@@ -1,4 +1,9 @@

 -------------------------------------------------------------------

+Sat Dec 05 12:23:17 UTC 2015 - joerg.lorenzen@ki.tng.de

+

+- update internal ffmpeg to version 2.8.3

+

+-------------------------------------------------------------------

 Fri Nov 20 07:00:02 UTC 2015 - olaf@aepfle.de

 - Set group permissions for included ffmpeg libs

​

@@ -16,7 +16,7 @@

 #

-%define         ffmpeg_version 2.8.1

+%define         ffmpeg_version 2.8.3

 Name:           avidemux3

 Summary:        Graphical video editing and transcoding tool

​

@@ -1,6 +1,87 @@

 Entries are sorted chronologically from oldest to youngest within each release,

 releases are sorted from youngest to oldest.

+version 2.8.3

+- avcodec/cabac: Check initial cabac decoder state

+- avcodec/cabac_functions: Fix "left shift of negative value -31767"

+- avcodec/h264_slice: Limit max_contexts when slice_context_count is initialized

+- rtmpcrypt: Do the xtea decryption in little endian mode

+- avformat/matroskadec: Check subtitle stream before dereferencing

+- avcodec/pngdec: Replace assert by request for sample for unsupported TRNS cases

+- avformat/utils: Do not init parser if probing is unfinished

+- avcodec/jpeg2000dec: Fix potential integer overflow with tile dimensions

+- avcodec/jpeg2000: Use av_image_check_size() in ff_jpeg2000_init_component()

+- avcodec/wmaprodec: Check for overread in decode_packet()

+- avcodec/smacker: Check that the data size is a multiple of a sample vector

+- avcodec/takdec: Skip last p2 sample (which is unused)

+- avcodec/dxtory: Fix input size check in dxtory_decode_v1_410()

+- avcodec/dxtory: Fix input size check in dxtory_decode_v1_420()

+- avcodec/error_resilience: avoid accessing previous or next frames tables beyond height

+- avcodec/dpx: Move need_align to act per line

+- avcodec/flashsv: Check size before updating it

+- avcodec/ivi: Check image dimensions

+- avcodec/utils: Better check for channels in av_get_audio_frame_duration()

+- avcodec/jpeg2000dec: Check for duplicate SIZ marker

+- aacsbr: don't call sbr_dequant twice without intermediate read_sbr_data

+- hqx: correct type and size check of info_offset

+- mxfdec: check edit_rate also for physical_track

+- avcodec/jpeg2000: Change coord to 32bit to support larger than 32k width or height

+- avcodec/jpeg2000dec: Check SIZ dimensions to be within the supported range

+- avcodec/jpeg2000: Check comp coords to be within the supported size

+- mpegvideo: clear overread in clear_context

+- avcodec/avrndec: Use the AVFrame format instead of the context

+- dds: disable palette flag for compressed images

+- dds: validate compressed source buffer size

+- dds: validate source buffer size before copying

+- dvdsubdec: validate offset2 similar to offset1

+- brstm: reject negative sample rate

+- aacps: avoid division by zero in stereo_processing

+- softfloat: assert when the argument of av_sqrt_sf is negative

+

+version 2.8.2

+- various fixes in the aac_fixed decoder

+- various fixes in softfloat

+- swresample/resample: increase precision for compensation

+- lavf/mov: add support for sidx fragment indexes

+- avformat/mxfenc: Only store user comment related tags when needed

+- tests/fate/avformat: Fix fate-lavf

+- doc/ffmpeg: Clarify that the sdp_file option requires an rtp output.

+- ffmpeg: Don't try and write sdp info if none of the outputs had an rtp format.

+- apng: use correct size for output buffer

+- jvdec: avoid unsigned overflow in comparison

+- avcodec/jpeg2000dec: Clip all tile coordinates

+- avcodec/microdvddec: Check for string end in 'P' case

+- avcodec/dirac_parser: Fix undefined memcpy() use

+- avformat/xmv: Discard remainder of packet on error

+- avformat/xmv: factor return check out of if/else

+- avcodec/mpeg12dec: Do not call show_bits() with invalid bits

+- avcodec/faxcompr: Add missing runs check in decode_uncompressed()

+- libavutil/channel_layout: Check strtol*() for failure

+- avformat/mpegts: Only start probing data streams within probe_packets

+- avcodec/hevc_ps: Check chroma_format_idc

+- avcodec/ffv1dec: Check for 0 quant tables

+- avcodec/mjpegdec: Reinitialize IDCT on BPP changes

+- avcodec/mjpegdec: Check index in ljpeg_decode_yuv_scan() before using it

+- avutil/file_open: avoid file handle inheritance on Windows

+- avcodec/h264_slice: Disable slice threads if there are multiple access units in a packet

+- avformat/hls: update cookies on setcookie response

+- opusdec: Don't run vector_fmul_scalar on zero length arrays

+- avcodec/opusdec: Fix extra samples read index

+- avcodec/ffv1: Initialize vlc_state on allocation

+- avcodec/ffv1dec: update progress in case of broken pointer chains

+- avcodec/ffv1dec: Clear slice coordinates if they are invalid or slice header decoding fails for other reasons

+- rtsp: Allow $ as interleaved packet indicator before a complete response header

+- videodsp: don't overread edges in vfix3 emu_edge.

+- avformat/mp3dec: improve junk skipping heuristic

+- concatdec: fix file_start_time calculation regression

+- avcodec: loongson optimize h264dsp idct and loop filter with mmi

+- avcodec/jpeg2000dec: Clear properties in jpeg2000_dec_cleanup() too

+- avformat/hls: add support for EXT-X-MAP

+- avformat/hls: fix segment selection regression on track changes of live streams

+- configure: Require libkvazaar < 0.7.

+- avcodec/vp8: Do not use num_coeff_partitions in thread/buffer setup

+

+

 version 2.8.1:

 - swscale: fix ticket #4881

 - doc: fix spelling errors

@@ -31,7 +112,7 @@

 - dnxhddec: decode and use interlace mb flag

 - swscale: fix ticket #4877

 - avcodec/rangecoder: Check e

-- avcodec/ffv1: seperate slice_count from max_slice_count

+- avcodec/ffv1: separate slice_count from max_slice_count

 - swscale: fix ticket 4850

 - cmdutils: Filter dst/srcw/h

 - avutil/log: fix zero length gnu_printf format string warning

​

@@ -1,1 +1,1 @@

-2.8.1

+2.8.3

​

@@ -1,1 +1,1 @@

-2.8.1

+2.8.3

​

@@ -5240,7 +5240,7 @@

                                    check_lib "${gsm_hdr}" gsm_create -lgsm && break;

                                done || die "ERROR: libgsm not found"; }

 enabled libilbc           && require libilbc ilbc.h WebRtcIlbcfix_InitDecode -lilbc

-enabled libkvazaar        && require_pkg_config kvazaar kvazaar.h kvz_api_get

+enabled libkvazaar        && require_pkg_config "kvazaar < 0.7.0" kvazaar.h kvz_api_get

 enabled libmfx            && require_pkg_config libmfx "mfx/mfxvideo.h" MFXInit

 enabled libmodplug        && require_pkg_config libmodplug libmodplug/modplug.h ModPlug_Load

 enabled libmp3lame        && require "libmp3lame >= 3.98.3" lame/lame.h lame_set_VBR_quality -lmp3lame

​

@@ -31,7 +31,7 @@

 # This could be handy for archiving the generated documentation or

 # if some version control system is used.

-PROJECT_NUMBER         = 2.8.1

+PROJECT_NUMBER         = 2.8.3

 # With the PROJECT_LOGO tag one can specify a logo or icon that is included

 # in the documentation. The maximum height of the logo should not exceed 55

​

@@ -1205,9 +1205,9 @@

 specified to @command{ffserver} but can be to @command{ffmpeg}.

 @item -sdp_file @var{file} (@emph{global})

-Print sdp information to @var{file}.

+Print sdp information for an output stream to @var{file}.

 This allows dumping sdp information when at least one output isn't an

-rtp stream.

+rtp stream. (Requires at least one of the output formats to be rtp).

 @item -discard (@emph{input})

 Allows discarding specific streams or frames of streams at the demuxer.

​

@@ -839,6 +839,21 @@

      -y out.ts

 @end example

+@section mxf, mxf_d10

+

+MXF muxer.

+

+@subsection Options

+

+The muxer options are:

+

+@table @option

+@item store_user_comments @var{bool}

+Set if user comments should be stored if available or never.

+IRT D-10 does not allow user comments. The default is thus to write them for

+mxf but not for mxf_d10

+@end table

+

 @section null

 Null muxer.

​

@@ -2447,6 +2447,9 @@

         }

     }

+    if (!j)

+        goto fail;

+

     av_sdp_create(avc, j, sdp, sizeof(sdp));

     if (!sdp_filename) {

@@ -2462,6 +2465,7 @@

         }

     }

+fail:

     av_freep(&avc);

 }

​

@@ -2889,6 +2889,11 @@

     spectral_to_sample(ac, samples);

+    if (!ac->frame->data[0] && samples) {

+        av_log(avctx, AV_LOG_ERROR, "no frame data found\n");

+        return AVERROR_INVALIDDATA;

+    }

+

     ac->frame->nb_samples = samples;

     ac->frame->sample_rate = avctx->sample_rate;

     *got_frame_ptr = 1;

​

@@ -940,7 +940,7 @@

             LOCAL_ALIGNED_16(INTFLOAT, h_step, [2], [4]);

             int start = ps->border_position[e];

             int stop  = ps->border_position[e+1];

-            INTFLOAT width = Q30(1.f) / (stop - start);

+            INTFLOAT width = Q30(1.f) / ((stop - start) ? (stop - start) : 1);

 #if USE_FIXED

             width <<= 1;

 #endif

​

@@ -169,6 +169,10 @@

                 else

                   temp1.mant = 0x20000000;

                 temp1.exp = (temp1.exp >> 1) + 1;

+                if (temp1.exp > 66) { // temp1 > 1E20

+                    av_log(NULL, AV_LOG_ERROR, "envelope scalefactor overflow in dequant\n");

+                    temp1 = FLOAT_1;

+                }

                 temp2.exp = (pan_offset - sbr->data[1].env_facs[e][k].mant) * alpha;

                 if (temp2.exp & 1)

@@ -188,6 +192,10 @@

                 temp1.exp = NOISE_FLOOR_OFFSET - \

                     sbr->data[0].noise_facs[e][k].mant + 2;

                 temp1.mant = 0x20000000;

+                if (temp1.exp > 66) { // temp1 > 1E20

+                    av_log(NULL, AV_LOG_ERROR, "envelope scalefactor overflow in dequant\n");

+                    temp1 = FLOAT_1;

+                }

                 temp2.exp = 12 - sbr->data[1].noise_facs[e][k].mant + 1;

                 temp2.mant = 0x20000000;

                 fac   = av_div_sf(temp1, av_add_sf(FLOAT_1, temp2));

@@ -208,7 +216,10 @@

                     else

                         temp1.mant = 0x20000000;

                     temp1.exp = (temp1.exp >> 1) + 1;

-

+                    if (temp1.exp > 66) { // temp1 > 1E20

+                        av_log(NULL, AV_LOG_ERROR, "envelope scalefactor overflow in dequant\n");

+                        temp1 = FLOAT_1;

+                    }

                     sbr->data[ch].env_facs[e][k] = temp1;

                 }

             for (e = 1; e <= sbr->data[ch].bs_num_noise; e++)

@@ -397,7 +408,8 @@

         int delta = !((e == e_a[1]) || (e == e_a[0]));

         for (k = 0; k < sbr->n_lim; k++) {

             SoftFloat gain_boost, gain_max;

-            SoftFloat sum[2] = { { 0, 0}, { 0, 0 } };

+            SoftFloat sum[2];

+            sum[0] = sum[1] = FLOAT_0;

             for (m = sbr->f_tablelim[k] - sbr->kx[1]; m < sbr->f_tablelim[k + 1] - sbr->kx[1]; m++) {

                 const SoftFloat temp = av_div_sf(sbr->e_origmapped[e][m],

                                             av_add_sf(FLOAT_1, sbr->q_mapped[e][m]));

​

@@ -70,6 +70,7 @@

 /** Places SBR in pure upsampling mode. */

 static void sbr_turnoff(SpectralBandReplication *sbr) {

     sbr->start = 0;

+    sbr->ready_for_dequant = 0;

     // Init defults used in pure upsampling mode

     sbr->kx[1] = 32; //Typo in spec, kx' inits to 32

     sbr->m[1] = 0;

@@ -177,6 +178,7 @@

     SpectrumParameters old_spectrum_params;

     sbr->start = 1;

+    sbr->ready_for_dequant = 0;

     // Save last spectrum parameters variables to compare to new ones

     memcpy(&old_spectrum_params, &sbr->spectrum_params, sizeof(SpectrumParameters));

@@ -1032,6 +1034,7 @@

     unsigned int cnt = get_bits_count(gb);

     sbr->id_aac = id_aac;

+    sbr->ready_for_dequant = 1;

     if (id_aac == TYPE_SCE || id_aac == TYPE_CCE) {

         if (read_sbr_single_channel_element(ac, sbr, gb)) {

@@ -1412,7 +1415,7 @@

             for (p = 0; p < sbr->n[ch_data->bs_freq_res[e + 1]]; p++) {

 #if USE_FIXED

-                SoftFloat sum = { 0, 0 };

+                SoftFloat sum = FLOAT_0;

                 const SoftFloat den = av_int2sf(0x20000000 / (env_size * (table[p + 1] - table[p])), 29);

                 for (k = table[p]; k < table[p + 1]; k++) {

                     sum = av_add_sf(sum, sbr->dsp.sum_square(X_high[k] + ilb, iub - ilb));

@@ -1449,6 +1452,12 @@

         sbr_turnoff(sbr);

     }

+    if (sbr->start && !sbr->ready_for_dequant) {

+        av_log(ac->avctx, AV_LOG_ERROR,

+               "No quantized data read for sbr_dequant.\n");

+        sbr_turnoff(sbr);

+    }

+

     if (!sbr->kx_and_m_pushed) {

         sbr->kx[0] = sbr->kx[1];

         sbr->m[0] = sbr->m[1];

@@ -1458,6 +1467,7 @@

     if (sbr->start) {

         sbr_dequant(sbr, id_aac);

+        sbr->ready_for_dequant = 0;

     }

     for (ch = 0; ch < nch; ch++) {

         /* decode channel */

​

@@ -113,7 +113,7 @@

             int shift = p->height - avctx->height;

             int subsample_h, subsample_v;

-            av_pix_fmt_get_chroma_sub_sample(avctx->pix_fmt, &subsample_h, &subsample_v);

+            av_pix_fmt_get_chroma_sub_sample(p->format, &subsample_h, &subsample_v);

             p->data[0] += p->linesize[0] * shift;

             if (p->data[2]) {

​

@@ -51,7 +51,7 @@

  *

  * @param buf_size size of buf in bits

  */

-void ff_init_cabac_decoder(CABACContext *c, const uint8_t *buf, int buf_size){

+int ff_init_cabac_decoder(CABACContext *c, const uint8_t *buf, int buf_size){

     c->bytestream_start=

     c->bytestream= buf;

     c->bytestream_end= buf + buf_size;

@@ -64,6 +64,9 @@

 #endif

     c->low+= ((*c->bytestream++)<<2) + 2;

     c->range= 0x1FE;

+    if ((c->range<<(CABAC_BITS+1)) < c->low)

+        return AVERROR_INVALIDDATA;

+    return 0;

 }

 void ff_init_cabac_states(void)

​

@@ -56,7 +56,7 @@

 }CABACContext;

 void ff_init_cabac_encoder(CABACContext *c, uint8_t *buf, int buf_size);

-void ff_init_cabac_decoder(CABACContext *c, const uint8_t *buf, int buf_size);

+int ff_init_cabac_decoder(CABACContext *c, const uint8_t *buf, int buf_size);

 void ff_init_cabac_states(void);

 #endif /* AVCODEC_CABAC_H */

​

@@ -74,7 +74,8 @@

 #ifndef get_cabac_inline

 static void refill2(CABACContext *c){

-    int i, x;

+    int i;

+    unsigned x;

     x= c->low ^ (c->low-1);

     i= 7 - ff_h264_norm_shift[x>>(CABAC_BITS-1)];

@@ -190,7 +191,8 @@

 #endif

     if ((int) (c->bytestream_end - ptr) < n)

         return NULL;

-    ff_init_cabac_decoder(c, ptr + n, c->bytestream_end - ptr - n);

+    if (ff_init_cabac_decoder(c, ptr + n, c->bytestream_end - ptr - n) < 0)

+        return NULL;

     return ptr;

 }

​

@@ -141,6 +141,12 @@

     normal_map      = flags & DDPF_NORMALMAP;

     fourcc = bytestream2_get_le32(gbc);

+    if (ctx->compressed && ctx->paletted) {

+        av_log(avctx, AV_LOG_WARNING,

+               "Disabling invalid palette flag for compressed dds.\n");

+        ctx->paletted = 0;

+    }

+

     bpp = bytestream2_get_le32(gbc); // rgbbitcount

     r   = bytestream2_get_le32(gbc); // rbitmask

     g   = bytestream2_get_le32(gbc); // gbitmask

@@ -642,9 +648,18 @@

         return ret;

     if (ctx->compressed) {

+        int size = (avctx->coded_height / TEXTURE_BLOCK_H) *

+                   (avctx->coded_width / TEXTURE_BLOCK_W) * ctx->tex_ratio;

         ctx->slice_count = av_clip(avctx->thread_count, 1,

                                    avctx->coded_height / TEXTURE_BLOCK_H);

+        if (bytestream2_get_bytes_left(gbc) < size) {

+            av_log(avctx, AV_LOG_ERROR,

+                   "Compressed Buffer is too small (%d < %d).\n",

+                   bytestream2_get_bytes_left(gbc), size);

+            return AVERROR_INVALIDDATA;

+        }

+

         /* Use the decompress function on the texture, one block per thread. */

         ctx->tex_data = gbc->buffer;

         avctx->execute2(avctx, decompress_texture_thread, frame, NULL, ctx->slice_count);

@@ -666,6 +681,12 @@

             frame->palette_has_changed = 1;

         }

+        if (bytestream2_get_bytes_left(gbc) < frame->height * linesize) {

+            av_log(avctx, AV_LOG_ERROR, "Buffer is too small (%d < %d).\n",

+                   bytestream2_get_bytes_left(gbc), frame->height * linesize);

+            return AVERROR_INVALIDDATA;

+        }

+

         av_image_copy_plane(frame->data[0], frame->linesize[0],

                             gbc->buffer, linesize,

                             linesize, frame->height);

​

@@ -123,7 +123,7 @@

     DiracParseContext *pc = s->priv_data;

     if (pc->overread_index) {

-        memcpy(pc->buffer, pc->buffer + pc->overread_index,

+        memmove(pc->buffer, pc->buffer + pc->overread_index,

                pc->index - pc->overread_index);

         pc->index         -= pc->overread_index;

         pc->overread_index = 0;

​

@@ -348,11 +348,11 @@

                 // For 12 bit, ignore alpha

                 if (elements == 4)

                     buf += 2;

-                // Jump to next aligned position

-                buf += need_align;

             }

             for (i = 0; i < 3; i++)

                 ptr[i] += p->linesize[i];

+            // Jump to next aligned position

+            buf += need_align;

         }

         break;

     case 16:

​

@@ -346,7 +346,7 @@

             }

         }

     the_end:

-        if (offset1 >= 0) {

+        if (offset1 >= 0 && offset2 >= 0) {

             int w, h;

             uint8_t *bitmap;

​

@@ -65,7 +65,7 @@

     uint8_t *Y1, *Y2, *Y3, *Y4, *U, *V;

     int ret;

-    if (src_size < avctx->width * avctx->height * 9LL / 8) {

+    if (src_size < FFALIGN(avctx->width, 4) * FFALIGN(avctx->height, 4) * 9LL / 8) {

         av_log(avctx, AV_LOG_ERROR, "packet too small\n");

         return AVERROR_INVALIDDATA;

     }

@@ -108,7 +108,7 @@

     uint8_t *Y1, *Y2, *U, *V;

     int ret;

-    if (src_size < avctx->width * avctx->height * 3LL / 2) {

+    if (src_size < FFALIGN(avctx->width, 2) * FFALIGN(avctx->height, 2) * 3LL / 2) {

         av_log(avctx, AV_LOG_ERROR, "packet too small\n");

         return AVERROR_INVALIDDATA;

     }

​

@@ -381,14 +381,19 @@

 #define MV_UNCHANGED 1

     const int mb_stride = s->mb_stride;

     const int mb_width  = s->mb_width;

-    const int mb_height = s->mb_height;

+    int mb_height = s->mb_height;

     int i, depth, num_avail;

     int mb_x, mb_y, mot_step, mot_stride;

+    if (s->last_pic.f && s->last_pic.f->data[0])

+        mb_height = FFMIN(mb_height, (s->last_pic.f->height+15)>>4);

+    if (s->next_pic.f && s->next_pic.f->data[0])

+        mb_height = FFMIN(mb_height, (s->next_pic.f->height+15)>>4);

+

     set_mv_strides(s, &mot_step, &mot_stride);

     num_avail = 0;

-    for (i = 0; i < s->mb_num; i++) {

+    for (i = 0; i < mb_width * mb_height; i++) {

         const int mb_xy = s->mb_index2xy[i];

         int f = 0;

         int error = s->error_status_table[mb_xy];

@@ -413,7 +418,7 @@

     if ((!(s->avctx->error_concealment&FF_EC_GUESS_MVS)) ||

         num_avail <= mb_width / 2) {

-        for (mb_y = 0; mb_y < s->mb_height; mb_y++) {

+        for (mb_y = 0; mb_y < mb_height; mb_y++) {

             for (mb_x = 0; mb_x < s->mb_width; mb_x++) {

                 const int mb_xy = mb_x + mb_y * s->mb_stride;

                 int mv_dir = (s->last_pic.f && s->last_pic.f->data[0]) ? MV_DIR_FORWARD : MV_DIR_BACKWARD;

@@ -442,7 +447,7 @@

             int score_sum = 0;

             changed = 0;

-            for (mb_y = 0; mb_y < s->mb_height; mb_y++) {

+            for (mb_y = 0; mb_y < mb_height; mb_y++) {

                 for (mb_x = 0; mb_x < s->mb_width; mb_x++) {

                     const int mb_xy        = mb_x + mb_y * s->mb_stride;

                     int mv_predictor[8][2] = { { 0 } };

@@ -675,7 +680,7 @@

         if (none_left)

             return;

-        for (i = 0; i < s->mb_num; i++) {

+        for (i = 0; i < mb_width * mb_height; i++) {

             int mb_xy = s->mb_index2xy[i];

             if (fixed[mb_xy])

                 fixed[mb_xy] = MV_FROZEN;

​

@@ -189,6 +189,10 @@

     *mode = !*mode;

     if (newmode != *mode) { //FIXME CHECK

         *(*runs)++ = 0;

+        if (*runs >= runend) {

+            av_log(avctx, AV_LOG_ERROR, "uncompressed run overrun\n");

+            return AVERROR_INVALIDDATA;

+        }

         *mode = newmode;

     }

     return 0;

​

@@ -66,7 +66,7 @@

 av_cold int ff_ffv1_init_slice_state(FFV1Context *f, FFV1Context *fs)

 {

-    int j;

+    int j, i;

     fs->plane_count  = f->plane_count;

     fs->transparency = f->transparency;

@@ -80,10 +80,15 @@

             if (!p->state)

                 return AVERROR(ENOMEM);

         } else {

-            if (!p->vlc_state)

-                p->vlc_state = av_malloc_array(p->context_count, sizeof(VlcState));

-            if (!p->vlc_state)

-                return AVERROR(ENOMEM);

+            if (!p->vlc_state) {

+                p->vlc_state = av_mallocz_array(p->context_count, sizeof(VlcState));

+                if (!p->vlc_state)

+                    return AVERROR(ENOMEM);

+                for (i = 0; i < p->context_count; i++) {

+                    p->vlc_state[i].error_sum = 4;

+                    p->vlc_state[i].count     = 1;

+                }

+            }

         }

     }

​

@@ -408,6 +408,7 @@

         if (ff_ffv1_init_slice_state(f, fs) < 0)

             return AVERROR(ENOMEM);

         if (decode_slice_header(f, fs) < 0) {

+            fs->slice_x = fs->slice_y = fs->slice_height = fs->slice_width = 0;

             fs->slice_damaged = 1;

             return AVERROR_INVALIDDATA;

         }

@@ -568,7 +569,7 @@

     }

     f->quant_table_count = get_symbol(c, state, 0);

-    if (f->quant_table_count > (unsigned)MAX_QUANT_TABLES)

+    if (f->quant_table_count > (unsigned)MAX_QUANT_TABLES || !f->quant_table_count)

         return AVERROR_INVALIDDATA;

     for (i = 0; i < f->quant_table_count; i++) {

@@ -939,6 +940,7 @@

         else                     v = buf_p - c->bytestream_start;

         if (buf_p - c->bytestream_start < v) {

             av_log(avctx, AV_LOG_ERROR, "Slice pointer chain broken\n");

+            ff_thread_report_progress(&f->picture, INT_MAX, 0);

             return AVERROR_INVALIDDATA;

         }

         buf_p -= v;

​

@@ -413,6 +413,10 @@

                 }

                 if (has_diff) {

+                    if (size < 3) {

+                        av_log(avctx, AV_LOG_ERROR, "size too small for diff\n");

+                        return AVERROR_INVALIDDATA;

+                    }

                     if (!s->keyframe) {

                         av_log(avctx, AV_LOG_ERROR,

                                "Inter frame without keyframe\n");

@@ -440,6 +444,10 @@

                     int row = get_bits(&gb, 8);

                     av_log(avctx, AV_LOG_DEBUG, "%dx%d zlibprime_curr %dx%d\n",

                            i, j, col, row);

+                    if (size < 3) {

+                        av_log(avctx, AV_LOG_ERROR, "size too small for zlibprime_curr\n");

+                        return AVERROR_INVALIDDATA;

+                    }

                     size -= 2;

                     avpriv_request_sample(avctx, "zlibprime_curr");

                     return AVERROR_PATCHWELCOME;

​

@@ -2026,6 +2026,7 @@

         const int mb_size = ff_h264_mb_sizes[h->sps.chroma_format_idc] *

                             h->sps.bit_depth_luma >> 3;

         const uint8_t *ptr;

+        int ret;

         // We assume these blocks are very rare so we do not optimize it.

         // FIXME The two following lines get the bitstream position in the cabac

@@ -2042,7 +2043,9 @@

         sl->intra_pcm_ptr = ptr;

         ptr += mb_size;

-        ff_init_cabac_decoder(&sl->cabac, ptr, sl->cabac.bytestream_end - ptr);

+        ret = ff_init_cabac_decoder(&sl->cabac, ptr, sl->cabac.bytestream_end - ptr);

+        if (ret < 0)

+            return ret;

         // All blocks are present

         h->cbp_table[mb_xy] = 0xf7ef;

​

@@ -1097,6 +1097,7 @@

         nb_slices = max_slices;

     }

     h->slice_context_count = nb_slices;

+    h->max_contexts = FFMIN(h->max_contexts, nb_slices);

     if (!HAVE_THREADS || !(h->avctx->active_thread_type & FF_THREAD_SLICE)) {

         ret = ff_h264_slice_context_init(h, &h->slice_ctx[0]);

@@ -1177,6 +1178,15 @@

                 av_log(h->avctx, AV_LOG_ERROR, "Too many fields\n");

                 return AVERROR_INVALIDDATA;

             }

+            if (h->max_contexts > 1) {

+                if (!h->single_decode_warning) {

+                    av_log(h->avctx, AV_LOG_WARNING, "Cannot decode multiple access units as slice threads\n");

+                    h->single_decode_warning = 1;

+                }

+                h->max_contexts = 1;

+                return SLICE_SINGLETHREAD;

+            }

+

             if (h->cur_pic_ptr && FIELD_PICTURE(h) && h->first_field) {

                 ret = ff_h264_field_end(h, h->slice_ctx, 1);

                 h->current_slice = 0;

@@ -2362,9 +2372,11 @@

         align_get_bits(&sl->gb);

         /* init cabac */

-        ff_init_cabac_decoder(&sl->cabac,

+        ret = ff_init_cabac_decoder(&sl->cabac,

                               sl->gb.buffer + get_bits_count(&sl->gb) / 8,

                               (get_bits_left(&sl->gb) + 7) / 8);

+        if (ret < 0)

+            return ret;

         ff_h264_init_cabac_states(h, sl);

​

@@ -834,6 +834,10 @@

     }

     sps->chroma_format_idc = get_ue_golomb_long(gb);

+    if (sps->chroma_format_idc > 3U) {

+        av_log(avctx, AV_LOG_ERROR, "chroma_format_idc %d is invalid\n", sps->chroma_format_idc);

+        return AVERROR_INVALIDDATA;

+    }

     if (sps->chroma_format_idc == 3)

         sps->separate_colour_plane_flag = get_bits1(gb);

​

@@ -417,8 +417,8 @@

     info_tag    = AV_RL32(src);

     if (info_tag == MKTAG('I', 'N', 'F', 'O')) {

-        int info_offset = AV_RL32(src + 4);

-        if (info_offset > UINT32_MAX - 8 || info_offset + 8 > avpkt->size) {

+        unsigned info_offset = AV_RL32(src + 4);

+        if (info_offset > INT_MAX || info_offset + 8 > avpkt->size) {

             av_log(avctx, AV_LOG_ERROR,

                    "Invalid INFO header offset: 0x%08"PRIX32" is too large.\n",

                    info_offset);

​

@@ -30,6 +30,7 @@

 #define BITSTREAM_READER_LE

 #include "libavutil/attributes.h"

+#include "libavutil/imgutils.h"

 #include "libavutil/timer.h"

 #include "avcodec.h"

 #include "get_bits.h"

@@ -310,7 +311,7 @@

     ivi_free_buffers(planes);

-    if (cfg->pic_width < 1 || cfg->pic_height < 1 ||

+    if (av_image_check_size(cfg->pic_width, cfg->pic_height, 0, NULL) < 0 ||

         cfg->luma_bands < 1 || cfg->chroma_bands < 1)

         return AVERROR_INVALIDDATA;

​

@@ -28,6 +28,7 @@

 #include "libavutil/attributes.h"

 #include "libavutil/avassert.h"

 #include "libavutil/common.h"

+#include "libavutil/imgutils.h"

 #include "libavutil/mem.h"

 #include "avcodec.h"

 #include "jpeg2000.h"

@@ -210,9 +211,17 @@

                                    codsty->nreslevels2decode - 1,

                                    codsty->transform))

         return ret;

-    // component size comp->coord is uint16_t so ir cannot overflow

+

+    if (av_image_check_size(comp->coord[0][1] - comp->coord[0][0],

+                            comp->coord[1][1] - comp->coord[1][0], 0, avctx))

+        return AVERROR_INVALIDDATA;

     csize = (comp->coord[0][1] - comp->coord[0][0]) *

             (comp->coord[1][1] - comp->coord[1][0]);

+    if (comp->coord[0][1] - comp->coord[0][0] > 32768 ||

+        comp->coord[1][1] - comp->coord[1][0] > 32768) {

+        av_log(avctx, AV_LOG_ERROR, "component size too large\n");

+        return AVERROR_PATCHWELCOME;

+    }

     if (codsty->transform == FF_DWT97) {

         csize += AV_INPUT_BUFFER_PADDING_SIZE / sizeof(*comp->f_data);

@@ -450,7 +459,7 @@

                     return AVERROR(ENOMEM);

                 for (cblkno = 0; cblkno < nb_codeblocks; cblkno++) {

                     Jpeg2000Cblk *cblk = prec->cblk + cblkno;

-                    uint16_t Cx0, Cy0;

+                    int Cx0, Cy0;

                     /* Compute coordinates of codeblocks */

                     /* Compute Cx0*/

​

@@ -174,21 +174,21 @@

     int nb_terminationsinc;

     int data_start[JPEG2000_MAX_PASSES];

     Jpeg2000Pass passes[JPEG2000_MAX_PASSES];

-    uint16_t coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}

+    int coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}

 } Jpeg2000Cblk; // code block

 typedef struct Jpeg2000Prec {

-    uint16_t nb_codeblocks_width;

-    uint16_t nb_codeblocks_height;

+    int nb_codeblocks_width;

+    int nb_codeblocks_height;

     Jpeg2000TgtNode *zerobits;

     Jpeg2000TgtNode *cblkincl;

     Jpeg2000Cblk *cblk;

     int decoded_layers;

-    uint16_t coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}

+    int coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}

 } Jpeg2000Prec; // precinct

 typedef struct Jpeg2000Band {

-    uint16_t coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}

+    int coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}

     uint16_t log2_cblk_width, log2_cblk_height;

     int i_stepsize; // quantization stepsize

     float f_stepsize; // quantization stepsize

@@ -197,8 +197,8 @@

 typedef struct Jpeg2000ResLevel {

     uint8_t nbands;

-    uint16_t coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}

-    uint16_t num_precincts_x, num_precincts_y; // number of precincts in x/y direction

+    int coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}

+    int num_precincts_x, num_precincts_y; // number of precincts in x/y direction

     uint8_t log2_prec_width, log2_prec_height; // exponent of precinct size

     Jpeg2000Band *band;

 } Jpeg2000ResLevel; // resolution level

@@ -208,8 +208,8 @@

     DWTContext dwt;

     float *f_data;

     int *i_data;

-    uint16_t coord[2][2];   // border coordinates {{x0, x1}, {y0, y1}} -- can be reduced with lowres option

-    uint16_t coord_o[2][2]; // border coordinates {{x0, x1}, {y0, y1}} -- original values from jpeg2000 headers

+    int coord[2][2];   // border coordinates {{x0, x1}, {y0, y1}} -- can be reduced with lowres option

+    int coord_o[2][2]; // border coordinates {{x0, x1}, {y0, y1}} -- original values from jpeg2000 headers

 } Jpeg2000Component;

 /* misc tools */

​

@@ -30,6 +30,7 @@

 #include "libavutil/attributes.h"

 #include "libavutil/avassert.h"

 #include "libavutil/common.h"

+#include "libavutil/imgutils.h"

 #include "libavutil/opt.h"

 #include "libavutil/pixdesc.h"

 #include "avcodec.h"

@@ -279,6 +280,10 @@

         avpriv_request_sample(s->avctx, "Support for image offsets");

         return AVERROR_PATCHWELCOME;

     }

+    if (av_image_check_size(s->width, s->height, 0, s->avctx)) {

+        avpriv_request_sample(s->avctx, "Large Dimensions");

+        return AVERROR_PATCHWELCOME;

+    }

     if (ncomponents <= 0) {

         av_log(s->avctx, AV_LOG_ERROR, "Invalid number of components: %d\n",

@@ -826,10 +831,10 @@

     if (!tile->comp)

         return AVERROR(ENOMEM);

-    tile->coord[0][0] = FFMAX(tilex       * s->tile_width  + s->tile_offset_x, s->image_offset_x);

-    tile->coord[0][1] = FFMIN((tilex + 1) * s->tile_width  + s->tile_offset_x, s->width);

-    tile->coord[1][0] = FFMAX(tiley       * s->tile_height + s->tile_offset_y, s->image_offset_y);

-    tile->coord[1][1] = FFMIN((tiley + 1) * s->tile_height + s->tile_offset_y, s->height);

+    tile->coord[0][0] = av_clip(tilex       * (int64_t)s->tile_width  + s->tile_offset_x, s->image_offset_x, s->width);

+    tile->coord[0][1] = av_clip((tilex + 1) * (int64_t)s->tile_width  + s->tile_offset_x, s->image_offset_x, s->width);

+    tile->coord[1][0] = av_clip(tiley       * (int64_t)s->tile_height + s->tile_offset_y, s->image_offset_y, s->height);

+    tile->coord[1][1] = av_clip((tiley + 1) * (int64_t)s->tile_height + s->tile_offset_y, s->image_offset_y, s->height);

     for (compno = 0; compno < s->ncomponents; compno++) {

         Jpeg2000Component *comp = tile->comp + compno;

@@ -1809,8 +1814,10 @@

     av_freep(&s->tile);

     memset(s->codsty, 0, sizeof(s->codsty));

     memset(s->qntsty, 0, sizeof(s->qntsty));

+    memset(s->properties, 0, sizeof(s->properties));

     memset(&s->poc  , 0, sizeof(s->poc));

     s->numXtiles = s->numYtiles = 0;

+    s->ncomponents = 0;

 }

 static int jpeg2000_read_main_headers(Jpeg2000DecoderContext *s)

@@ -1868,6 +1875,10 @@

         switch (marker) {

         case JPEG2000_SIZ:

+            if (s->ncomponents) {

+                av_log(s->avctx, AV_LOG_ERROR, "Duplicate SIZ\n");

+                return AVERROR_INVALIDDATA;

+            }

             ret = get_siz(s);

             if (!s->tile)

                 s->numXtiles = s->numYtiles = 0;

​

@@ -534,7 +534,7 @@

         data[i] = (data[i] + ((1<<I_PRESHIFT)>>1)) >> I_PRESHIFT;

 }

-int ff_jpeg2000_dwt_init(DWTContext *s, uint16_t border[2][2],

+int ff_jpeg2000_dwt_init(DWTContext *s, int border[2][2],

                          int decomp_levels, int type)

 {

     int i, j, lev = decomp_levels, maxlen,

@@ -623,7 +623,7 @@

 #define MAX_W 256

-static int test_dwt(int *array, int *ref, uint16_t border[2][2], int decomp_levels, int type, int max_diff) {

+static int test_dwt(int *array, int *ref, int border[2][2], int decomp_levels, int type, int max_diff) {

     int ret, j;

     DWTContext s1={{{0}}}, *s= &s1;

     int64_t err2 = 0;

@@ -662,7 +662,7 @@

     return 0;

 }

-static int test_dwtf(float *array, float *ref, uint16_t border[2][2], int decomp_levels, float max_diff) {

+static int test_dwtf(float *array, float *ref, int border[2][2], int decomp_levels, float max_diff) {

     int ret, j;

     DWTContext s1={{{0}}}, *s= &s1;

     double err2 = 0;

@@ -708,7 +708,7 @@

 int main(void) {

     AVLFG prng;

     int i,j;

-    uint16_t border[2][2];

+    int border[2][2];

     int ret, decomp_levels;

     av_lfg_init(&prng, 1);

​

@@ -42,7 +42,7 @@

 typedef struct DWTContext {

     /// line lengths { horizontal, vertical } in consecutive decomposition levels

-    uint16_t linelen[FF_DWT_MAX_DECLVLS][2];

+    int linelen[FF_DWT_MAX_DECLVLS][2];

     uint8_t mod[FF_DWT_MAX_DECLVLS][2];  ///< coordinates (x0, y0) of decomp. levels mod 2

     uint8_t ndeclevels;                  ///< number of decomposition levels

     uint8_t type;                        ///< 0 for 9/7; 1 for 5/3

@@ -57,7 +57,7 @@

  * @param decomp_levels     number of decomposition levels

  * @param type              0 for DWT 9/7; 1 for DWT 5/3

  */

-int ff_jpeg2000_dwt_init(DWTContext *s, uint16_t border[2][2],

+int ff_jpeg2000_dwt_init(DWTContext *s, int border[2][2],

                          int decomp_levels, int type);

 int ff_dwt_encode(DWTContext *s, void *t);

​

@@ -164,6 +164,8 @@

         /* Position */

         case 'P':

+            if (!*s)

+                break;

             tag.persistent = MICRODVD_PERSISTENT_ON;

             tag.data1 = (*s++ == '1');

             if (*s != '}')

​

@@ -82,11 +82,33 @@

 #endif  // #if HAVE_MSA

 #if HAVE_MMI

-static av_cold void h264dsp_init_mmi(H264DSPContext * c,

-                                     const int bit_depth,

-                                     const int chroma_format_idc)

+static av_cold void h264dsp_init_mmi(H264DSPContext * c, const int bit_depth,

+        const int chroma_format_idc)

 {

     if (bit_depth == 8) {

+        c->h264_add_pixels4_clear = ff_h264_add_pixels4_8_mmi;

+        c->h264_idct_add = ff_h264_idct_add_8_mmi;

+        c->h264_idct8_add = ff_h264_idct8_add_8_mmi;

+        c->h264_idct_dc_add = ff_h264_idct_dc_add_8_mmi;

+        c->h264_idct8_dc_add = ff_h264_idct8_dc_add_8_mmi;

+        c->h264_idct_add16 = ff_h264_idct_add16_8_mmi;

+        c->h264_idct_add16intra = ff_h264_idct_add16intra_8_mmi;

+        c->h264_idct8_add4 = ff_h264_idct8_add4_8_mmi;

+

+        if (chroma_format_idc <= 1)

+            c->h264_idct_add8 = ff_h264_idct_add8_8_mmi;

+        else

+            c->h264_idct_add8 = ff_h264_idct_add8_422_8_mmi;

+

+        c->h264_luma_dc_dequant_idct = ff_h264_luma_dc_dequant_idct_8_mmi;

+

+        if (chroma_format_idc <= 1)

+            c->h264_chroma_dc_dequant_idct =

+                ff_h264_chroma_dc_dequant_idct_8_mmi;

+        else

+            c->h264_chroma_dc_dequant_idct =

+                ff_h264_chroma422_dc_dequant_idct_8_mmi;

+

         c->weight_h264_pixels_tab[0] = ff_h264_weight_pixels16_8_mmi;

         c->weight_h264_pixels_tab[1] = ff_h264_weight_pixels8_8_mmi;

         c->weight_h264_pixels_tab[2] = ff_h264_weight_pixels4_8_mmi;

@@ -94,6 +116,21 @@

         c->biweight_h264_pixels_tab[0] = ff_h264_biweight_pixels16_8_mmi;

         c->biweight_h264_pixels_tab[1] = ff_h264_biweight_pixels8_8_mmi;

         c->biweight_h264_pixels_tab[2] = ff_h264_biweight_pixels4_8_mmi;

+

+        c->h264_v_loop_filter_chroma       = ff_deblock_v_chroma_8_mmi;

+        c->h264_v_loop_filter_chroma_intra = ff_deblock_v_chroma_intra_8_mmi;

+

+        if (chroma_format_idc <= 1) {

+            c->h264_h_loop_filter_chroma =

+                ff_deblock_h_chroma_8_mmi;

+            c->h264_h_loop_filter_chroma_intra =

+                ff_deblock_h_chroma_intra_8_mmi;

+        }

+

+        c->h264_v_loop_filter_luma = ff_deblock_v_luma_8_mmi;

+        c->h264_v_loop_filter_luma_intra = ff_deblock_v_luma_intra_8_mmi;

+        c->h264_h_loop_filter_luma = ff_deblock_h_luma_8_mmi;

+        c->h264_h_loop_filter_luma_intra = ff_deblock_h_luma_intra_8_mmi;

     }

 }

 #endif /* HAVE_MMI */

​

@@ -319,6 +319,26 @@

 void ff_vp8_pred16x16_127_dc_8_msa(uint8_t *src, ptrdiff_t stride);

 void ff_vp8_pred16x16_129_dc_8_msa(uint8_t *src, ptrdiff_t stride);

+void ff_h264_add_pixels4_8_mmi(uint8_t *_dst, int16_t *_src, int stride);

+void ff_h264_idct_add_8_mmi(uint8_t *dst, int16_t *block, int stride);

+void ff_h264_idct8_add_8_mmi(uint8_t *dst, int16_t *block, int stride);

+void ff_h264_idct_dc_add_8_mmi(uint8_t *dst, int16_t *block, int stride);

+void ff_h264_idct8_dc_add_8_mmi(uint8_t *dst, int16_t *block, int stride);

+void ff_h264_idct_add16_8_mmi(uint8_t *dst, const int *block_offset,

+        int16_t *block, int stride, const uint8_t nnzc[15*8]);

+void ff_h264_idct_add16intra_8_mmi(uint8_t *dst, const int *block_offset,

+        int16_t *block, int stride, const uint8_t nnzc[15*8]);

+void ff_h264_idct8_add4_8_mmi(uint8_t *dst, const int *block_offset,

+        int16_t *block, int stride, const uint8_t nnzc[15*8]);

+void ff_h264_idct_add8_8_mmi(uint8_t **dest, const int *block_offset,

+        int16_t *block, int stride, const uint8_t nnzc[15*8]);

+void ff_h264_idct_add8_422_8_mmi(uint8_t **dest, const int *block_offset,

+        int16_t *block, int stride, const uint8_t nnzc[15*8]);

+void ff_h264_luma_dc_dequant_idct_8_mmi(int16_t *output, int16_t *input,

+        int qmul);

+void ff_h264_chroma_dc_dequant_idct_8_mmi(int16_t *block, int qmul);

+void ff_h264_chroma422_dc_dequant_idct_8_mmi(int16_t *block, int qmul);

+

 void ff_h264_weight_pixels16_8_mmi(uint8_t *block, int stride, int height,

         int log2_denom, int weight, int offset);

 void ff_h264_biweight_pixels16_8_mmi(uint8_t *dst, uint8_t *src,

@@ -335,6 +355,27 @@

         int stride, int height, int log2_denom, int weightd, int weights,

         int offset);

+void ff_deblock_v_chroma_8_mmi(uint8_t *pix, int stride, int alpha, int beta,

+        int8_t *tc0);

+void ff_deblock_v_chroma_intra_8_mmi(uint8_t *pix, int stride, int alpha,

+        int beta);

+void ff_deblock_h_chroma_8_mmi(uint8_t *pix, int stride, int alpha, int beta,

+        int8_t *tc0);

+void ff_deblock_h_chroma_intra_8_mmi(uint8_t *pix, int stride, int alpha,

+        int beta);

+void ff_deblock_v_luma_8_mmi(uint8_t *pix, int stride, int alpha, int beta,

+        int8_t *tc0);

+void ff_deblock_v_luma_intra_8_mmi(uint8_t *pix, int stride, int alpha,

+        int beta);

+void ff_deblock_h_luma_8_mmi(uint8_t *pix, int stride, int alpha, int beta,

+        int8_t *tc0);

+void ff_deblock_h_luma_intra_8_mmi(uint8_t *pix, int stride, int alpha,

+        int beta);

+void ff_deblock_v8_luma_8_mmi(uint8_t *pix, int stride, int alpha, int beta,

+        int8_t *tc0);

+void ff_deblock_v8_luma_intra_8_mmi(uint8_t *pix, int stride, int alpha,

+        int beta);

+

 void ff_put_h264_qpel16_mc00_mmi(uint8_t *dst, const uint8_t *src,

         ptrdiff_t dst_stride);

 void ff_put_h264_qpel16_mc10_mmi(uint8_t *dst, const uint8_t *src,

​

@@ -4,6 +4,7 @@

  * Copyright (c) 2015 Loongson Technology Corporation Limited

  * Copyright (c) 2015 Zhou Xiaoyong <zhouxiaoyong@loongson.cn>

  *                    Zhang Shuangshuang <zhangshuangshuang@ict.ac.cn>

+ *                    Heiher <r@hev.cc>

  *

  * This file is part of FFmpeg.

  *

@@ -25,6 +26,1011 @@

 #include "libavcodec/bit_depth_template.c"

 #include "h264dsp_mips.h"

+void ff_h264_add_pixels4_8_mmi(uint8_t *dst, int16_t *src, int stride)

+{

+    __asm__ volatile (

+        "xor $f0, $f0, $f0              \r\n"

+        "ldc1 $f2, 0(%[src])            \r\n"

+        "ldc1 $f4, 8(%[src])            \r\n"

+        "ldc1 $f6, 16(%[src])           \r\n"

+        "ldc1 $f8, 24(%[src])           \r\n"

+        "lwc1 $f10, 0(%[dst0])          \r\n"

+        "lwc1 $f12, 0(%[dst1])          \r\n"

+        "lwc1 $f14, 0(%[dst2])          \r\n"

+        "lwc1 $f16, 0(%[dst3])          \r\n"

+        "punpcklbh $f10, $f10, $f0      \r\n"

+        "punpcklbh $f12, $f12, $f0      \r\n"

+        "punpcklbh $f14, $f14, $f0      \r\n"

+        "punpcklbh $f16, $f16, $f0      \r\n"

+        "paddh $f2, $f2, $f10           \r\n"

+        "paddh $f4, $f4, $f12           \r\n"

+        "paddh $f6, $f6, $f14           \r\n"

+        "paddh $f8, $f8, $f16           \r\n"

+        "packushb $f2, $f2, $f0         \r\n"

+        "packushb $f4, $f4, $f0         \r\n"

+        "packushb $f6, $f6, $f0         \r\n"

+        "packushb $f8, $f8, $f0         \r\n"

+        "swc1 $f2, 0(%[dst0])           \r\n"

+        "swc1 $f4, 0(%[dst1])           \r\n"

+        "swc1 $f6, 0(%[dst2])           \r\n"

+        "swc1 $f8, 0(%[dst3])           \r\n"

+        ::[dst0]"r"(dst),[dst1]"r"(dst+stride),[dst2]"r"(dst+2*stride),

+          [dst3]"r"(dst+3*stride),[src]"r"(src)

+        : "$f0","$f2","$f4","$f6","$f8","$f10","$f12","$f14","$f16"

+    );