride = w;
     l->cur = 0;
+    if (!l->Y1_base || !l->Y2_base || !l->U1_base ||
+        !l->V1_base || !l->U2_base || !l->V2_base ||
+        !l->last    || !l->clast) {
+        av_freep(l->Y1_base);
+        av_freep(l->Y2_base);
+        av_freep(l->U1_base);
+        av_freep(l->U2_base);
+        av_freep(l->V1_base);
+        av_freep(l->V2_base);
+        av_freep(l->last);
+        av_freep(l->clast);
+        return AVERROR(ENOMEM);
+    }
+    l->Y1 = l->Y1_base + l->y_stride  * 4 + 4;
+    l->Y2 = l->Y2_base + l->y_stride  * 4 + 4;
+    l->U1 = l->U1_base + l->uv_stride * 2 + 2;
+    l->U2 = l->U2_base + l->uv_stride * 2 + 2;
+    l->V1 = l->V1_base + l->uv_stride * 2 + 2;
+    l->V2 = l->V2_base + l->uv_stride * 2 + 2;
 
     return 0;
 }
@@ -854,12 +935,12 @@
     for(i = 0; i < TM2_NUM_STREAMS; i++)
         av_free(l->tokensi);
     if(l->Y1){
-        av_free(l->Y1);
-        av_free(l->U1);
-        av_free(l->V1);
-        av_free(l->Y2);
-        av_free(l->U2);
-        av_free(l->V2);
+        av_free(l->Y1_base);
+        av_free(l->U1_base);
+        av_free(l->V1_base);
+        av_free(l->Y2_base);
+        av_free(l->U2_base);
+        av_free(l->V2_base);
     }
     av_freep(&l->buffer);
     l->buffer_size = 0;

ffmpeg-0.10.2.tar.bz2/libavcodec/tta.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/tta.c Changed

@@ -32,6 +32,7 @@
 #include <limits.h>
 #include "avcodec.h"
 #include "get_bits.h"
+#include "libavutil/crc.h"
 
 #define FORMAT_SIMPLE    1
 #define FORMAT_ENCRYPTED 2
@@ -58,8 +59,10 @@
     AVCodecContext *avctx;
     AVFrame frame;
     GetBitContext gb;
+    const AVCRC *crc_table;
 
-    int format, channels, bps, data_length;
+    int format, channels, bps;
+    unsigned data_length;
     int frame_length, last_frame_length, total_frames;
 
     int32_t *decode_buffer;
@@ -198,10 +201,23 @@
     AV_CH_LAYOUT_7POINT1_WIDE
 };
 
+static int tta_check_crc(TTAContext *s, const uint8_t *buf, int buf_size)
+{
+    uint32_t crc, CRC;
+
+    CRC = AV_RL32(buf + buf_size);
+    crc = av_crc(s->crc_table, 0xFFFFFFFFU, buf, buf_size);
+    if (CRC != (crc ^ 0xFFFFFFFFU)) {
+        av_log(s->avctx, AV_LOG_ERROR, "CRC error\n");
+        return AVERROR_INVALIDDATA;
+    }
+
+    return 0;
+}
+
 static av_cold int tta_decode_init(AVCodecContext * avctx)
 {
     TTAContext *s = avctx->priv_data;
-    int i;
 
     s->avctx = avctx;
 
@@ -212,8 +228,14 @@
     init_get_bits(&s->gb, avctx->extradata, avctx->extradata_size * 8);
     if (show_bits_long(&s->gb, 32) == AV_RL32("TTA1"))
     {
+        if (avctx->err_recognition & AV_EF_CRCCHECK) {
+            s->crc_table = av_crc_get_table(AV_CRC_32_IEEE_LE);
+            if (tta_check_crc(s, avctx->extradata, 18))
+                return AVERROR_INVALIDDATA;
+        }
+
         /* signature */
-        skip_bits(&s->gb, 32);
+        skip_bits_long(&s->gb, 32);
 
         s->format = get_bits(&s->gb, 16);
         if (s->format > 2) {
@@ -231,7 +253,7 @@
         s->bps = (avctx->bits_per_coded_sample + 7) / 8;
         avctx->sample_rate = get_bits_long(&s->gb, 32);
         s->data_length = get_bits_long(&s->gb, 32);
-        skip_bits(&s->gb, 32); // CRC32 of header
+        skip_bits_long(&s->gb, 32); // CRC32 of header
 
         if (s->channels == 0) {
             av_log(s->avctx, AV_LOG_ERROR, "Invalid number of channels\n");
@@ -258,7 +280,7 @@
         }
 
         // prevent overflow
-        if (avctx->sample_rate > 0x7FFFFF) {
+        if (avctx->sample_rate > 0x7FFFFFu) {
             av_log(avctx, AV_LOG_ERROR, "sample_rate too large\n");
             return AVERROR(EINVAL);
         }
@@ -275,9 +297,15 @@
             s->data_length, s->frame_length, s->last_frame_length, s->total_frames);
 
         // FIXME: seek table
-        for (i = 0; i < s->total_frames; i++)
-            skip_bits(&s->gb, 32);
-        skip_bits(&s->gb, 32); // CRC32 of seektable
+        if (avctx->extradata_size <= 26 || s->total_frames > INT_MAX / 4 ||
+            avctx->extradata_size - 26 < s->total_frames * 4)
+            av_log(avctx, AV_LOG_WARNING, "Seek table missing or too small\n");
+        else if (avctx->err_recognition & AV_EF_CRCCHECK) {
+            if (tta_check_crc(s, avctx->extradata + 22, s->total_frames * 4))
+                return AVERROR_INVALIDDATA;
+        }
+        skip_bits_long(&s->gb, 32 * s->total_frames);
+        skip_bits_long(&s->gb, 32); // CRC32 of seektable
 
         if(s->frame_length >= UINT_MAX / (s->channels * sizeof(int32_t))){
             av_log(avctx, AV_LOG_ERROR, "frame_length too large\n");
@@ -313,6 +341,11 @@
     int cur_chan = 0, framelen = s->frame_length;
     int32_t *p;
 
+    if (avctx->err_recognition & AV_EF_CRCCHECK) {
+        if (buf_size < 4 || tta_check_crc(s, buf, buf_size - 4))
+            return AVERROR_INVALIDDATA;
+    }
+
     init_get_bits(&s->gb, buf, buf_size*8);
 
     // FIXME: seeking
@@ -416,7 +449,7 @@
 
     if (get_bits_left(&s->gb) < 32)
         return -1;
-    skip_bits(&s->gb, 32); // frame crc
+    skip_bits_long(&s->gb, 32); // frame crc
 
         // convert to output buffer
         switch(s->bps) {

ffmpeg-0.10.2.tar.bz2/libavcodec/utvideo.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/utvideo.c Changed

@@ -358,13 +358,12 @@
 {
     const uint8_t *buf = avpkt->data;
     int buf_size = avpkt->size;
-    const uint8_t *buf_end = buf + buf_size;
     UtvideoContext *c = avctx->priv_data;
-    const uint8_t *ptr;
     int i, j;
     const uint8_t *plane_start5;
     int plane_size, max_slice_size = 0, slice_start, slice_end, slice_size;
     int ret;
+    GetByteContext gb;
 
     if (c->pic.data0)
         ff_thread_release_buffer(avctx, &c->pic);
@@ -379,20 +378,21 @@
     ff_thread_finish_setup(avctx);
 
     /* parse plane structure to retrieve frame flags and validate slice offsets */
-    ptr = buf;
+    bytestream2_init(&gb, buf, buf_size);
     for (i = 0; i < c->planes; i++) {
-        plane_starti = ptr;
-        if (buf_end - ptr < 256 + 4 * c->slices) {
+        plane_starti = gb.buffer;
+        if (bytestream2_get_bytes_left(&gb) < 256 + 4 * c->slices) {
             av_log(avctx, AV_LOG_ERROR, "Insufficient data for a plane\n");
             return AVERROR_INVALIDDATA;
         }
-        ptr += 256;
+        bytestream2_skipu(&gb, 256);
         slice_start = 0;
         slice_end   = 0;
         for (j = 0; j < c->slices; j++) {
-            slice_end   = bytestream_get_le32(&ptr);
+            slice_end   = bytestream2_get_le32u(&gb);
             slice_size  = slice_end - slice_start;
-            if (slice_size < 0) {
+            if (slice_end <= 0 || slice_size <= 0 ||
+                bytestream2_get_bytes_left(&gb) < slice_end) {
                 av_log(avctx, AV_LOG_ERROR, "Incorrect slice size\n");
                 return AVERROR_INVALIDDATA;
             }
@@ -400,18 +400,14 @@
             max_slice_size = FFMAX(max_slice_size, slice_size);
         }
         plane_size = slice_end;
-        if (buf_end - ptr < plane_size) {
-            av_log(avctx, AV_LOG_ERROR, "Plane size is bigger than available data\n");
-            return AVERROR_INVALIDDATA;
-        }
-        ptr += plane_size;
+        bytestream2_skipu(&gb, plane_size);
     }
-    plane_startc->planes = ptr;
-    if (buf_end - ptr < c->frame_info_size) {
+    plane_startc->planes = gb.buffer;
+    if (bytestream2_get_bytes_left(&gb) < c->frame_info_size) {
         av_log(avctx, AV_LOG_ERROR, "Not enough data for frame information\n");
         return AVERROR_INVALIDDATA;
     }
-    c->frame_info = AV_RL32(ptr);
+    c->frame_info = bytestream2_get_le32u(&gb);
     av_log(avctx, AV_LOG_DEBUG, "frame information flags %X\n", c->frame_info);
 
     c->frame_pred = (c->frame_info >> 8) & 3;

ffmpeg-0.10.2.tar.bz2/libavcodec/vc1.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/vc1.c Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/vc1data.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/vc1data.c Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/vc1data.h -> ffmpeg-0.10.3.tar.bz2/libavcodec/vc1data.h Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/vc1dec.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/vc1dec.c Changed

@@ -2512,6 +2512,7 @@
     int16_t *dc_val;
     int mb_pos = s->mb_x + s->mb_y * s->mb_stride;
     int q1, q2 = 0;
+    int dqscale_index;
 
     wrap = s->block_wrapn;
     dc_val = s->dc_val0 + s->block_indexn;
@@ -2524,15 +2525,18 @@
     a = dc_val - wrap;
     /* scale predictors if needed */
     q1 = s->current_picture.f.qscale_tablemb_pos;
+    dqscale_index = s->y_dc_scale_tableq1 - 1;
+    if (dqscale_index < 0)
+        return 0;
     if (c_avail && (n != 1 && n != 3)) {
         q2 = s->current_picture.f.qscale_tablemb_pos - 1;
         if (q2 && q2 != q1)
-            c = (c * s->y_dc_scale_tableq2 * ff_vc1_dqscales->y_dc_scale_tableq1 - 1 + 0x20000) >> 18;
+            c = (c * s->y_dc_scale_tableq2 * ff_vc1_dqscaledqscale_index + 0x20000) >> 18;
     }
     if (a_avail && (n != 2 && n != 3)) {
         q2 = s->current_picture.f.qscale_tablemb_pos - s->mb_stride;
         if (q2 && q2 != q1)
-            a = (a * s->y_dc_scale_tableq2 * ff_vc1_dqscales->y_dc_scale_tableq1 - 1 + 0x20000) >> 18;
+            a = (a * s->y_dc_scale_tableq2 * ff_vc1_dqscaledqscale_index + 0x20000) >> 18;
     }
     if (a_avail && c_avail && (n != 3)) {
         int off = mb_pos;
@@ -2542,7 +2546,7 @@
             off -= s->mb_stride;
         q2 = s->current_picture.f.qscale_tableoff;
         if (q2 && q2 != q1)
-            b = (b * s->y_dc_scale_tableq2 * ff_vc1_dqscales->y_dc_scale_tableq1 - 1 + 0x20000) >> 18;
+            b = (b * s->y_dc_scale_tableq2 * ff_vc1_dqscaledqscale_index + 0x20000) >> 18;
     }
 
     if (a_avail && c_avail) {
@@ -2959,6 +2963,8 @@
                 q1 = q1 * 2 + ((q1 == v->pq) ? v->halfpq : 0) - 1;
                 q2 = q2 * 2 + ((q2 == v->pq) ? v->halfpq : 0) - 1;
 
+                if (q1 < 1)
+                    return AVERROR_INVALIDDATA;
                 if (dc_pred_dir) { // left
                     for (k = 1; k < 8; k++)
                         blockk << v->left_blk_sh += (ac_valk * q2 * ff_vc1_dqscaleq1 - 1 + 0x20000) >> 18;
@@ -3001,6 +3007,8 @@
                 if (q2 && q1 != q2) {
                     q1 = q1 * 2 + ((q1 == v->pq) ? v->halfpq : 0) - 1;
                     q2 = q2 * 2 + ((q2 == v->pq) ? v->halfpq : 0) - 1;
+                    if (q1 < 1)
+                        return AVERROR_INVALIDDATA;
                     for (k = 1; k < 8; k++)
                         ac_val2k = (ac_val2k * q2 * ff_vc1_dqscaleq1 - 1 + 0x20000) >> 18;
                 }
@@ -3011,6 +3019,8 @@
                 if (q2 && q1 != q2) {
                     q1 = q1 * 2 + ((q1 == v->pq) ? v->halfpq : 0) - 1;
                     q2 = q2 * 2 + ((q2 == v->pq) ? v->halfpq : 0) - 1;
+                    if (q1 < 1)
+                        return AVERROR_INVALIDDATA;
                     for (k = 1; k < 8; k++)
                         ac_val2k + 8 = (ac_val2k + 8 * q2 * ff_vc1_dqscaleq1 - 1 + 0x20000) >> 18;
                 }
@@ -3169,6 +3179,8 @@
                 q1 = q1 * 2 + ((q1 == v->pq) ? v->halfpq : 0) - 1;
                 q2 = q2 * 2 + ((q2 == v->pq) ? v->halfpq : 0) - 1;
 
+                if (q1 < 1)
+                    return AVERROR_INVALIDDATA;
                 if (dc_pred_dir) { // left
                     for (k = 1; k < 8; k++)
                         blockk << v->left_blk_sh += (ac_valk * q2 * ff_vc1_dqscaleq1 - 1 + 0x20000) >> 18;
@@ -3211,6 +3223,8 @@
                 if (q2 && q1 != q2) {
                     q1 = q1 * 2 + ((q1 == v->pq) ? v->halfpq : 0) - 1;
                     q2 = q2 * 2 + ((q2 == v->pq) ? v->halfpq : 0) - 1;
+                    if (q1 < 1)
+                        return AVERROR_INVALIDDATA;
                     for (k = 1; k < 8; k++)
                         ac_val2k = (ac_val2k * q2 * ff_vc1_dqscaleq1 - 1 + 0x20000) >> 18;
                 }
@@ -3221,6 +3235,8 @@
                 if (q2 && q1 != q2) {
                     q1 = q1 * 2 + ((q1 == v->pq) ? v->halfpq : 0) - 1;
                     q2 = q2 * 2 + ((q2 == v->pq) ? v->halfpq : 0) - 1;
+                    if (q1 < 1)
+                        return AVERROR_INVALIDDATA;
                     for (k = 1; k < 8; k++)
                         ac_val2k + 8 = (ac_val2k + 8 * q2 * ff_vc1_dqscaleq1 - 1 + 0x20000) >> 18;
                 }

ffmpeg-0.10.2.tar.bz2/libavcodec/vqavideo.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/vqavideo.c Changed

@@ -70,10 +70,10 @@
 #include "libavutil/intreadwrite.h"
 #include "libavutil/imgutils.h"
 #include "avcodec.h"
+#include "bytestream.h"
 
 #define PALETTE_COUNT 256
 #define VQA_HEADER_SIZE 0x2A
-#define CHUNK_PREAMBLE_SIZE 8
 
 /* allocate the maximum vector space, regardless of the file version:
  * (0xFF00 codebook vectors + 0x100 solid pixel vectors) * (4x4 pixels/block) */
@@ -94,9 +94,7 @@
 
     AVCodecContext *avctx;
     AVFrame frame;
-
-    const unsigned char *buf;
-    int size;
+    GetByteContext gb;
 
     uint32_t palettePALETTE_COUNT;
 
@@ -123,7 +121,6 @@
 static av_cold int vqa_decode_init(AVCodecContext *avctx)
 {
     VqaContext *s = avctx->priv_data;
-    unsigned char *vqa_header;
     int i, j, codebook_index;
 
     s->avctx = avctx;
@@ -136,21 +133,20 @@
     }
 
     /* load up the VQA parameters from the header */
-    vqa_header = (unsigned char *)s->avctx->extradata;
-    s->vqa_version = vqa_header0;
+    s->vqa_version = s->avctx->extradata0;
     if (s->vqa_version < 1 || s->vqa_version > 3) {
         av_log(s->avctx, AV_LOG_ERROR, "  VQA video: unsupported version %d\n", s->vqa_version);
         return -1;
     }
-    s->width = AV_RL16(&vqa_header6);
-    s->height = AV_RL16(&vqa_header8);
+    s->width = AV_RL16(&s->avctx->extradata6);
+    s->height = AV_RL16(&s->avctx->extradata8);
     if(av_image_check_size(s->width, s->height, 0, avctx)){
         s->width= s->height= 0;
         return -1;
     }
-    s->vector_width = vqa_header10;
-    s->vector_height = vqa_header11;
-    s->partial_count = s->partial_countdown = vqa_header13;
+    s->vector_width = s->avctx->extradata10;
+    s->vector_height = s->avctx->extradata11;
+    s->partial_count = s->partial_countdown = s->avctx->extradata13;
 
     /* the vector dimensions have to meet very stringent requirements */
     if ((s->vector_width != 4) ||
@@ -159,6 +155,11 @@
         return -1;
     }
 
+    if (s->width % s->vector_width || s->height % s->vector_height) {
+        av_log(avctx, AV_LOG_ERROR, "Image size not multiple of block size\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     /* allocate codebooks */
     s->codebook_size = MAX_CODEBOOK_SIZE;
     s->codebook = av_malloc(s->codebook_size);
@@ -194,90 +195,88 @@
         av_log(NULL, AV_LOG_ERROR, "  VQA video: decode_format80 problem: next op would overflow dest_index\n"); \
         av_log(NULL, AV_LOG_ERROR, "  VQA video: current dest_index = %d, count = %d, dest_size = %d\n", \
             dest_index, count, dest_size); \
-        return; \
+        return AVERROR_INVALIDDATA; \
     }
 
-static void decode_format80(const unsigned char *src, int src_size,
+#define CHECK_COPY(idx) \
+    if (idx < 0 || idx + count > dest_size) { \
+        av_log(NULL, AV_LOG_ERROR, "  VQA video: decode_format80 problem: next op would overflow dest_index\n"); \
+        av_log(NULL, AV_LOG_ERROR, "  VQA video: current src_pos = %d, count = %d, dest_size = %d\n", \
+            src_pos, count, dest_size); \
+        return AVERROR_INVALIDDATA; \
+    }
+
+
+static int decode_format80(GetByteContext *gb, int src_size,
     unsigned char *dest, int dest_size, int check_size) {
 
-    int src_index = 0;
     int dest_index = 0;
-    int count;
+    int count, opcode, start;
     int src_pos;
     unsigned char color;
     int i;
 
-    while (src_index < src_size) {
-
-        av_dlog(NULL, "      opcode %02X: ", srcsrc_index);
+    start = bytestream2_tell(gb);
+    while (bytestream2_tell(gb) - start < src_size) {
+        opcode = bytestream2_get_byte(gb);
+        av_dlog(NULL, "      opcode %02X: ", opcode);
 
         /* 0x80 means that frame is finished */
-        if (srcsrc_index == 0x80)
-            return;
+        if (opcode == 0x80)
+            return 0;
 
         if (dest_index >= dest_size) {
             av_log(NULL, AV_LOG_ERROR, "  VQA video: decode_format80 problem: dest_index (%d) exceeded dest_size (%d)\n",
                 dest_index, dest_size);
-            return;
+            return AVERROR_INVALIDDATA;
         }
 
-        if (srcsrc_index == 0xFF) {
+        if (opcode == 0xFF) {
 
-            src_index++;
-            count = AV_RL16(&srcsrc_index);
-            src_index += 2;
-            src_pos = AV_RL16(&srcsrc_index);
-            src_index += 2;
+            count   = bytestream2_get_le16(gb);
+            src_pos = bytestream2_get_le16(gb);
             av_dlog(NULL, "(1) copy %X bytes from absolute pos %X\n", count, src_pos);
             CHECK_COUNT();
-            if (src_pos + count > dest_size)
-                return;
+            CHECK_COPY(src_pos);
             for (i = 0; i < count; i++)
                 destdest_index + i = destsrc_pos + i;
             dest_index += count;
 
-        } else if (srcsrc_index == 0xFE) {
+        } else if (opcode == 0xFE) {
 
-            src_index++;
-            count = AV_RL16(&srcsrc_index);
-            src_index += 2;
-            color = srcsrc_index++;
+            count = bytestream2_get_le16(gb);
+            color = bytestream2_get_byte(gb);
             av_dlog(NULL, "(2) set %X bytes to %02X\n", count, color);
             CHECK_COUNT();
             memset(&destdest_index, color, count);
             dest_index += count;
 
-        } else if ((srcsrc_index & 0xC0) == 0xC0) {
+        } else if ((opcode & 0xC0) == 0xC0) {
 
-            count = (srcsrc_index++ & 0x3F) + 3;
-            src_pos = AV_RL16(&srcsrc_index);
-            src_index += 2;
+            count = (opcode & 0x3F) + 3;
+            src_pos = bytestream2_get_le16(gb);
             av_dlog(NULL, "(3) copy %X bytes from absolute pos %X\n", count, src_pos);
             CHECK_COUNT();
-            if (src_pos + count > dest_size)
-                return;
+            CHECK_COPY(src_pos);
             for (i = 0; i < count; i++)
                 destdest_index + i = destsrc_pos + i;
             dest_index += count;
 
-        } else if (srcsrc_index > 0x80) {
+        } else if (opcode > 0x80) {
 
-            count = srcsrc_index++ & 0x3F;
+            count = opcode & 0x3F;
             av_dlog(NULL, "(4) copy %X bytes from source to dest\n", count);
             CHECK_COUNT();
-            memcpy(&destdest_index, &srcsrc_index, count);
-            src_index += count;
+            bytestream2_get_buffer(gb, &destdest_index, count);
             dest_index += count;
 
         } else {
 
-            count = ((srcsrc_index & 0x70) >> 4) + 3;
-            src_pos = AV_RB16(&srcsrc_index) & 0x0FFF;
-            src_index += 2;
+            count = ((opcode & 0x70) >> 4) + 3;
+            src_pos = bytestream2_get_byte(gb) | ((opcode & 0x0F) << 8);
             av_dlog(NULL, "(5) copy %X bytes from relpos %X\n", count, src_pos);
             CHECK_COUNT();
-            if (dest_index < src_pos)
-                return;
+            CHECK_COPY(dest_index - src_pos);
             for (i = 0; i < count; i++)
                 destdest_index + i = destdest_index - src_pos + i;
             dest_index += count;
@@ -292,9 +291,11 @@
         if (dest_index < dest_size)
             av_log(NULL, AV_LOG_ERROR, "  VQA video: decode_format80 problem: decode finished with dest_index (%d) < dest_size (%d)\n",
                 dest_index, dest_size);
+
+    return 0; // let's display what we decoded anyway
 }
 
-static void vqa_decode_chunk(VqaContext *s)
+static int vqa_decode_chunk(VqaContext *s)
 {
     unsigned int chunk_type;
     unsigned int chunk_size;
@@ -303,6 +304,7 @@
     int i;
     unsigned char r, g, b;
     int index_shift;
+    int res;
 
     int cbf0_chunk = -1;
     int cbfz_chunk = -1;
@@ -322,17 +324,11 @@
     int hibytes = s->decode_buffer_size / 2;
 
     /* first, traverse through the frame and find the subchunks */
-    while (index + CHUNK_PREAMBLE_SIZE <= s->size) {
-        unsigned next_index;
+    while (bytestream2_get_bytes_left(&s->gb) >= 8) {
 
-        chunk_type = AV_RB32(&s->bufindex);
-        chunk_size = AV_RB32(&s->bufindex + 4);
-        byte_skip = chunk_size & 0x01;
-        next_index = index + CHUNK_PREAMBLE_SIZE + chunk_size + byte_skip;
-        if (next_index > s->size) {
-            av_log(s->avctx, AV_LOG_ERROR, "Dropping incomplete chunk\n");
-            break;
-        }
+        chunk_type = bytestream2_get_be32u(&s->gb);
+        index      = bytestream2_tell(&s->gb);
+        chunk_size = bytestream2_get_be32u(&s->gb);
 
         switch (chunk_type) {
 
@@ -373,7 +369,9 @@
             chunk_type);
             break;
         }
-        index = next_index;
+
+        byte_skip = chunk_size & 0x01;
+        bytestream2_skip(&s->gb, chunk_size + byte_skip);
     }
 
     /* next, deal with the palette */
@@ -381,7 +379,7 @@
 
         /* a chunk should not have both chunk types */
         av_log(s->avctx, AV_LOG_ERROR, "  VQA video: problem: found both CPL0 and CPLZ chunks\n");
-        return;
+        return AVERROR_INVALIDDATA;
     }
 
     /* decompress the palette chunk */
@@ -394,19 +392,19 @@
     /* convert the RGB palette into the machine's endian format */
     if (cpl0_chunk != -1) {
 
-        chunk_size = AV_RB32(&s->bufcpl0_chunk + 4);
+        bytestream2_seek(&s->gb, cpl0_chunk, SEEK_SET);
+        chunk_size = bytestream2_get_be32(&s->gb);
         /* sanity check the palette size */
-        if (chunk_size / 3 > 256) {
+        if (chunk_size / 3 > 256 || chunk_size > bytestream2_get_bytes_left(&s->gb)) {
             av_log(s->avctx, AV_LOG_ERROR, "  VQA video: problem: found a palette chunk with %d colors\n",
                 chunk_size / 3);
-            return;
+            return AVERROR_INVALIDDATA;
         }
-        cpl0_chunk += CHUNK_PREAMBLE_SIZE;
         for (i = 0; i < chunk_size / 3; i++) {
             /* scale by 4 to transform 6-bit palette -> 8-bit */
-            r = s->bufcpl0_chunk++ * 4;
-            g = s->bufcpl0_chunk++ * 4;
-            b = s->bufcpl0_chunk++ * 4;
+            r = bytestream2_get_byteu(&s->gb) * 4;
+            g = bytestream2_get_byteu(&s->gb) * 4;
+            b = bytestream2_get_byteu(&s->gb) * 4;
             s->palettei = 0xFF << 24 | r << 16 | g << 8 | b;
             s->palettei |= s->palettei >> 6 & 0x30303;
         }
@@ -417,31 +415,32 @@
 
         /* a chunk should not have both chunk types */
         av_log(s->avctx, AV_LOG_ERROR, "  VQA video: problem: found both CBF0 and CBFZ chunks\n");
-        return;
+        return AVERROR_INVALIDDATA;
     }
 
     /* decompress the full codebook chunk */
     if (cbfz_chunk != -1) {
 
-        chunk_size = AV_RB32(&s->bufcbfz_chunk + 4);
-        cbfz_chunk += CHUNK_PREAMBLE_SIZE;
-        decode_format80(&s->bufcbfz_chunk, chunk_size,
-            s->codebook, s->codebook_size, 0);
+        bytestream2_seek(&s->gb, cbfz_chunk, SEEK_SET);
+        chunk_size = bytestream2_get_be32(&s->gb);
+        if ((res = decode_format80(&s->gb, chunk_size, s->codebook,
+                                   s->codebook_size, 0)) < 0)
+            return res;
     }
 
     /* copy a full codebook */
     if (cbf0_chunk != -1) {
 
-        chunk_size = AV_RB32(&s->bufcbf0_chunk + 4);
+        bytestream2_seek(&s->gb, cbf0_chunk, SEEK_SET);
+        chunk_size = bytestream2_get_be32(&s->gb);
         /* sanity check the full codebook size */
         if (chunk_size > MAX_CODEBOOK_SIZE) {
             av_log(s->avctx, AV_LOG_ERROR, "  VQA video: problem: CBF0 chunk too large (0x%X bytes)\n",
                 chunk_size);
-            return;
+            return AVERROR_INVALIDDATA;
         }
-        cbf0_chunk += CHUNK_PREAMBLE_SIZE;
 
-        memcpy(s->codebook, &s->bufcbf0_chunk, chunk_size);
+        bytestream2_get_buffer(&s->gb, s->codebook, chunk_size);
     }
 
     /* decode the frame */
@@ -449,13 +448,14 @@
 
         /* something is wrong if there is no VPTZ chunk */
         av_log(s->avctx, AV_LOG_ERROR, "  VQA video: problem: no VPTZ chunk found\n");
-        return;
+        return AVERROR_INVALIDDATA;
     }
 
-    chunk_size = AV_RB32(&s->bufvptz_chunk + 4);
-    vptz_chunk += CHUNK_PREAMBLE_SIZE;
-    decode_format80(&s->bufvptz_chunk, chunk_size,
-        s->decode_buffer, s->decode_buffer_size, 1);
+    bytestream2_seek(&s->gb, vptz_chunk, SEEK_SET);
+    chunk_size = bytestream2_get_be32(&s->gb);
+    if ((res = decode_format80(&s->gb, chunk_size,
+                               s->decode_buffer, s->decode_buffer_size, 1)) < 0)
+        return res;
 
     /* render the final PAL8 frame */
     if (s->vector_height == 4)
@@ -519,17 +519,17 @@
     if ((cbp0_chunk != -1) && (cbpz_chunk != -1)) {
         /* a chunk should not have both chunk types */
         av_log(s->avctx, AV_LOG_ERROR, "  VQA video: problem: found both CBP0 and CBPZ chunks\n");
-        return;
+        return AVERROR_INVALIDDATA;
     }
 
     if (cbp0_chunk != -1) {
 
-        chunk_size = AV_RB32(&s->bufcbp0_chunk + 4);
-        cbp0_chunk += CHUNK_PREAMBLE_SIZE;
+        bytestream2_seek(&s->gb, cbp0_chunk, SEEK_SET);
+        chunk_size = bytestream2_get_be32(&s->gb);
 
         /* accumulate partial codebook */
-        memcpy(&s->next_codebook_buffers->next_codebook_buffer_index,
-            &s->bufcbp0_chunk, chunk_size);
+        bytestream2_get_buffer(&s->gb, &s->next_codebook_buffers->next_codebook_buffer_index,
+                               chunk_size);
         s->next_codebook_buffer_index += chunk_size;
 
         s->partial_countdown--;
@@ -547,39 +547,39 @@
 
     if (cbpz_chunk != -1) {
 
-        chunk_size = AV_RB32(&s->bufcbpz_chunk + 4);
-        cbpz_chunk += CHUNK_PREAMBLE_SIZE;
+        bytestream2_seek(&s->gb, cbpz_chunk, SEEK_SET);
+        chunk_size = bytestream2_get_be32(&s->gb);
 
         /* accumulate partial codebook */
-        memcpy(&s->next_codebook_buffers->next_codebook_buffer_index,
-            &s->bufcbpz_chunk, chunk_size);
+        bytestream2_get_buffer(&s->gb, &s->next_codebook_buffers->next_codebook_buffer_index,
+                               chunk_size);
         s->next_codebook_buffer_index += chunk_size;
 
         s->partial_countdown--;
         if (s->partial_countdown == 0) {
+            GetByteContext gb;
 
+            bytestream2_init(&gb, s->next_codebook_buffer, s->next_codebook_buffer_index);
             /* decompress codebook */
-            decode_format80(s->next_codebook_buffer,
-                s->next_codebook_buffer_index,
-                s->codebook, s->codebook_size, 0);
+            if ((res = decode_format80(&gb, s->next_codebook_buffer_index,
+                                       s->codebook, s->codebook_size, 0)) < 0)
+                return res;
 
             /* reset accounting */
             s->next_codebook_buffer_index = 0;
             s->partial_countdown = s->partial_count;
         }
     }
+
+    return 0;
 }
 
 static int vqa_decode_frame(AVCodecContext *avctx,
                             void *data, int *data_size,
                             AVPacket *avpkt)
 {
-    const uint8_t *buf = avpkt->data;
-    int buf_size = avpkt->size;
     VqaContext *s = avctx->priv_data;
-
-    s->buf = buf;
-    s->size = buf_size;
+    int res;
 
     if (s->frame.data0)
         avctx->release_buffer(avctx, &s->frame);
@@ -589,7 +589,9 @@
         return -1;
     }
 
-    vqa_decode_chunk(s);
+    bytestream2_init(&s->gb, avpkt->data, avpkt->size);
+    if ((res = vqa_decode_chunk(s)) < 0)
+        return res;
 
     /* make the palette available on the way out */
     memcpy(s->frame.data1, s->palette, PALETTE_COUNT * 4);
@@ -599,7 +601,7 @@
     *(AVFrame*)data = s->frame;
 
     /* report that the buffer was completely consumed */
-    return buf_size;
+    return avpkt->size;
 }
 
 static av_cold int vqa_decode_end(AVCodecContext *avctx)

ffmpeg-0.10.2.tar.bz2/libavcodec/wmavoice.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/wmavoice.c Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/x86/cabac.h -> ffmpeg-0.10.3.tar.bz2/libavcodec/x86/cabac.h Changed

@@ -107,8 +107,8 @@
 {
     x86_reg tmp;
     __asm__ volatile(
-        "movl %4, %k1                           \n\t"
-        "movl %2, %%eax                         \n\t"
+        "movl %a5(%2), %k1                      \n\t"
+        "movl %a3(%2), %%eax                    \n\t"
         "shl $17, %k1                           \n\t"
         "add %%eax, %%eax                       \n\t"
         "sub %k1, %%eax                         \n\t"
@@ -119,20 +119,23 @@
         "sub %%edx, %%ecx                       \n\t"
         "test %%ax, %%ax                        \n\t"
         " jnz 1f                                \n\t"
-        "mov  %3, %1                            \n\t"
+        "mov  %a4(%2), %1                       \n\t"
         "subl $0xFFFF, %%eax                    \n\t"
         "movzwl (%1), %%edx                     \n\t"
         "bswap %%edx                            \n\t"
         "shrl $15, %%edx                        \n\t"
         "add  $2, %1                            \n\t"
         "addl %%edx, %%eax                      \n\t"
-        "mov  %1, %3                            \n\t"
+        "mov  %1, %a4(%2)                       \n\t"
         "1:                                     \n\t"
-        "movl %%eax, %2                         \n\t"
+        "movl %%eax, %a3(%2)                    \n\t"
 
-        :"+c"(val), "=&r"(tmp), "+m"(c->low), "+m"(c->bytestream)
-        :"m"(c->range)
-        : "%eax", "%edx"
+        : "+c"(val), "=&r"(tmp)
+        : "r"(c),
+          "i"(offsetof(CABACContext, low)),
+          "i"(offsetof(CABACContext, bytestream)),
+          "i"(offsetof(CABACContext, range))
+        : "%eax", "%edx", "memory"
     );
     return val;
 }

ffmpeg-0.10.2.tar.bz2/libavcodec/x86/dsputil_yasm.asm -> ffmpeg-0.10.3.tar.bz2/libavcodec/x86/dsputil_yasm.asm Changed

ffmpeg-0.10.2.tar.bz2/libavcodec/x86/dsputilenc_mmx.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/x86/dsputilenc_mmx.c Changed

ffmpeg-0.10.2.tar.bz2/libavfilter/vf_fade.c -> ffmpeg-0.10.3.tar.bz2/libavfilter/vf_fade.c Changed

ffmpeg-0.10.2.tar.bz2/libavformat/4xm.c -> ffmpeg-0.10.3.tar.bz2/libavformat/4xm.c Changed

ffmpeg-0.10.2.tar.bz2/libavformat/asfdec.c -> ffmpeg-0.10.3.tar.bz2/libavformat/asfdec.c Changed

ffmpeg-0.10.2.tar.bz2/libavformat/avidec.c -> ffmpeg-0.10.3.tar.bz2/libavformat/avidec.c Changed

ffmpeg-0.10.2.tar.bz2/libavformat/id3v2.c -> ffmpeg-0.10.3.tar.bz2/libavformat/id3v2.c Changed

ffmpeg-0.10.2.tar.bz2/libavformat/mm.c -> ffmpeg-0.10.3.tar.bz2/libavformat/mm.c Changed

ffmpeg-0.10.2.tar.bz2/libavformat/mov.c -> ffmpeg-0.10.3.tar.bz2/libavformat/mov.c Changed

@@ -160,7 +160,7 @@
         uint8_t t, c = avio_r8(pb);
         if (c < 0x80 && p < end)
             *p++ = c;
-        else
+        else if (p < end)
             PUT_UTF8(mac_to_unicodec-0x80, t, if (p < end) *p++ = t;);
     }
     *p = 0;
@@ -1767,6 +1767,7 @@
     unsigned int stps_index = 0;
     unsigned int i, j;
     uint64_t stream_size = 0;
+    AVIndexEntry *mem;
 
     /* adjust first dts according to edit list */
     if ((sc->empty_duration || sc->start_time) && mov->time_scale > 0) {
@@ -1796,12 +1797,13 @@
 
         if (!sc->sample_count)
             return;
-        if (sc->sample_count >= UINT_MAX / sizeof(*st->index_entries))
+        if (sc->sample_count >= UINT_MAX / sizeof(*st->index_entries) - st->nb_index_entries)
             return;
-        st->index_entries = av_malloc(sc->sample_count*sizeof(*st->index_entries));
-        if (!st->index_entries)
+        mem = av_realloc(st->index_entries, (st->nb_index_entries + sc->sample_count) * sizeof(*st->index_entries));
+        if (!mem)
             return;
-        st->index_entries_allocated_size = sc->sample_count*sizeof(*st->index_entries);
+        st->index_entries = mem;
+        st->index_entries_allocated_size = (st->nb_index_entries + sc->sample_count) * sizeof(*st->index_entries);
 
         for (i = 0; i < sc->chunk_count; i++) {
             current_offset = sc->chunk_offsetsi;
@@ -1885,12 +1887,13 @@
         }
 
         av_dlog(mov->fc, "chunk count %d\n", total);
-        if (total >= UINT_MAX / sizeof(*st->index_entries))
+        if (total >= UINT_MAX / sizeof(*st->index_entries) - st->nb_index_entries)
             return;
-        st->index_entries = av_malloc(total*sizeof(*st->index_entries));
-        if (!st->index_entries)
+        mem = av_realloc(st->index_entries, (st->nb_index_entries + total) * sizeof(*st->index_entries));
+        if (!mem)
             return;
-        st->index_entries_allocated_size = total*sizeof(*st->index_entries);
+        st->index_entries = mem;
+        st->index_entries_allocated_size = (st->nb_index_entries + total) * sizeof(*st->index_entries);
 
         // populate index
         for (i = 0; i < sc->chunk_count; i++) {
@@ -2831,7 +2834,7 @@
 
     pkt->stream_index = sc->ffindex;
     pkt->dts = sample->timestamp;
-    if (sc->ctts_data) {
+    if (sc->ctts_data && sc->ctts_index < sc->ctts_count) {
         pkt->pts = pkt->dts + sc->dts_shift + sc->ctts_datasc->ctts_index.duration;
         /* update ctts context */
         sc->ctts_sample++;

ffmpeg-0.10.2.tar.bz2/libavformat/mxfdec.c -> ffmpeg-0.10.3.tar.bz2/libavformat/mxfdec.c Changed

ffmpeg-0.10.2.tar.bz2/libavformat/xmv.c -> ffmpeg-0.10.3.tar.bz2/libavformat/xmv.c Changed

ffmpeg-0.10.2.tar.bz2/libavformat/xwma.c -> ffmpeg-0.10.3.tar.bz2/libavformat/xwma.c Changed

ffmpeg-0.10.2.tar.bz2/tests/ref/fate/vqa-cc -> ffmpeg-0.10.3.tar.bz2/tests/ref/fate/vqa-cc Changed

Overview

Request 222 (accepted)

Request History