Update for 5.1.1

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Changelog

@@ -1,6 +1,37 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.
 
+version 5.1.1:
+- avformat/asfdec_o: limit recursion depth in asf_read_unknown()
+- avformat/mov: Check count sums in build_open_gop_key_points()
+- doc/git-howto.texi: Document commit signing
+- libavcodec/8bps: Check that line lengths fit within the buffer
+- avcodec/midivid: Perform lzss_uncompress() before ff_reget_buffer()
+- libavformat/iff: Check for overflow in body_end calculation
+- avformat/avidec: Prevent entity expansion attacks
+- avcodec/h263dec: Sanity check against minimal I/P frame size
+- avcodec/hevcdec: Check s->ref in the md5 path similar to hwaccel
+- avcodec/mpegaudiodec_template: use unsigned shift in handle_crc()
+- avformat/subviewerdec: Make read_ts() more flexible
+- avcodec/mjpegdec: bayer and rct are incompatible
+- MAINTAINERS: Add ED25519 key for signing my commits in the future
+- avcodec/pngdec: Fix APNG_DISPOSE_OP_BACKGROUND
+- avcodec/libvpx: fix assembling vp9 packets with alpha channel
+- fftools/ffmpeg_opt: try to propagate the requested output channel layout
+- avcodec/libsvtav1: properly initialize the flush EbBufferHeaderType struct
+- configure: enable the av1_frame_split bsf for the av1 decoder
+- swresample/swresample: fill the correct buffer to print the output layout string
+- ffprobe: restore reporting error code for failed inputs
+- ipfsgateway: Remove default gateway
+- avcodec/libspeexdec: Fix use of uninitialized value
+- avformat/avisynth: use ch_layout.nb_channels for channel count
+- fate/lavf-image: Disable file checksums for exr tests
+- tests/fate-run: Allow to skip file checksums for lavf_image
+- fate/imf: Rename IMF fate-target
+- avcodec/alac: don't fail if channels aren't set during init() when extradata is valid
+- configure: properly require libx264 if enabled
+
+
 version 5.1:
 - add ipfs/ipns protocol support
 - dialogue enhance audio filter

MAINTAINERS

@@ -625,6 +625,7 @@ Leo Izen (thebombzen)         B6FD 3CFC 7ACF 83FC 9137 6945 5A71 C331 FD2F A19A
 Loren Merritt                 ABD9 08F4 C920 3F65 D8BE 35D7 1540 DAA7 060F 56DE
 Lynne                         FE50 139C 6805 72CA FD52 1F8D A2FE A5F0 3F03 4464
 Michael Niedermayer           9FF2 128B 147E F673 0BAD F133 611E C787 040B 0FAB
+                              DD1E C9E8 DE08 5C62 9B3E 1846 B18E 8928 B394 8D64
 Nicolas George                24CE 01CE 9ACC 5CEB 74D8 8D9D B063 D997 36E5 4C93
 Niklas Haas (haasn)           1DDB 8076 B14D 5B48 32FC 99D9 EB52 DA9C 02BA 6FB4
 Nikolay Aleksandrov           8978 1D8C FB71 588E 4B27 EAA8 C4F0 B5FC E011 13B1

RELEASE

@@ -1 +1 @@
-4.4.git
+5.1.1

RELEASE_NOTES

@@ -0,0 +1,18 @@
+
+            ┌────────────────────────────────────────────┐
+            │ RELEASE NOTES for FFmpeg 5.1 "Riemann" LTS │
+            └────────────────────────────────────────────┘
+
+   The FFmpeg Project proudly presents FFmpeg 5.1 "Riemann" LTS, about 6
+   months after the release of FFmpeg 5.0, our first Long Term Support
+   release. While several past FFmpeg releases have enjoyed long term
+   support, this is the first release where such an intention is made
+   clear at release.
+
+   A complete Changelog is available at the root of the project, and the
+   complete Git history on https://git.ffmpeg.org/gitweb/ffmpeg.git
+
+   We hope you will like this release as much as we enjoyed working on it, and
+   as usual, if you have any questions about it, or any FFmpeg related topic,
+   feel free to join us on the #ffmpeg IRC channel (on irc.libera.chat) or ask
+   on the mailing-lists.

configure

@@ -2781,7 +2781,7 @@ atrac3al_decoder_select="mdct"
 atrac3p_decoder_select="mdct sinewin"
 atrac3pal_decoder_select="mdct sinewin"
 atrac9_decoder_select="mdct"
-av1_decoder_select="cbs_av1"
+av1_decoder_select="av1_frame_split_bsf cbs_av1"
 bink_decoder_select="blockdsp hpeldsp"
 binkaudio_dct_decoder_select="mdct rdft dct sinewin wma_freqs"
 binkaudio_rdft_decoder_select="mdct rdft sinewin wma_freqs"
@@ -6666,7 +6666,7 @@ enabled libvpx            && {
 enabled libwebp           && {
     enabled libwebp_encoder      && require_pkg_config libwebp "libwebp >= 0.2.0" webp/encode.h WebPGetEncoderVersion
     enabled libwebp_anim_encoder && check_pkg_config libwebp_anim_encoder "libwebpmux >= 0.4.0" webp/mux.h WebPAnimEncoderOptionsInit; }
-enabled libx264           && check_pkg_config libx264 x264 "stdint.h x264.h" x264_encoder_encode &&
+enabled libx264           && require_pkg_config libx264 x264 "stdint.h x264.h" x264_encoder_encode &&
                              require_cpp_condition libx264 x264.h "X264_BUILD >= 118" && {
                              [ "$toolchain" != "msvc" ] ||
                              require_cpp_condition libx264 x264.h "X264_BUILD >= 158"; } &&

doc/Doxyfile

@@ -38,7 +38,7 @@ PROJECT_NAME           = FFmpeg
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         =
+PROJECT_NUMBER         = 5.1.1
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a

doc/ffmpeg.texi

@@ -518,6 +518,21 @@ see @ref{time duration syntax,,the Time duration section in the ffmpeg-utils(1)
 Like the @code{-ss} option but relative to the "end of file". That is negative
 values are earlier in the file, 0 is at EOF.
 
+@item -isync @var{input_index} (@emph{input})
+Assign an input as a sync source.
+
+This will take the difference between the start times of the target and reference inputs and
+offset the timestamps of the target file by that difference. The source timestamps of the two
+inputs should derive from the same clock source for expected results. If @code{copyts} is set
+then @code{start_at_zero} must also be set. If either of the inputs has no starting timestamp
+then no sync adjustment is made.
+
+Acceptable values are those that refer to a valid ffmpeg input index. If the sync reference is
+the target index itself or @var{-1}, then no adjustment is made to target timestamps. A sync
+reference may not itself be synced to any other input.
+
+Default value is @var{-1}.
+
 @item -itsoffset @var{offset} (@emph{input})
 Set the input time offset.
 

doc/git-howto.texi

@@ -187,11 +187,18 @@ to make sure you don't have untracked files or deletions.
 git add [-i|-p|-A] <filenames/dirnames>
 @end example
 
-Make sure you have told Git your name and email address
+Make sure you have told Git your name, email address and GPG key
 
 @example
 git config --global user.name "My Name"
 git config --global user.email my@@email.invalid
+git config --global user.signingkey ABCDEF0123245
+@end example
+
+Enable signing all commits or use -S
+
+@example
+git config --global commit.gpgsign true
 @end example
 
 Use @option{--global} to set the global configuration for all your Git checkouts.
@@ -423,6 +430,19 @@ git checkout -b svn_23456 $SHA1
 where @var{$SHA1} is the commit hash from the @command{git log} output.
 
 
+@chapter gpg key generation
+
+If you have no gpg key yet, we recommend that you create a ed25519 based key as it
+is small, fast and secure. Especially it results in small signatures in git.
+
+@example
+gpg --default-new-key-algo "ed25519/cert,sign+cv25519/encr" --quick-generate-key "human@@server.com"
+@end example
+
+When generating a key, make sure the email specified matches the email used in git as some sites like
+github consider mismatches a reason to declare such commits unverified. After generating a key you
+can add it to the MAINTAINER file and upload it to a keyserver.
+
 @chapter Pre-push checklist
 
 Once you have a set of commits that you feel are ready for pushing,

fftools/ffmpeg.h

@@ -118,6 +118,7 @@ typedef struct OptionsContext {
     float readrate;
     int accurate_seek;
     int thread_queue_size;
+    int input_sync_ref;
 
     SpecifierOpt *ts_scale;
     int        nb_ts_scale;
@@ -410,6 +411,7 @@ typedef struct InputFile {
                              at the moment when looping happens */
     AVRational time_base; /* time base of the duration */
     int64_t input_ts_offset;
+    int input_sync_ref;
 
     int64_t ts_offset;
     int64_t last_ts;

fftools/ffmpeg_opt.c

@@ -235,6 +235,7 @@ static void init_options(OptionsContext *o)
     o->chapters_input_file = INT_MAX;
     o->accurate_seek  = 1;
     o->thread_queue_size = -1;
+    o->input_sync_ref = -1;
 }
 
 static int show_hwaccels(void *optctx, const char *opt, const char *arg)
@@ -287,6 +288,58 @@ static int parse_and_set_vsync(const char *arg, int *vsync_var, int file_idx, in
     return 0;
 }
 
+static int apply_sync_offsets(void)
+{
+    for (int i = 0; i < nb_input_files; i++) {
+        InputFile *ref, *self = input_files[i];
+        int64_t adjustment;
+        int64_t self_start_time, ref_start_time, self_seek_start, ref_seek_start;
+        int start_times_set = 1;
+
+        if (self->input_sync_ref == -1 || self->input_sync_ref == i) continue;
+        if (self->input_sync_ref >= nb_input_files || self->input_sync_ref < -1) {
+            av_log(NULL, AV_LOG_FATAL, "-isync for input %d references non-existent input %d.\n", i, self->input_sync_ref);
+            exit_program(1);
+        }
+
+        if (copy_ts && !start_at_zero) {
+            av_log(NULL, AV_LOG_FATAL, "Use of -isync requires that start_at_zero be set if copyts is set.\n");
+            exit_program(1);
+        }
+
+        ref = input_files[self->input_sync_ref];
+        if (ref->input_sync_ref != -1 && ref->input_sync_ref != self->input_sync_ref) {
+            av_log(NULL, AV_LOG_ERROR, "-isync for input %d references a resynced input %d. Sync not set.\n", i, self->input_sync_ref);
+            continue;
+        }
+
+        if (self->ctx->start_time_realtime != AV_NOPTS_VALUE && ref->ctx->start_time_realtime != AV_NOPTS_VALUE) {
+            self_start_time = self->ctx->start_time_realtime;
+            ref_start_time  =  ref->ctx->start_time_realtime;
+        } else if (self->ctx->start_time != AV_NOPTS_VALUE && ref->ctx->start_time != AV_NOPTS_VALUE) {
+            self_start_time = self->ctx->start_time;
+            ref_start_time  =  ref->ctx->start_time;
+        } else {
+            start_times_set = 0;
+        }
+
+        if (start_times_set) {
+            self_seek_start = self->start_time == AV_NOPTS_VALUE ? 0 : self->start_time;
+            ref_seek_start  =  ref->start_time == AV_NOPTS_VALUE ? 0 :  ref->start_time;
+
+            adjustment = (self_start_time - ref_start_time) + !copy_ts*(self_seek_start - ref_seek_start) + ref->input_ts_offset;
+
+            self->ts_offset += adjustment;
+
+            av_log(NULL, AV_LOG_INFO, "Adjusted ts offset for Input #%d by %"PRId64" us to sync with Input #%d.\n", i, adjustment, self->input_sync_ref);
+        } else {
+            av_log(NULL, AV_LOG_INFO, "Unable to identify start times for Inputs #%d and %d both. No sync adjustment made.\n", i, self->input_sync_ref);
+        }
+    }
+
+    return 0;
+}
+
 static int opt_filter_threads(void *optctx, const char *opt, const char *arg)
 {
     av_free(filter_nbthreads);
@@ -1305,6 +1358,7 @@ static int open_input_file(OptionsContext *o, const char *filename)
     f->ist_index  = nb_input_streams - ic->nb_streams;
     f->start_time = o->start_time;
     f->recording_time = o->recording_time;
+    f->input_sync_ref = o->input_sync_ref;
     f->input_ts_offset = o->input_ts_offset;
     f->ts_offset  = o->input_ts_offset - (copy_ts ? (start_at_zero && ic->start_time != AV_NOPTS_VALUE ? ic->start_time : 0) : timestamp);
     f->nb_streams = ic->nb_streams;
@@ -2318,6 +2372,43 @@ static int init_complex_filters(void)
     return 0;
 }
 
+static void set_channel_layout(OutputFilter *f, OutputStream *ost)
+{
+    int i, err;
+
+    if (ost->enc_ctx->ch_layout.order != AV_CHANNEL_ORDER_UNSPEC) {
+        /* Pass the layout through for all orders but UNSPEC */
+        err = av_channel_layout_copy(&f->ch_layout, &ost->enc_ctx->ch_layout);
+        if (err < 0)
+            exit_program(1);
+        return;
+    }
+
+    /* Requested layout is of order UNSPEC */
+    if (!ost->enc->ch_layouts) {
+        /* Use the default native layout for the requested amount of channels when the
+           encoder doesn't have a list of supported layouts */
+        av_channel_layout_default(&f->ch_layout, ost->enc_ctx->ch_layout.nb_channels);
+        return;
+    }
+    /* Encoder has a list of supported layouts. Pick the first layout in it with the
+       same amount of channels as the requested layout */
+    for (i = 0; ost->enc->ch_layouts[i].nb_channels; i++) {
+        if (ost->enc->ch_layouts[i].nb_channels == ost->enc_ctx->ch_layout.nb_channels)
+            break;
+    }
+    if (ost->enc->ch_layouts[i].nb_channels) {
+        /* Use it if one is found */
+        err = av_channel_layout_copy(&f->ch_layout, &ost->enc->ch_layouts[i]);
+        if (err < 0)
+            exit_program(1);
+        return;
+    }
+    /* If no layout for the amount of channels requested was found, use the default
+       native layout for it. */
+    av_channel_layout_default(&f->ch_layout, ost->enc_ctx->ch_layout.nb_channels);
+}
+
 static int open_output_file(OptionsContext *o, const char *filename)
 {
     AVFormatContext *oc;
@@ -2720,7 +2811,7 @@ loop_end:
                     f->sample_rates = ost->enc->supported_samplerates;
                 }
                 if (ost->enc_ctx->ch_layout.nb_channels) {
-                    av_channel_layout_default(&f->ch_layout, ost->enc_ctx->ch_layout.nb_channels);
+                    set_channel_layout(f, ost);
                 } else if (ost->enc->ch_layouts) {
                     f->ch_layouts = ost->enc->ch_layouts;
                 }
@@ -3489,6 +3580,8 @@ int ffmpeg_parse_options(int argc, char **argv)
         goto fail;
     }
 
+    apply_sync_offsets();
+
     /* create the complex filtergraphs */
     ret = init_complex_filters();
     if (ret < 0) {
@@ -3603,6 +3696,9 @@ const OptionDef options[] = {
     { "accurate_seek",  OPT_BOOL | OPT_OFFSET | OPT_EXPERT |
                         OPT_INPUT,                                   { .off = OFFSET(accurate_seek) },
         "enable/disable accurate seeking with -ss" },
+    { "isync",          HAS_ARG | OPT_INT | OPT_OFFSET |
+                        OPT_EXPERT | OPT_INPUT,                      { .off = OFFSET(input_sync_ref) },
+        "Indicate the input index for sync reference", "sync ref" },
     { "itsoffset",      HAS_ARG | OPT_TIME | OPT_OFFSET |
                         OPT_EXPERT | OPT_INPUT,                      { .off = OFFSET(input_ts_offset) },
         "set the input ts offset", "time_off" },

fftools/ffprobe.c

@@ -4026,7 +4026,7 @@ int main(int argc, char **argv)
     WriterContext *wctx;
     char *buf;
     char *w_name = NULL, *w_args = NULL;
-    int ret, i;
+    int ret, input_ret, i;
 
     init_dynload();
 
@@ -4150,10 +4150,14 @@ int main(int argc, char **argv)
                 show_error(wctx, ret);
         }
 
+        input_ret = ret;
+
         writer_print_section_footer(wctx);
         ret = writer_close(&wctx);
         if (ret < 0)
             av_log(NULL, AV_LOG_ERROR, "Writing output failed: %s\n", av_err2str(ret));
+
+        ret = FFMIN(ret, input_ret);
     }
 
 end:

libavcodec/8bps.c

@@ -71,6 +71,9 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
     unsigned char *planemap = c->planemap;
     int ret;
 
+    if (buf_size < planes * height *2)
+        return AVERROR_INVALIDDATA;
+
     if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
         return ret;
 

libavcodec/alac.c

@@ -574,13 +574,15 @@ static av_cold int alac_decode_init(AVCodecContext * avctx)
     avctx->bits_per_raw_sample = alac->sample_size;
     avctx->sample_rate         = alac->sample_rate;
 
-    if (alac->channels < 1 || alac->channels > ALAC_MAX_CHANNELS) {
+    if (alac->channels < 1) {
         av_log(avctx, AV_LOG_WARNING, "Invalid channel count\n");
+        if (avctx->ch_layout.nb_channels < 1)
+            return AVERROR(EINVAL);
         alac->channels = avctx->ch_layout.nb_channels;
     }
-    if (avctx->ch_layout.nb_channels > ALAC_MAX_CHANNELS || avctx->ch_layout.nb_channels <= 0 ) {
+    if (alac->channels > ALAC_MAX_CHANNELS) {
         avpriv_report_missing_feature(avctx, "Channel count %d",
-                                      avctx->ch_layout.nb_channels);
+                                      alac->channels);
         return AVERROR_PATCHWELCOME;
     }
     av_channel_layout_uninit(&avctx->ch_layout);

libavcodec/exr.c

@@ -1241,7 +1241,8 @@ static int decode_block(AVCodecContext *avctx, void *tdata,
         td->ysize = FFMIN(s->tile_attr.ySize, s->ydelta - tile_y * s->tile_attr.ySize);
         td->xsize = FFMIN(s->tile_attr.xSize, s->xdelta - tile_x * s->tile_attr.xSize);
 
-        if (td->xsize * (uint64_t)s->current_channel_offset > INT_MAX)
+        if (td->xsize * (uint64_t)s->current_channel_offset > INT_MAX ||
+            av_image_check_size2(td->xsize, td->ysize, s->avctx->max_pixels, AV_PIX_FMT_NONE, 0, s->avctx) < 0)
             return AVERROR_INVALIDDATA;
 
         td->channel_line_size = td->xsize * s->current_channel_offset;/* uncompress size of one line */
@@ -1265,7 +1266,8 @@ static int decode_block(AVCodecContext *avctx, void *tdata,
         td->ysize          = FFMIN(s->scan_lines_per_block, s->ymax - line + 1); /* s->ydelta - line ?? */
         td->xsize          = s->xdelta;
 
-        if (td->xsize * (uint64_t)s->current_channel_offset > INT_MAX)
+        if (td->xsize * (uint64_t)s->current_channel_offset > INT_MAX ||
+            av_image_check_size2(td->xsize, td->ysize, s->avctx->max_pixels, AV_PIX_FMT_NONE, 0, s->avctx) < 0)
             return AVERROR_INVALIDDATA;
 
         td->channel_line_size = td->xsize * s->current_channel_offset;/* uncompress size of one line */

libavcodec/ffv1dec.c

@@ -883,7 +883,14 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *rframe,
         if (buf_size < avctx->width * avctx->height / (128*8))
             return AVERROR_INVALIDDATA;
     } else {
-        if (buf_size < avctx->height / 8)
+        int w = avctx->width;
+        int s = 1 + w / (1<<23);
+
+        w /= s;
+
+        for (i = 0; w > (1<<ff_log2_run[i]); i++)
+            w -= ff_log2_run[i];
+        if (buf_size < (avctx->height + i + 6) / 8 * s)
             return AVERROR_INVALIDDATA;
     }
 

libavcodec/h263dec.c

@@ -552,6 +552,8 @@ retry:
     avctx->has_b_frames = !s->low_delay;
 
     if (CONFIG_MPEG4_DECODER && avctx->codec_id == AV_CODEC_ID_MPEG4) {
+        if (s->pict_type != AV_PICTURE_TYPE_B && s->mb_num/2 > get_bits_left(&s->gb))
+            return AVERROR_INVALIDDATA;
         if (ff_mpeg4_workaround_bugs(avctx) == 1)
             goto retry;
         if (s->studio_profile != (s->idsp.idct == NULL))

libavcodec/hevc_filter.c

@@ -143,11 +143,22 @@ static void copy_CTB(uint8_t *dst, const uint8_t *src, int width, int height,
 
     if (((intptr_t)dst | (intptr_t)src | stride_dst | stride_src) & 15) {
         for (i = 0; i < height; i++) {
-            for (j = 0; j < width; j+=8)
+            for (j = 0; j < width - 7; j+=8)
                 AV_COPY64U(dst+j, src+j);
             dst += stride_dst;
             src += stride_src;
         }
+        if (width&7) {
+            dst += ((width>>3)<<3) - stride_dst * height;
+            src += ((width>>3)<<3) - stride_src * height;
+            width &= 7;
+            for (i = 0; i < height; i++) {
+                for (j = 0; j < width; j++)
+                    dst[j] = src[j];
+                dst += stride_dst;
+                src += stride_src;
+            }
+        }
     } else {
         for (i = 0; i < height; i++) {
             for (j = 0; j < width; j+=16)

libavcodec/hevcdec.c

@@ -3516,7 +3516,7 @@ static int hevc_decode_frame(AVCodecContext *avctx, AVFrame *rframe,
         }
     } else {
         /* verify the SEI checksum */
-        if (avctx->err_recognition & AV_EF_CRCCHECK && s->is_decoded &&
+        if (avctx->err_recognition & AV_EF_CRCCHECK && s->ref && s->is_decoded &&
             s->sei.picture_hash.is_md5) {
             ret = verify_md5(s, s->ref->frame);
             if (ret < 0 && avctx->err_recognition & AV_EF_EXPLODE) {

libavcodec/lagarith.c

@@ -409,6 +409,9 @@ output_zeros:
         if (zero_run) {
             zero_run = 0;
             i += esc_count;
+            if (i >  end - dst ||
+                i >= src_end - src)
+                return AVERROR_INVALIDDATA;
             memcpy(dst, src, i);
             dst += i;
             l->zeros_rem = lag_calc_zero_run(src[i]);

libavcodec/libspeexdec.c

@@ -43,7 +43,7 @@ static av_cold int libspeex_decode_init(AVCodecContext *avctx)
     LibSpeexContext *s = avctx->priv_data;
     const SpeexMode *mode;
     SpeexHeader *header = NULL;
-    int spx_mode, channels;
+    int spx_mode, channels = avctx->ch_layout.nb_channels;
 
     if (avctx->extradata && avctx->extradata_size >= 80) {
         header = speex_packet_to_header(avctx->extradata,

libavcodec/libsvtav1.c

@@ -424,11 +424,8 @@ static int eb_send_frame(AVCodecContext *avctx, const AVFrame *frame)
         if (svt_enc->eos_flag == EOS_SENT)
             return 0;
 
-        headerPtrLast.n_alloc_len   = 0;
-        headerPtrLast.n_filled_len  = 0;
-        headerPtrLast.n_tick_count  = 0;
-        headerPtrLast.p_app_private = NULL;
-        headerPtrLast.p_buffer      = NULL;
+        memset(&headerPtrLast, 0, sizeof(headerPtrLast));
+        headerPtrLast.pic_type      = EB_AV1_INVALID_PICTURE;
         headerPtrLast.flags         = EB_BUFFERFLAG_EOS;
 
         svt_av1_enc_send_picture(svt_enc->svt_handle, &headerPtrLast);

libavcodec/libvpxenc.c

@@ -56,8 +56,6 @@
 struct FrameListData {
     void *buf;                       /**< compressed data buffer */
     size_t sz;                       /**< length of compressed data */
-    void *buf_alpha;
-    size_t sz_alpha;
     int64_t pts;                     /**< time stamp to show frame
                                           (in timebase units) */
     unsigned long duration;          /**< duration to show frame
@@ -87,6 +85,7 @@ typedef struct VPxEncoderContext {
     int have_sse; /**< true if we have pending sse[] */
     uint64_t frame_number;
     struct FrameListData *coded_frame_list;
+    struct FrameListData *alpha_coded_frame_list;
 
     int cpu_used;
     int sharpness;
@@ -311,8 +310,6 @@ static void coded_frame_add(void *list, struct FrameListData *cx_frame)
 static av_cold void free_coded_frame(struct FrameListData *cx_frame)
 {
     av_freep(&cx_frame->buf);
-    if (cx_frame->buf_alpha)
-        av_freep(&cx_frame->buf_alpha);
     av_freep(&cx_frame);
 }
 
@@ -446,6 +443,7 @@ static av_cold int vpx_free(AVCodecContext *avctx)
     av_freep(&ctx->twopass_stats.buf);
     av_freep(&avctx->stats_out);
     free_frame_list(ctx->coded_frame_list);
+    free_frame_list(ctx->alpha_coded_frame_list);
     if (ctx->hdr10_plus_fifo)
         free_hdr10_plus_fifo(&ctx->hdr10_plus_fifo);
     return 0;
@@ -1205,7 +1203,6 @@ static av_cold int vpx_init(AVCodecContext *avctx,
 
 static inline void cx_pktcpy(struct FrameListData *dst,
                              const struct vpx_codec_cx_pkt *src,
-                             const struct vpx_codec_cx_pkt *src_alpha,
                              VPxContext *ctx)
 {
     dst->pts      = src->data.frame.pts;
@@ -1229,13 +1226,6 @@ static inline void cx_pktcpy(struct FrameListData *dst,
     } else {
         dst->frame_number = -1;   /* sanity marker */
     }
-    if (src_alpha) {
-        dst->buf_alpha = src_alpha->data.frame.buf;
-        dst->sz_alpha = src_alpha->data.frame.sz;
-    } else {
-        dst->buf_alpha = NULL;
-        dst->sz_alpha = 0;
-    }
 }
 
 /**
@@ -1246,7 +1236,7 @@ static inline void cx_pktcpy(struct FrameListData *dst,
  * @return a negative AVERROR on error
  */
 static int storeframe(AVCodecContext *avctx, struct FrameListData *cx_frame,
-                      AVPacket *pkt)
+                      struct FrameListData *alpha_cx_frame, AVPacket *pkt)
 {
     VPxContext *ctx = avctx->priv_data;
     int ret = ff_get_encode_buffer(avctx, pkt, cx_frame->sz, 0);
@@ -1279,16 +1269,16 @@ static int storeframe(AVCodecContext *avctx, struct FrameListData *cx_frame,
             avctx->error[i] += cx_frame->sse[i + 1];
         cx_frame->have_sse = 0;
     }
-    if (cx_frame->sz_alpha > 0) {
+    if (alpha_cx_frame) {
         side_data = av_packet_new_side_data(pkt,
                                             AV_PKT_DATA_MATROSKA_BLOCKADDITIONAL,
-                                            cx_frame->sz_alpha + 8);
+                                            alpha_cx_frame->sz + 8);
         if (!side_data) {
             av_packet_unref(pkt);
             return AVERROR(ENOMEM);
         }
         AV_WB64(side_data, 1);
-        memcpy(side_data + 8, cx_frame->buf_alpha, cx_frame->sz_alpha);
+        memcpy(side_data + 8, alpha_cx_frame->buf, alpha_cx_frame->sz);
     }
     if (cx_frame->frame_number != -1) {
         if (ctx->hdr10_plus_fifo) {
@@ -1309,40 +1299,37 @@ static int storeframe(AVCodecContext *avctx, struct FrameListData *cx_frame,
  * @return AVERROR(EINVAL) on output size error
  * @return AVERROR(ENOMEM) on coded frame queue data allocation error
  */
-static int queue_frames(AVCodecContext *avctx, AVPacket *pkt_out)
+static int queue_frames(AVCodecContext *avctx, struct vpx_codec_ctx *encoder,
+                        struct FrameListData **frame_list, AVPacket *pkt_out)
 {
     VPxContext *ctx = avctx->priv_data;
     const struct vpx_codec_cx_pkt *pkt;
-    const struct vpx_codec_cx_pkt *pkt_alpha = NULL;
     const void *iter = NULL;
-    const void *iter_alpha = NULL;
     int size = 0;
 
-    if (ctx->coded_frame_list) {
-        struct FrameListData *cx_frame = ctx->coded_frame_list;
+    if (!ctx->is_alpha && *frame_list) {
+        struct FrameListData *cx_frame = *frame_list;
         /* return the leading frame if we've already begun queueing */
-        size = storeframe(avctx, cx_frame, pkt_out);
+        size = storeframe(avctx, cx_frame, NULL, pkt_out);
         if (size < 0)
             return size;
-        ctx->coded_frame_list = cx_frame->next;
+        *frame_list = cx_frame->next;
         free_coded_frame(cx_frame);
     }
 
     /* consume all available output from the encoder before returning. buffers
        are only good through the next vpx_codec call */
-    while ((pkt = vpx_codec_get_cx_data(&ctx->encoder, &iter)) &&
-           (!ctx->is_alpha ||
-            (pkt_alpha = vpx_codec_get_cx_data(&ctx->encoder_alpha, &iter_alpha)))) {
+    while (pkt = vpx_codec_get_cx_data(encoder, &iter)) {
         switch (pkt->kind) {
         case VPX_CODEC_CX_FRAME_PKT:
-            if (!size) {
+            if (!ctx->is_alpha && !size) {
                 struct FrameListData cx_frame;
 
                 /* avoid storing the frame when the list is empty and we haven't yet
                    provided a frame for output */
                 av_assert0(!ctx->coded_frame_list);
-                cx_pktcpy(&cx_frame, pkt, pkt_alpha, ctx);
-                size = storeframe(avctx, &cx_frame, pkt_out);
+                cx_pktcpy(&cx_frame, pkt, ctx);
+                size = storeframe(avctx, &cx_frame, NULL, pkt_out);
                 if (size < 0)
                     return size;
             } else {
@@ -1353,7 +1340,7 @@ static int queue_frames(AVCodecContext *avctx, AVPacket *pkt_out)
                            "Frame queue element alloc failed\n");
                     return AVERROR(ENOMEM);
                 }
-                cx_pktcpy(cx_frame, pkt, pkt_alpha, ctx);
+                cx_pktcpy(cx_frame, pkt, ctx);
                 cx_frame->buf = av_malloc(cx_frame->sz);
 
                 if (!cx_frame->buf) {
@@ -1364,23 +1351,14 @@ static int queue_frames(AVCodecContext *avctx, AVPacket *pkt_out)
                     return AVERROR(ENOMEM);
                 }
                 memcpy(cx_frame->buf, pkt->data.frame.buf, pkt->data.frame.sz);
-                if (ctx->is_alpha) {
-                    cx_frame->buf_alpha = av_malloc(cx_frame->sz_alpha);
-                    if (!cx_frame->buf_alpha) {
-                        av_log(avctx, AV_LOG_ERROR,
-                               "Data buffer alloc (%"SIZE_SPECIFIER" bytes) failed\n",
-                               cx_frame->sz_alpha);
-                        av_free(cx_frame);
-                        return AVERROR(ENOMEM);
-                    }
-                    memcpy(cx_frame->buf_alpha, pkt_alpha->data.frame.buf, pkt_alpha->data.frame.sz);
-                }
-                coded_frame_add(&ctx->coded_frame_list, cx_frame);
+                coded_frame_add(frame_list, cx_frame);
             }
             break;
         case VPX_CODEC_STATS_PKT: {
             struct vpx_fixed_buf *stats = &ctx->twopass_stats;
             int err;
+            if (!pkt_out)
+                break;
             if ((err = av_reallocp(&stats->buf,
                                    stats->sz +
                                    pkt->data.twopass_stats.sz)) < 0) {
@@ -1394,6 +1372,8 @@ static int queue_frames(AVCodecContext *avctx, AVPacket *pkt_out)
             break;
         }
         case VPX_CODEC_PSNR_PKT:
+            if (!pkt_out)
+                break;
             av_assert0(!ctx->have_sse);
             ctx->sse[0] = pkt->data.psnr.sse[0];
             ctx->sse[1] = pkt->data.psnr.sse[1];
@@ -1788,7 +1768,24 @@ static int vpx_encode(AVCodecContext *avctx, AVPacket *pkt,
         }
     }
 
-    coded_size = queue_frames(avctx, pkt);
+    coded_size = queue_frames(avctx, &ctx->encoder, &ctx->coded_frame_list, pkt);
+    if (ctx->is_alpha) {
+        queue_frames(avctx, &ctx->encoder_alpha, &ctx->alpha_coded_frame_list, NULL);
+
+        if (ctx->coded_frame_list && ctx->alpha_coded_frame_list) {
+            struct FrameListData *cx_frame = ctx->coded_frame_list;
+            struct FrameListData *alpha_cx_frame = ctx->alpha_coded_frame_list;
+            av_assert0(!coded_size);
+            /* return the leading frame if we've already begun queueing */
+            coded_size = storeframe(avctx, cx_frame, alpha_cx_frame, pkt);
+            if (coded_size < 0)
+                return coded_size;
+            ctx->coded_frame_list = cx_frame->next;
+            ctx->alpha_coded_frame_list = alpha_cx_frame->next;
+            free_coded_frame(cx_frame);
+            free_coded_frame(alpha_cx_frame);
+        }
+    }
 
     if (!frame && avctx->flags & AV_CODEC_FLAG_PASS1) {
         unsigned int b64_size = AV_BASE64_SIZE(ctx->twopass_stats.sz);

libavcodec/midivid.c

@@ -203,12 +203,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *rframe,
     bytestream2_skip(gb, 8);
     uncompressed = bytestream2_get_le32(gb);
 
-    if ((ret = ff_reget_buffer(avctx, s->frame, 0)) < 0)
-        return ret;
-
-    if (uncompressed) {
-        ret = decode_mvdv(s, avctx, frame);
-    } else {
+    if (!uncompressed) {
         av_fast_padded_malloc(&s->uncompressed, &s->uncompressed_size, 16LL * (avpkt->size - 12));
         if (!s->uncompressed)
             return AVERROR(ENOMEM);
@@ -217,9 +212,13 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *rframe,
         if (ret < 0)
             return ret;
         bytestream2_init(gb, s->uncompressed, ret);
-        ret = decode_mvdv(s, avctx, frame);
     }
 
+    if ((ret = ff_reget_buffer(avctx, s->frame, 0)) < 0)
+        return ret;
+
+    ret = decode_mvdv(s, avctx, frame);
+
     if (ret < 0)
         return ret;
     key = ret;

libavcodec/mjpegdec.c

@@ -1092,6 +1092,10 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int nb_components, int p
         return AVERROR_INVALIDDATA;
     if (s->v_max != 1 || s->h_max != 1 || !s->lossless)
         return AVERROR_INVALIDDATA;
+    if (s->bayer) {
+        if (s->rct || s->pegasus_rct)
+            return AVERROR_INVALIDDATA;
+    }
 
 
     s->restart_count = s->restart_interval;
@@ -1942,6 +1946,8 @@ static int mjpeg_decode_app(MJpegDecodeContext *s)
         }
 
         len -= 9;
+        if (s->bayer)
+            goto out;
         if (s->got_picture)
             if (rgb != s->rgb || pegasus_rct != s->pegasus_rct) {
                 av_log(s->avctx, AV_LOG_WARNING, "Mismatching LJIF tag\n");

libavcodec/mpegaudiodec_template.c

@@ -374,7 +374,7 @@ static int handle_crc(MPADecodeContext *s, int sec_len)
         crc_val = av_crc(crc_tab, crc_val, &buf[6], sec_byte_len);
 
         AV_WB32(tmp_buf,
-                ((buf[6 + sec_byte_len] & (0xFF00 >> sec_rem_bits)) << 24) +
+                ((buf[6 + sec_byte_len] & (0xFF00U >> sec_rem_bits)) << 24) +
                 ((s->crc << 16) >> sec_rem_bits));
 
         crc_val = av_crc(crc_tab, crc_val, tmp_buf, 3);

libavcodec/mss4.c

@@ -26,6 +26,7 @@
  */
 
 #include "libavutil/thread.h"
+#include "libavutil/imgutils.h"
 
 #include "avcodec.h"
 #include "bytestream.h"
@@ -477,6 +478,9 @@ static int mss4_decode_frame(AVCodecContext *avctx, AVFrame *rframe,
                width, height);
         return AVERROR_INVALIDDATA;
     }
+    if (av_image_check_size2(width, height, avctx->max_pixels, AV_PIX_FMT_NONE, 0, avctx) < 0)
+        return AVERROR_INVALIDDATA;
+
     if (quality < 1 || quality > 100) {
         av_log(avctx, AV_LOG_ERROR, "Invalid quality setting %d\n", quality);
         return AVERROR_INVALIDDATA;

libavcodec/pngdec.c

@@ -78,11 +78,8 @@ typedef struct PNGDecContext {
     enum PNGImageState pic_state;
     int width, height;
     int cur_w, cur_h;
-    int last_w, last_h;
     int x_offset, y_offset;
-    int last_x_offset, last_y_offset;
     uint8_t dispose_op, blend_op;
-    uint8_t last_dispose_op;
     int bit_depth;
     int color_type;
     int compression_type;
@@ -94,8 +91,6 @@ typedef struct PNGDecContext {
     int has_trns;
     uint8_t transparent_color_be[6];
 
-    uint8_t *background_buf;
-    unsigned background_buf_allocated;
     uint32_t palette[256];
     uint8_t *crow_buf;
     uint8_t *last_row;
@@ -725,9 +720,30 @@ static int decode_idat_chunk(AVCodecContext *avctx, PNGDecContext *s,
         }
 
         ff_thread_release_ext_buffer(avctx, &s->picture);
-        if ((ret = ff_thread_get_ext_buffer(avctx, &s->picture,
-                                            AV_GET_BUFFER_FLAG_REF)) < 0)
-            return ret;
+        if (s->dispose_op == APNG_DISPOSE_OP_PREVIOUS) {
+            /* We only need a buffer for the current picture. */
+            ret = ff_thread_get_buffer(avctx, p, 0);
+            if (ret < 0)
+                return ret;
+        } else if (s->dispose_op == APNG_DISPOSE_OP_BACKGROUND) {
+            /* We need a buffer for the current picture as well as
+             * a buffer for the reference to retain. */
+            ret = ff_thread_get_ext_buffer(avctx, &s->picture,
+                                           AV_GET_BUFFER_FLAG_REF);
+            if (ret < 0)
+                return ret;
+            ret = ff_thread_get_buffer(avctx, p, 0);
+            if (ret < 0)
+                return ret;
+        } else {
+            /* The picture output this time and the reference to retain coincide. */
+            if ((ret = ff_thread_get_ext_buffer(avctx, &s->picture,
+                                                AV_GET_BUFFER_FLAG_REF)) < 0)
+                return ret;
+            ret = av_frame_ref(p, s->picture.f);
+            if (ret < 0)
+                return ret;
+        }
 
         p->pict_type        = AV_PICTURE_TYPE_I;
         p->key_frame        = 1;
@@ -985,12 +1001,6 @@ static int decode_fctl_chunk(AVCodecContext *avctx, PNGDecContext *s,
         return AVERROR_INVALIDDATA;
     }
 
-    s->last_w = s->cur_w;
-    s->last_h = s->cur_h;
-    s->last_x_offset = s->x_offset;
-    s->last_y_offset = s->y_offset;
-    s->last_dispose_op = s->dispose_op;
-
     sequence_number = bytestream2_get_be32(gb);
     cur_w           = bytestream2_get_be32(gb);
     cur_h           = bytestream2_get_be32(gb);
@@ -1086,23 +1096,6 @@ static int handle_p_frame_apng(AVCodecContext *avctx, PNGDecContext *s,
 
     ff_thread_await_progress(&s->last_picture, INT_MAX, 0);
 
-    // need to reset a rectangle to background:
-    if (s->last_dispose_op == APNG_DISPOSE_OP_BACKGROUND) {
-        av_fast_malloc(&s->background_buf, &s->background_buf_allocated,
-                       src_stride * p->height);
-        if (!s->background_buf)
-            return AVERROR(ENOMEM);
-
-        memcpy(s->background_buf, src, src_stride * p->height);
-
-        for (y = s->last_y_offset; y < s->last_y_offset + s->last_h; y++) {
-            memset(s->background_buf + src_stride * y +
-                   bpp * s->last_x_offset, 0, bpp * s->last_w);
-        }
-
-        src = s->background_buf;
-    }
-
     // copy unchanged rectangles from the last frame
     for (y = 0; y < s->y_offset; y++)
         memcpy(dst + y * dst_stride, src + y * src_stride, p->width * bpp);
@@ -1171,6 +1164,22 @@ static int handle_p_frame_apng(AVCodecContext *avctx, PNGDecContext *s,
     return 0;
 }
 
+static void apng_reset_background(PNGDecContext *s, const AVFrame *p)
+{
+    // need to reset a rectangle to black
+    av_unused int ret = av_frame_copy(s->picture.f, p);
+    const int bpp = s->color_type == PNG_COLOR_TYPE_PALETTE ? 4 : s->bpp;
+    const ptrdiff_t dst_stride = s->picture.f->linesize[0];
+    uint8_t *dst = s->picture.f->data[0] + s->y_offset * dst_stride + bpp * s->x_offset;
+
+    av_assert1(ret >= 0);
+
+    for (size_t y = 0; y < s->cur_h; y++) {
+        memset(dst, 0, bpp * s->cur_w);
+        dst += dst_stride;
+    }
+}
+
 static int decode_frame_common(AVCodecContext *avctx, PNGDecContext *s,
                                AVFrame *p, const AVPacket *avpkt)
 {
@@ -1434,6 +1443,9 @@ exit_loop:
                 goto fail;
         }
     }
+    if (CONFIG_APNG_DECODER && s->dispose_op == APNG_DISPOSE_OP_BACKGROUND)
+        apng_reset_background(s, p);
+
     ff_thread_report_progress(&s->picture, INT_MAX, 0);
 
     return 0;
@@ -1456,15 +1468,10 @@ static void clear_frame_metadata(PNGDecContext *s)
     av_dict_free(&s->frame_metadata);
 }
 
-static int output_frame(PNGDecContext *s, AVFrame *f,
-                        const AVFrame *src)
+static int output_frame(PNGDecContext *s, AVFrame *f)
 {
     int ret;
 
-    ret = av_frame_ref(f, src);
-    if (ret < 0)
-        return ret;
-
     if (s->iccp_data) {
         AVFrameSideData *sd = av_frame_new_side_data(f, AV_FRAME_DATA_ICC_PROFILE, s->iccp_data_len);
         if (!sd) {
@@ -1515,13 +1522,12 @@ fail:
 }
 
 #if CONFIG_PNG_DECODER
-static int decode_frame_png(AVCodecContext *avctx, AVFrame *dst_frame,
+static int decode_frame_png(AVCodecContext *avctx, AVFrame *p,
                             int *got_frame, AVPacket *avpkt)
 {
     PNGDecContext *const s = avctx->priv_data;
     const uint8_t *buf     = avpkt->data;
     int buf_size           = avpkt->size;
-    AVFrame *p = s->picture.f;
     int64_t sig;
     int ret;
 
@@ -1555,7 +1561,7 @@ static int decode_frame_png(AVCodecContext *avctx, AVFrame *dst_frame,
         goto the_end;
     }
 
-    ret = output_frame(s, dst_frame, s->picture.f);
+    ret = output_frame(s, p);
     if (ret < 0)
         goto the_end;
 
@@ -1574,12 +1580,11 @@ the_end:
 #endif
 
 #if CONFIG_APNG_DECODER
-static int decode_frame_apng(AVCodecContext *avctx, AVFrame *dst_frame,
+static int decode_frame_apng(AVCodecContext *avctx, AVFrame *p,
                              int *got_frame, AVPacket *avpkt)
 {
     PNGDecContext *const s = avctx->priv_data;
     int ret;
-    AVFrame *p = s->picture.f;
 
     clear_frame_metadata(s);
 
@@ -1608,7 +1613,7 @@ static int decode_frame_apng(AVCodecContext *avctx, AVFrame *dst_frame,
     if (!(s->pic_state & (PNG_ALLIMAGE|PNG_IDAT)))
         return AVERROR_INVALIDDATA;
 
-    ret = output_frame(s, dst_frame, s->picture.f);
+    ret = output_frame(s, p);
     if (ret < 0)
         return ret;
 
@@ -1646,15 +1651,9 @@ static int update_thread_context(AVCodecContext *dst, const AVCodecContext *src)
         pdst->compression_type  = psrc->compression_type;
         pdst->interlace_type    = psrc->interlace_type;
         pdst->filter_type       = psrc->filter_type;
-        pdst->cur_w = psrc->cur_w;
-        pdst->cur_h = psrc->cur_h;
-        pdst->x_offset = psrc->x_offset;
-        pdst->y_offset = psrc->y_offset;
         pdst->has_trns = psrc->has_trns;
         memcpy(pdst->transparent_color_be, psrc->transparent_color_be, sizeof(pdst->transparent_color_be));
 
-        pdst->dispose_op = psrc->dispose_op;
-
         memcpy(pdst->palette, psrc->palette, sizeof(pdst->palette));
 
         pdst->hdr_state |= psrc->hdr_state;
@@ -1705,7 +1704,6 @@ static av_cold int png_dec_end(AVCodecContext *avctx)
     s->last_row_size = 0;
     av_freep(&s->tmp_row);
     s->tmp_row_size = 0;
-    av_freep(&s->background_buf);
 
     av_freep(&s->iccp_data);
     av_dict_free(&s->frame_metadata);

libavcodec/tiff.c

@@ -965,6 +965,9 @@ static int dng_decode_tiles(AVCodecContext *avctx, AVFrame *frame,
     int pos_x = 0, pos_y = 0;
     int ret;
 
+    if (s->tile_width <= 0 || s->tile_length <= 0)
+        return AVERROR_INVALIDDATA;
+
     has_width_leftover = (s->width % s->tile_width != 0);
     has_height_leftover = (s->height % s->tile_length != 0);
 

libavdevice/avdevice.c

@@ -75,9 +75,11 @@ int avdevice_list_devices(AVFormatContext *s, AVDeviceInfoList **device_list)
         ret = s->oformat->get_device_list(s, *device_list);
     else
         ret = s->iformat->get_device_list(s, *device_list);
-    if (ret < 0)
+    if (ret < 0) {
         avdevice_free_list_devices(device_list);
-    return ret;
+        return ret;
+    }
+    return (*device_list)->nb_devices;
 }
 
 static int list_devices_for_context(AVFormatContext *s, AVDictionary *options,

libavformat/asfdec_f.c

@@ -104,7 +104,7 @@ typedef struct ASFContext {
     int ts_is_pts;
     int packet_multi_size;
     int packet_time_delta;
-    int packet_time_start;
+    int64_t packet_time_start;
     int64_t packet_pos;
 
     int stream_index;

libavformat/asfdec_o.c

@@ -109,6 +109,7 @@ typedef struct ASFContext {
     int64_t data_offset;
     int64_t first_packet_offset; // packet offset
     int64_t unknown_offset;   // for top level header objects or subobjects without specified behavior
+    int in_asf_read_unknown;
 
     // ASF file must not contain more than 128 streams according to the specification
     ASFStream *asf_st[ASF_MAX_STREAMS];
@@ -173,7 +174,7 @@ static int asf_read_unknown(AVFormatContext *s, const GUIDParseTable *g)
     uint64_t size   = avio_rl64(pb);
     int ret;
 
-    if (size > INT64_MAX)
+    if (size > INT64_MAX || asf->in_asf_read_unknown > 5)
         return AVERROR_INVALIDDATA;
 
     if (asf->is_header)
@@ -182,8 +183,11 @@ static int asf_read_unknown(AVFormatContext *s, const GUIDParseTable *g)
     if (!g->is_subobject) {
         if (!(ret = strcmp(g->name, "Header Extension")))
             avio_skip(pb, 22); // skip reserved fields and Data Size
-        if ((ret = detect_unknown_subobject(s, asf->unknown_offset,
-                                            asf->unknown_size)) < 0)
+        asf->in_asf_read_unknown ++;
+        ret = detect_unknown_subobject(s, asf->unknown_offset,
+                                            asf->unknown_size);
+        asf->in_asf_read_unknown --;
+        if (ret < 0)
             return ret;
     } else {
         if (size < 24) {

libavformat/avidec.c

@@ -82,6 +82,8 @@ typedef struct AVIContext {
     int stream_index;
     DVDemuxContext *dv_demux;
     int odml_depth;
+    int64_t odml_read;
+    int64_t odml_max_pos;
     int use_odml;
 #define MAX_ODML_DEPTH 1000
     int64_t dts_max;
@@ -200,7 +202,7 @@ static int read_odml_index(AVFormatContext *s, int64_t frame_num)
     st  = s->streams[stream_id];
     ast = st->priv_data;
 
-    if (index_sub_type)
+    if (index_sub_type || entries_in_use < 0)
         return AVERROR_INVALIDDATA;
 
     avio_rl32(pb);
@@ -221,11 +223,18 @@ static int read_odml_index(AVFormatContext *s, int64_t frame_num)
     }
 
     for (i = 0; i < entries_in_use; i++) {
+        avi->odml_max_pos = FFMAX(avi->odml_max_pos, avio_tell(pb));
+
+        // If we read more than there are bytes then we must have been reading something twice
+        if (avi->odml_read > avi->odml_max_pos)
+            return AVERROR_INVALIDDATA;
+
         if (index_type) {
             int64_t pos = avio_rl32(pb) + base - 8;
             int len     = avio_rl32(pb);
             int key     = len >= 0;
             len &= 0x7FFFFFFF;
+            avi->odml_read += 8;
 
             av_log(s, AV_LOG_TRACE, "pos:%"PRId64", len:%X\n", pos, len);
 
@@ -244,6 +253,7 @@ static int read_odml_index(AVFormatContext *s, int64_t frame_num)
             int64_t offset, pos;
             int duration;
             int ret;
+            avi->odml_read += 16;
 
             offset = avio_rl64(pb);
             avio_rl32(pb);       /* size */

libavformat/avisynth.c

@@ -752,7 +752,7 @@ static int avisynth_create_stream_audio(AVFormatContext *s, AVStream *st)
 
     st->codecpar->codec_type  = AVMEDIA_TYPE_AUDIO;
     st->codecpar->sample_rate = avs->vi->audio_samples_per_second;
-    st->codecpar->channels    = avs->vi->nchannels;
+    st->codecpar->ch_layout.nb_channels    = avs->vi->nchannels;
     st->duration              = avs->vi->num_audio_samples;
     avpriv_set_pts_info(st, 64, 1, avs->vi->audio_samples_per_second);
 

libavformat/flvdec.c

@@ -463,6 +463,8 @@ static int parse_keyframes_index(AVFormatContext *s, AVIOContext *ioc, int64_t m
                 goto invalid;
             if (current_array == &times && (d <= INT64_MIN / 1000 || d >= INT64_MAX / 1000))
                 goto invalid;
+            if (avio_feof(ioc))
+                goto invalid;
             current_array[0][i] = d;
         }
         if (times && filepositions) {

libavformat/iff.c

@@ -501,6 +501,9 @@ static int iff_read_header(AVFormatContext *s)
         case ID_DST:
         case ID_MDAT:
             iff->body_pos = avio_tell(pb);
+            if (iff->body_pos < 0 || iff->body_pos + data_size > INT64_MAX)
+                return AVERROR_INVALIDDATA;
+
             iff->body_end = iff->body_pos + data_size;
             iff->body_size = data_size;
             if (chunk_id == ID_DST) {

libavformat/ipfsgateway.c

@@ -240,13 +240,8 @@ static int translate_ipfs_to_http(URLContext *h, const char *uri, int flags, AVD
         ret = populate_ipfs_gateway(h);
 
         if (ret < 1) {
-            // We fallback on dweb.link (managed by Protocol Labs).
-            snprintf(c->gateway_buffer, sizeof(c->gateway_buffer), "https://dweb.link");
-
-            av_log(h, AV_LOG_WARNING,
-                   "IPFS does not appear to be running. "
-                   "You’re now using the public gateway at dweb.link.\n");
-            av_log(h, AV_LOG_INFO,
+            av_log(h, AV_LOG_ERROR,
+                   "IPFS does not appear to be running.\n\n"
                    "Installing IPFS locally is recommended to "
                    "improve performance and reliability, "
                    "and not share all your activity with a single IPFS gateway.\n"
@@ -259,6 +254,8 @@ static int translate_ipfs_to_http(URLContext *h, const char *uri, int flags, AVD
                    "3. Define an $IPFS_PATH environment variable "
                    "and point it to the IPFS data path "
                    "- this is typically ~/.ipfs\n");
+            ret = AVERROR(EINVAL);
+            goto err;
         }
     }
 

libavformat/mov.c

@@ -3949,8 +3949,11 @@ static int build_open_gop_key_points(AVStream *st)
 
     /* Build an unrolled index of the samples */
     sc->sample_offsets_count = 0;
-    for (uint32_t i = 0; i < sc->ctts_count; i++)
+    for (uint32_t i = 0; i < sc->ctts_count; i++) {
+        if (sc->ctts_data[i].count > INT_MAX - sc->sample_offsets_count)
+            return AVERROR(ENOMEM);
         sc->sample_offsets_count += sc->ctts_data[i].count;
+    }
     av_freep(&sc->sample_offsets);
     sc->sample_offsets = av_calloc(sc->sample_offsets_count, sizeof(*sc->sample_offsets));
     if (!sc->sample_offsets)
@@ -3969,8 +3972,11 @@ static int build_open_gop_key_points(AVStream *st)
     /* Build a list of open-GOP key samples */
     sc->open_key_samples_count = 0;
     for (uint32_t i = 0; i < sc->sync_group_count; i++)
-        if (sc->sync_group[i].index == cra_index)
+        if (sc->sync_group[i].index == cra_index) {
+            if (sc->sync_group[i].count > INT_MAX - sc->open_key_samples_count)
+                return AVERROR(ENOMEM);
             sc->open_key_samples_count += sc->sync_group[i].count;
+        }
     av_freep(&sc->open_key_samples);
     sc->open_key_samples = av_calloc(sc->open_key_samples_count, sizeof(*sc->open_key_samples));
     if (!sc->open_key_samples)
@@ -3981,6 +3987,8 @@ static int build_open_gop_key_points(AVStream *st)
         if (sg->index == cra_index)
             for (uint32_t j = 0; j < sg->count; j++)
                 sc->open_key_samples[k++] = sample_id;
+        if (sg->count > INT_MAX - sample_id)
+            return AVERROR_PATCHWELCOME;
         sample_id += sg->count;
     }
 
@@ -7540,6 +7548,8 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom)
 
     for (int i = 0; i < item_count; i++) {
         int item_id = (version < 2) ? avio_rb16(pb) : avio_rb32(pb);
+        if (avio_feof(pb))
+            return AVERROR_INVALIDDATA;
         if (version > 0)
             avio_rb16(pb);  // construction_method.
         avio_rb16(pb);  // data_reference_index.

libavformat/nutdec.c

@@ -200,6 +200,8 @@ static int decode_main_header(NUTContext *nut)
     int tmp_stream, tmp_mul, tmp_pts, tmp_size, tmp_res, tmp_head_idx;
 
     length = get_packetheader(nut, bc, 1, MAIN_STARTCODE);
+    if (length == (uint64_t)-1)
+        return AVERROR_INVALIDDATA;
     end = length + avio_tell(bc);
 
     nut->version = ffio_read_varlen(bc);

libavformat/subviewerdec.c

@@ -50,26 +50,32 @@ static int subviewer_probe(const AVProbeData *p)
     return 0;
 }
 
+static int get_multiplier(int e) {
+    switch (e) {
+    case 1  : return 100;
+    case 2  : return 10;
+    case 3  : return 1;
+    default : return -1;
+    }
+}
+
 static int read_ts(const char *s, int64_t *start, int *duration)
 {
     int64_t end;
     int hh1, mm1, ss1, ms1;
     int hh2, mm2, ss2, ms2;
-    int multiplier = 1;
+    int multiplier1, multiplier2;
+    int ms1p1, ms1p2, ms2p1, ms2p2;
 
-    if (sscanf(s, "%u:%u:%u.%2u,%u:%u:%u.%2u",
-               &hh1, &mm1, &ss1, &ms1, &hh2, &mm2, &ss2, &ms2) == 8) {
-        multiplier = 10;
-    } else if (sscanf(s, "%u:%u:%u.%1u,%u:%u:%u.%1u",
-                      &hh1, &mm1, &ss1, &ms1, &hh2, &mm2, &ss2, &ms2) == 8) {
-        multiplier = 100;
-    }
-    if (sscanf(s, "%u:%u:%u.%u,%u:%u:%u.%u",
-               &hh1, &mm1, &ss1, &ms1, &hh2, &mm2, &ss2, &ms2) == 8) {
-        ms1 = FFMIN(ms1, 999);
-        ms2 = FFMIN(ms2, 999);
-        end    = (hh2*3600LL + mm2*60LL + ss2) * 1000LL + ms2 * multiplier;
-        *start = (hh1*3600LL + mm1*60LL + ss1) * 1000LL + ms1 * multiplier;
+    if (sscanf(s, "%u:%u:%u.%n%u%n,%u:%u:%u.%n%u%n",
+               &hh1, &mm1, &ss1, &ms1p1, &ms1, &ms1p2, &hh2, &mm2, &ss2, &ms2p1, &ms2, &ms2p2) == 8) {
+        multiplier1 = get_multiplier(ms1p2 - ms1p1);
+        multiplier2 = get_multiplier(ms2p2 - ms2p1);
+        if (multiplier1 <= 0 ||multiplier2 <= 0)
+            return -1;
+
+        end    = (hh2*3600LL + mm2*60LL + ss2) * 1000LL + ms2 * multiplier2;
+        *start = (hh1*3600LL + mm1*60LL + ss1) * 1000LL + ms1 * multiplier1;
         *duration = end - *start;
         return 0;
     }

libavutil/hwcontext_d3d11va.c

@@ -166,6 +166,17 @@ static AVBufferRef *wrap_texture_buf(AVHWFramesContext *ctx, ID3D11Texture2D *te
         return NULL;
     }
 
+    if (s->nb_surfaces <= s->nb_surfaces_used) {
+        frames_hwctx->texture_infos = av_realloc_f(frames_hwctx->texture_infos,
+                                                   s->nb_surfaces_used + 1,
+                                                   sizeof(*frames_hwctx->texture_infos));
+        if (!frames_hwctx->texture_infos) {
+            ID3D11Texture2D_Release(tex);
+            return NULL;
+        }
+        s->nb_surfaces = s->nb_surfaces_used + 1;
+    }
+
     frames_hwctx->texture_infos[s->nb_surfaces_used].texture = tex;
     frames_hwctx->texture_infos[s->nb_surfaces_used].index = index;
     s->nb_surfaces_used++;
@@ -284,7 +295,7 @@ static int d3d11va_frames_init(AVHWFramesContext *ctx)
         }
     }
 
-    hwctx->texture_infos = av_calloc(ctx->initial_pool_size, sizeof(*hwctx->texture_infos));
+    hwctx->texture_infos = av_realloc_f(NULL, ctx->initial_pool_size, sizeof(*hwctx->texture_infos));
     if (!hwctx->texture_infos)
         return AVERROR(ENOMEM);
     s->nb_surfaces = ctx->initial_pool_size;

libswresample/swresample.c

@@ -385,8 +385,8 @@ av_cold int swr_init(struct SwrContext *s){
         goto fail;
     }
 
+    av_channel_layout_describe(&s->out_ch_layout, l2, sizeof(l2));
 #if FF_API_OLD_CHANNEL_LAYOUT
-    av_channel_layout_describe(&s->out_ch_layout, l1, sizeof(l1));
     if (s->out_ch_layout.order != AV_CHANNEL_ORDER_UNSPEC && s->out.ch_count != s->out_ch_layout.nb_channels) {
         av_log(s, AV_LOG_ERROR, "Output channel layout %s mismatches specified channel count %d\n", l2, s->out.ch_count);
         ret = AVERROR(EINVAL);

tests/fate-run.sh

@@ -362,6 +362,7 @@ lavf_container_fate()
 }
 
 lavf_image(){
+    no_file_checksums="$3"
     nb_frames=13
     t="${test#lavf-}"
     outdir="tests/data/images/$t"
@@ -374,9 +375,11 @@ lavf_image(){
         done
     fi
     run_avconv $DEC_OPTS -f image2 -c:v pgmyuv -i $raw_src $1 "$ENC_OPTS -metadata title=lavftest" -vf scale -frames $nb_frames -y -qscale 10 $target_path/$file
-    do_md5sum ${outdir}/02.$t
+    if [ -z "$no_file_checksums" ]; then
+        do_md5sum ${outdir}/02.$t
+        echo $(wc -c ${outdir}/02.$t)
+    fi
     do_avconv_crc $file -auto_conversion_filters $DEC_OPTS $2 -i $target_path/$file $2
-    echo $(wc -c ${outdir}/02.$t)
 }
 
 lavf_image2pipe(){

tests/fate/imf.mak

@@ -3,4 +3,4 @@ fate-imf-cpl-with-repeat: CMD = framecrc -f imf -i $(TARGET_SAMPLES)/imf/countdo
 
 FATE_SAMPLES_FFMPEG-$(CONFIG_IMF_DEMUXER) += $(FATE_IMF)
 
-fate-imf: $(FATE_IMF)
+fate-imfdec: $(FATE_IMF)

tests/fate/lavf-image.mak

@@ -59,18 +59,18 @@ $(FATE_LAVF_IMAGES): CMD = lavf_image
 $(FATE_LAVF_IMAGES): REF = $(SRC_PATH)/tests/ref/lavf/$(@:fate-lavf-%=%)
 $(FATE_LAVF_IMAGES): $(VREF)
 
-fate-lavf-none.grayf32le.exr:   CMD = lavf_image "-compression none  -pix_fmt grayf32le"
-fate-lavf-rle.grayf32le.exr:    CMD = lavf_image "-compression rle   -pix_fmt grayf32le"
-fate-lavf-zip1.grayf32le.exr:   CMD = lavf_image "-compression zip1  -pix_fmt grayf32le"
-fate-lavf-zip16.grayf32le.exr:  CMD = lavf_image "-compression zip16 -pix_fmt grayf32le"
-fate-lavf-none.gbrpf32le.exr:   CMD = lavf_image "-compression none  -pix_fmt gbrpf32le"
-fate-lavf-rle.gbrpf32le.exr:    CMD = lavf_image "-compression rle   -pix_fmt gbrpf32le"
-fate-lavf-zip1.gbrpf32le.exr:   CMD = lavf_image "-compression zip1  -pix_fmt gbrpf32le"
-fate-lavf-zip16.gbrpf32le.exr:  CMD = lavf_image "-compression zip16 -pix_fmt gbrpf32le"
-fate-lavf-none.gbrapf32le.exr:  CMD = lavf_image "-compression none  -pix_fmt gbrapf32le"
-fate-lavf-rle.gbrapf32le.exr:   CMD = lavf_image "-compression rle   -pix_fmt gbrapf32le"
-fate-lavf-zip1.gbrapf32le.exr:  CMD = lavf_image "-compression zip1  -pix_fmt gbrapf32le"
-fate-lavf-zip16.gbrapf32le.exr: CMD = lavf_image "-compression zip16 -pix_fmt gbrapf32le"
+fate-lavf-none.grayf32le.exr:   CMD = lavf_image "-compression none  -pix_fmt grayf32le" "" "no_file_checksums"
+fate-lavf-rle.grayf32le.exr:    CMD = lavf_image "-compression rle   -pix_fmt grayf32le" "" "no_file_checksums"
+fate-lavf-zip1.grayf32le.exr:   CMD = lavf_image "-compression zip1  -pix_fmt grayf32le" "" "no_file_checksums"
+fate-lavf-zip16.grayf32le.exr:  CMD = lavf_image "-compression zip16 -pix_fmt grayf32le" "" "no_file_checksums"
+fate-lavf-none.gbrpf32le.exr:   CMD = lavf_image "-compression none  -pix_fmt gbrpf32le" "" "no_file_checksums"
+fate-lavf-rle.gbrpf32le.exr:    CMD = lavf_image "-compression rle   -pix_fmt gbrpf32le" "" "no_file_checksums"
+fate-lavf-zip1.gbrpf32le.exr:   CMD = lavf_image "-compression zip1  -pix_fmt gbrpf32le" "" "no_file_checksums"
+fate-lavf-zip16.gbrpf32le.exr:  CMD = lavf_image "-compression zip16 -pix_fmt gbrpf32le" "" "no_file_checksums"
+fate-lavf-none.gbrapf32le.exr:  CMD = lavf_image "-compression none  -pix_fmt gbrapf32le" "" "no_file_checksums"
+fate-lavf-rle.gbrapf32le.exr:   CMD = lavf_image "-compression rle   -pix_fmt gbrapf32le" "" "no_file_checksums"
+fate-lavf-zip1.gbrapf32le.exr:  CMD = lavf_image "-compression zip1  -pix_fmt gbrapf32le" "" "no_file_checksums"
+fate-lavf-zip16.gbrapf32le.exr: CMD = lavf_image "-compression zip16 -pix_fmt gbrapf32le" "" "no_file_checksums"
 fate-lavf-jpg: CMD = lavf_image "-pix_fmt yuvj420p"
 fate-lavf-tiff: CMD = lavf_image "-pix_fmt rgb24"
 fate-lavf-gbrp10le.dpx: CMD = lavf_image "-pix_fmt gbrp10le" "-pix_fmt gbrp10le"

tests/ref/lavf/bmp

@@ -1,3 +1,3 @@
 71f4d64a6b3c71f43a4eff526f84841c *tests/data/images/bmp/02.bmp
-tests/data/images/bmp/%02d.bmp CRC=0xe6c71946
 304182 tests/data/images/bmp/02.bmp
+tests/data/images/bmp/%02d.bmp CRC=0xe6c71946

tests/ref/lavf/dpx

@@ -1,3 +1,3 @@
 4c8880d5835ffb5fe37c1ed8c8d404de *tests/data/images/dpx/02.dpx
-tests/data/images/dpx/%02d.dpx CRC=0x6da01946
 305792 tests/data/images/dpx/02.dpx
+tests/data/images/dpx/%02d.dpx CRC=0x6da01946

tests/ref/lavf/gbrp10le.dpx

@@ -1,3 +1,3 @@
 7ca935d5d5e00c54acbc85565d3039b6 *tests/data/images/gbrp10le.dpx/02.gbrp10le.dpx
-tests/data/images/gbrp10le.dpx/%02d.gbrp10le.dpx CRC=0xe6663fba
 407168 tests/data/images/gbrp10le.dpx/02.gbrp10le.dpx
+tests/data/images/gbrp10le.dpx/%02d.gbrp10le.dpx CRC=0xe6663fba

tests/ref/lavf/gbrp12le.dpx

@@ -1,3 +1,3 @@
 a4cfea1797c928f2eff73573e559675d *tests/data/images/gbrp12le.dpx/02.gbrp12le.dpx
-tests/data/images/gbrp12le.dpx/%02d.gbrp12le.dpx CRC=0x1c755633
 609920 tests/data/images/gbrp12le.dpx/02.gbrp12le.dpx
+tests/data/images/gbrp12le.dpx/%02d.gbrp12le.dpx CRC=0x1c755633

tests/ref/lavf/gbrpf32be.pfm

@@ -1,3 +1,3 @@
 6d470f8d6018b95b45afafc14b7d161a *tests/data/images/gbrpf32be.pfm/02.gbrpf32be.pfm
-tests/data/images/gbrpf32be.pfm/%02d.gbrpf32be.pfm CRC=0x4b73053f
 1216532 tests/data/images/gbrpf32be.pfm/02.gbrpf32be.pfm
+tests/data/images/gbrpf32be.pfm/%02d.gbrpf32be.pfm CRC=0x4b73053f

tests/ref/lavf/gbrpf32le.pfm

@@ -1,3 +1,3 @@
 892c5a05e1cbb3d2f7761d51e18b9c4c *tests/data/images/gbrpf32le.pfm/02.gbrpf32le.pfm
-tests/data/images/gbrpf32le.pfm/%02d.gbrpf32le.pfm CRC=0x95e1053f
 1216533 tests/data/images/gbrpf32le.pfm/02.gbrpf32le.pfm
+tests/data/images/gbrpf32le.pfm/%02d.gbrpf32le.pfm CRC=0x95e1053f

tests/ref/lavf/gray.pam

@@ -1,3 +1,3 @@
 35cb9e42b2d3181be494f8693af1ddea *tests/data/images/gray.pam/02.gray.pam
-tests/data/images/gray.pam/%02d.gray.pam CRC=0x0ff205be
 101445 tests/data/images/gray.pam/02.gray.pam
+tests/data/images/gray.pam/%02d.gray.pam CRC=0x0ff205be

tests/ref/lavf/gray.xwd

@@ -1,3 +1,3 @@
 85e9b8b814a1dea71d143aac2e487037 *tests/data/images/gray.xwd/02.gray.xwd
-tests/data/images/gray.xwd/%02d.gray.xwd CRC=0x0ff205be
 101487 tests/data/images/gray.xwd/02.gray.xwd
+tests/data/images/gray.xwd/%02d.gray.xwd CRC=0x0ff205be

tests/ref/lavf/gray16be.pam

@@ -1,3 +1,3 @@
 740eb42157af9e9eed46b70ba6a6cf4d *tests/data/images/gray16be.pam/02.gray16be.pam
-tests/data/images/gray16be.pam/%02d.gray16be.pam CRC=0x893f10ef
 202823 tests/data/images/gray16be.pam/02.gray16be.pam
+tests/data/images/gray16be.pam/%02d.gray16be.pam CRC=0x893f10ef

tests/ref/lavf/gray16be.png

@@ -1,3 +1,3 @@
 6cf54c13aa407b77547cf6dfe23ecba3 *tests/data/images/gray16be.png/02.gray16be.png
-tests/data/images/gray16be.png/%02d.gray16be.png CRC=0x893f10ef
 47365 tests/data/images/gray16be.png/02.gray16be.png
+tests/data/images/gray16be.png/%02d.gray16be.png CRC=0x893f10ef

tests/ref/lavf/grayf32be.pfm

@@ -1,3 +1,3 @@
 0f6df0d68d7dd30e67386b1255f443c9 *tests/data/images/grayf32be.pfm/02.grayf32be.pfm
-tests/data/images/grayf32be.pfm/%02d.grayf32be.pfm CRC=0xe3fda443
 405524 tests/data/images/grayf32be.pfm/02.grayf32be.pfm
+tests/data/images/grayf32be.pfm/%02d.grayf32be.pfm CRC=0xe3fda443

tests/ref/lavf/grayf32le.pfm

@@ -1,3 +1,3 @@
 145715872a894b1fde0105d8a0106191 *tests/data/images/grayf32le.pfm/02.grayf32le.pfm
-tests/data/images/grayf32le.pfm/%02d.grayf32le.pfm CRC=0x5443a443
 405525 tests/data/images/grayf32le.pfm/02.grayf32le.pfm
+tests/data/images/grayf32le.pfm/%02d.grayf32le.pfm CRC=0x5443a443

tests/ref/lavf/jpg

@@ -1,3 +1,3 @@
 1e7c6d937f21c045e0b238a83f62f3c5 *tests/data/images/jpg/02.jpg
-tests/data/images/jpg/%02d.jpg CRC=0xe3509f33
 26037 tests/data/images/jpg/02.jpg
+tests/data/images/jpg/%02d.jpg CRC=0xe3509f33

tests/ref/lavf/monob.pam

@@ -1,3 +1,3 @@
 d2f5eb2f959ca3a90c02f1887b6e0c4f *tests/data/images/monob.pam/02.monob.pam
-tests/data/images/monob.pam/%02d.monob.pam CRC=0xab19200d
 101447 tests/data/images/monob.pam/02.monob.pam
+tests/data/images/monob.pam/%02d.monob.pam CRC=0xab19200d

tests/ref/lavf/monow.xwd

@@ -1,3 +1,3 @@
 796e2e309ac0844cfb2f4959816508ee *tests/data/images/monow.xwd/02.monow.xwd
-tests/data/images/monow.xwd/%02d.monow.xwd CRC=0xc9a20204
 12783 tests/data/images/monow.xwd/02.monow.xwd
+tests/data/images/monow.xwd/%02d.monow.xwd CRC=0xc9a20204

tests/ref/lavf/none.gbrapf32le.exr

@@ -1,3 +1 @@
-c586035e67f9ba7f2a3777933b5b22a0 *tests/data/images/none.gbrapf32le.exr/02.none.gbrapf32le.exr
 tests/data/images/none.gbrapf32le.exr/%02d.none.gbrapf32le.exr CRC=0x068aca4e
-1627003 tests/data/images/none.gbrapf32le.exr/02.none.gbrapf32le.exr

tests/ref/lavf/none.gbrpf32le.exr

@@ -1,3 +1 @@
-10f42423c6585fe5053c5457fba7b235 *tests/data/images/none.gbrpf32le.exr/02.none.gbrpf32le.exr
 tests/data/images/none.gbrpf32le.exr/%02d.none.gbrpf32le.exr CRC=0x95e1053f
-1221481 tests/data/images/none.gbrpf32le.exr/02.none.gbrpf32le.exr

tests/ref/lavf/none.grayf32le.exr

@@ -1,3 +1 @@
-8aa28b10bf2591b7030b78bc29907293 *tests/data/images/none.grayf32le.exr/02.none.grayf32le.exr
 tests/data/images/none.grayf32le.exr/%02d.none.grayf32le.exr CRC=0x5443a443
-410437 tests/data/images/none.grayf32le.exr/02.none.grayf32le.exr

tests/ref/lavf/pam

@@ -1,3 +1,3 @@
 0dce5565222cf0f8b309467f279aecd2 *tests/data/images/pam/02.pam
-tests/data/images/pam/%02d.pam CRC=0x6da01946
 304191 tests/data/images/pam/02.pam
+tests/data/images/pam/%02d.pam CRC=0x6da01946

tests/ref/lavf/pcx

@@ -1,3 +1,3 @@
 c4faf65ecc812ec8412cc26140c13bd5 *tests/data/images/pcx/02.pcx
-tests/data/images/pcx/%02d.pcx CRC=0x6da01946
 364147 tests/data/images/pcx/02.pcx
+tests/data/images/pcx/%02d.pcx CRC=0x6da01946

tests/ref/lavf/pgm

@@ -1,3 +1,3 @@
 cc777c5fc4d116d4c5a996eac8d3133e *tests/data/images/pgm/02.pgm
-tests/data/images/pgm/%02d.pgm CRC=0x0ff205be
 101391 tests/data/images/pgm/02.pgm
+tests/data/images/pgm/%02d.pgm CRC=0x0ff205be

tests/ref/lavf/png

@@ -1,3 +1,3 @@
 2af72da4468e61a37c220b25cb28618a *tests/data/images/png/02.png
-tests/data/images/png/%02d.png CRC=0x6da01946
 248633 tests/data/images/png/02.png
+tests/data/images/png/%02d.png CRC=0x6da01946

tests/ref/lavf/ppm

@@ -1,3 +1,3 @@
 16d5dadf0b362fc8ba3cb676c5dde985 *tests/data/images/ppm/02.ppm
-tests/data/images/ppm/%02d.ppm CRC=0x6da01946
 304143 tests/data/images/ppm/02.ppm
+tests/data/images/ppm/%02d.ppm CRC=0x6da01946

tests/ref/lavf/qoi

@@ -1,3 +1,3 @@
 3887a856d13f6444e213e9e268d58d55 *tests/data/images/qoi/02.qoi
-tests/data/images/qoi/%02d.qoi CRC=0x6da01946
 307658 tests/data/images/qoi/02.qoi
+tests/data/images/qoi/%02d.qoi CRC=0x6da01946

tests/ref/lavf/rgb48be.pam

@@ -1,3 +1,3 @@
 032538f0313b4f240b44a5bef115f5bf *tests/data/images/rgb48be.pam/02.rgb48be.pam
-tests/data/images/rgb48be.pam/%02d.rgb48be.pam CRC=0x5984c023
 608321 tests/data/images/rgb48be.pam/02.rgb48be.pam
+tests/data/images/rgb48be.pam/%02d.rgb48be.pam CRC=0x5984c023

tests/ref/lavf/rgb48be.png

@@ -1,3 +1,3 @@
 b4e38244c97debe3f528e7d1adb283ef *tests/data/images/rgb48be.png/02.rgb48be.png
-tests/data/images/rgb48be.png/%02d.rgb48be.png CRC=0x5984c023
 511900 tests/data/images/rgb48be.png/02.rgb48be.png
+tests/data/images/rgb48be.png/%02d.rgb48be.png CRC=0x5984c023

tests/ref/lavf/rgb48le.dpx

@@ -1,3 +1,3 @@
 075963c3c08978b6a20555ba09161434 *tests/data/images/rgb48le.dpx/02.rgb48le.dpx
-tests/data/images/rgb48le.dpx/%02d.rgb48le.dpx CRC=0xe5b9c023
 609920 tests/data/images/rgb48le.dpx/02.rgb48le.dpx
+tests/data/images/rgb48le.dpx/%02d.rgb48le.dpx CRC=0xe5b9c023

tests/ref/lavf/rgb48le_10.dpx

@@ -1,3 +1,3 @@
 b9f22728f8ff393bf30cf6cbd624fa95 *tests/data/images/rgb48le_10.dpx/02.rgb48le_10.dpx
-tests/data/images/rgb48le_10.dpx/%02d.rgb48le_10.dpx CRC=0xf38d5830
 407168 tests/data/images/rgb48le_10.dpx/02.rgb48le_10.dpx
+tests/data/images/rgb48le_10.dpx/%02d.rgb48le_10.dpx CRC=0xf38d5830

tests/ref/lavf/rgb4_byte.xwd

@@ -1,3 +1,3 @@
 fe1af954966a40c2cd35fc27094ff823 *tests/data/images/rgb4_byte.xwd/02.rgb4_byte.xwd
-tests/data/images/rgb4_byte.xwd/%02d.rgb4_byte.xwd CRC=0xce042dcc
 104559 tests/data/images/rgb4_byte.xwd/02.rgb4_byte.xwd
+tests/data/images/rgb4_byte.xwd/%02d.rgb4_byte.xwd CRC=0xce042dcc

tests/ref/lavf/rgb555be.xwd

@@ -1,3 +1,3 @@
 1300938325d5ac12caa09a43bd58f37c *tests/data/images/rgb555be.xwd/02.rgb555be.xwd
-tests/data/images/rgb555be.xwd/%02d.rgb555be.xwd CRC=0x14555d6e
 202863 tests/data/images/rgb555be.xwd/02.rgb555be.xwd
+tests/data/images/rgb555be.xwd/%02d.rgb555be.xwd CRC=0x14555d6e

tests/ref/lavf/rgb565be.xwd

@@ -1,3 +1,3 @@
 c0866e9e710fce735423594a93bee604 *tests/data/images/rgb565be.xwd/02.rgb565be.xwd
-tests/data/images/rgb565be.xwd/%02d.rgb565be.xwd CRC=0x53209216
 202863 tests/data/images/rgb565be.xwd/02.rgb565be.xwd
+tests/data/images/rgb565be.xwd/%02d.rgb565be.xwd CRC=0x53209216

tests/ref/lavf/rgb8.xwd

@@ -1,3 +1,3 @@
 c6f3cb7c45f7238474a89d2ad61a1caf *tests/data/images/rgb8.xwd/02.rgb8.xwd
-tests/data/images/rgb8.xwd/%02d.rgb8.xwd CRC=0xf217a95e
 104559 tests/data/images/rgb8.xwd/02.rgb8.xwd
+tests/data/images/rgb8.xwd/%02d.rgb8.xwd CRC=0xf217a95e

tests/ref/lavf/rgba.pam

@@ -1,3 +1,3 @@
 2ed31ca8d8de560afb3e0fd7a873cde5 *tests/data/images/rgba.pam/02.rgba.pam
-tests/data/images/rgba.pam/%02d.rgba.pam CRC=0xf07d29cd
 405573 tests/data/images/rgba.pam/02.rgba.pam
+tests/data/images/rgba.pam/%02d.rgba.pam CRC=0xf07d29cd

tests/ref/lavf/rgba.xwd

@@ -1,3 +1,3 @@
 1cdb43599c956dc8563f1e09fac5df00 *tests/data/images/rgba.xwd/02.rgba.xwd
-tests/data/images/rgba.xwd/%02d.rgba.xwd CRC=0xf07d29cd
 405615 tests/data/images/rgba.xwd/02.rgba.xwd
+tests/data/images/rgba.xwd/%02d.rgba.xwd CRC=0xf07d29cd

tests/ref/lavf/rgba64le.dpx

@@ -1,3 +1,3 @@
 545603630f30dec2768c8ae8d12eb8ea *tests/data/images/rgba64le.dpx/02.rgba64le.dpx
-tests/data/images/rgba64le.dpx/%02d.rgba64le.dpx CRC=0xe72ce131
 812672 tests/data/images/rgba64le.dpx/02.rgba64le.dpx
+tests/data/images/rgba64le.dpx/%02d.rgba64le.dpx CRC=0xe72ce131

tests/ref/lavf/rle.gbrapf32le.exr

@@ -1,3 +1 @@
-94398a5ce98bb7b1b78b2b807306f6d7 *tests/data/images/rle.gbrapf32le.exr/02.rle.gbrapf32le.exr
 tests/data/images/rle.gbrapf32le.exr/%02d.rle.gbrapf32le.exr CRC=0x068aca4e
-1436849 tests/data/images/rle.gbrapf32le.exr/02.rle.gbrapf32le.exr

tests/ref/lavf/rle.gbrpf32le.exr

@@ -1,3 +1 @@
-fed878e1f4391314c37088085942e572 *tests/data/images/rle.gbrpf32le.exr/02.rle.gbrpf32le.exr
 tests/data/images/rle.gbrpf32le.exr/%02d.rle.gbrpf32le.exr CRC=0x95e1053f
-1208298 tests/data/images/rle.gbrpf32le.exr/02.rle.gbrpf32le.exr

tests/ref/lavf/rle.grayf32le.exr

@@ -1,3 +1 @@
-2841f839cb5aa98bb7aded800dda7cc7 *tests/data/images/rle.grayf32le.exr/02.rle.grayf32le.exr
 tests/data/images/rle.grayf32le.exr/%02d.rle.grayf32le.exr CRC=0x5443a443
-410437 tests/data/images/rle.grayf32le.exr/02.rle.grayf32le.exr

tests/ref/lavf/sgi

@@ -1,3 +1,3 @@
 d446e540a7c18da5fd3cc0e9942cd46f *tests/data/images/sgi/02.sgi
-tests/data/images/sgi/%02d.sgi CRC=0x6da01946
 307287 tests/data/images/sgi/02.sgi
+tests/data/images/sgi/%02d.sgi CRC=0x6da01946

tests/ref/lavf/sun

@@ -1,3 +1,3 @@
 07518bcb0841bc677ce6aea8464ea240 *tests/data/images/sun/02.sun
-tests/data/images/sun/%02d.sun CRC=0xe6c71946
 304123 tests/data/images/sun/02.sun
+tests/data/images/sun/%02d.sun CRC=0xe6c71946

tests/ref/lavf/tga

@@ -1,3 +1,3 @@
 c0305c53e6d79d4ed9f35f04f671246c *tests/data/images/tga/02.tga
-tests/data/images/tga/%02d.tga CRC=0xe6c71946
 304172 tests/data/images/tga/02.tga
+tests/data/images/tga/%02d.tga CRC=0xe6c71946

tests/ref/lavf/tiff

@@ -1,3 +1,3 @@
 b3299346a8959553a437e486d8f3bf76 *tests/data/images/tiff/02.tiff
-tests/data/images/tiff/%02d.tiff CRC=0x6da01946
 307131 tests/data/images/tiff/02.tiff
+tests/data/images/tiff/%02d.tiff CRC=0x6da01946

tests/ref/lavf/xbm

@@ -1,3 +1,3 @@
 83ed197cc88f382d9253365ffef70ec5 *tests/data/images/xbm/02.xbm
-tests/data/images/xbm/%02d.xbm CRC=0xc9a20204
 76410 tests/data/images/xbm/02.xbm
+tests/data/images/xbm/%02d.xbm CRC=0xc9a20204

tests/ref/lavf/xwd

@@ -1,3 +1,3 @@
 50baa5560b7d1aa3188b19c1162bf7dc *tests/data/images/xwd/02.xwd
-tests/data/images/xwd/%02d.xwd CRC=0x6da01946
 304239 tests/data/images/xwd/02.xwd
+tests/data/images/xwd/%02d.xwd CRC=0x6da01946

tests/ref/lavf/zip1.gbrapf32le.exr

@@ -1,3 +1 @@
-9fca73aac1a2e38969bed55929da48b4 *tests/data/images/zip1.gbrapf32le.exr/02.zip1.gbrapf32le.exr
 tests/data/images/zip1.gbrapf32le.exr/%02d.zip1.gbrapf32le.exr CRC=0x068aca4e
-902782 tests/data/images/zip1.gbrapf32le.exr/02.zip1.gbrapf32le.exr

tests/ref/lavf/zip1.gbrpf32le.exr

@@ -1,3 +1 @@
-a405ee4328719c53f97d351b5910e82b *tests/data/images/zip1.gbrpf32le.exr/02.zip1.gbrpf32le.exr
 tests/data/images/zip1.gbrpf32le.exr/%02d.zip1.gbrpf32le.exr CRC=0x95e1053f
-897319 tests/data/images/zip1.gbrpf32le.exr/02.zip1.gbrpf32le.exr

tests/ref/lavf/zip1.grayf32le.exr

@@ -1,3 +1 @@
-76fe15b4e0b735a6318ca273ff52fb58 *tests/data/images/zip1.grayf32le.exr/02.zip1.grayf32le.exr
 tests/data/images/zip1.grayf32le.exr/%02d.zip1.grayf32le.exr CRC=0x5443a443
-91044 tests/data/images/zip1.grayf32le.exr/02.zip1.grayf32le.exr

tests/ref/lavf/zip16.gbrapf32le.exr

@@ -1,3 +1 @@
-8beb8db200e658e74fdd4ed4c4ca9214 *tests/data/images/zip16.gbrapf32le.exr/02.zip16.gbrapf32le.exr
 tests/data/images/zip16.gbrapf32le.exr/%02d.zip16.gbrapf32le.exr CRC=0x068aca4e
-807513 tests/data/images/zip16.gbrapf32le.exr/02.zip16.gbrapf32le.exr

tests/ref/lavf/zip16.gbrpf32le.exr

@@ -1,3 +1 @@
-4bc7e2640ea086b7fc31cbcd4fff19f5 *tests/data/images/zip16.gbrpf32le.exr/02.zip16.gbrpf32le.exr
 tests/data/images/zip16.gbrpf32le.exr/%02d.zip16.gbrpf32le.exr CRC=0x95e1053f
-796693 tests/data/images/zip16.gbrpf32le.exr/02.zip16.gbrpf32le.exr

tests/ref/lavf/zip16.grayf32le.exr

@@ -1,3 +1 @@
-5d5def6a4f16cef1122280d80c7c527d *tests/data/images/zip16.grayf32le.exr/02.zip16.grayf32le.exr
 tests/data/images/zip16.grayf32le.exr/%02d.zip16.grayf32le.exr CRC=0x5443a443
-63997 tests/data/images/zip16.grayf32le.exr/02.zip16.grayf32le.exr

tools/target_dec_fuzzer.c

@@ -246,6 +246,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     case AV_CODEC_ID_LOCO:        maxpixels  /= 1024;  break;
     case AV_CODEC_ID_VORBIS:      maxsamples /= 1024;  break;
     case AV_CODEC_ID_LSCR:        maxpixels  /= 16;    break;
+    case AV_CODEC_ID_MMVIDEO:     maxpixels  /= 256;   break;
     case AV_CODEC_ID_MOTIONPIXELS:maxpixels  /= 256;   break;
     case AV_CODEC_ID_MP4ALS:      maxsamples /= 65536; break;
     case AV_CODEC_ID_MSA1:        maxpixels  /= 16384; break;