@@ -1,4 +1,9 @@

 -------------------------------------------------------------------

+We Dec 23 13:25:33 UTC 2015 - joerg.lorenzen@ki.tng.de

+

+- update internal ffmpeg to version 2.8.4

+

+-------------------------------------------------------------------

 Sat Dec 05 12:23:17 UTC 2015 - joerg.lorenzen@ki.tng.de

 - update internal ffmpeg to version 2.8.3

​

@@ -16,7 +16,7 @@

 #

-%define         ffmpeg_version 2.8.3

+%define         ffmpeg_version 2.8.4

 Name:           avidemux3

 Summary:        Graphical video editing and transcoding tool

​

@@ -1,6 +1,74 @@

 Entries are sorted chronologically from oldest to youngest within each release,

 releases are sorted from youngest to oldest.

+version 2.8.4

+- rawdec: only exempt BIT0 with need_copy from buffer sanity check

+- mlvdec: check that index_entries exist

+- avcodec/mpeg4videodec: also for empty partitioned slices

+- avcodec/h264_refs: Fix long_idx check

+- avcodec/h264_mc_template: prefetch list1 only if it is used in the MB

+- avcodec/h264_slice: Simplify ref2frm indexing

+- avfilter/vf_mpdecimate: Add missing emms_c()

+- sonic: make sure num_taps * channels is not larger than frame_size

+- opus_silk: fix typo causing overflow in silk_stabilize_lsf

+- ffm: reject invalid codec_id and codec_type

+- golomb: always check for invalid UE golomb codes in get_ue_golomb

+- sbr_qmf_analysis: sanitize input for 32-bit imdct

+- sbrdsp_fixed: assert that input values are in the valid range

+- aacsbr: ensure strictly monotone time borders

+- aacenc: update max_sfb when num_swb changes

+- aaccoder: prevent crash of anmr coder

+- ffmdec: reject zero-sized chunks

+- swscale/x86/rgb2rgb_template: Fallback to mmx in interleaveBytes() if the alignment is insufficient for SSE*

+- swscale/x86/rgb2rgb_template: Do not crash on misaligend stride

+- avformat/mxfenc: Do not crash if there is no packet in the first stream

+- lavf/tee: fix side data double free.

+- avformat/hlsenc: Check the return code of avformat_write_header()

+- avformat/mov: Enable parser for mp3s by old HandBrake

+- avformat/mxfenc: Fix integer overflow in length computation

+- avformat/utils: estimate_timings_from_pts - increase retry counter, fixes invalid duration for ts files with hevc codec

+- avformat/matroskaenc: Check codecdelay before use

+- avutil/mathematics: Fix division by 0

+- mjpegdec: consider chroma subsampling in size check

+- libvpxenc: remove some unused ctrl id mappings

+- avcodec/vp3: ensure header is parsed successfully before tables

+- avcodec/jpeg2000dec: Check bpno in decode_cblk()

+- avcodec/pgssubdec: Fix left shift of 255 by 24 places cannot be represented in type int

+- swscale/utils: Fix for runtime error: left shift of negative value -1

+- avcodec/hevc: Fix integer overflow of entry_point_offset

+- avcodec/dirac_parser: Check that there is a previous PU before accessing it

+- avcodec/dirac_parser: Add basic validity checks for next_pu_offset and prev_pu_offset

+- avcodec/dirac_parser: Fix potential overflows in pointer checks

+- avcodec/wmaprodec: Check bits per sample to be within the range not causing integer overflows

+- avcodec/wmaprodec: Fix overflow of cutoff

+- avformat/smacker: fix integer overflow with pts_inc

+- avcodec/vp3: Fix "runtime error: left shift of negative value"

+- avformat/riffdec: Initialize bitrate

+- mpegencts: Fix overflow in cbr mode period calculations

+- avutil/timecode: Fix fps check

+- avutil/mathematics: return INT64_MIN (=AV_NOPTS_VALUE) from av_rescale_rnd() for overflows

+- avcodec/apedec: Check length in long_filter_high_3800()

+- avcodec/vp3: always set pix_fmt in theora_decode_header()

+- avcodec/mpeg4videodec: Check available data before reading custom matrix

+- avutil/mathematics: Do not treat INT64_MIN as positive in av_rescale_rnd

+- avutil/integer: Fix av_mod_i() with negative dividend

+- avformat/dump: Fix integer overflow in av_dump_format()

+- avcodec/h264_refs: Check that long references match before use

+- avcodec/utils: Clear dimensions in ff_get_buffer() on failure

+- avcodec/utils: Use 64bit for aspect ratio calculation in avcodec_string()

+- avcodec/hevc: Check max ctb addresses for WPP

+- avcodec/vp3: Clear context on reinitialization failure

+- avcodec/hevc: allocate entries unconditionally

+- avcodec/hevc_cabac: Fix multiple integer overflows

+- avcodec/jpeg2000dwt: Check ndeclevels before calling dwt_encode*()

+- avcodec/jpeg2000dwt: Check ndeclevels before calling dwt_decode*()

+- avcodec/hevc: Check entry_point_offsets

+- lavf/rtpenc_jpeg: Less strict check for standard Huffman tables.

+- avcodec/ffv1dec: Clear quant_table_count if its invalid

+- avcodec/ffv1dec: Print an error if the quant table count is invalid

+- doc/filters/drawtext: fix centering example

+

+

 version 2.8.3

 - avcodec/cabac: Check initial cabac decoder state

 - avcodec/cabac_functions: Fix "left shift of negative value -31767"

​

@@ -1,1 +1,1 @@

-2.8.3

+2.8.4

​

@@ -1,1 +1,1 @@

-2.8.3

+2.8.4

​

@@ -31,7 +31,7 @@

 # This could be handy for archiving the generated documentation or

 # if some version control system is used.

-PROJECT_NUMBER         = 2.8.3

+PROJECT_NUMBER         = 2.8.4

 # With the PROJECT_LOGO tag one can specify a logo or icon that is included

 # in the documentation. The maximum height of the logo should not exceed 55

​

@@ -4967,7 +4967,7 @@

 @item

 Show the text at the center of the video frame:

 @example

-drawtext="fontsize=30:fontfile=FreeSerif.ttf:text='hello world':x=(w-text_w)/2:y=(h-text_h-line_h)/2"

+drawtext="fontsize=30:fontfile=FreeSerif.ttf:text='hello world':x=(w-text_w)/2:y=(h-text_h)/2"

 @end example

 @item

​

@@ -499,7 +499,7 @@

     }

     while (idx) {

         sce->sf_idx[bandaddr[idx]] = minq + q0;

-        minq = paths[idx][minq].prev;

+        minq = FFMAX(paths[idx][minq].prev, 0);

         idx--;

     }

     //set the same quantizers inside window groups

​

@@ -547,6 +547,7 @@

             ics->num_windows        = wi[ch].num_windows;

             ics->swb_sizes          = s->psy.bands    [ics->num_windows == 8];

             ics->num_swb            = tag == TYPE_LFE ? ics->num_swb : s->psy.num_bands[ics->num_windows == 8];

+            ics->max_sfb            = FFMIN(ics->max_sfb, ics->num_swb);

             ics->swb_offset         = wi[ch].window_type[0] == EIGHT_SHORT_SEQUENCE ?

                                         ff_swb_offset_128 [s->samplerate_index]:

                                         ff_swb_offset_1024[s->samplerate_index];

​

@@ -718,8 +718,8 @@

     }

     for (i = 1; i <= ch_data->bs_num_env; i++) {

-        if (ch_data->t_env[i-1] > ch_data->t_env[i]) {

-            av_log(ac->avctx, AV_LOG_ERROR, "Non monotone time borders\n");

+        if (ch_data->t_env[i-1] >= ch_data->t_env[i]) {

+            av_log(ac->avctx, AV_LOG_ERROR, "Not strictly monotone time borders\n");

             return -1;

         }

     }

@@ -1154,6 +1154,9 @@

                              INTFLOAT z[320], INTFLOAT W[2][32][32][2], int buf_idx)

 {

     int i;

+#if USE_FIXED

+    int j;

+#endif

     memcpy(x    , x+1024, (320-32)*sizeof(x[0]));

     memcpy(x+288, in,         1024*sizeof(x[0]));

     for (i = 0; i < 32; i++) { // numTimeSlots*RATE = 16*2 as 960 sample frames

@@ -1161,6 +1164,21 @@

         dsp->vector_fmul_reverse(z, sbr_qmf_window_ds, x, 320);

         sbrdsp->sum64x5(z);

         sbrdsp->qmf_pre_shuffle(z);

+#if USE_FIXED

+        for (j = 64; j < 128; j++) {

+            if (z[j] > 1<<24) {

+                av_log(NULL, AV_LOG_WARNING,

+                       "sbr_qmf_analysis: value %09d too large, setting to %09d\n",

+                       z[j], 1<<24);

+                z[j] = 1<<24;

+            } else if (z[j] < -(1<<24)) {

+                av_log(NULL, AV_LOG_WARNING,

+                       "sbr_qmf_analysis: value %09d too small, setting to %09d\n",

+                       z[j], -(1<<24));

+                z[j] = -(1<<24);

+            }

+        }

+#endif

         mdct->imdct_half(mdct, z, z+64);

         sbrdsp->qmf_post_shuffle(W[buf_idx][i], z);

         x += 32;

​

@@ -892,6 +892,9 @@

     int32_t dotprod, sign;

     int32_t coeffs[256], delay[256];

+    if (order >= length)

+        return;

+

     memset(coeffs, 0, order * sizeof(*coeffs));

     for (i = 0; i < order; i++)

         delay[i] = buffer[i];

​

@@ -100,10 +100,12 @@

 static int unpack_parse_unit(DiracParseUnit *pu, DiracParseContext *pc,

                              int offset)

 {

-    uint8_t *start = pc->buffer + offset;

-    uint8_t *end   = pc->buffer + pc->index;

-    if (start < pc->buffer || (start + 13 > end))

+    int8_t *start;

+

+    if (offset < 0 || pc->index - 13 < offset)

         return 0;

+

+    start = pc->buffer + offset;

     pu->pu_type = start[4];

     pu->next_pu_offset = AV_RB32(start + 5);

@@ -112,6 +114,15 @@

     if (pu->pu_type == 0x10 && pu->next_pu_offset == 0)

         pu->next_pu_offset = 13;

+    if (pu->next_pu_offset && pu->next_pu_offset < 13) {

+        av_log(NULL, AV_LOG_ERROR, "next_pu_offset %d is invalid\n", pu->next_pu_offset);

+        return 0;

+    }

+    if (pu->prev_pu_offset && pu->prev_pu_offset < 13) {

+        av_log(NULL, AV_LOG_ERROR, "prev_pu_offset %d is invalid\n", pu->prev_pu_offset);

+        return 0;

+    }

+

     return 1;

 }

@@ -190,7 +201,7 @@

         }

         /* Get the picture number to set the pts and dts*/

-        if (parse_timing_info) {

+        if (parse_timing_info && pu1.prev_pu_offset >= 13) {

             uint8_t *cur_pu = pc->buffer +

                               pc->index - 13 - pu1.prev_pu_offset;

             int pts = AV_RB32(cur_pu + 13);

​

@@ -569,8 +569,11 @@

     }

     f->quant_table_count = get_symbol(c, state, 0);

-    if (f->quant_table_count > (unsigned)MAX_QUANT_TABLES || !f->quant_table_count)

+    if (f->quant_table_count > (unsigned)MAX_QUANT_TABLES || !f->quant_table_count) {

+        av_log(f->avctx, AV_LOG_ERROR, "quant table count %d is invalid\n", f->quant_table_count);

+        f->quant_table_count = 0;

         return AVERROR_INVALIDDATA;

+    }

     for (i = 0; i < f->quant_table_count; i++) {

         f->context_count[i] = read_quant_tables(c, f->quant_tables[i]);

​

@@ -68,7 +68,7 @@

         int log = 2 * av_log2(buf) - 31;

         LAST_SKIP_BITS(re, gb, 32 - log);

         CLOSE_READER(re, gb);

-        if (CONFIG_FTRAPV && log < 0) {

+        if (log < 7) {

             av_log(NULL, AV_LOG_ERROR, "Invalid UE golomb code\n");

             return AVERROR_INVALIDDATA;

         }

​

@@ -158,6 +158,7 @@

         }

     }

-    prefetch_motion(h, sl, 1, PIXEL_SHIFT, CHROMA_IDC);

+    if (USES_LIST(mb_type, 1))

+        prefetch_motion(h, sl, 1, PIXEL_SHIFT, CHROMA_IDC);

 }

​

@@ -122,6 +122,14 @@

     return out_i;

 }

+static int mismatches_ref(H264Context *h, H264Picture *pic)

+{

+    AVFrame *f = pic->f;

+    return (h->cur_pic_ptr->f->width  != f->width ||

+            h->cur_pic_ptr->f->height != f->height ||

+            h->cur_pic_ptr->f->format != f->format);

+}

+

 int ff_h264_fill_default_ref_list(H264Context *h, H264SliceContext *sl)

 {

     int i, len;

@@ -193,10 +201,7 @@

     for (j = 0; j<1+(sl->slice_type_nos == AV_PICTURE_TYPE_B); j++) {

         for (i = 0; i < sl->ref_count[j]; i++) {

             if (h->default_ref_list[j][i].parent) {

-                AVFrame *f = h->default_ref_list[j][i].parent->f;

-                if (h->cur_pic_ptr->f->width  != f->width ||

-                    h->cur_pic_ptr->f->height != f->height ||

-                    h->cur_pic_ptr->f->format != f->format) {

+                if (mismatches_ref(h, h->default_ref_list[j][i].parent)) {

                     av_log(h->avctx, AV_LOG_ERROR, "Discarding mismatching reference\n");

                     memset(&h->default_ref_list[j][i], 0, sizeof(h->default_ref_list[j][i]));

                 }

@@ -298,14 +303,14 @@

                     long_idx = pic_num_extract(h, pic_id, &pic_structure);

-                    if (long_idx > 31) {

+                    if (long_idx > 31U) {

                         av_log(h->avctx, AV_LOG_ERROR,

                                "long_term_pic_idx overflow\n");

                         return AVERROR_INVALIDDATA;

                     }

                     ref = h->long_ref[long_idx];

                     assert(!(ref && !ref->reference));

-                    if (ref && (ref->reference & pic_structure)) {

+                    if (ref && (ref->reference & pic_structure) && !mismatches_ref(h, ref)) {

                         ref->pic_id = pic_id;

                         assert(ref->long_ref);

                         i = 0;

​

@@ -1993,12 +1993,12 @@

         if (USES_LIST(top_type, list)) {

             const int b_xy  = h->mb2b_xy[top_xy] + 3 * b_stride;

             const int b8_xy = 4 * top_xy + 2;

-            int (*ref2frm)[64] = (void*)(sl->ref2frm[h->slice_table[top_xy] & (MAX_SLICES - 1)][0] + (MB_MBAFF(sl) ? 20 : 2));

+            int *ref2frm = sl->ref2frm[h->slice_table[top_xy] & (MAX_SLICES - 1)][list] + (MB_MBAFF(sl) ? 20 : 2);

             AV_COPY128(mv_dst - 1 * 8, h->cur_pic.motion_val[list][b_xy + 0]);

             ref_cache[0 - 1 * 8] =

-            ref_cache[1 - 1 * 8] = ref2frm[list][h->cur_pic.ref_index[list][b8_xy + 0]];

+            ref_cache[1 - 1 * 8] = ref2frm[h->cur_pic.ref_index[list][b8_xy + 0]];

             ref_cache[2 - 1 * 8] =

-            ref_cache[3 - 1 * 8] = ref2frm[list][h->cur_pic.ref_index[list][b8_xy + 1]];

+            ref_cache[3 - 1 * 8] = ref2frm[h->cur_pic.ref_index[list][b8_xy + 1]];

         } else {

             AV_ZERO128(mv_dst - 1 * 8);

             AV_WN32A(&ref_cache[0 - 1 * 8], ((LIST_NOT_USED) & 0xFF) * 0x01010101u);

@@ -2008,15 +2008,15 @@

             if (USES_LIST(left_type[LTOP], list)) {

                 const int b_xy  = h->mb2b_xy[left_xy[LTOP]] + 3;

                 const int b8_xy = 4 * left_xy[LTOP] + 1;

-                int (*ref2frm)[64] =(void*)( sl->ref2frm[h->slice_table[left_xy[LTOP]] & (MAX_SLICES - 1)][0] + (MB_MBAFF(sl) ? 20 : 2));

+                int *ref2frm = sl->ref2frm[h->slice_table[left_xy[LTOP]] & (MAX_SLICES - 1)][list] + (MB_MBAFF(sl) ? 20 : 2);

                 AV_COPY32(mv_dst - 1 +  0, h->cur_pic.motion_val[list][b_xy + b_stride * 0]);

                 AV_COPY32(mv_dst - 1 +  8, h->cur_pic.motion_val[list][b_xy + b_stride * 1]);

                 AV_COPY32(mv_dst - 1 + 16, h->cur_pic.motion_val[list][b_xy + b_stride * 2]);

                 AV_COPY32(mv_dst - 1 + 24, h->cur_pic.motion_val[list][b_xy + b_stride * 3]);

                 ref_cache[-1 +  0] =

-                ref_cache[-1 +  8] = ref2frm[list][h->cur_pic.ref_index[list][b8_xy + 2 * 0]];

+                ref_cache[-1 +  8] = ref2frm[h->cur_pic.ref_index[list][b8_xy + 2 * 0]];

                 ref_cache[-1 + 16] =

-                ref_cache[-1 + 24] = ref2frm[list][h->cur_pic.ref_index[list][b8_xy + 2 * 1]];

+                ref_cache[-1 + 24] = ref2frm[h->cur_pic.ref_index[list][b8_xy + 2 * 1]];

             } else {

                 AV_ZERO32(mv_dst - 1 +  0);

                 AV_ZERO32(mv_dst - 1 +  8);

@@ -2041,9 +2041,9 @@

     {

         int8_t *ref = &h->cur_pic.ref_index[list][4 * mb_xy];

-        int (*ref2frm)[64] = (void*)(sl->ref2frm[sl->slice_num & (MAX_SLICES - 1)][0] + (MB_MBAFF(sl) ? 20 : 2));

-        uint32_t ref01 = (pack16to32(ref2frm[list][ref[0]], ref2frm[list][ref[1]]) & 0x00FF00FF) * 0x0101;

-        uint32_t ref23 = (pack16to32(ref2frm[list][ref[2]], ref2frm[list][ref[3]]) & 0x00FF00FF) * 0x0101;

+        int *ref2frm = sl->ref2frm[sl->slice_num & (MAX_SLICES - 1)][list] + (MB_MBAFF(sl) ? 20 : 2);

+        uint32_t ref01 = (pack16to32(ref2frm[ref[0]], ref2frm[ref[1]]) & 0x00FF00FF) * 0x0101;

+        uint32_t ref23 = (pack16to32(ref2frm[ref[2]], ref2frm[ref[3]]) & 0x00FF00FF) * 0x0101;

         AV_WN32A(&ref_cache[0 * 8], ref01);

         AV_WN32A(&ref_cache[1 * 8], ref01);

         AV_WN32A(&ref_cache[2 * 8], ref23);

​

@@ -744,7 +744,7 @@

             av_freep(&sh->entry_point_offset);

             av_freep(&sh->offset);

             av_freep(&sh->size);

-            sh->entry_point_offset = av_malloc_array(sh->num_entry_point_offsets, sizeof(int));

+            sh->entry_point_offset = av_malloc_array(sh->num_entry_point_offsets, sizeof(unsigned));

             sh->offset = av_malloc_array(sh->num_entry_point_offsets, sizeof(int));

             sh->size = av_malloc_array(sh->num_entry_point_offsets, sizeof(int));

             if (!sh->entry_point_offset || !sh->offset || !sh->size) {

@@ -2440,8 +2440,8 @@

     HEVCLocalContext *lc = s->HEVClc;

     int *ret = av_malloc_array(s->sh.num_entry_point_offsets + 1, sizeof(int));

     int *arg = av_malloc_array(s->sh.num_entry_point_offsets + 1, sizeof(int));

-    int offset;

-    int startheader, cmpt = 0;

+    int64_t offset;

+    int64_t startheader, cmpt = 0;

     int i, j, res = 0;

     if (!ret || !arg) {

@@ -2450,11 +2450,18 @@

         return AVERROR(ENOMEM);

     }

+    if (s->sh.slice_ctb_addr_rs + s->sh.num_entry_point_offsets * s->ps.sps->ctb_width >= s->ps.sps->ctb_width * s->ps.sps->ctb_height) {

+        av_log(s->avctx, AV_LOG_ERROR, "WPP ctb addresses are wrong (%d %d %d %d)\n",

+            s->sh.slice_ctb_addr_rs, s->sh.num_entry_point_offsets,

+            s->ps.sps->ctb_width, s->ps.sps->ctb_height

+        );

+        res = AVERROR_INVALIDDATA;

+        goto error;

+    }

-    if (!s->sList[1]) {

-        ff_alloc_entries(s->avctx, s->sh.num_entry_point_offsets + 1);

-

+    ff_alloc_entries(s->avctx, s->sh.num_entry_point_offsets + 1);

+    if (!s->sList[1]) {

         for (i = 1; i < s->threads_number; i++) {

             s->sList[i] = av_malloc(sizeof(HEVCContext));

             memcpy(s->sList[i], s, sizeof(HEVCContext));

@@ -2487,6 +2494,11 @@

     }

     if (s->sh.num_entry_point_offsets != 0) {

         offset += s->sh.entry_point_offset[s->sh.num_entry_point_offsets - 1] - cmpt;

+        if (length < offset) {

+            av_log(s->avctx, AV_LOG_ERROR, "entry_point_offset table is corrupted\n");

+            res = AVERROR_INVALIDDATA;

+            goto error;

+        }

         s->sh.size[s->sh.num_entry_point_offsets - 1] = length - offset;

         s->sh.offset[s->sh.num_entry_point_offsets - 1] = offset;

@@ -2513,6 +2525,7 @@

     for (i = 0; i <= s->sh.num_entry_point_offsets; i++)

         res += ret[i];

+error:

     av_free(ret);

     av_free(arg);

     return res;

​

@@ -622,7 +622,7 @@

     unsigned int max_num_merge_cand; ///< 5 - 5_minus_max_num_merge_cand

-    int *entry_point_offset;

+    unsigned *entry_point_offset;

     int * offset;

     int * size;

     int num_entry_point_offsets;

​

@@ -831,11 +831,13 @@

     int k = 1;

     while (k < CABAC_MAX_BIN && get_cabac_bypass(&s->HEVClc->cc)) {

-        ret += 1 << k;

+        ret += 1U << k;

         k++;

     }

-    if (k == CABAC_MAX_BIN)

+    if (k == CABAC_MAX_BIN) {

         av_log(s->avctx, AV_LOG_ERROR, "CABAC_MAX_BIN : %d\n", k);

+        return 0;

+    }

     while (k--)

         ret += get_cabac_bypass(&s->HEVClc->cc) << k;

     return get_cabac_bypass_sign(&s->HEVClc->cc, -ret);

@@ -973,8 +975,10 @@

     while (prefix < CABAC_MAX_BIN && get_cabac_bypass(&s->HEVClc->cc))

         prefix++;

-    if (prefix == CABAC_MAX_BIN)

+    if (prefix == CABAC_MAX_BIN) {

         av_log(s->avctx, AV_LOG_ERROR, "CABAC_MAX_BIN : %d\n", prefix);

+        return 0;

+    }

     if (prefix < 3) {

         for (i = 0; i < rc_rice_param; i++)

             suffix = (suffix << 1) | get_cabac_bypass(&s->HEVClc->cc);

​

@@ -1489,6 +1489,10 @@

     ff_mqc_initdec(&t1->mqc, cblk->data, 0, 1);

     while (passno--) {

+        if (bpno < 0) {

+            av_log(s->avctx, AV_LOG_ERROR, "bpno became negative\n");

+            return AVERROR_INVALIDDATA;

+        }

         switch(pass_t) {

         case 0:

             decode_sigpass(t1, width, height, bpno + 1, bandpos,

​

@@ -580,6 +580,9 @@

 int ff_dwt_encode(DWTContext *s, void *t)

 {

+    if (s->ndeclevels == 0)

+        return 0;

+

     switch(s->type){

         case FF_DWT97:

             dwt_encode97_float(s, t); break;

@@ -595,6 +598,9 @@

 int ff_dwt_decode(DWTContext *s, void *t)

 {

+    if (s->ndeclevels == 0)

+        return 0;

+

     switch (s->type) {

     case FF_DWT97:

         dwt_decode97_float(s, t);

​

@@ -104,19 +104,11 @@

 /** String mappings for enum vp8e_enc_control_id */

 static const char *const ctlidstr[] = {

-    [VP8E_UPD_ENTROPY]           = "VP8E_UPD_ENTROPY",

-    [VP8E_UPD_REFERENCE]         = "VP8E_UPD_REFERENCE",

-    [VP8E_USE_REFERENCE]         = "VP8E_USE_REFERENCE",

-    [VP8E_SET_ROI_MAP]           = "VP8E_SET_ROI_MAP",

-    [VP8E_SET_ACTIVEMAP]         = "VP8E_SET_ACTIVEMAP",

-    [VP8E_SET_SCALEMODE]         = "VP8E_SET_SCALEMODE",

     [VP8E_SET_CPUUSED]           = "VP8E_SET_CPUUSED",

     [VP8E_SET_ENABLEAUTOALTREF]  = "VP8E_SET_ENABLEAUTOALTREF",

     [VP8E_SET_NOISE_SENSITIVITY] = "VP8E_SET_NOISE_SENSITIVITY",

-    [VP8E_SET_SHARPNESS]         = "VP8E_SET_SHARPNESS",

     [VP8E_SET_STATIC_THRESHOLD]  = "VP8E_SET_STATIC_THRESHOLD",

     [VP8E_SET_TOKEN_PARTITIONS]  = "VP8E_SET_TOKEN_PARTITIONS",

-    [VP8E_GET_LAST_QUANTIZER]    = "VP8E_GET_LAST_QUANTIZER",

     [VP8E_SET_ARNR_MAXFRAMES]    = "VP8E_SET_ARNR_MAXFRAMES",

     [VP8E_SET_ARNR_STRENGTH]     = "VP8E_SET_ARNR_STRENGTH",

     [VP8E_SET_ARNR_TYPE]         = "VP8E_SET_ARNR_TYPE",

​

@@ -1246,7 +1246,7 @@

                              int mb_bitmask_size,

                              const AVFrame *reference)

 {

-    int i, mb_x, mb_y;

+    int i, mb_x, mb_y, chroma_h_shift, chroma_v_shift, chroma_width, chroma_height;

     uint8_t *data[MAX_COMPONENTS];

     const uint8_t *reference_data[MAX_COMPONENTS];

     int linesize[MAX_COMPONENTS];

@@ -1263,6 +1263,11 @@

     s->restart_count = 0;

+    av_pix_fmt_get_chroma_sub_sample(s->avctx->pix_fmt, &chroma_h_shift,

+                                     &chroma_v_shift);

+    chroma_width  = FF_CEIL_RSHIFT(s->width,  chroma_h_shift);

+    chroma_height = FF_CEIL_RSHIFT(s->height, chroma_v_shift);

+

     for (i = 0; i < nb_components; i++) {

         int c   = s->comp_index[i];

         data[c] = s->picture_ptr->data[c];

@@ -1299,8 +1304,8 @@

                     if (s->interlaced && s->bottom_field)

                         block_offset += linesize[c] >> 1;

-                    if (   8*(h * mb_x + x) < s->width

-                        && 8*(v * mb_y + y) < s->height) {

+                    if (   8*(h * mb_x + x) < ((c == 1) || (c == 2) ? chroma_width  : s->width)

+                        && 8*(v * mb_y + y) < ((c == 1) || (c == 2) ? chroma_height : s->height)) {

                         ptr = data[c] + block_offset;

                     } else

                         ptr = NULL;

​

@@ -883,7 +883,7 @@

     const int part_a_end   = s->pict_type == AV_PICTURE_TYPE_I ? (ER_DC_END   | ER_MV_END)   : ER_MV_END;

     mb_num = mpeg4_decode_partition_a(ctx);

-    if (mb_num < 0) {

+    if (mb_num <= 0) {

         ff_er_add_slice(&s->er, s->resync_mb_x, s->resync_mb_y,

                         s->mb_x, s->mb_y, part_a_error);

         return -1;

@@ -1881,6 +1881,10 @@

                 int last = 0;

                 for (i = 0; i < 64; i++) {

                     int j;

+                    if (get_bits_left(gb) < 8) {

+                        av_log(s->avctx, AV_LOG_ERROR, "insufficient data for custom matrix\n");

+                        return AVERROR_INVALIDDATA;

+                    }

                     v = get_bits(gb, 8);

                     if (v == 0)

                         break;

@@ -1904,6 +1908,10 @@

                 int last = 0;

                 for (i = 0; i < 64; i++) {

                     int j;

+                    if (get_bits_left(gb) < 8) {

+                        av_log(s->avctx, AV_LOG_ERROR, "insufficient data for custom matrix\n");

+                        return AVERROR_INVALIDDATA;

+                    }

                     v = get_bits(gb, 8);

                     if (v == 0)

                         break;

​

@@ -824,7 +824,7 @@

             /* upper extent */

             for (i = order; i > k; i--)

-                max_center -= min_delta[k];

+                max_center -= min_delta[i];

             max_center -= min_delta[k] >> 1;

             /* move apart */

​

@@ -33,7 +33,7 @@

 #include "libavutil/imgutils.h"

 #include "libavutil/opt.h"

-#define RGBA(r,g,b,a) (((a) << 24) | ((r) << 16) | ((g) << 8) | (b))

+#define RGBA(r,g,b,a) (((unsigned)(a) << 24) | ((r) << 16) | ((g) << 8) | (b))

 #define MAX_EPOCH_PALETTES 8   // Max 8 allowed per PGS epoch

 #define MAX_EPOCH_OBJECTS  64  // Max 64 allowed per PGS epoch

 #define MAX_OBJECT_REFS    2   // Max objects per display set

​

@@ -258,7 +258,7 @@

         buf += buf_size - context->frame_size;

     len = context->frame_size - (avctx->pix_fmt==AV_PIX_FMT_PAL8 ? AVPALETTE_SIZE : 0);

-    if (buf_size < len && (avctx->codec_tag & 0xFFFFFF) != MKTAG('B','I','T', 0)) {

+    if (buf_size < len && ((avctx->codec_tag & 0xFFFFFF) != MKTAG('B','I','T', 0) || !need_copy)) {

         av_log(avctx, AV_LOG_ERROR, "Invalid buffer size, packet size %d < expected frame_size %d\n", buf_size, len);

         av_buffer_unref(&frame->buf[0]);

         return AVERROR(EINVAL);

​

@@ -38,9 +38,14 @@

     int i, nz, round;

     for (i = 0; i < n; i += 2) {

+        // Larger values are inavlid and could cause overflows of accu.

+        av_assert2(FFABS(x[i + 0][0]) >> 29 == 0);

         accu += (int64_t)x[i + 0][0] * x[i + 0][0];

+        av_assert2(FFABS(x[i + 0][1]) >> 29 == 0);

         accu += (int64_t)x[i + 0][1] * x[i + 0][1];

+        av_assert2(FFABS(x[i + 1][0]) >> 29 == 0);

         accu += (int64_t)x[i + 1][0] * x[i + 1][0];

+        av_assert2(FFABS(x[i + 1][1]) >> 29 == 0);

         accu += (int64_t)x[i + 1][1] * x[i + 1][1];

     }

​

@@ -928,6 +928,13 @@

     s->frame_size = s->channels*s->block_align*s->downsampling;

 //    avctx->frame_size = s->block_align;

+    if (s->num_taps * s->channels > s->frame_size) {

+        av_log(avctx, AV_LOG_ERROR,

+               "number of taps times channels (%d * %d) larger than frame size %d\n",

+               s->num_taps, s->channels, s->frame_size);

+        return AVERROR_INVALIDDATA;

+    }

+

     av_log(avctx, AV_LOG_INFO, "Sonic: ver: %d.%d ls: %d dr: %d taps: %d block: %d frame: %d downsamp: %d\n",

         s->version, s->minor_version, s->lossless, s->decorrelation, s->num_taps, s->block_align, s->frame_size, s->downsampling);

​

@@ -1040,8 +1040,10 @@

 int ff_get_buffer(AVCodecContext *avctx, AVFrame *frame, int flags)

 {

     int ret = get_buffer_internal(avctx, frame, flags);

-    if (ret < 0)

+    if (ret < 0) {

         av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");

+        frame->width = frame->height = 0;

+    }

     return ret;

 }

@@ -3178,8 +3180,8 @@

             if (enc->sample_aspect_ratio.num) {

                 av_reduce(&display_aspect_ratio.num, &display_aspect_ratio.den,

-                          enc->width * enc->sample_aspect_ratio.num,

-                          enc->height * enc->sample_aspect_ratio.den,

+                          enc->width * (int64_t)enc->sample_aspect_ratio.num,

+                          enc->height * (int64_t)enc->sample_aspect_ratio.den,

                           1024 * 1024);

                 snprintf(buf + strlen(buf), buf_size - strlen(buf),

                          " [SAR %d:%d DAR %d:%d]",

​

@@ -131,7 +131,7 @@

 typedef struct Vp3DecodeContext {

     AVCodecContext *avctx;

-    int theora, theora_tables;

+    int theora, theora_tables, theora_header;

     int version;

     int width, height;

     int chroma_x_shift, chroma_y_shift;

@@ -209,8 +209,8 @@

     int16_t *dct_tokens[3][64];

     int16_t *dct_tokens_base;

 #define TOKEN_EOB(eob_run)              ((eob_run) << 2)

-#define TOKEN_ZERO_RUN(coeff, zero_run) (((coeff) << 9) + ((zero_run) << 2) + 1)

-#define TOKEN_COEFF(coeff)              (((coeff) << 2) + 2)

+#define TOKEN_ZERO_RUN(coeff, zero_run) (((coeff) * 512) + ((zero_run) << 2) + 1)

+#define TOKEN_COEFF(coeff)              (((coeff) * 4) + 2)

     /**

      * number of blocks that contain DCT coefficients at

@@ -2016,17 +2016,19 @@

             vp3_decode_end(avctx);

             ret = theora_decode_header(avctx, &gb);

+            if (ret >= 0)

+                ret = vp3_decode_init(avctx);

             if (ret < 0) {

                 vp3_decode_end(avctx);

-            } else

-                ret = vp3_decode_init(avctx);

+            }

             return ret;

         } else if (type == 2) {

             ret = theora_decode_tables(avctx, &gb);

+            if (ret >= 0)

+                ret = vp3_decode_init(avctx);

             if (ret < 0) {

                 vp3_decode_end(avctx);

-            } else

-                ret = vp3_decode_init(avctx);

+            }

             return ret;

         }

@@ -2251,6 +2253,7 @@

     int ret;

     AVRational fps, aspect;

+    s->theora_header = 0;

     s->theora = get_bits_long(gb, 24);

     av_log(avctx, AV_LOG_DEBUG, "Theora bitstream version %X\n", s->theora);

@@ -2321,7 +2324,8 @@

             return AVERROR_INVALIDDATA;

         }

         skip_bits(gb, 3); /* reserved */

-    }

+    } else

+        avctx->pix_fmt = AV_PIX_FMT_YUV420P;

     ret = ff_set_dimensions(avctx, s->width, s->height);

     if (ret < 0)

@@ -2355,6 +2359,7 @@

         avctx->color_trc  = AVCOL_TRC_BT709;

     }

+    s->theora_header = 1;

     return 0;

 }

@@ -2363,6 +2368,9 @@

     Vp3DecodeContext *s = avctx->priv_data;

     int i, n, matrices, inter, plane;

+    if (!s->theora_header)

+        return AVERROR_INVALIDDATA;

+

     if (s->theora >= 0x030200) {

         n = get_bits(gb, 3);

         /* loop filter limit values table */

​

@@ -300,6 +300,12 @@

         s->decode_flags    = AV_RL16(edata_ptr+14);

         channel_mask       = AV_RL32(edata_ptr+2);

         s->bits_per_sample = AV_RL16(edata_ptr);

+

+        if (s->bits_per_sample > 32 || s->bits_per_sample < 1) {

+            avpriv_request_sample(avctx, "bits per sample is %d", s->bits_per_sample);

+            return AVERROR_PATCHWELCOME;

+        }

+

         /** dump the extradata */

         for (i = 0; i < avctx->extradata_size; i++)

             ff_dlog(avctx, "[%x] ", avctx->extradata[i]);

@@ -477,7 +483,7 @@

     /** calculate subwoofer cutoff values */

     for (i = 0; i < num_possible_block_sizes; i++) {

         int block_size = s->samples_per_frame >> i;

-        int cutoff = (440*block_size + 3 * (s->avctx->sample_rate >> 1) - 1)

+        int cutoff = (440*block_size + 3LL * (s->avctx->sample_rate >> 1) - 1)

                      / s->avctx->sample_rate;

         s->subwoofer_cutoffs[i] = av_clip(cutoff, 4, block_size);

     }

​

@@ -131,10 +131,13 @@

                         cur->data[plane], cur->linesize[plane],

                         ref->data[plane], ref->linesize[plane],

                         FF_CEIL_RSHIFT(ref->width,  hsub),

-                        FF_CEIL_RSHIFT(ref->height, vsub)))

+                        FF_CEIL_RSHIFT(ref->height, vsub))) {

+            emms_c();

             return 0;

+        }

     }

+    emms_c();

     return 1;

 }

​

@@ -496,7 +496,7 @@

         av_log(NULL, AV_LOG_INFO, "  Duration: ");

         if (ic->duration != AV_NOPTS_VALUE) {

             int hours, mins, secs, us;

-            int64_t duration = ic->duration + 5000;

+            int64_t duration = ic->duration + (ic->duration <= INT64_MAX - 5000 ? 5000 : 0);

             secs  = duration / AV_TIME_BASE;

             us    = duration % AV_TIME_BASE;

             mins  = secs / 60;

​

@@ -268,6 +268,7 @@

     AVStream *st;

     AVIOContext *pb = s->pb;

     AVCodecContext *codec;

+    const AVCodecDescriptor *codec_desc;

     int ret;

     int f_main = 0, f_cprv = -1, f_stvi = -1, f_stau = -1;

     AVCodec *enc;

@@ -322,7 +323,20 @@

             codec = st->codec;

             /* generic info */

             codec->codec_id = avio_rb32(pb);

+            codec_desc = avcodec_descriptor_get(codec->codec_id);

+            if (!codec_desc) {

+                av_log(s, AV_LOG_ERROR, "Invalid codec id: %d\n", codec->codec_id);

+                codec->codec_id = AV_CODEC_ID_NONE;

+                goto fail;

+            }

             codec->codec_type = avio_r8(pb);

+            if (codec->codec_type != codec_desc->type) {

+                av_log(s, AV_LOG_ERROR, "Codec type mismatch: expected %d, found %d\n",

+                       codec_desc->type, codec->codec_type);

+                codec->codec_id = AV_CODEC_ID_NONE;

+                codec->codec_type = AVMEDIA_TYPE_UNKNOWN;

+                goto fail;

+            }

             codec->bit_rate = avio_rb32(pb);

             codec->flags = avio_rb32(pb);

             codec->flags2 = avio_rb32(pb);

@@ -415,7 +429,7 @@

             }

             break;

         case MKBETAG('S', '2', 'V', 'I'):

-            if (f_stvi++) {

+            if (f_stvi++ || !size) {

                 ret = AVERROR(EINVAL);

                 goto fail;

             }

@@ -430,7 +444,7 @@

                 goto fail;

             break;

         case MKBETAG('S', '2', 'A', 'U'):

-            if (f_stau++) {

+            if (f_stau++ || !size) {

                 ret = AVERROR(EINVAL);

                 goto fail;

             }

@@ -471,6 +485,7 @@

     AVStream *st;

     AVIOContext *pb = s->pb;

     AVCodecContext *codec;

+    const AVCodecDescriptor *codec_desc;

     int i, nb_streams;

     uint32_t tag;

@@ -508,7 +523,20 @@

         codec = st->codec;

         /* generic info */

         codec->codec_id = avio_rb32(pb);

+        codec_desc = avcodec_descriptor_get(codec->codec_id);

+        if (!codec_desc) {

+            av_log(s, AV_LOG_ERROR, "Invalid codec id: %d\n", codec->codec_id);

+            codec->codec_id = AV_CODEC_ID_NONE;

+            goto fail;

+        }

         codec->codec_type = avio_r8(pb); /* codec_type */

+        if (codec->codec_type != codec_desc->type) {

+            av_log(s, AV_LOG_ERROR, "Codec type mismatch: expected %d, found %d\n",

+                   codec_desc->type, codec->codec_type);

+            codec->codec_id = AV_CODEC_ID_NONE;

+            codec->codec_type = AVMEDIA_TYPE_UNKNOWN;

+            goto fail;

+        }

         codec->bit_rate = avio_rb32(pb);

         codec->flags = avio_rb32(pb);

         codec->flags2 = avio_rb32(pb);

​

@@ -548,8 +548,11 @@

     if (oc->oformat->priv_class && oc->priv_data)

         av_opt_set(oc->priv_data, "mpegts_flags", "resend_headers", 0);

-    if (c->vtt_basename)

-        avformat_write_header(vtt_oc,NULL);

+    if (c->vtt_basename) {

+        err = avformat_write_header(vtt_oc,NULL);

+        if (err < 0)

+            return err;

+    }

     return 0;

 }

​

@@ -184,6 +184,7 @@

     MOVTrackExt *trex_data;

     unsigned trex_count;

     int itunes_metadata;  ///< metadata are itunes style

+    int handbrake_version;

     int chapter_track;

     int use_absolute_path;

     int ignore_editlist;

​

@@ -926,14 +926,18 @@

     }

     if (codec->codec_type == AVMEDIA_TYPE_AUDIO && codec->initial_padding && codec->codec_id == AV_CODEC_ID_OPUS) {

+        int64_t codecdelay = av_rescale_q(codec->initial_padding,

+                                          (AVRational){ 1, codec->sample_rate },

+                                          (AVRational){ 1, 1000000000 });

+        if (codecdelay < 0) {

+            av_log(s, AV_LOG_ERROR, "Initial padding is invalid\n");

+            return AVERROR(EINVAL);

+        }

 //         mkv->tracks[i].ts_offset = av_rescale_q(codec->initial_padding,

 //                                                 (AVRational){ 1, codec->sample_rate },

 //                                                 st->time_base);

-        put_ebml_uint(pb, MATROSKA_ID_CODECDELAY,

-                      av_rescale_q(codec->initial_padding,

-                                   (AVRational){ 1, codec->sample_rate },

-                                   (AVRational){ 1, 1000000000 }));

+        put_ebml_uint(pb, MATROSKA_ID_CODECDELAY, codecdelay);

     }

     if (codec->codec_id == AV_CODEC_ID_OPUS) {

         put_ebml_uint(pb, MATROSKA_ID_SEEKPREROLL, OPUS_SEEK_PREROLL);

​

@@ -365,6 +365,11 @@

     if (ast)

         ast->duration = ast->nb_index_entries;

+    if ((vst && !vst->nb_index_entries) || (ast && !ast->nb_index_entries)) {

+        av_log(avctx, AV_LOG_ERROR, "no index entries found\n");

+        return AVERROR_INVALIDDATA;

+    }

+

     if (vst && ast)

         avio_seek(pb, FFMIN(vst->index_entries[0].pos, ast->index_entries[0].pos), SEEK_SET);

     else if (vst)

​

@@ -419,6 +419,12 @@

             snprintf(key2, sizeof(key2), "%s-%s", key, language);

             av_dict_set(&c->fc->metadata, key2, str, 0);

         }

+        if (!strcmp(key, "encoder")) {

+            int major, minor, micro;

+            if (sscanf(str, "HandBrake %d.%d.%d", &major, &minor, &micro) == 3) {

+                c->handbrake_version = 1000000*major + 1000*minor + micro;

+            }

+        }

     }

     av_log(c->fc, AV_LOG_TRACE, "lang \"%3s\" ", language);

     av_log(c->fc, AV_LOG_TRACE, "tag \"%s\" value \"%s\" atom \"%.4s\" %d %"PRId64"\n",

@@ -4528,6 +4534,13 @@

                     return err;

             }

         }

+        if (mov->handbrake_version &&

+            mov->handbrake_version <= 1000000*0 + 1000*10 + 0 &&  // 0.10.0

+            st->codec->codec_id == AV_CODEC_ID_MP3

+        ) {

+            av_log(s, AV_LOG_VERBOSE, "Forcing full parsing for mp3 stream\n");

+            st->need_parsing = AVSTREAM_PARSE_FULL;

+        }

     }

     if (mov->trex_data) {

​

@@ -756,11 +756,11 @@

         ts_st = pcr_st->priv_data;

     if (ts->mux_rate > 1) {

-        service->pcr_packet_period = (ts->mux_rate * ts->pcr_period) /

+        service->pcr_packet_period = (int64_t)ts->mux_rate * ts->pcr_period /

                                      (TS_PACKET_SIZE * 8 * 1000);

-        ts->sdt_packet_period      = (ts->mux_rate * SDT_RETRANS_TIME) /

+        ts->sdt_packet_period      = (int64_t)ts->mux_rate * SDT_RETRANS_TIME /

                                      (TS_PACKET_SIZE * 8 * 1000);

-        ts->pat_packet_period      = (ts->mux_rate * PAT_RETRANS_TIME) /

+        ts->pat_packet_period      = (int64_t)ts->mux_rate * PAT_RETRANS_TIME /

                                      (TS_PACKET_SIZE * 8 * 1000);

         if (ts->copyts < 1)

​

@@ -1266,11 +1266,11 @@

             user_comment_count = mxf_write_user_comments(s, s->metadata);

         mxf_write_metadata_key(pb, 0x013600);

         PRINT_KEY(s, "Material Package key", pb->buf_ptr - 16);

-        klv_encode_ber_length(pb, 92 + name_size + (16*track_count) + (16*user_comment_count) + 12*mxf->store_user_comments);

+        klv_encode_ber_length(pb, 92 + name_size + (16*track_count) + (16*user_comment_count) + 12LL*mxf->store_user_comments);

     } else {

         mxf_write_metadata_key(pb, 0x013700);

         PRINT_KEY(s, "Source Package key", pb->buf_ptr - 16);

-        klv_encode_ber_length(pb, 112 + name_size + (16*track_count) + 12*mxf->store_user_comments); // 20 bytes length for descriptor reference

+        klv_encode_ber_length(pb, 112 + name_size + (16*track_count) + 12LL*mxf->store_user_comments); // 20 bytes length for descriptor reference

     }

     // write uid

@@ -2467,6 +2467,10 @@

         }

         mxf->edit_units_count++;

     } else if (!mxf->edit_unit_byte_count && st->index == 1) {

+        if (!mxf->edit_units_count) {

+            av_log(s, AV_LOG_ERROR, "No packets in first stream\n");

+            return AVERROR_PATCHWELCOME;

+        }

         mxf->index_entries[mxf->edit_units_count-1].slice_offset =

             mxf->body_offset - mxf->index_entries[mxf->edit_units_count-1].offset;

     }

​

@@ -87,7 +87,7 @@

                       AVCodecContext *codec, int size, int big_endian)

 {

     int id;

-    uint64_t bitrate;

+    uint64_t bitrate = 0;

     if (size < 14) {

         avpriv_request_sample(codec, "wav header size < 14");

​

@@ -36,6 +36,7 @@

     int off = 0; /* fragment offset of the current JPEG frame */

     int len;

     int i;

+    int default_huffman_tables = 0;

     s->buf_ptr   = s->buf;

     s->timestamp = s->cur_timestamp;

@@ -90,23 +91,66 @@

                 return;

             }

         } else if (buf[i + 1] == DHT) {

-            if (   AV_RB16(&buf[i + 2]) < 418

-                || i + 420 >= size

-                || buf[i +   4] != 0x00

-                || buf[i +  33] != 0x01

-                || buf[i +  62] != 0x10

-                || buf[i + 241] != 0x11

-                || memcmp(buf + i +   5, avpriv_mjpeg_bits_dc_luminance   + 1, 16)

-                || memcmp(buf + i +  21, avpriv_mjpeg_val_dc, 12)

-                || memcmp(buf + i +  34, avpriv_mjpeg_bits_dc_chrominance + 1, 16)

-                || memcmp(buf + i +  50, avpriv_mjpeg_val_dc, 12)

-                || memcmp(buf + i +  63, avpriv_mjpeg_bits_ac_luminance   + 1, 16)

-                || memcmp(buf + i +  79, avpriv_mjpeg_val_ac_luminance, 162)

-                || memcmp(buf + i + 242, avpriv_mjpeg_bits_ac_chrominance + 1, 16)

-                || memcmp(buf + i + 258, avpriv_mjpeg_val_ac_chrominance, 162)) {

-                av_log(s1, AV_LOG_ERROR,

-                       "RFC 2435 requires standard Huffman tables for jpeg\n");

-                return;

+            int dht_size = AV_RB16(&buf[i + 2]);

+            default_huffman_tables |= 1 << 4;

+            i += 3;

+            dht_size -= 2;

+            if (i + dht_size >= size)

+                continue;

+            while (dht_size > 0)

+                switch (buf[i + 1]) {

+                case 0x00:

+                    if (   dht_size >= 29

+                        && !memcmp(buf + i +  2, avpriv_mjpeg_bits_dc_luminance + 1, 16)

+                        && !memcmp(buf + i + 18, avpriv_mjpeg_val_dc, 12)) {

+                        default_huffman_tables |= 1;

+                        i += 29;

+                        dht_size -= 29;

+                    } else {

+                        i += dht_size;

+                        dht_size = 0;

+                    }

+                    break;

+                case 0x01:

+                    if (   dht_size >= 29

+                        && !memcmp(buf + i +  2, avpriv_mjpeg_bits_dc_chrominance + 1, 16)

+                        && !memcmp(buf + i + 18, avpriv_mjpeg_val_dc, 12)) {

+                        default_huffman_tables |= 1 << 1;

+                        i += 29;