@@ -1,12 +1,12 @@

 -------------------------------------------------------------------

-Sun Oct  1 15:31:56 UTC 2023 - Manfred Hollstein <manfred.h@gmx.net>

+Tue Dec 12 12:12:12 UTC 2023 - olaf@aepfle.de

-- Add ffmpeg-x86-mathops.patch

+- Version update to 3.4.13

 -------------------------------------------------------------------

-Fri Mar  3 03:03:03 UTC 2023 - olaf@aepfle.de

+Sun Oct  1 15:31:56 UTC 2023 - Manfred Hollstein <manfred.h@gmx.net>

-- Version update to 3.4.12

+- Add ffmpeg-x86-mathops.patch

 -------------------------------------------------------------------

 Mon Feb 11 21:43:44 UTC 2019 - bjorn.lie@gmail.com

​

@@ -55,7 +55,7 @@

 %define _major_version 3

 %define _major_expected 4

 Name:           ffmpeg-3

-Version:        3.4.12

+Version:        3.4.13

 Release:        0

 Summary:        Library for working with various multimedia formats

 License:        LGPL-2.1-or-later AND GPL-2.0-or-later

​

@@ -1,7 +1,7 @@

 <services>

   <service name="tar_scm" mode="disabled">

     <param name="filename">ffmpeg-3</param>

-    <param name="revision">872001459cf0a20c6f44105f485d125c8e22fc76</param>

+    <param name="revision">c7210207555effd194b60dee424fd5632bb388f4</param>

     <param name="scm">git</param>

     <param name="submodules">disable</param>

     <param name="url">https://git.ffmpeg.org/ffmpeg.git</param>

​

@@ -1,6 +1,6 @@

-See the Git history of the project (git://source.ffmpeg.org/ffmpeg) to

+See the Git history of the project (https://git.ffmpeg.org/ffmpeg) to

 get the names of people who have contributed to FFmpeg.

 To check the log, you can type the command "git log" in the FFmpeg

 source directory, or browse the online repository at

-http://source.ffmpeg.org.

+https://git.ffmpeg.org/ffmpeg

​

@@ -1,6 +1,60 @@

 Entries are sorted chronologically from oldest to youngest within each release,

 releases are sorted from youngest to oldest.

+version 3.4.13:

+ avcodec/noise_bsf: Check for wrapped frames

+ avcodec/pngdec: Do not pass AVFrame into global header decode

+ avformat/wavdec: Check that smv block fits in available space

+ avcodec/tak: Check remaining bits in ff_tak_decode_frame_header()

+ avcodec/utils: the IFF_ILBM implementation assumes that there are a multiple of 16 allocated

+ avcodec/vorbisdec: Check codebook float values to be finite

+ avcodec/g2meet: Replace fake allocation avoidance for framebuf

+ avcodec/lcldec: More space for rgb24

+ avcodec/lcldec: Support 4:1:1 and 4:2:2 with odd width

+ libavcodec/lcldec: width and height should not be unsigned

+ avcodec/escape124: Check that blocks are allocated before use

+ avcodec/huffyuvdec: Fix undefined behavior with shift

+ avcodec/j2kenc: fix 5/3 DWT identifer

+ avcodec/vp3: Check width to avoid assertion failure

+ avcodec/g729postfilter: Limit shift in long term filter

+ configure: update copyright year

+ avcodec/tests/snowenc: Fix 2nd test

+ avcodec/tests/snowenc: return a failure if DWT/IDWT mismatches

+ avcodec/snowenc: Fix visual weight calculation

+ avcodec/tests/snowenc: unbreak DWT tests

+ avcodec/vp3: Add missing check for av_malloc

+ avcodec/escape124: Fix some return codes

+ avcodec/escape124: fix signdness of end of input check

+ Use https for repository links

+ avcodec/motionpixels: Mask pixels to valid values

+ avcodec/xpmdec: Check size before allocation to avoid truncation

+ avcodec/bink: Avoid undefined out of array end pointers in binkb_decode_plane()

+ avcodec/bink: Fix off by 1 error in ref end

+ avcodec/utils: Ensure linesize for SVQ3

+ avcodec/utils: allocate a line more for VC1 and WMV3

+ avcodec/videodsp_template: Adjust pointers to avoid undefined pointer things

+ avcodec/pngdec: Check deloco index more exactly

+ avcodec/ffv1dec: Check that num h/v slices is supported

+ avformat/mov: Check samplesize and offset to avoid integer overflow

+ avcodec/pictordec: Remove mid exit branch

+ avcodec/eac3dec: avoid float noise in fixed mode addition to overflow

+ avcodec/utils: use 32pixel alignment for bink

+ avcodec/012v: Order operations for odd size handling

+ avcodec/eatgq: : Check index increments in tgq_decode_block()

+ avcodec/scpr: Test bx before use

+ avcodec/sunrast: Fix maplength check

+ avcodec/wavpack: Avoid undefined shift in get_tail()

+ avformat/id3v2: Check taglen in read_uslt()

+ avcodec/ffv1dec: restructure slice coordinate reading a bit

+ avcodec/mlpdec: Check max matrix instead of max channel in noise check

+ swscale/input: Use more unsigned intermediates

+ avcodec/alsdec: The minimal block is at least 7 bits

+ avformat/replaygain: avoid undefined / negative abs

+ swscale/output: Bias 16bps output calculations to improve non overflowing range

+ avcodec/speedhq: Check buf_size to be big enough for DC

+ avcodec/ffv1dec: Fail earlier if prior context is corrupted

+ swscale: aarch64: Fix yuv2rgb with negative strides

+

 version 3.4.12:

  avcodec/dstdec: Check for overflow in build_filter()

  avformat/spdifdec: Use 64bit to compute bit rate

​

@@ -1,1 +1,1 @@

-3.4.12

+3.4.13

​

@@ -7000,7 +7000,7 @@

 #define FFMPEG_CONFIG_H

 #define FFMPEG_CONFIGURATION "$(c_escape $FFMPEG_CONFIGURATION)"

 #define FFMPEG_LICENSE "$(c_escape $license)"

-#define CONFIG_THIS_YEAR 2022

+#define CONFIG_THIS_YEAR 2023

 #define FFMPEG_DATADIR "$(eval c_escape $datadir)"

 #define AVCONV_DATADIR "$(eval c_escape $datadir)"

 #define CC_IDENT "$(c_escape ${cc_ident:-Unknown compiler})"

​

@@ -38,7 +38,7 @@

 # could be handy for archiving the generated documentation or if some version

 # control system is used.

-PROJECT_NUMBER         = 3.4.12

+PROJECT_NUMBER         = 3.4.13

 # Using the PROJECT_BRIEF tag one can provide an optional one line description

 # for a project that appears at the top of each page and should give viewer a

​

@@ -3,9 +3,9 @@

 The FFmpeg developers.

 For details about the authorship, see the Git history of the project

-(git://source.ffmpeg.org/ffmpeg), e.g. by typing the command

+(https://git.ffmpeg.org/ffmpeg), e.g. by typing the command

 @command{git log} in the FFmpeg source directory, or browsing the

-online repository at @url{http://source.ffmpeg.org}.

+online repository at @url{https://git.ffmpeg.org/ffmpeg}.

 Maintainers for the specific components are listed in the file

 @file{MAINTAINERS} in the source code tree.

​

@@ -53,7 +53,7 @@

 @section Cloning the source tree

 @example

-git clone git://source.ffmpeg.org/ffmpeg <target>

+git clone https://git.ffmpeg.org/ffmpeg.git <target>

 @end example

 This will put the FFmpeg sources into the directory @var{<target>}.

​

@@ -131,8 +131,8 @@

             u = x/2 + (uint16_t *)(pic->data1 + line * pic->linesize1);

             v = x/2 + (uint16_t *)(pic->data2 + line * pic->linesize2);

             memcpy(y, y_temp, sizeof(*y) * (width - x));

-            memcpy(u, u_temp, sizeof(*u) * (width - x + 1) / 2);

-            memcpy(v, v_temp, sizeof(*v) * (width - x + 1) / 2);

+            memcpy(u, u_temp, sizeof(*u) * ((width - x + 1) / 2));

+            memcpy(v, v_temp, sizeof(*v) * ((width - x + 1) / 2));

         }

         line_end += stride;

​

@@ -74,6 +74,7 @@

 #define AC3_DYNAMIC_RANGE1      0

 typedef int                     INTFLOAT;

+typedef unsigned int            UINTFLOAT;

 typedef int16_t                 SHORTFLOAT;

 #else /* USE_FIXED */

@@ -93,6 +94,7 @@

 #define AC3_DYNAMIC_RANGE1      1.0f

 typedef float                   INTFLOAT;

+typedef float                   UINTFLOAT;

 typedef float                   SHORTFLOAT;

 #endif /* USE_FIXED */

​

@@ -1021,7 +1021,7 @@

     *bd->shift_lsbs = 0;

-    if (get_bits_left(gb) < 1)

+    if (get_bits_left(gb) < 7)

         return AVERROR_INVALIDDATA;

     // read block type flag and read the samples accordingly

​

@@ -825,7 +825,7 @@

     binkb_init_bundles(c);

     ref_start = frame->dataplane_idx;

-    ref_end   = frame->dataplane_idx + (bh * frame->linesizeplane_idx + bw) * 8;

+    ref_end   = frame->dataplane_idx + ((bh - 1) * frame->linesizeplane_idx + bw - 1) * 8;

     for (i = 0; i < 64; i++)

         coordmapi = (i & 7) + (i >> 3) * stride;

@@ -879,7 +879,7 @@

                 xoff = binkb_get_value(c, BINKB_SRC_X_OFF);

                 yoff = binkb_get_value(c, BINKB_SRC_Y_OFF) + ybias;

                 ref = dst + xoff + yoff * stride;

-                if (ref < ref_start || ref + 8*stride > ref_end) {

+                if (ref < ref_start || ref > ref_end) {

                     av_log(c->avctx, AV_LOG_WARNING, "Reference block is out of bounds\n");

                 } else if (ref + 8*stride < dst || ref >= dst + 8*stride) {

                     c->hdsp.put_pixels_tab10(dst, ref, stride, 8);

@@ -895,7 +895,7 @@

                 xoff = binkb_get_value(c, BINKB_SRC_X_OFF);

                 yoff = binkb_get_value(c, BINKB_SRC_Y_OFF) + ybias;

                 ref = dst + xoff + yoff * stride;

-                if (ref < ref_start || ref + 8 * stride > ref_end) {

+                if (ref < ref_start || ref > ref_end) {

                     av_log(c->avctx, AV_LOG_WARNING, "Reference block is out of bounds\n");

                 } else if (ref + 8*stride < dst || ref >= dst + 8*stride) {

                     c->hdsp.put_pixels_tab10(dst, ref, stride, 8);

@@ -925,7 +925,7 @@

                 xoff = binkb_get_value(c, BINKB_SRC_X_OFF);

                 yoff = binkb_get_value(c, BINKB_SRC_Y_OFF) + ybias;

                 ref = dst + xoff + yoff * stride;

-                if (ref < ref_start || ref + 8 * stride > ref_end) {

+                if (ref < ref_start || ref > ref_end) {

                     av_log(c->avctx, AV_LOG_WARNING, "Reference block is out of bounds\n");

                 } else if (ref + 8*stride < dst || ref >= dst + 8*stride) {

                     c->hdsp.put_pixels_tab10(dst, ref, stride, 8);

​

@@ -146,9 +146,11 @@

             // spx_noise_blend and spx_signal_blend are both FP.23

             nscale *= 1.0 / (1<<23);

             sscale *= 1.0 / (1<<23);

+            if (nscale < -1.0)

+                nscale = -1.0;

 #endif

             for (i = 0; i < s->spx_band_sizesbnd; i++) {

-                float noise  = nscale * (int32_t)av_lfg_get(&s->dith_state);

+                UINTFLOAT noise = (INTFLOAT)(nscale * (int32_t)av_lfg_get(&s->dith_state));

                 s->transform_coeffschbin   *= sscale;

                 s->transform_coeffschbin++ += noise;

             }

​

@@ -58,7 +58,7 @@

     return 0;

 }

-static void tgq_decode_block(TgqContext *s, int16_t block64, GetBitContext *gb)

+static int tgq_decode_block(TgqContext *s, int16_t block64, GetBitContext *gb)

 {

     uint8_t *perm = s->scantable.permutated;

     int i, j, value;

@@ -66,6 +66,8 @@

     for (i = 1; i < 64;) {

         switch (show_bits(gb, 3)) {

         case 4:

+            if (i >= 63)

+                return AVERROR_INVALIDDATA;

             blockpermi++ = 0;

         case 0:

             blockpermi++ = 0;

@@ -75,6 +77,8 @@

         case 1:

             skip_bits(gb, 2);

             value = get_bits(gb, 6);

+            if (value > 64 - i)

+                return AVERROR_INVALIDDATA;

             for (j = 0; j < value; j++)

                 blockpermi++ = 0;

             break;

@@ -102,6 +106,7 @@

         }

     }

     block0 += 128 << 4;

+    return 0;

 }

 static void tgq_idct_put_mb(TgqContext *s, int16_t (*block)64, AVFrame *frame,

@@ -161,8 +166,11 @@

         if (ret < 0)

             return ret;

-        for (i = 0; i < 6; i++)

-            tgq_decode_block(s, s->blocki, &gb);

+        for (i = 0; i < 6; i++) {

+            int ret = tgq_decode_block(s, s->blocki, &gb);

+            if (ret < 0)

+                return ret;

+        }

         tgq_idct_put_mb(s, s->block, frame, mb_x, mb_y);

         bytestream2_skip(&s->gb, mode);

     } else {

​

@@ -88,11 +88,6 @@

     unsigned i, j;

     CodeBook cb = { 0 };

-    if (size >= INT_MAX / 34 || get_bits_left(gb) < size * 34)

-        return cb;

-

-    if (size >= INT_MAX / sizeof(MacroBlock))

-        return cb;

     cb.blocks = av_malloc(size ? size * sizeof(MacroBlock) : 1);

     if (!cb.blocks)

         return cb;

@@ -162,7 +157,7 @@

     // This condition can occur with invalid bitstreams and

     // *codebook_index == 2

-    if (block_index >= s->codebooks*codebook_index.size)

+    if (block_index >= s->codebooks*codebook_index.size || !s->codebooks*codebook_index.blocks)

         return (MacroBlock) { { 0 } };

     return s->codebooks*codebook_index.blocksblock_index;

@@ -226,7 +221,7 @@

     // represent a lower bound of the space needed for skipped superblocks. Non

     // skipped SBs need more space.

     if (get_bits_left(&gb) < 64 + s->num_superblocks * 23LL / 4320)

-        return -1;

+        return AVERROR_INVALIDDATA;

     frame_flags = get_bits_long(&gb, 32);

     frame_size  = get_bits_long(&gb, 32);

@@ -277,9 +272,14 @@

             }

             av_freep(&s->codebooksi.blocks);

+            if (cb_size >= INT_MAX / 34 || get_bits_left(&gb) < (int)cb_size * 34)

+                return AVERROR_INVALIDDATA;

+

+            if (cb_size >= INT_MAX / sizeof(MacroBlock))

+                return AVERROR_INVALIDDATA;

             s->codebooksi = unpack_codebook(&gb, cb_depth, cb_size);

             if (!s->codebooksi.blocks)

-                return -1;

+                return AVERROR(ENOMEM);

         }

     }

​

@@ -169,24 +169,31 @@

     RangeCoder *c = &fs->c;

     uint8_t stateCONTEXT_SIZE;

     unsigned ps, i, context_count;

+    int sx, sy, sw, sh;

+

     memset(state, 128, sizeof(state));

+    sx = get_symbol(c, state, 0);

+    sy = get_symbol(c, state, 0);

+    sw = get_symbol(c, state, 0) + 1U;

+    sh = get_symbol(c, state, 0) + 1U;

     av_assert0(f->version > 2);

-    fs->slice_x      =  get_symbol(c, state, 0)      * f->width ;

-    fs->slice_y      =  get_symbol(c, state, 0)      * f->height;

-    fs->slice_width  = (get_symbol(c, state, 0) + 1) * f->width  + fs->slice_x;

-    fs->slice_height = (get_symbol(c, state, 0) + 1) * f->height + fs->slice_y;

-

-    fs->slice_x /= f->num_h_slices;

-    fs->slice_y /= f->num_v_slices;

-    fs->slice_width  = fs->slice_width /f->num_h_slices - fs->slice_x;

-    fs->slice_height = fs->slice_height/f->num_v_slices - fs->slice_y;

-    if ((unsigned)fs->slice_width > f->width || (unsigned)fs->slice_height > f->height)

-        return -1;

-    if (    (unsigned)fs->slice_x + (uint64_t)fs->slice_width  > f->width

-         || (unsigned)fs->slice_y + (uint64_t)fs->slice_height > f->height)

-        return -1;

+

+    if (sx < 0 || sy < 0 || sw <= 0 || sh <= 0)

+        return AVERROR_INVALIDDATA;

+    if (sx > f->num_h_slices - sw || sy > f->num_v_slices - sh)

+        return AVERROR_INVALIDDATA;

+

+    fs->slice_x      =  sx       * (int64_t)f->width  / f->num_h_slices;

+    fs->slice_y      =  sy       * (int64_t)f->height / f->num_v_slices;

+    fs->slice_width  = (sx + sw) * (int64_t)f->width  / f->num_h_slices - fs->slice_x;

+    fs->slice_height = (sy + sh) * (int64_t)f->height / f->num_v_slices - fs->slice_y;

+

+    av_assert0((unsigned)fs->slice_width  <= f->width &&

+                (unsigned)fs->slice_height <= f->height);

+    av_assert0 (   (unsigned)fs->slice_x + (uint64_t)fs->slice_width  <= f->width

+                && (unsigned)fs->slice_y + (uint64_t)fs->slice_height <= f->height);

     if (fs->ac == AC_GOLOMB_RICE && fs->slice_width >= (1<<23))

         return AVERROR_INVALIDDATA;

@@ -304,8 +311,11 @@

     }

     if ((ret = ff_ffv1_init_slice_state(f, fs)) < 0)

         return ret;

-    if (f->cur->key_frame || fs->slice_reset_contexts)

+    if (f->cur->key_frame || fs->slice_reset_contexts) {

         ff_ffv1_clear_slice_state(f, fs);

+    } else if (fs->slice_damaged) {

+        return AVERROR_INVALIDDATA;

+    }

     width  = fs->slice_width;

     height = fs->slice_height;

@@ -466,6 +476,11 @@

         return AVERROR_INVALIDDATA;

     }

+    if (f->num_h_slices > MAX_SLICES / f->num_v_slices) {

+        av_log(f->avctx, AV_LOG_ERROR, "slice count unsupported\n");

+        return AVERROR_PATCHWELCOME;

+    }

+

     f->quant_table_count = get_symbol(c, state, 0);

     if (f->quant_table_count > (unsigned)MAX_QUANT_TABLES || !f->quant_table_count) {

         av_log(f->avctx, AV_LOG_ERROR, "quant table count %d is invalid\n", f->quant_table_count);

@@ -742,21 +757,25 @@

         fs->slice_damaged = 0;

         if (f->version == 2) {

-            fs->slice_x      =  get_symbol(c, state, 0)      * f->width ;

-            fs->slice_y      =  get_symbol(c, state, 0)      * f->height;

-            fs->slice_width  = (get_symbol(c, state, 0) + 1) * f->width  + fs->slice_x;

-            fs->slice_height = (get_symbol(c, state, 0) + 1) * f->height + fs->slice_y;

-

-            fs->slice_x     /= f->num_h_slices;

-            fs->slice_y     /= f->num_v_slices;

-            fs->slice_width  = fs->slice_width  / f->num_h_slices - fs->slice_x;

-            fs->slice_height = fs->slice_height / f->num_v_slices - fs->slice_y;

-            if ((unsigned)fs->slice_width  > f->width ||

-                (unsigned)fs->slice_height > f->height)

+            int sx = get_symbol(c, state, 0);

+            int sy = get_symbol(c, state, 0);

+            int sw = get_symbol(c, state, 0) + 1U;

+            int sh = get_symbol(c, state, 0) + 1U;

+

+            if (sx < 0 || sy < 0 || sw <= 0 || sh <= 0)

                 return AVERROR_INVALIDDATA;

-            if (   (unsigned)fs->slice_x + (uint64_t)fs->slice_width  > f->width

-                || (unsigned)fs->slice_y + (uint64_t)fs->slice_height > f->height)

+            if (sx > f->num_h_slices - sw || sy > f->num_v_slices - sh)

                 return AVERROR_INVALIDDATA;

+

+            fs->slice_x      =  sx       * (int64_t)f->width  / f->num_h_slices;

+            fs->slice_y      =  sy       * (int64_t)f->height / f->num_v_slices;

+            fs->slice_width  = (sx + sw) * (int64_t)f->width  / f->num_h_slices - fs->slice_x;

+            fs->slice_height = (sy + sh) * (int64_t)f->height / f->num_v_slices - fs->slice_y;

+

+            av_assert0((unsigned)fs->slice_width  <= f->width &&

+                       (unsigned)fs->slice_height <= f->height);

+            av_assert0 (   (unsigned)fs->slice_x + (uint64_t)fs->slice_width  <= f->width

+                        && (unsigned)fs->slice_y + (uint64_t)fs->slice_height <= f->height);

         }

         for (i = 0; i < f->plane_count; i++) {

​

@@ -143,7 +143,8 @@

     int        got_header;

     uint8_t    *framebuf;

-    int        framebuf_stride, old_width, old_height;

+    int        framebuf_stride;

+    unsigned int framebuf_allocated;

     uint8_t    *synth_tile, *jpeg_tile, *epic_buf, *epic_buf_base;

     int        tile_stride, epic_buf_stride, old_tile_w, old_tile_h;

@@ -1179,14 +1180,13 @@

 {

     int aligned_height;

-    if (!c->framebuf || c->old_width < c->width || c->old_height < c->height) {

-        c->framebuf_stride = FFALIGN(c->width + 15, 16) * 3;

-        aligned_height     = c->height + 15;

-        av_free(c->framebuf);

-        c->framebuf = av_mallocz_array(c->framebuf_stride, aligned_height);

-        if (!c->framebuf)

-            return AVERROR(ENOMEM);

-    }

+    c->framebuf_stride = FFALIGN(c->width + 15, 16) * 3;

+    aligned_height = c->height + 15;

+

+    av_fast_mallocz(&c->framebuf, &c->framebuf_allocated, c->framebuf_stride * aligned_height);

+    if (!c->framebuf)

+        return AVERROR(ENOMEM);

+

     if (!c->synth_tile || !c->jpeg_tile ||

         (c->compression == 2 && !c->epic_buf_base) ||

         c->old_tile_w < c->tile_width ||

@@ -1638,6 +1638,7 @@

     av_freep(&c->jpeg_tile);

     av_freep(&c->cursor);

     av_freep(&c->framebuf);

+    c->framebuf_allocated = 0;

     return 0;

 }

​

@@ -350,7 +350,7 @@

         if (tmp > 0)

             L_temp0 >>= tmp;

         else

-            L_temp1 >>= -tmp;

+            L_temp1 >>= FFMIN(-tmp, 31);

         /* Check if longer filter increases the values of R'(k). */

         if (L_temp1 > L_temp0) {

​

@@ -691,9 +691,9 @@

 /* TODO instead of restarting the read when the code isn't in the first level

  * of the joint table, jump into the 2nd level of the individual table. */

 #define READ_2PIX_PLANE16(dst0, dst1, plane){\

-    dst0 = get_vlc2(&s->gb, s->vlcplane.table, VLC_BITS, 3)<<2;\

+    dst0 = get_vlc2(&s->gb, s->vlcplane.table, VLC_BITS, 3)*4;\

     dst0 += get_bits(&s->gb, 2);\

-    dst1 = get_vlc2(&s->gb, s->vlcplane.table, VLC_BITS, 3)<<2;\

+    dst1 = get_vlc2(&s->gb, s->vlcplane.table, VLC_BITS, 3)*4;\

     dst1 += get_bits(&s->gb, 2);\

 }

 static void decode_plane_bitstream(HYuvContext *s, int width, int plane)

​

@@ -1188,7 +1188,7 @@

     { "tile_height",   "Tile Height",       OFFSET(tile_height),   AV_OPT_TYPE_INT,   { .i64 = 256         }, 1,     1<<30,           VE, },

     { "pred",          "DWT Type",          OFFSET(pred),          AV_OPT_TYPE_INT,   { .i64 = 0           }, 0,         1,           VE, "pred"        },

     { "dwt97int",      NULL,                0,                     AV_OPT_TYPE_CONST, { .i64 = 0           }, INT_MIN, INT_MAX,       VE, "pred"        },

-    { "dwt53",         NULL,                0,                     AV_OPT_TYPE_CONST, { .i64 = 0           }, INT_MIN, INT_MAX,       VE, "pred"        },

+    { "dwt53",         NULL,                0,                     AV_OPT_TYPE_CONST, { .i64 = 1           }, INT_MIN, INT_MAX,       VE, "pred"        },

     { NULL }

 };

​

@@ -148,6 +148,8 @@

     if (expected != (unsigned int)c->zstream.total_out) {

         av_log(avctx, AV_LOG_ERROR, "Decoded size differs (%d != %lu)\n",

                expected, c->zstream.total_out);

+        if (expected > (unsigned int)c->zstream.total_out)

+            return (unsigned int)c->zstream.total_out;

         return AVERROR_UNKNOWN;

     }

     return c->zstream.total_out;

@@ -166,8 +168,8 @@

     int row, col;

     unsigned char *encoded = avpkt->data, *outptr;

     uint8_t *y_out, *u_out, *v_out;

-    unsigned int width = avctx->width; // Real image width

-    unsigned int height = avctx->height; // Real image height

+    int width = avctx->width; // Real image width

+    int height = avctx->height; // Real image height

     unsigned int mszh_dlen;

     unsigned char yq, y1q, uq, vq;

     int uqvq, ret;

@@ -274,12 +276,13 @@

             ret = zlib_decomp(avctx, buf + 8 + mthread_inlen, len - 8 - mthread_inlen,

                               mthread_outlen, mthread_outlen);

             if (ret < 0) return ret;

+            len = c->decomp_size;

         } else {

             int ret = zlib_decomp(avctx, buf, len, 0, c->decomp_size);

             if (ret < 0) return ret;

+            len = ret;

         }

         encoded = c->decomp_buf;

-        len = c->decomp_size;

         break;

 #endif

     default:

@@ -399,6 +402,11 @@

                 v_out col >> 1      = *encoded++ + 128;

                 v_out(col >> 1) + 1 = *encoded++ + 128;

             }

+            if (col && col < width) {

+                u_out col >> 1      = u_out(col>>1) - 1;

+                v_out col >> 1      = v_out(col>>1) - 1;

+            }

+

             y_out -= frame->linesize0;

             u_out -= frame->linesize1;

             v_out -= frame->linesize2;

@@ -420,6 +428,10 @@

                 u_outcol >> 2 = *encoded++ + 128;

                 v_outcol >> 2 = *encoded++ + 128;

             }

+            if (col && col < width) {

+                u_outcol >> 2 = u_out(col>>2) - 1;

+                v_outcol >> 2 = v_out(col>>2) - 1;

+            }

             y_out -= frame->linesize0;

             u_out -= frame->linesize1;

             v_out -= frame->linesize2;

@@ -477,6 +489,7 @@

                                 FFALIGN(avctx->height, 4);

     unsigned int max_decomp_size;

     int subsample_h, subsample_v;

+    int partial_h_supported = 0;

     if (avctx->extradata_size < 8) {

         av_log(avctx, AV_LOG_ERROR, "Extradata size too small.\n");

@@ -498,26 +511,24 @@

         av_log(avctx, AV_LOG_DEBUG, "Image type is YUV 1:1:1.\n");

         break;

     case IMGTYPE_YUV422:

-        c->decomp_size = basesize * 2;

+        c->decomp_size = (avctx->width & ~3) * avctx->height * 2;

         max_decomp_size = max_basesize * 2;

         avctx->pix_fmt = AV_PIX_FMT_YUV422P;

         av_log(avctx, AV_LOG_DEBUG, "Image type is YUV 4:2:2.\n");

-        if (avctx->width % 4) {

-            avpriv_request_sample(avctx, "Unsupported dimensions");

-            return AVERROR_INVALIDDATA;

-        }

+        partial_h_supported = 1;

         break;

     case IMGTYPE_RGB24:

-        c->decomp_size = basesize * 3;

+        c->decomp_size = FFALIGN(avctx->width*3, 4) * avctx->height;

         max_decomp_size = max_basesize * 3;

         avctx->pix_fmt = AV_PIX_FMT_BGR24;

         av_log(avctx, AV_LOG_DEBUG, "Image type is RGB 24.\n");

         break;

     case IMGTYPE_YUV411:

-        c->decomp_size = basesize / 2 * 3;

+        c->decomp_size = (avctx->width & ~3) * avctx->height / 2 * 3;

         max_decomp_size = max_basesize / 2 * 3;

         avctx->pix_fmt = AV_PIX_FMT_YUV411P;

         av_log(avctx, AV_LOG_DEBUG, "Image type is YUV 4:1:1.\n");

+        partial_h_supported = 1;

         break;

     case IMGTYPE_YUV211:

         c->decomp_size = basesize * 2;

@@ -537,7 +548,7 @@

     }

     av_pix_fmt_get_chroma_sub_sample(avctx->pix_fmt, &subsample_h, &subsample_v);

-    if (avctx->width % (1<<subsample_h) || avctx->height % (1<<subsample_v)) {

+    if ((avctx->width % (1<<subsample_h) && !partial_h_supported) || avctx->height % (1<<subsample_v)) {

         avpriv_request_sample(avctx, "Unsupported dimensions");

         return AVERROR_INVALIDDATA;

     }

​

@@ -515,7 +515,7 @@

     /* This should happen for TrueHD streams with >6 channels and MLP's noise

      * type. It is not yet known if this is allowed. */

-    if (max_channel > MAX_MATRIX_CHANNEL_MLP && !noise_type) {

+    if (max_matrix_channel > MAX_MATRIX_CHANNEL_MLP && !noise_type) {

         avpriv_request_sample(m->avctx,

                               "%d channels (more than the "

                               "maximum supported by the decoder)",

​

@@ -185,7 +185,7 @@

     int color;

     color = *(uint16_t *)&mp->frame->data0y * mp->frame->linesize0 + x * 2;

-    return mp_rgb_yuv_tablecolor;

+    return mp_rgb_yuv_tablecolor & 0x7FFF;

 }

 static void mp_set_rgb_from_yuv(MotionPixelsContext *mp, int x, int y, const YuvPixel *p)

​

@@ -45,6 +45,11 @@

     if (amount <= 0)

         return AVERROR(EINVAL);

+    if (ctx->par_in->codec_id == AV_CODEC_ID_WRAPPED_AVFRAME) {

+        av_log(ctx, AV_LOG_ERROR, "Wrapped AVFrame noising is unsupported\n");

+        return AVERROR_PATCHWELCOME;

+    }

+

     ret = ff_bsf_get_packet(ctx, &in);

     if (ret < 0)

         return ret;

​

@@ -223,8 +223,6 @@

                         run = bytestream2_get_le16(&s->g);

                     val = bytestream2_get_byte(&s->g);

                 }

-                if (!bytestream2_get_bytes_left(&s->g))

-                    break;

                 if (bits_per_plane == 8) {

                     picmemset_8bpp(s, frame, val, run, &x, &y);

​

@@ -308,7 +308,7 @@

 static void deloco_ ## NAME(TYPE *dst, int size, int alpha) \

 { \

     int i; \

-    for (i = 0; i < size; i += 3 + alpha) { \

+    for (i = 0; i < size - 2; i += 3 + alpha) { \

         int g = dst i + 1; \

         dsti + 0 += g; \

         dsti + 2 += g; \

@@ -620,6 +620,8 @@

     int ret;

     size_t byte_depth = s->bit_depth > 8 ? 2 : 1;

+    if (!p)

+        return AVERROR_INVALIDDATA;

     if (!(s->hdr_state & PNG_IHDR)) {

         av_log(avctx, AV_LOG_ERROR, "IDAT without IHDR\n");

         return AVERROR_INVALIDDATA;

@@ -1292,6 +1294,8 @@

             break;

         }

         case MKTAG('i', 'C', 'C', 'P'): {

+            if (!p)

+                return AVERROR_INVALIDDATA;

             if ((ret = decode_iccp_chunk(s, length, p)) < 0)

                 goto fail;

             break;

@@ -1314,6 +1318,9 @@

     }

 exit_loop:

+    if (!p)

+        return AVERROR_INVALIDDATA;

+

     if (avctx->codec_id == AV_CODEC_ID_PNG &&

         avctx->skip_frame == AVDISCARD_ALL) {

         return 0;

@@ -1460,7 +1467,7 @@

         s->zstream.zfree  = ff_png_zfree;

         bytestream2_init(&s->gb, avctx->extradata, avctx->extradata_size);

-        if ((ret = decode_frame_common(avctx, s, p, avpkt)) < 0)

+        if ((ret = decode_frame_common(avctx, s, NULL, avpkt)) < 0)

             goto end;

     }

​

@@ -583,6 +583,9 @@

                 int run, r, g, b, z, bx = x * 16 + sx1, by = y * 16 + sy1;

                 unsigned clr, ptype = 0;

+                if (bx >= avctx->width)

+                    return AVERROR_INVALIDDATA;

+

                 for (; by < y * 16 + sy2 && by < avctx->height;) {

                     ret = decode_value(s, s->op_modelptype, 6, 1000, &ptype);

                     if (ret < 0)

​

@@ -1542,10 +1542,10 @@

     int level, orientation, x, y;

     for(level=0; level<s->spatial_decomposition_count; level++){

+        int64_t error=0;

         for(orientation=level ? 1 : 0; orientation<4; orientation++){

             SubBand *b= &p->bandlevelorientation;

             IDWTELEM *ibuf= b->ibuf;

-            int64_t error=0;

             memset(s->spatial_idwt_buffer, 0, sizeof(*s->spatial_idwt_buffer)*width*height);

             ibufb->width/2 + b->height/2*b->stride= 256*16;

@@ -1556,9 +1556,13 @@

                     error += d*d;

                 }

             }

-

+            if (orientation == 2)

+                error /= 2;

             b->qlog= (int)(QROOT * log2(352256.0/sqrt(error)) + 0.5);

+            if (orientation != 1)

+                error = 0;

         }

+        p->bandlevel1.qlog = p->bandlevel2.qlog;

     }

 }

​

@@ -426,6 +426,8 @@

     if (buf_size < 4 || avctx->width < 8 || avctx->width % 8 != 0)

         return AVERROR_INVALIDDATA;

+    if (buf_size < avctx->width*avctx->height / 64 / 4)

+        return AVERROR_INVALIDDATA;

     quality = buf0;

     if (quality >= 100) {

​

@@ -19,6 +19,7 @@

  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA

  */

+#include "libavutil/avassert.h"

 #include "libavutil/common.h"

 #include "libavutil/intreadwrite.h"

 #include "libavutil/imgutils.h"

@@ -75,6 +76,12 @@

         return AVERROR_PATCHWELCOME;

     }

+    if (maplength > 768) {

+        av_log(avctx, AV_LOG_WARNING, "invalid colormap length\n");

+        return AVERROR_INVALIDDATA;

+    }

+

+    // This also checks depth to be valid

     switch (depth) {

         case 1:

             avctx->pix_fmt = maplength ? AV_PIX_FMT_PAL8 : AV_PIX_FMT_MONOWHITE;

@@ -96,15 +103,23 @@

             return AVERROR_INVALIDDATA;

     }

+    // This checks w and h to be valid in the sense that bytes of a padded bitmap are addressable with 32bit int

     ret = ff_set_dimensions(avctx, w, h);

     if (ret < 0)

         return ret;

+    // ensured by ff_set_dimensions()

+    av_assert0(w <= (INT32_MAX - 7) / depth);

+

     /* scanlines are aligned on 16 bit boundaries */

     len  = (depth * w + 7) >> 3;

     alen = len + (len & 1);

-    if (buf_end - buf < maplength + (len * h) * 3 / 256)

+    // ensured by ff_set_dimensions()

+    av_assert0(h  <= INT32_MAX / (3 * len));

+

+    // maplength is limited to 768 and the right term is limited to INT32_MAX / 256 so the add needs no check

+    if (buf_end - buf < (uint64_t)maplength + (len * h) * 3 / 256)

         return AVERROR_INVALIDDATA;

     if ((ret = ff_get_buffer(avctx, p, 0)) < 0)

@@ -118,7 +133,7 @@

     } else if (maplength) {

         unsigned int len = maplength / 3;

-        if (maplength % 3 || maplength > 768) {

+        if (maplength % 3) {

             av_log(avctx, AV_LOG_WARNING, "invalid colormap length\n");

             return AVERROR_INVALIDDATA;

         }

​

@@ -154,6 +154,9 @@

     if (ti->flags & TAK_FRAME_FLAG_HAS_METADATA)

         return AVERROR_INVALIDDATA;

+    if (get_bits_left(gb) < 24)

+        return AVERROR_INVALIDDATA;

+

     skip_bits(gb, 24);

     return 0;

​

@@ -31,11 +31,13 @@

 #define width  256

 #define height 256

     int buffer2width*height;

+    short obufferwidth*height;

     SnowContext s;

     int i;

     AVLFG prng;

     s.spatial_decomposition_count=6;

     s.spatial_decomposition_type=1;

+    int ret = 0;

     s.temp_dwt_buffer  = av_mallocz_array(width, sizeof(DWTELEM));

     s.temp_idwt_buffer = av_mallocz_array(width, sizeof(IDWTELEM));

@@ -49,24 +51,34 @@

     printf("testing 5/3 DWT\n");

     for(i=0; i<width*height; i++)

-        buffer0i = buffer1i = av_lfg_get(&prng) % 54321 - 12345;

+        buffer0i = buffer1i = av_lfg_get(&prng) % 19000 - 9000;

     ff_spatial_dwt(buffer0, s.temp_dwt_buffer, width, height, width, s.spatial_decomposition_type, s.spatial_decomposition_count);

-    ff_spatial_idwt((IDWTELEM*)buffer0, s.temp_idwt_buffer, width, height, width, s.spatial_decomposition_type, s.spatial_decomposition_count);

+    for(i=0; i<width*height; i++)

+        obufferi = buffer0i;

+    ff_spatial_idwt(obuffer, s.temp_idwt_buffer, width, height, width, s.spatial_decomposition_type, s.spatial_decomposition_count);

     for(i=0; i<width*height; i++)

-        if(buffer0i!= buffer1i) printf("fsck: %6d %12d %7d\n",i, buffer0i, buffer1i);

+        if(buffer1i!= obufferi) {

+            printf("fsck: %4dx%4dx %12d %7d\n",i%width, i/width, buffer1i, obufferi);

+            ret = 1;

+        }

     printf("testing 9/7 DWT\n");

     s.spatial_decomposition_type=0;

     for(i=0; i<width*height; i++)

-        buffer0i = buffer1i = av_lfg_get(&prng) % 54321 - 12345;

+        buffer0i = buffer1i = av_lfg_get(&prng) % 11000 - 5000;

     ff_spatial_dwt(buffer0, s.temp_dwt_buffer, width, height, width, s.spatial_decomposition_type, s.spatial_decomposition_count);

-    ff_spatial_idwt((IDWTELEM*)buffer0, s.temp_idwt_buffer, width, height, width, s.spatial_decomposition_type, s.spatial_decomposition_count);

+    for(i=0; i<width*height; i++)

+        obufferi = buffer0i;

+    ff_spatial_idwt(obuffer, s.temp_idwt_buffer, width, height, width, s.spatial_decomposition_type, s.spatial_decomposition_count);

     for(i=0; i<width*height; i++)

-        if(FFABS(buffer0i - buffer1i)>20) printf("fsck: %6d %12d %7d\n",i, buffer0i, buffer1i);

+        if(FFABS(buffer1i - obufferi)>20) {

+            printf("fsck: %4dx%4d %12d %7d\n",i%width, i/width, buffer1i, obufferi);

+            ret = 1;

+        }

     {

     int level, orientation, x, y;

@@ -81,18 +93,18 @@

                 int w= width  >> (s.spatial_decomposition_count-level);

                 int h= height >> (s.spatial_decomposition_count-level);

                 int stride= width  << (s.spatial_decomposition_count-level);

-                DWTELEM *buf= buffer0;

+                IDWTELEM *buf= obuffer;

                 int64_t error=0;

                 if(orientation&1) buf+=w;

                 if(orientation>1) buf+=stride>>1;

-                memset(buffer0, 0, sizeof(int)*width*height);

-                bufw/2 + h/2*stride= 256*256;

-                ff_spatial_idwt((IDWTELEM*)buffer0, s.temp_idwt_buffer, width, height, width, s.spatial_decomposition_type, s.spatial_decomposition_count);

+                memset(obuffer, 0, sizeof(short)*width*height);

+                bufw/2 + h/2*stride= 8*256;

+                ff_spatial_idwt(obuffer, s.temp_idwt_buffer, width, height, width, s.spatial_decomposition_type, s.spatial_decomposition_count);

                 for(y=0; y<height; y++){

                     for(x=0; x<width; x++){

-                        int64_t d= buffer0x + y*width;

+                        int64_t d= obufferx + y*width;

                         error += d*d;

                         if(FFABS(width/2-x)<9 && FFABS(height/2-y)<9 && level==2) printf("%8"PRId64" ", d);

                     }

@@ -143,5 +155,5 @@

         }

     }

-    return 0;

+    return ret;

 }

​

@@ -359,6 +359,8 @@

     case AV_PIX_FMT_GBRAP16BE:

         w_align = 16; //FIXME assume 16 pixel per macroblock

         h_align = 16 * 2; // interlaced needs 2 macroblocks height

+        if (s->codec_id == AV_CODEC_ID_BINKVIDEO)

+            w_align = 16*2;

         break;

     case AV_PIX_FMT_YUV411P:

     case AV_PIX_FMT_YUVJ411P:

@@ -424,12 +426,13 @@

     }

     if (s->codec_id == AV_CODEC_ID_IFF_ILBM) {

-        w_align = FFMAX(w_align, 8);

+        w_align = FFMAX(w_align, 16);

     }

     *width  = FFALIGN(*width, w_align);

     *height = FFALIGN(*height, h_align);

     if (s->codec_id == AV_CODEC_ID_H264 || s->lowres ||

+        s->codec_id == AV_CODEC_ID_VC1  || s->codec_id == AV_CODEC_ID_WMV3 ||

         s->codec_id == AV_CODEC_ID_VP5  || s->codec_id == AV_CODEC_ID_VP6 ||

         s->codec_id == AV_CODEC_ID_VP6F || s->codec_id == AV_CODEC_ID_VP6A

     ) {

@@ -443,6 +446,9 @@

         // the next rounded up width is 32

         *width = FFMAX(*width, 32);

     }

+    if (s->codec_id == AV_CODEC_ID_SVQ3) {

+        *width = FFMAX(*width, 32);

+    }

     for (i = 0; i < 4; i++)

         linesize_aligni = STRIDE_ALIGN;

​

@@ -60,7 +60,7 @@

     av_assert2(start_x < end_x && block_w);

     w    = end_x - start_x;

-    src += start_y * src_linesize + start_x * sizeof(pixel);

+    src += start_y * src_linesize + start_x * (ptrdiff_t)sizeof(pixel);

     buf += start_x * sizeof(pixel);

     // top

@@ -83,7 +83,7 @@

         buf += buf_linesize;

     }

-    buf -= block_h * buf_linesize + start_x * sizeof(pixel);

+    buf -= block_h * buf_linesize + start_x * (ptrdiff_t)sizeof(pixel);

     while (block_h--) {

         pixel *bufp = (pixel *) buf;

​

@@ -363,6 +363,10 @@

             unsigned codebook_value_bits = get_bits(gb, 4) + 1;

             unsigned codebook_sequence_p = get_bits1(gb);

+            if (!isfinite(codebook_minimum_value) || !isfinite(codebook_delta_value)) {

+                ret = AVERROR_INVALIDDATA;

+                goto error;

+            }

             ff_dlog(NULL, " We expect %d numbers for building the codevectors. \n",

                     codebook_lookup_values);

             ff_dlog(NULL, "  delta %f minmum %f \n",

​

@@ -1747,6 +1747,8 @@

     s->avctx  = avctx;

     s->width  = FFALIGN(avctx->coded_width, 16);

     s->height = FFALIGN(avctx->coded_height, 16);

+    if (s->width < 18)

+        return AVERROR_PATCHWELCOME;

     if (avctx->codec_id != AV_CODEC_ID_THEORA)

         avctx->pix_fmt = AV_PIX_FMT_YUV420P;

     avctx->chroma_sample_location = AVCHROMA_LOC_CENTER;

@@ -2099,8 +2101,13 @@

     if (ff_thread_get_buffer(avctx, &s->current_frame, AV_GET_BUFFER_FLAG_REF) < 0)

         goto error;

-    if (!s->edge_emu_buffer)

+    if (!s->edge_emu_buffer) {

         s->edge_emu_buffer = av_malloc(9 * FFABS(s->current_frame.f->linesize0));

+        if (!s->edge_emu_buffer) {

+            ret = AVERROR(ENOMEM);

+            goto error;

+        }

+    }

     if (s->keyframe) {

         if (!s->theora) {

@@ -2308,7 +2315,9 @@

     /* sanity check */

     if (av_image_check_size(visible_width, visible_height, 0, avctx) < 0 ||

         visible_width  + offset_x > s->width ||

-        visible_height + offset_y > s->height) {

+        visible_height + offset_y > s->height ||

+        visible_width < 18

+    ) {

         av_log(avctx, AV_LOG_ERROR,

                "Invalid frame dimensions - w:%d h:%d x:%d y:%d (%dx%d).\n",

                visible_width, visible_height, offset_x, offset_y,

@@ -2354,6 +2363,8 @@

     } else

         avctx->pix_fmt = AV_PIX_FMT_YUV420P;

+    if (s->width < 18)

+        return AVERROR_PATCHWELCOME;

     ret = ff_set_dimensions(avctx, s->width, s->height);

     if (ret < 0)

         return ret;

​

@@ -95,7 +95,7 @@

     e   = (1 << (p + 1)) - k - 1;

     res = get_bitsz(gb, p);

     if (res >= e)

-        res = (res << 1) - e + get_bits1(gb);

+        res = res * 2U - e + get_bits1(gb);

     return res;

 }

​

@@ -351,6 +351,9 @@

         return AVERROR_INVALIDDATA;

     }

+    if (size > SIZE_MAX / 4)

+        return AVERROR(ENOMEM);

+

     size *= 4;

     ptr += mod_strcspn(ptr, ",") + 1;

​

@@ -375,10 +375,10 @@

     lang3 = '\0';

     taglen -= 3;

-    if (decode_str(s, pb, encoding, &descriptor, &taglen) < 0)

+    if (decode_str(s, pb, encoding, &descriptor, &taglen) < 0 || taglen < 0)

         goto error;

-    if (decode_str(s, pb, encoding, &text, &taglen) < 0)

+    if (decode_str(s, pb, encoding, &text, &taglen) < 0 || taglen < 0)

         goto error;

     // FFmpeg does not support hierarchical metadata, so concatenate the keys.

​

@@ -3553,6 +3553,13 @@

                 if (keyframe)

                     distance = 0;

                 sample_size = sc->stsz_sample_size > 0 ? sc->stsz_sample_size : sc->sample_sizescurrent_sample;

+                if (current_offset > INT64_MAX - sample_size) {

+                    av_log(mov->fc, AV_LOG_ERROR, "Current offset %"PRId64" or sample size %u is too large\n",

+                           current_offset,

+                           sample_size);

+                    return;

+                }

+

                 if (sc->pseudo_stream_id == -1 ||

                    sc->stsc_datastsc_index.id - 1 == sc->pseudo_stream_id) {

                     AVIndexEntry *e;

​

@@ -61,7 +61,7 @@

         }

     }

-    if (abs(db) > (INT32_MAX - mb) / 100000)

+    if (llabs(db) > (INT32_MAX - mb) / 100000)

         return min;