Bump versions for master after 3.3

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Changelog

@@ -1,475 +1,7 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.
 
-version 3.3.6:
-- x264: Support version 153
-- avcodec/exr: Check buf_size more completely
-- avcodec/flacdec: Fix overflow in multiplication in decode_subframe_fixed()
-- avcodec/hevcdsp_template: Fix Invalid shifts in put_hevc_qpel_bi_w_h() and put_hevc_qpel_bi_w_w()
-- avcodec/flacdec: avoid undefined shift
-- avcodec/hevcdsp_template.c: Fix undefined shift in FUNC(dequant)
-- avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD97iH0() and COMPOSE_DD137iL0()
-- avcodec/hevc_cabac: Fix integer overflow in ff_hevc_cu_qp_delta_abs()
-- tests/audiomatch: Add missing return code at the end of main()
-- avcodec/hevc_sei: Fix integer overflows in decode_nal_sei_message()
-- avcodec/hevcdsp_template: Fix undefined shift in put_hevc_qpel_bi_w_hv()
-- libavfilter/af_dcshift.c: Fixed repeated spelling error
-- avfilter/formats: fix wrong function name in error message
-- avcodec/amrwbdec: Fix division by 0 in voice_factor()
-- avcodec/diracdsp: Fix integer overflow in PUT_SIGNED_RECT_CLAMPED()
-- avcodec/dirac_dwt: Fix integer overflows in COMPOSE_DAUB97*
-- avcodec/extract_extradata_bsf: Fix leak discovered via fuzzing
-- avcodec/vorbis: Fix another 1 << 31 > int32_t::max() with 1u.
-- Don't manipulate duration when it's AV_NOPTS_VALUE.
-- avcodec/vorbis: 1 << 31 > int32_t::max(), so use 1u << 31 instead.
-- avformat/utils: Prevent undefined shift with wrap_bits > 64.
-- avcodec/j2kenc: Fix out of array access in encode_cblk()
-- avcodec/hevcdsp_template: Fix undefined shift in put_hevc_epel_bi_w_h()
-- avcodec/mlpdsp: Fix signed integer overflow, 2nd try
-- avcodec/kgv1dec: Check that there is enough input for maximum RLE compression
-- avcodec/dirac_dwt: Fix integer overflow in COMPOSE_FIDELITYi*
-- avcodec/mpeg4videodec: Check also for negative versions in the validity check
-- Close ogg stream upon error when using AV_EF_EXPLODE.
-- Fix undefined shift on assumed 8-bit input.
-- Use ff_thread_once for fixed, float table init.
-- Fix leak of frame_duration_buffer in mov_fix_index().
-- avformat/mov: Propagate errors in mov_switch_root.
-- avcodec/hevcdsp_template: Fix invalid shift in put_hevc_epel_bi_w_v()
-- avcodec/mlpdsp: Fix undefined shift ff_mlp_pack_output()
-- avcodec/zmbv: Check that the buffer is large enough for mvec
-- avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD137iL0()
-- avcodec/wmv2dec: Check end of bitstream in parse_mb_skip() and ff_wmv2_decode_mb()
-- avcodec/snowdec: Check for remaining bitstream in decode_blocks()
-- avcodec/snowdec: Check intra block dc differences.
-- avformat/mov: Check size of STSC allocation
-- avcodec/vc2enc: Clear coef_buf on allocation
-- avcodec/h264dec: Fix potential array overread
-- avcodec/x86/mpegvideodsp: Fix signedness bug in need_emu
-- avcodec/aacpsdsp_template: Fix integer overflows in ps_decorrelate_c()
-- avcodec/aacdec_fixed: Fix undefined shift
-- avcodec/mdct_*: Fix integer overflow in addition in RESCALE()
-- avcodec/snowdec: Fix integer overflow in header parsing
-- avcodec/cngdec: Fix integer clipping
-- avcodec/sbrdsp_fixed: Fix integer overflow in shift in sbr_hf_g_filt_c()
-- avcodec/aacsbr_fixed: Fix division by zero in sbr_gain_calc()
-- avutil/softfloat: Add FLOAT_MIN
-- avcodec/h264idct_template: Fix integer overflows in ff_h264_idct8_add()
-- avcodec/xan: Check for bitstream end in xan_huffman_decode()
-- avcodec/exr: fix undefined shift in pxr24_uncompress()
-- avformat: Free the internal codec context at the end
-- avcodec/h264idct_template: Fix integer overflows in ff_h264_idct8_add()
-- avcodec/xan: Improve overlapping check
-- avcodec/aacdec_fixed: Fix integer overflow in apply_dependent_coupling_fixed()
-- avcodec/aacdec_fixed: Fix integer overflow in predict()
-- avcodec/jpeglsdec: Check for end of bitstream in ls_decode_line()
-- avcodec/jpeglsdec: Check ilv for being a supported value
-- lavfi/af_pan: fix sign handling in channel coefficient parser
-- vc2enc_dwt: pad the temporary buffer by the slice siz
-
-version 3.3.5:
-- ffserver: Fix off by 1 error in path
-- avcodec/snowdec: Check mv_scale
-- avcodec/pafvideo: Check for bitstream end in decode_0()
-- avcodec/ffv1dec: Fix out of array read in slice counting
-- avcodec/dirac_dwt: Fix integer overflow in COMPOSE_53iL0()
-- avcodec/mpeg_er: Clear mcsel in mpeg_er_decode_mb()
-- avcodec/mpeg4videodec: Use 64 bit intermediates for sprite delta
-- avcodec/x86/lossless_videoencdsp: Fix warning: signed dword value exceeds bounds
-- avcodec/x86/lossless_videoencdsp: Fix handling of small widths
-- avcodec/truemotion2: Fix integer overflows in tm2_high_chroma()
-- avcodec/aacdec_template: Clear tns present flag on error
-- avcodec/proresdec2: SKIP_BITS() does not work with len=32
-- avcodec/hevcdsp_template: Fix undefined shift
-- avcodec/jpeg2000: Check that codsty->log2_prec_widths/heights has been initialized
-- avcodec/takdec: Fix integer overflow in decode_lpc()
-- avcodec/proresdec2: Check bits in DECODE_CODEWORD(), fixes invalid shift
-- avcodec/takdec: Fix integer overflows in decode_subframe()
-- avcodec/dirac_dwt: Fix integer overflow in COMPOSE_FIDELITYi*()
-- avcodec/ffv1dec: Fix integer overflow in read_quant_table()
-- avcodec/svq3: Fix overflow in svq3_add_idct_c()
-- avcodec/pngdec: Clean up on av_frame_ref() failure
-
-version 3.3.4:
-- avcodec/hevc_ps: improve check for missing default display window bitstream
-- avcodec/hevc_ps: Fix c?_qp_offset_list size
-- avcodec/shorten: Move buffer allocation and offset init to end of read_header()
-- avcodec/jpeg2000dsp: Fix multiple integer overflows in ict_int()
-- avcodec/hevcdsp_template: Fix undefined shift in put_hevc_pel_bi_w_pixels
-- avcodec/diracdec: Fix overflow in DC computation
-- avcodec/scpr: optimize shift loop.
-- avcodec/dirac_vlc: limit res_bits in APPEND_RESIDUE()
-- libavcodec/h264_parse: don't use uninitialized value when chroma_format_idc==0
-- avformat/asfdec: Fix DoS in asf_build_simple_index()
-- avformat/mov: Fix DoS in read_tfra()
-- avcodec/dirac_vlc: Fix invalid shift in ff_dirac_golomb_read_32bit()
-- avcodec/dirac_dwt: Fix multiple overflows in 9/7 lifting
-- avcodec/diracdec: Fix integer overflow in INTRA_DC_PRED()
-- avformat/mxfdec: Fix Sign error in mxf_read_primer_pack()
-- avformat/mxfdec: Fix DoS issues in mxf_read_index_entry_array()
-- avformat/nsvdec: Fix DoS due to lack of eof check in nsvs_file_offset loop.
-- avcodec/snowdec: Fix integer overflow in decode_subband_slice_buffered()
-- avcodec/hevc_ps: Fix undefined shift in pcm code
-- avcodec/sbrdsp_fixed: Fix undefined overflows in autocorrelate()
-- avformat/mvdec: Fix DoS due to lack of eof check
-- avformat/rl2: Fix DoS due to lack of eof check
-- avformat/rmdec: Fix DoS due to lack of eof check
-- avformat/cinedec: Fix DoS due to lack of eof check
-- avformat/asfdec: Fix DoS due to lack of eof check
-- avformat/hls: Fix DoS due to infinite loop
-- ffprobe: Fix NULL pointer handling in color parameter printing
-- ffprobe: Fix null pointer dereference with color primaries
-- avcodec/hevc_ps: Check delta_pocs in ff_hevc_decode_short_term_rps()
-- avformat/rtpdec_h264: Fix heap-buffer-overflow
-- avformat/aviobuf: Fix signed integer overflow in avio_seek()
-- avformat/mov: Fix signed integer overflows with total_size
-- avcodec/utils: Fix signed integer overflow in rc_initial_buffer_occupancy initialization
-- avcodec/aacdec_template: Fix running cleanup in decode_ics_info()
-- avcodec/me_cmp: Fix crashes on ARM due to misalignment
-- avcodec/pixlet: Fixes: undefined shift in av_mod_uintp2()
-- avcodec/dirac_dwt_template: Fix integer overflow in vertical_compose53iL0()
-- avcodec/fic: Fixes signed integer overflow
-- avcodec/snowdec: Fix off by 1 error
-- avcodec/pixlet: fixes integer overflow in read_highpass()
-- avcodec/zmbv: Check decomp_size
-- avcodec/diracdec: Fixes integer overflow
-- avcodec/diracdec: Check perspective_exp and zrs_exp.
-- avcodec/ffv1dec_template: Fix undefined shift
-- avcodec/mpeg4videodec: Clear mcsel before decoding an image
-- avcodec/dirac_dwt: Fixes integer overflows in COMPOSE_DAUB97*
-- avcodec/aacdec_fixed: fix invalid shift in predict()
-- avcodec/h264_slice: Fix overflow in slice offset
-- avformat/utils: fix memory leak in avformat_free_context
-- swscale: fix gbrap16 alpha channel issues
-- avcodec/h264idct_template: Fix integer overflow in ff_h264_idct_add()
-- avcodec/diracdsp: fix integer overflow
-- avcodec/diracdec: Check weight_log2denom
-- avcodec/nvenc: only push cuda context on encoder close if encoder exists
-- avfilter/vf_ssim: fix temp size calculation
-
-version 3.3.3:
-- avcodec/dirac_dwt: Fix multiple integer overflows in COMPOSE_DD97iH0()
-- avcodec/diracdec: Fix integer overflow in divide3()
-- avcodec/takdec: Fix integer overflow in decode_subframe()
-- avformat/rtmppkt: Convert ff_amf_get_field_value() to bytestream2
-- avformat/rtmppkt: Convert ff_amf_tag_size() to bytestream2
-- avcodec/diracdec: Fix integer overflow in signed multiplication in UNPACK_ARITH()
-- avcodec/pixlet: Simplify nbits computation
-- avcodec/dnxhddec: Move mb height check out of non hr branch
-- avcodec/hevc_ps: fix integer overflow in log2_parallel_merge_level_minus2
-- avformat/oggparsecelt: Do not re-allocate os->private
-- avcodec/ylc: Fix shift overflow
-- avcodec/aacps: Fix multiple integer overflow in map_val_34_to_20()
-- avcodec/aacdec_fixed: fix: left shift of negative value -1
-- avcodec/dirac_vlc: Fix undefined shift
-- doc/filters: typo in frei0r
-- avcodec/cfhd: Fix decoding regression due to height check
-- avcodec/aacdec_template (fixed point): Check gain in decode_cce() to avoid undefined shifts later
-- avcodec/ffv1dec_template: Fix signed integer overflow
-- avcodec/aacdec_template: Fix undefined integer overflow in apply_tns()
-- avcodec/magicyuv: Check that vlc len is not too large
-- avcodec/mjpegdec: Clip DC also on the negative side.
-- avcodec/aacps (fixed point): Fix multiple signed integer overflows
-- avcodec/ylc: Fix vlc of 31 bits
-- avcodec/sbrdsp_fixed: Fix integer overflow in sbr_hf_apply_noise()
-- avcodec/hevcdec: do not let updated extradata corrupt state
-- avcodec/wavpack: Fix invalid shift
-- avcodec/h264_slice: Fix signed integer overflow
-- avcodec/hevc_ps: Fix integer overflow with beta/tc offsets
-- avcodec/cfhd: Fix invalid left shift of negative value
-- avcodec/vb: Check vertical GMC component before multiply
-- avcodec/hevcdec: do basic validity check on delta_chroma_weight and offset
-- avcodec/jpeg2000dwt: Fix integer overflow in dwt_decode97_int()
-- avcodec/apedec: Fix integer overflow
-- avcodec/wavpack: Fix integer overflow in wv_unpack_stereo()
-- avcodec/hevc_ps: Fix max_dec_buffer check
-- avcodec/mpeg4videodec: Fix GMC with videos of dimension 1
-- avcodec/wavpack: Fix integer overflow
-- avcodec/takdec: Fix integer overflow
-- avcodec/tiff: Update pointer only when the result is used
-- avcodec/cfhd: Check bpc before setting bpc in context
-- avcodec/cfhd: Fix undefined shift
-- avcodec/hevc_filter: Fix invalid shift
-- avcodec/mpeg4videodec: Fix overflow in virtual_ref computation
-- avcodec/lpc: signed integer overflow in compute_lpc_coefs() (aacdec_fixed)
-- avcodec/wavpack: Fix undefined integer negation
-- avcodec/aacdec_fixed: Check s for being too small
-- avcodec/htmlsubtitles: Replace very slow redundant sscanf() calls by cleaner and faster code
-- avcodec/h264: Fix mix of lossless and lossy MBs decoding
-- avcodec/h264_mb: Fix 8x8dct in lossless for new versions of x264
-- avcodec/h264_cabac: Fix CABAC+8x8dct in 4:4:4
-- avcodec/takdec: Fixes: integer overflow in AV_SAMPLE_FMT_U8P output
-- avcodec/jpeg2000dsp: Reorder operations in ict_int() to avoid 2 integer overflows
-- avcodec/hevcpred_template: Fix left shift of negative value
-- avcodec/hevcdec: Fix signed integer overflow in decode_lt_rps()
-- avcodec/jpeg2000dec: Check nonzerobits more completely
-- avcodec/shorten: Sanity check maxnlpc
-- avcodec/truemotion2: Move skip computation after checks
-- avcodec/jpeg2000: Fixes integer overflow in ff_jpeg2000_ceildivpow2()
-- avcodec/dnxhd_parser: Do not return invalid value from dnxhd_find_frame_end() on error
-- avcodec/hevcdec: Check nb_sps
-- avcodec/hevc_refs: Check nb_refs in add_candidate_ref()
-- avcodec/mpeg4videodec: Check sprite delta upshift against overflowing.
-- avcodec/mpeg4videodec: Fix integer overflow in num_sprite_warping_points=2 case
-- avcodec/aacsbr_fixed: Check shift in sbr_hf_assemble()
-- avcodec/sbrdsp_fixed: Return an error from sbr_hf_apply_noise() if operations are impossible
-- avcodec/libvpxdec: Check that display dimensions fit in the storage dimensions
-- avcodec/jpeg2000dwt: Fix runtime error: left shift of negative value -123
-- avcodec/wavpack: Fix runtime error: signed integer overflow: 1886191616 + 277872640 cannot be represented in type 'int'
-- avcodec/snowdec: Fix runtime error: left shift of negative value -1
-- avcodec/aacdec_fixed: Fix runtime error: left shift of negative value -1297616
-- avcodec/tiff: Fix leak of geotags[].val
-- avcodec/ra144: Fix runtime error: signed integer overflow: -2200 * 1033073 cannot be represented in type 'int'
-- avcodec/flicvideo: Fix runtime error: signed integer overflow: 4864 * 459296 cannot be represented in type 'int'
-- avcodec/cfhd: Check band parameters before storing them
-- avcodec/h264_parse: Check picture structure when initializig weight table
-- avcodec/indeo4: Check remaining data in Pic hdr extension parsing code
-- avcodec/ac3dec_fixed: Fix multiple runtime error: signed integer overflow: -39271008 * 59 cannot be represented in type 'int'
-- lavc/aarch64/simple_idct: fix idct_col4_top coefficient
-
-
-version 3.3.2:
-- avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: 53098 * 40448 cannot be represented in type 'int'
-- avcodec/pafvideo: Fix assertion failure
-- avcodec/takdec: Fix multiple runtime error: signed integer overflow: 637072 * 4096 cannot be represented in type 'int'
-- avcodec/mjpegdec: Check that reference frame matches the current frame
-- avcodec/tiff: Avoid loosing allocated geotag values
-- avcodec/cavs: Fix runtime error: signed integer overflow: -12648062 * 256 cannot be represented in type 'int'
-- avformat/hls: Check local file extensions
-- avcodec/qdrw: Fix null pointer dereference
-- avutil/softfloat: Fix sign error in and improve documentation of av_int2sf()
-- avcodec/hevc_ps: Fix runtime error: index 32 out of bounds for type 'uint8_t [32]'
-- avcodec/dxv: Check remaining bytes in dxv_decompress_raw()
-- avcodec/pafvideo: Check packet size and frame code before ff_reget_buffer()
-- avcodec/ac3dec_fixed: Fix runtime error: left shift of 419 by 23 places cannot be represented in type 'int'
-- avformat/options: log filename on open
-- avcodec/aacps: Fix runtime error: left shift of 1073741824 by 1 places cannot be represented in type 'INTFLOAT' (aka 'int')
-- avcodec/wavpack: Fix runtime error: shift exponent 32 is too large for 32-bit type 'int'
-- avcodec/cfhd: Fix runtime error: signed integer overflow: 65280 * 65288 cannot be represented in type 'int'
-- avcodec/wavpack: Fix runtime error: signed integer overflow: 2013265955 - -134217694 cannot be represented in type 'int'
-- avcodec/cinepak: Check input packet size before frame reallocation
-- avcodec/hevc_ps: Fix runtime error: signed integer overflow: 2147483628 + 256 cannot be represented in type 'int'
-- avcodec/ra144: Fixes runtime error: signed integer overflow: 7160 * 327138 cannot be represented in type 'int'
-- avcodec/pnm: Use ff_set_dimensions()
-- avcodec/cavsdec: Fix runtime error: signed integer overflow: 59 + 2147483600 cannot be represented in type 'int'
-- avcodec/nvenc: fix hw accelerated transcode with bframes
-- libavformat/hls: Observe Set-Cookie headers
-- libavformat/http: Ignore expired cookies
-- avformat/avidec: Limit formats in gab2 to srt and ass/ssa
-- avcodec/acelp_pitch_delay: Fix runtime error: value 4.83233e+39 is outside the range of representable values of type 'float'
-- avcodec/wavpack: Check float_shift
-- avcodec/wavpack: Fix runtime error: signed integer overflow: 24 * -2147483648 cannot be represented in type 'int'
-- avcodec/ansi: Fix frame memleak
-- avcodec/dds: Fix runtime error: left shift of 145 by 24 places cannot be represented in type 'int'
-- avcodec/jpeg2000dec: Use ff_set_dimensions()
-- avcodec/truemotion2: Fix passing null pointer to memset()
-- avcodec/truemotion2: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
-- avcodec/ra144: Fix runtime error: signed integer overflow: -2449 * 1398101 cannot be represented in type 'int'
-- avcodec/ra144: Fix runtime error: signed integer overflow: 11184810 * 404 cannot be represented in type 'int'
-- avcodec/aac_defines: Add missing () to AAC_HALF_SUM() macro
-- avcodec/webp: Fixes null pointer dereference
-- avcodec/aacdec_fixed: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
-- avcodec/ylc: Check count in build_vlc()
-- avcodec/snow: Fix runtime error: signed integer overflow: 1086573993 + 1086573994 cannot be represented in type 'int'
-- avcodec/jpeg2000: Fix runtime error: signed integer overflow: 4185 + 2147483394 cannot be represented in type 'int'
-- avcodec/jpeg2000dec: Check tile offsets more completely
-- avcodec/sheervideo: Check input buffer size before allocating and decoding
-- avcodec/aacdec_fixed: Fix multiple runtime error: shift exponent 127 is too large for 32-bit type 'int'
-- avcodec/wnv1: More strict buffer size check
-- avcodec/libfdk-aacdec: Correct buffer_size parameter
-- avcodec/sbrdsp_template: Fix: runtime error: signed integer overflow: 849815297 + 1315389781 cannot be represented in type 'int'
-- avcodec/ivi_dsp: Fix runtime error: left shift of negative value -2
-- doc/filters: Clarify scale2ref example
-- avcodec/mlpdec: Do not leave invalid values in matrix_out_ch[] on error
-- avcodec/ra144dec: Fix runtime error: left shift of negative value -17
-- avcodec/pixlet: Fix runtime error: signed integer overflow: 2147483647 + 32 cannot be represented in type 'int'
-- avformat/mux: Fix copy an paste typo
-- avutil/internal: Do not enable CHECKED with DEBUG
-- avcodec/clearvideo: Check buf_size before decoding frame
-- avcodec/aacdec_fixed: Fix runtime error: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
-- avcodec/smc: Check remaining input
-- avcodec/diracdec: Fix off by 1 error in quant check
-- avcodec/jpeg2000dec: Fix copy and paste error
-- avcodec/jpeg2000dec: Check tile offsets
-- avcodec/sanm: Fix uninitialized reference frames
-- avcodec/jpeglsdec: Check get_bits_left() before decoding a picture
-- avcodec/fmvc: Fix use of uninitialized memory when the first frame is not a keyframe
-- avcodec/ivi_dsp: Fix multiple runtime error: left shift of negative value -71
-- avcodec/mjpegdec: Fix runtime error: signed integer overflow: -32767 * 130560 cannot be represented in type 'int'
-- avcodec/aacdec_fixed: Fix runtime error: shift exponent 34 is too large for 32-bit type 'int'
-- avcodec/mpeg4videodec: Check for multiple VOL headers
-- avcodec/vp9block: fix runtime error: signed integer overflow: 196675 * 20670 cannot be represented in type 'int'
-- avcodec/vmnc: Check location before use
-- avcodec/takdec: Fix runtime error: signed integer overflow: 8192 * 524308 cannot be represented in type 'int'
-- avcodec/aac_defines: Fix: runtime error: left shift of negative value -2
-- avcodec/takdec: Fix runtime error: left shift of negative value -63
-- avcodec/mlpdsp: Fix runtime error: signed integer overflow: -24419392 * 128 cannot be represented in type 'int'
-- avcodec/sbrdsp_fixed: fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
-- avcodec/aacsbr_fixed: Fix multiple runtime error: shift exponent 170 is too large for 32-bit type 'int'
-- avcodec/mlpdec: Do not leave a invalid num_primitive_matrices in the context
-- avcodec/aacsbr_fixed: Fix multiple runtime error: shift exponent 150 is too large for 32-bit type 'int'
-- avcodec/mimic: Use ff_set_dimensions() to set the dimensions
-- avcodec/fic: Fix multiple runtime error: signed integer overflow: 5793 * 419752 cannot be represented in type 'int'
-- avcodec/pixlet: Fix reading invalid numbers of bits
-- avcodec/mlpdec: Fix: runtime error: left shift of negative value -8
-- avcodec/dfa: Fix: runtime error: signed integer overflow: -14202 * 196877 cannot be represented in type 'int'
-- avcodec/aacdec: Fix runtime error: signed integer overflow: 2147483520 + 255 cannot be represented in type 'int'
-- avcodec/aacdec_template: Fix fixed point scale in decode_cce()
-- avcodec/fmvc: Fix off by 1 error
-- avcodec/flicvideo: Check frame_size before decrementing
-- avcodec/mlpdec: Fix runtime error: left shift of negative value -1
-- avcodec/takdec: Fix  runtime error: left shift of negative value -42
-- avcodec/hq_hqa: Fix: runtime error: signed integer overflow: -255 * 10180917 cannot be represented in type 'int'
-- avcodec/scpr: mask bits to prevent out of array read
-- avcodec/truemotion1: Fix multiple runtime error: signed integer overflow: 1246906962 * 2 cannot be represented in type 'int'
-- avcodec/svq3: Fix runtime error: left shift of negative value -6
-- avcodec/tiff: reset sampling[] if its invalid
-- configure: Fix the msvcrt version check for mingw32
-- lavf/mov: make invalid m{d,v}hd time_scale default to 1 instead of erroring out
-- lavc/ffjni: add missing '\n'
-- lavc/mediacodec_wrapper: do not declare JNIAMedia{Codec,CodecList,Format}Fields on the stack
-- lavc/mediacodec_wrapper: fix local reference leaks
-- avcodec/nvenc: remove unnecessary alignment
-- Use AVOnce as a static variable consistently
-- avfilter: take_samples: do not directly return frame when samples are skipped
-- avutil/hwcontext_dxva2: Don't improperly free IDirect3DSurface9 objects
-
-version 3.3.1:
-- libswscale/tests/swscale: Fix uninitialized variables
-- avcodec/ffv1dec: Fix runtime error: signed integer overflow: 1550964438 + 1550964438 cannot be represented in type 'int'
-- avcodec/webp: Fix signedness in prefix_code check
-- avcodec/svq3: Fix runtime error: signed integer overflow: 169 * 12717677 cannot be represented in type 'int'
-- avcodec/mlpdec: Check that there is enough data for headers
-- avcodec/ac3dec: Keep track of band structure
-- avcodec/webp: Add missing input padding
-- avcodec/aacdec_fixed: Fix runtime error: left shift of negative value -1
-- avcodec/aacsbr_template: Do not change bs_num_env before its checked
-- avcodec/scpr: Fix multiple runtime error: index 256 out of bounds for type 'unsigned int [256]'
-- avcodec/mlp: Fix multiple runtime error: left shift of negative value -1
-- avcodec/xpmdec: Fix multiple pointer/memory issues
-- avcodec/vp8dsp: vp7_luma_dc_wht_c: Fix multiple runtime error: signed integer overflow: -1366381240 + -1262413604 cannot be represented in type 'int'
-- avcodec/avcodec: Limit the number of side data elements per packet
-- avcodec/texturedsp: Fix runtime error: left shift of 255 by 24 places cannot be represented in type 'int'
-- avcodec/g723_1dec: Fix runtime error: left shift of negative value -1
-- avcodec/wmv2dsp: Fix runtime error: signed integer overflow: 181 * -17047030 cannot be represented in type 'int'
-- avcodec/diracdec: Fix Assertion frame->buf[0] failed at libavcodec/decode.c:610
-- avcodec/msmpeg4dec: Check for cbpy VLC errors
-- avcodec/cllc: Check num_bits
-- avcodec/cllc: Factor VLC_BITS/DEPTH out, do not use repeated literal numbers
-- avcodec/scpr: Check y in first line loop in decompress_i()
-- avcodec/dvbsubdec: Check entry_id
-- avcodec/aacdec_fixed: Fix multiple shift exponent 33 is too large for 32-bit type 'int'
-- avcodec/mpeg12dec: Fixes runtime error: division by zero
-- avcodec/pixlet: Fix runtime error: signed integer overflow: 436207616 * -5160230545260541 cannot be represented in type 'long'
-- avcodec/webp: Always set pix_fmt
-- avfilter/vf_uspp: Fix currently unused input frame dimensions
-- avcodec/truemotion1: Fix multiple runtime error: left shift of negative value -1
-- avcodec/eatqi: Fix runtime error: signed integer overflow: 4466147 * 1075 cannot be represented in type 'int'
-- avcodec/dss_sp: Fix runtime error: signed integer overflow: 2147481189 + 4096 cannot be represented in type 'int'
-- avformat/wavdec: Check chunk_size
-- avcodec/cavs: Check updated MV
-- avcodec/y41pdec: Fix width in input buffer size check
-- avcodec/svq3: Fix multiple runtime error: signed integer overflow: -237341 * 24552 cannot be represented in type 'int'
-- avcodec/texturedsp: Fix runtime error: left shift of 218 by 24 places cannot be represented in type 'int'
-- avcodec/lagarith: Check scale_factor
-- avcodec/lagarith: Fix runtime error: left shift of negative value -1
-- avcodec/takdec: Fix multiple  runtime error: left shift of negative value -1
-- avcodec/indeo2: Check for invalid VLCs
-- avcodec/g723_1dec: Fix several integer related cases of undefined behaviour
-- avcodec/htmlsubtitles: Check for string truncation and return error
-- avcodec/bmvvideo: Fix runtime error: left shift of 137 by 24 places cannot be represented in type 'int'
-- avcodec/dss_sp: Fix multiple runtime error: signed integer overflow: -15699 * -164039 cannot be represented in type 'int'
-- avcodec/dvbsubdec: check region dimensions
-- avcodec/vp8dsp: Fixes: runtime error: signed integer overflow: 1330143360 - -1023040530 cannot be represented in type 'int'
-- avcodec/hqxdsp: Fix multiple runtime error: signed integer overflow: 248220 * 21407 cannot be represented in type 'int' in idct_col()
-- avcodec/cavsdec: Check sym_factor
-- avcodec/cdxl: Check format for BGR24
-- avcodec/ffv1dec: Fix copying planes of paletted formats
-- avcodec/wmv2dsp: Fix runtime error: signed integer overflow: 181 * -12156865 cannot be represented in type 'int'
-- avcodec/xwddec: Check bpp more completely
-- avcodec/aacdec_template: Do not decode 2nd PCE if it will lead to failure
-- avcodec/s302m: Fix left shift of 8 by 28 places cannot be represented in type 'int'
-- avcodec/eamad: Fix runtime error: signed integer overflow: 49674 * 49858 cannot be represented in type 'int'
-- avcodec/g726: Fix runtime error: left shift of negative value -2
-- avcodec/magicyuv: Check len to be supported
-- avcodec/ra144: Fix runtime error: left shift of negative value -798
-- avcodec/mss34dsp: Fix multiple signed integer overflow
-- avcodec/targa_y216dec: Fix width type
-- avcodec/texturedsp: Fix multiple runtime error: left shift of 255 by 24 places cannot be represented in type 'int'
-- avcodec/ivi_dsp: Fix multiple left shift of negative value -2
-- avcodec/svq3: Fix multiple runtime error: signed integer overflow: 44161 * 61694 cannot be represented in type 'int'
-- avcodec/msmpeg4dec: Correct table depth
-- avcodec/dds: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
-- avcodec/cdxl: Check format parameter
-- avutil/softfloat: Fix overflow in av_div_sf()
-- avcodec/hq_hqa: Fix runtime error: left shift of negative value -207
-- avcodec/mss3: Change types in rac_get_model_sym() to match the types they are initialized from
-- avcodec/shorten: Check k in get_uint()
-- avcodec/webp: Fix null pointer dereference
-- avcodec/dfa: Fix signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
-- avcodec/g723_1: Fix multiple runtime error: left shift of negative value
-- avcodec/mimic: Fix runtime error: left shift of negative value -1
-- avcodec/clearvideo: Fix multiple runtime error: left shift of negative value -1024
-- avcodec/fic: Fix multiple left shift of negative value -15
-- avcodec/mlpdec: Fix runtime error: left shift of negative value -22
-- avcodec/snowdec: Check qbias
-- avutil/softfloat: Fix multiple runtime error: left shift of negative value -8
-- avcodec/aacsbr_template: Do not leave bs_num_env invalid
-- avcodec/mdec: Fix signed integer overflow: 28835400 * 83 cannot be represented in type 'int'
-- avcodec/dfa: Fix off by 1 error
-- avcodec/nellymoser: Fix multiple left shift of negative value -8591
-- avcodec/cdxl: Fix signed integer overflow: 14243456 * 164 cannot be represented in type 'int'
-- avcodec/g722: Fix multiple runtime error: left shift of negative value -1
-- avcodec/dss_sp: Fix multiple left shift of negative value -466
-- avcodec/wnv1: Fix runtime error: left shift of negative value -1
-- avcodec/tiertexseqv: set the fixed dimenasions, do not depend on the demuxer doing so
-- avcodec/mjpegdec: Fix runtime error: signed integer overflow: -24543 * 2031616 cannot be represented in type 'int'
-- avcodec/cavsdec: Fix undefined behavior from integer overflow
-- avcodec/dvdsubdec: Fix runtime error: left shift of 242 by 24 places cannot be represented in type 'int'
-- libavcodec/mpeg4videodec: Convert sprite_offset to 64bit
-- avcodec/pngdec: Use ff_set_dimensions()
-- avcodec/msvideo1: Check buffer size before re-getting the frame
-- avcodec/h264_cavlc: Fix undefined behavior on qscale overflow
-- avcodec/dcadsp: Fix runtime error: signed integer overflow
-- avcodec/svq3: Reject dx/dy beyond 16bit
-- avcodec/svq3: Increase offsets to prevent integer overflows
-- avcodec/indeo2: Check remaining bits in ir2_decode_plane()
-- avcodec/vp3: Check remaining bits in unpack_dct_coeffs()
-- doc/developer: Add terse documentation of assumed C implementation defined behavior
-- avcodec/bmp: Use ff_set_dimensions()
-- avcodec/mdec: Fix runtime error: left shift of negative value -127
-- avcodec/x86/vc1dsp_init: Fix build failure with --disable-optimizations and clang
-- libavcodec/exr : fix float to uint16 conversion for negative float value
-- avformat/webmdashenc: Validate the 'streams' adaptation sets parameter
-- avformat/webmdashenc: Require the 'adaptation_sets' option to be set
-- lavfi/avfiltergraph: only return EOF in avfilter_graph_request_oldest if all sinks EOFed
-- ffmpeg: check for unconnected outputs
-- avformat/utils: free AVStream.codec properly in free_stream()
-- avcodec/options: do a more thorough clean up in avcodec_copy_context()
-- avcodec/options: factorize avcodec_copy_context() cleanup code
-- ffmpeg: count packets when queued
-- avformat/concatdec: fix the h264 annexb extradata check
-- avcodec/dnxhd_parser: fix parsing interlaced video, simplify code
-- ffmpeg; check return code of avcodec_send_frame when flushing encoders
-- avcodec/g723_1dec: Fix LCG type
-- avcodec/hqxdsp: Fix runtime error: signed integer overflow: -196264 * 11585 cannot be represented in type 'int'
-- avcodec/ac3dec: Fix: runtime error: index -1 out of bounds for type 'INTFLOAT [2]'
-- avcodec/mpeg4videodec: Clear sprite wraping on unsupported cases in VOP decode
-- avcodec/pixlet: Fixes: runtime error: signed integer overflow: 9203954323419769657 + 29897660706736950 cannot be represented in type 'long'
-- avcodec/dds: Fix runtime error: left shift of 210 by 24 places cannot be represented in type 'int'
-- avcodec/rscc: Check pixel_size for overflow
-- avcodec/fmvc: Check nb_blocks
-- avcodec/cllc: Check prefix
-- avcodec/webp: Factor update_canvas_size() out
-- avcodec/webp: Update canvas size in vp8_lossy_decode_frame() as in vp8_lossless_decode_frame()
-- avcodec/snowdec: Check width
-- avcodec/flacdec: Return error code instead of 0 for failures
-- avcodec/opus_silk: Fix integer overflow and out of array read
-- avcodec/aacps: Fix undefined behavior
-- avcodec/pixlet: Fix shift exponent 4294967268 is too large for 32-bit type 'int'
-- doc/general: fix project name after 2b1a6b1ae
-
-
-version 3.3:
+version <next>:
 - CrystalHD decoder moved to new decode API
 - add internal ebur128 library, remove external libebur128 dependency
 - Pro-MPEG CoP #3-R2 FEC protocol
@@ -490,7 +22,6 @@ version 3.3:
 - threshold filter
 - midequalizer filter
 - Optimal Huffman tables for (M)JPEG encoding
-- VAAPI-accelerated MPEG-2 and VP8 encoding
 - FM Screen Capture Codec decoder
 - native Opus encoder
 - ScreenPressor decoder
@@ -501,7 +32,6 @@ version 3.3:
 - Removed the legacy X11 screen grabber, use XCB instead
 - MPEG-7 Video Signature filter
 - Removed asyncts filter (use af_aresample instead)
-- Intel QSV-accelerated VP8 video decoding
 
 
 version 3.2:
@@ -589,6 +119,7 @@ version 3.1:
 - libutvideo wrapper removed
 - YUY2 Lossless Codec decoder
 - VideoToolbox H.264 encoder
+- VAAPI-accelerated MPEG-2 and VP8 encoding
 
 
 version 3.0:

RELEASE

@@ -1 +1 @@
-3.3.6
+3.3.git

RELEASE_NOTES

@@ -1,15 +0,0 @@
-
-              ┌────────────────────────────────────────┐
-              │ RELEASE NOTES for FFmpeg 3.3 "Hilbert" │
-              └────────────────────────────────────────┘
-
-   The FFmpeg Project proudly presents FFmpeg 3.3 "Hilbert", about 5
-   months after the release of FFmpeg 3.2.
-
-   A complete Changelog is available at the root of the project, and the
-   complete Git history on http://source.ffmpeg.org.
-
-   We hope you will like this release as much as we enjoyed working on it, and
-   as usual, if you have any questions about it, or any FFmpeg related topic,
-   feel free to join us on the #ffmpeg IRC channel (on irc.freenode.net) or ask
-   on the mailing-lists.

configure

@@ -1513,7 +1513,6 @@ EXTERNAL_LIBRARY_GPL_LIST="
 "
 
 EXTERNAL_LIBRARY_NONFREE_LIST="
-    decklink
     libfdk_aac
     openssl
 "
@@ -1537,6 +1536,7 @@ EXTERNAL_LIBRARY_LIST="
     $EXTERNAL_LIBRARY_GPLV3_LIST
     chromaprint
     crystalhd
+    decklink
     gcrypt
     gnutls
     jni
@@ -5067,7 +5067,7 @@ probe_libc(){
         add_${pfx}cppflags -U__STRICT_ANSI__ -D__USE_MINGW_ANSI_STDIO=1
         check_${pfx}cpp_condition _mingw.h "defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x0502" ||
             add_${pfx}cppflags -D_WIN32_WINNT=0x0502
-        check_${pfx}cpp_condition _mingw.h "__MSVCRT_VERSION__ < 0x0700" &&
+        check_${pfx}cpp_condition _mingw.h "__MSVCRT_VERSION__ < 0x0700__" &&
             add_${pfx}cppflags -D__MSVCRT_VERSION__=0x0700
         eval test \$${pfx_no_}cc_type = "gcc" &&
             add_${pfx}cppflags -D__printf__=__gnu_printf__

doc/APIchanges

@@ -15,11 +15,11 @@ libavutil:     2015-08-28
 
 API changes, most recent first:
 
-2017-03-31 - 9033e8723c - lavu 55.57.100 - spherical.h
+2017-03-31 - xxxxxxx - lavu 55.57.100 - spherical.h
   Add av_spherical_projection_name().
   Add av_spherical_from_name().
 
-2017-03-30 - 4cda23f1f1 - lavu 55.53.100 / 55.27.0 - hwcontext.h
+2017-03-30 - xxxxxxx - lavu 55.53.100 / 55.27.0 - hwcontext.h
   Add av_hwframe_map() and associated AV_HWFRAME_MAP_* flags.
   Add av_hwframe_ctx_create_derived().
 
@@ -44,7 +44,7 @@ API changes, most recent first:
   Add AVCodecContext.hwaccel_flags field. This will control some hwaccels at
   a later point.
 
-2017-03-21 - fc9f14c7de - lavf 57.67.100 / 57.08.0 - avio.h
+2017-03-21 - xxxxxxx - lavf 57.67.100 / 57.08.0 - avio.h
   Add AVIO_SEEKABLE_TIME flag.
 
 2017-03-21 - d682ae70b4 - lavf 57.66.105, lavc 57.83.101 - avformat.h, avcodec.h
@@ -52,7 +52,7 @@ API changes, most recent first:
   bump, and libavformat will behave as if it were always set.
   Deprecate av_packet_merge_side_data() and av_packet_split_side_data().
 
-2016-03-20 - 8200b16a9c - lavu 55.50.100 / 55.21.0 - imgutils.h
+2016-03-20 - xxxxxxx - lavu 55.50.100 / 55.21.0 - imgutils.h
   Add av_image_copy_uc_from(), a version of av_image_copy() for copying
   from GPU mapped memory.
 
@@ -63,7 +63,7 @@ API changes, most recent first:
   Deprecate AVFilterGraph.resample_lavr_opts
   It's never been used by avfilter nor passed to anything.
 
-2017-02-10 - 1b7ffddb3a - lavu 55.48.100 / 55.33.0 - spherical.h
+2017-02-10 - xxxxxxx - lavu 55.48.100 / 55.33.0 - spherical.h
   Add AV_SPHERICAL_EQUIRECTANGULAR_TILE, av_spherical_tile_bounds(),
   and projection-specific properties (bound_left, bound_top, bound_right,
   bound_bottom, padding) to AVSphericalMapping.
@@ -83,7 +83,7 @@ API changes, most recent first:
 2017-02-11 - e3af49b14b - lavu 55.47.100 - frame.h
   Add AVFrame.opaque_ref.
 
-2017-01-31 - 2eab48177d - lavu 55.46.100 / 55.20.0 - cpu.h
+2017-01-31 - xxxxxxx - lavu 55.46.100 / 55.20.0 - cpu.h
   Add AV_CPU_FLAG_SSSE3SLOW.
 
 2017-01-24 - c4618f842a - lavu 55.45.100 - channel_layout.h
@@ -96,20 +96,20 @@ API changes, most recent first:
   Deprecate struct vaapi_context and the vaapi.h installed header.
   Callers should set AVCodecContext.hw_frames_ctx instead.
 
-2017-01-12 - dbe9dbed31 - lavfi 6.69.100 - buffersink.h
+2017-01-12 - dbe9dbed31 - lavfi 6.69.100- buffersink.h
   Add av_buffersink_get_*() functions.
 
-2017-01-06 - 9488032e10 - lavf 57.62.100 - avio.h
+2017-01-06 - 9488032e10 - lavf 57.62.100- avio.h
   Add avio_get_dyn_buf()
 
-2016-12-10 - f542b152aa - lavu 55.43.100 - imgutils.h
+2016-12-10 - xxxxxxx - lavu xx.xx.100- imgutils.h
   Add av_image_check_size2()
 
-2016-12-07 - e7a6f8c972 - lavc 57.67.100 / 57.29.0 - avcodec.h
+2016-xx-xx - xxxxxxx - lavc 57.67.100 / 57.29.0 - avcodec.h
   Add AV_PKT_DATA_SPHERICAL packet side data to export AVSphericalMapping
   information from containers.
 
-2016-12-07 - 8f58ecc344 - lavu 55.42.100 / 55.30.0 - spherical.h
+2016-xx-xx - xxxxxxx - lavu 55.42.100 / 55.30.0 - spherical.h
   Add AV_FRAME_DATA_SPHERICAL value, av_spherical_alloc() API and
   AVSphericalMapping type to export and describe spherical video properties.
 

doc/Doxyfile

@@ -38,7 +38,7 @@ PROJECT_NAME           = FFmpeg
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = 3.3.6
+PROJECT_NUMBER         =
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a

doc/demuxers.texi

@@ -300,24 +300,6 @@ used to end the output video at the length of the shortest input file,
 which in this case is @file{input.mp4} as the GIF in this example loops
 infinitely.
 
-@section hls
-
-HLS demuxer
-
-It accepts the following options:
-
-@table @option
-@item live_start_index
-segment index to start live streams at (negative values are from the end).
-
-@item allowed_extensions
-',' separated list of file extensions that hls is allowed to access.
-
-@item max_reload
-Maximum number of times a insufficient list is attempted to be reloaded.
-Default value is 1000.
-@end table
-
 @section image2
 
 Image file demuxer.

doc/developer.texi

@@ -131,11 +131,6 @@ designated struct initializers (@samp{struct s x = @{ .i = 17 @};});
 
 @item
 compound literals (@samp{x = (struct s) @{ 17, 23 @};}).
-
-@item
-Implementation defined behavior for signed integers is assumed to match the
-expected behavior for two's complement. Non representable values in integer
-casts are binary truncated. Shift right of signed values uses sign extension.
 @end itemize
 
 These features are supported by all compilers we care about, so we will not

doc/examples/decode_video.c

@@ -64,7 +64,7 @@ static int decode_write_frame(const char *outfilename, AVCodecContext *avctx,
         fflush(stdout);
 
         /* the picture is allocated by the decoder, no need to free it */
-        snprintf(buf, sizeof(buf), "%s-%d", outfilename, *frame_count);
+        snprintf(buf, sizeof(buf), outfilename, *frame_count);
         pgm_save(frame->data[0], frame->linesize[0],
                  frame->width, frame->height, buf);
         (*frame_count)++;

doc/filters.texi

@@ -8263,7 +8263,7 @@ It accepts the following parameters:
 @item filter_name
 The name of the frei0r effect to load. If the environment variable
 @env{FREI0R_PATH} is defined, the frei0r effect is searched for in each of the
-directories specified by the colon-separated list in @env{FREI0R_PATH}.
+directories specified by the colon-separated list in @env{FREIOR_PATH}.
 Otherwise, the standard frei0r paths are searched, in this order:
 @file{HOME/.frei0r-1/lib/}, @file{/usr/local/lib/frei0r-1/},
 @file{/usr/lib/frei0r-1/}.
@@ -12077,7 +12077,7 @@ uses the reference video instead of the main input as basis.
 
 @itemize
 @item
-Scale a subtitle stream (b) to match the main video (a) in size before overlaying
+Scale a subtitle stream to match the main video in size before overlaying
 @example
 'scale2ref[b][a];[a][b]overlay'
 @end example

doc/general.texi

@@ -188,7 +188,7 @@ For Linux and OS X, the supported AviSynth variant is
 
 @float NOTE
 There is currently a regression in AviSynth+'s @code{capi.h} header as of
-October 2016, which interferes with the ability for builds of FFmpeg to use
+October 2016, which interferes with the ability for builds of Libav to use
 MSVC-built binaries of AviSynth. Until this is resolved, you can make sure
 a known good version is installed by checking out a version from before
 the regression occurred:

ffmpeg.c

@@ -30,7 +30,6 @@
 #include <stdlib.h>
 #include <errno.h>
 #include <limits.h>
-#include <stdatomic.h>
 #include <stdint.h>
 
 #if HAVE_IO_H
@@ -320,7 +319,7 @@ void term_exit(void)
 
 static volatile int received_sigterm = 0;
 static volatile int received_nb_signals = 0;
-static atomic_int transcode_init_done = ATOMIC_VAR_INIT(0);
+static volatile int transcode_init_done = 0;
 static volatile int ffmpeg_exited = 0;
 static int main_return_code = 0;
 
@@ -458,7 +457,7 @@ static int read_key(void)
 
 static int decode_interrupt_cb(void *ctx)
 {
-    return received_nb_signals > atomic_load(&transcode_init_done);
+    return received_nb_signals > transcode_init_done;
 }
 
 const AVIOInterruptCB int_cb = { decode_interrupt_cb, NULL };
@@ -613,7 +612,7 @@ static void ffmpeg_cleanup(int ret)
     if (received_sigterm) {
         av_log(NULL, AV_LOG_INFO, "Exiting normally, received signal %d.\n",
                (int) received_sigterm);
-    } else if (ret && atomic_load(&transcode_init_done)) {
+    } else if (ret && transcode_init_done) {
         av_log(NULL, AV_LOG_INFO, "Conversion failed!\n");
     }
     term_exit();
@@ -669,28 +668,12 @@ static void close_all_output_streams(OutputStream *ost, OSTFinished this_stream,
     }
 }
 
-static void write_packet(OutputFile *of, AVPacket *pkt, OutputStream *ost, int unqueue)
+static void write_packet(OutputFile *of, AVPacket *pkt, OutputStream *ost)
 {
     AVFormatContext *s = of->ctx;
     AVStream *st = ost->st;
     int ret;
 
-    /*
-     * Audio encoders may split the packets --  #frames in != #packets out.
-     * But there is no reordering, so we can limit the number of output packets
-     * by simply dropping them here.
-     * Counting encoded video frames needs to be done separately because of
-     * reordering, see do_video_out().
-     * Do not count the packet when unqueued because it has been counted when queued.
-     */
-    if (!(st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO && ost->encoding_needed) && !unqueue) {
-        if (ost->frame_number >= ost->max_frames) {
-            av_packet_unref(pkt);
-            return;
-        }
-        ost->frame_number++;
-    }
-
     if (!of->header_written) {
         AVPacket tmp_pkt = {0};
         /* the muxer is not initialized yet, buffer the packet */
@@ -719,6 +702,20 @@ static void write_packet(OutputFile *of, AVPacket *pkt, OutputStream *ost, int u
         (st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO && audio_sync_method < 0))
         pkt->pts = pkt->dts = AV_NOPTS_VALUE;
 
+    /*
+     * Audio encoders may split the packets --  #frames in != #packets out.
+     * But there is no reordering, so we can limit the number of output packets
+     * by simply dropping them here.
+     * Counting encoded video frames needs to be done separately because of
+     * reordering, see do_video_out()
+     */
+    if (!(st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO && ost->encoding_needed)) {
+        if (ost->frame_number >= ost->max_frames) {
+            av_packet_unref(pkt);
+            return;
+        }
+        ost->frame_number++;
+    }
     if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO) {
         int i;
         uint8_t *sd = av_packet_get_side_data(pkt, AV_PKT_DATA_QUALITY_STATS,
@@ -863,10 +860,10 @@ static void output_packet(OutputFile *of, AVPacket *pkt, OutputStream *ost)
                     goto finish;
                 idx++;
             } else
-                write_packet(of, pkt, ost, 0);
+                write_packet(of, pkt, ost);
         }
     } else
-        write_packet(of, pkt, ost, 0);
+        write_packet(of, pkt, ost);
 
 finish:
     if (ret < 0 && ret != AVERROR_EOF) {
@@ -1906,6 +1903,8 @@ static void flush_encoders(void)
         if (enc->codec_type != AVMEDIA_TYPE_VIDEO && enc->codec_type != AVMEDIA_TYPE_AUDIO)
             continue;
 
+        avcodec_send_frame(enc, NULL);
+
         for (;;) {
             const char *desc = NULL;
             AVPacket pkt;
@@ -1927,17 +1926,7 @@ static void flush_encoders(void)
                 pkt.size = 0;
 
                 update_benchmark(NULL);
-
-                while ((ret = avcodec_receive_packet(enc, &pkt)) == AVERROR(EAGAIN)) {
-                    ret = avcodec_send_frame(enc, NULL);
-                    if (ret < 0) {
-                        av_log(NULL, AV_LOG_FATAL, "%s encoding failed: %s\n",
-                               desc,
-                               av_err2str(ret));
-                        exit_program(1);
-                    }
-                }
-
+                ret = avcodec_receive_packet(enc, &pkt);
                 update_benchmark("flush_%s %d.%d", desc, ost->file_index, ost->index);
                 if (ret < 0 && ret != AVERROR_EOF) {
                     av_log(NULL, AV_LOG_FATAL, "%s encoding failed: %s\n",
@@ -2973,7 +2962,7 @@ static int check_init_output_file(OutputFile *of, int file_index)
         while (av_fifo_size(ost->muxing_queue)) {
             AVPacket pkt;
             av_fifo_generic_read(ost->muxing_queue, &pkt, sizeof(pkt), NULL);
-            write_packet(of, &pkt, ost, 1);
+            write_packet(of, &pkt, ost);
         }
     }
 
@@ -3769,7 +3758,7 @@ static int transcode_init(void)
         return ret;
     }
 
-    atomic_store(&transcode_init_done, 1);
+    transcode_init_done = 1;
 
     return 0;
 }

ffmpeg.h

@@ -638,7 +638,6 @@ void choose_sample_fmt(AVStream *st, AVCodec *codec);
 
 int configure_filtergraph(FilterGraph *fg);
 int configure_output_filter(FilterGraph *fg, OutputFilter *ofilter, AVFilterInOut *out);
-void check_filter_outputs(void);
 int ist_in_filtergraph(FilterGraph *fg, InputStream *ist);
 int filtergraph_is_simple(FilterGraph *fg);
 int init_simple_filtergraph(InputStream *ist, OutputStream *ost);

ffmpeg_filter.c

@@ -678,21 +678,6 @@ int configure_output_filter(FilterGraph *fg, OutputFilter *ofilter, AVFilterInOu
     }
 }
 
-void check_filter_outputs(void)
-{
-    int i;
-    for (i = 0; i < nb_filtergraphs; i++) {
-        int n;
-        for (n = 0; n < filtergraphs[i]->nb_outputs; n++) {
-            OutputFilter *output = filtergraphs[i]->outputs[n];
-            if (!output->ost) {
-                av_log(NULL, AV_LOG_FATAL, "Filter %s has an unconnected output\n", output->name);
-                exit_program(1);
-            }
-        }
-    }
-}
-
 static int sub2video_prepare(InputStream *ist, InputFilter *ifilter)
 {
     AVFormatContext *avf = input_files[ist->file_index]->ctx;

ffmpeg_opt.c

@@ -3260,8 +3260,6 @@ int ffmpeg_parse_options(int argc, char **argv)
         goto fail;
     }
 
-    check_filter_outputs();
-
 fail:
     uninit_parse_context(&octx);
     if (ret < 0) {

ffprobe.c

@@ -1899,57 +1899,6 @@ static void print_pkt_side_data(WriterContext *w,
     writer_print_section_footer(w);
 }
 
-static void print_color_range(WriterContext *w, enum AVColorRange color_range, const char *fallback)
-{
-    const char *val = av_color_range_name(color_range);
-    if (!val || color_range == AVCOL_RANGE_UNSPECIFIED) {
-        print_str_opt("color_range", fallback);
-    } else {
-        print_str("color_range", val);
-    }
-}
-
-static void print_color_space(WriterContext *w, enum AVColorSpace color_space)
-{
-    const char *val = av_color_space_name(color_space);
-    if (!val || color_space == AVCOL_SPC_UNSPECIFIED) {
-        print_str_opt("color_space", "unknown");
-    } else {
-        print_str("color_space", val);
-    }
-}
-
-static void print_primaries(WriterContext *w, enum AVColorPrimaries color_primaries)
-{
-    const char *val = av_color_primaries_name(color_primaries);
-    if (!val || color_primaries == AVCOL_PRI_UNSPECIFIED) {
-        print_str_opt("color_primaries", "unknown");
-    } else {
-        print_str("color_primaries", val);
-    }
-}
-
-static void print_color_trc(WriterContext *w, enum AVColorTransferCharacteristic color_trc)
-{
-    const char *val = av_color_transfer_name(color_trc);
-    if (!val || color_trc == AVCOL_TRC_UNSPECIFIED) {
-        print_str_opt("color_transfer", "unknown");
-    } else {
-        print_str("color_transfer", val);
-    }
-}
-
-static void print_chroma_location(WriterContext *w, enum AVChromaLocation chroma_location)
-{
-    const char *val = av_chroma_location_name(chroma_location);
-    if (!val || chroma_location == AVCHROMA_LOC_UNSPECIFIED) {
-        print_str_opt("chroma_location", "unspecified");
-    } else {
-        print_str("chroma_location", val);
-    }
-}
-
-
 static void clear_log(int need_lock)
 {
     int i;
@@ -2457,12 +2406,29 @@ static int show_stream(WriterContext *w, AVFormatContext *fmt_ctx, int stream_id
         if (s) print_str    ("pix_fmt", s);
         else   print_str_opt("pix_fmt", "unknown");
         print_int("level",   par->level);
+        if (par->color_range != AVCOL_RANGE_UNSPECIFIED)
+            print_str    ("color_range", av_color_range_name(par->color_range));
+        else
+            print_str_opt("color_range", "N/A");
 
-        print_color_range(w, par->color_range, "N/A");
-        print_color_space(w, par->color_space);
-        print_color_trc(w, par->color_trc);
-        print_primaries(w, par->color_primaries);
-        print_chroma_location(w, par->chroma_location);
+        s = av_get_colorspace_name(par->color_space);
+        if (s) print_str    ("color_space", s);
+        else   print_str_opt("color_space", "unknown");
+
+        if (par->color_trc != AVCOL_TRC_UNSPECIFIED)
+            print_str("color_transfer", av_color_transfer_name(par->color_trc));
+        else
+            print_str_opt("color_transfer", av_color_transfer_name(par->color_trc));
+
+        if (par->color_primaries != AVCOL_PRI_UNSPECIFIED)
+            print_str("color_primaries", av_color_primaries_name(par->color_primaries));
+        else
+            print_str_opt("color_primaries", av_color_primaries_name(par->color_primaries));
+
+        if (par->chroma_location != AVCHROMA_LOC_UNSPECIFIED)
+            print_str("chroma_location", av_chroma_location_name(par->chroma_location));
+        else
+            print_str_opt("chroma_location", av_chroma_location_name(par->chroma_location));
 
         if (par->field_order == AV_FIELD_PROGRESSIVE)
             print_str("field_order", "progressive");
@@ -3476,6 +3442,8 @@ int main(int argc, char **argv)
         goto end;
     }
 #endif
+    av_log_set_callback(log_callback);
+
     av_log_set_flags(AV_LOG_SKIP_REPEATED);
     register_exit(ffprobe_cleanup);
 
@@ -3491,9 +3459,6 @@ int main(int argc, char **argv)
     show_banner(argc, argv, options);
     parse_options(NULL, argc, argv, options, opt_input_file);
 
-    if (do_show_log)
-        av_log_set_callback(log_callback);
-
     /* mark things to show, based on -show_entries */
     SET_DO_SHOW(CHAPTERS, chapters);
     SET_DO_SHOW(ERROR, error);

ffserver.c

@@ -476,7 +476,7 @@ static int compute_datarate(DataRateData *drd, int64_t count)
 static void start_children(FFServerStream *feed)
 {
     char *pathname;
-    char *dirname, *prog;
+    char *slash;
     int i;
     size_t cmd_length;
 
@@ -495,18 +495,22 @@ static void start_children(FFServerStream *feed)
         return;
     }
 
-   /* use "ffmpeg" in the path of current program. Ignore user provided path */
-    prog = av_strdup(my_program_name);
-    if (prog) {
-        dirname = av_dirname(prog);
-        pathname = *dirname ? av_asprintf("%s/%s", dirname, "ffmpeg")
-                            : av_asprintf("ffmpeg");
-        av_free(prog);
+    slash = strrchr(my_program_name, '/');
+    if (!slash) {
+        pathname = av_mallocz(sizeof("ffmpeg"));
+    } else {
+        pathname = av_mallocz(slash - my_program_name + sizeof("ffmpeg"));
+        if (pathname != NULL) {
+            memcpy(pathname, my_program_name, slash - my_program_name);
+        }
     }
-    if (!prog || !pathname) {
+    if (!pathname) {
         http_log("Could not allocate memory for children cmd line\n");
         return;
     }
+   /* use "ffmpeg" in the path of current program. Ignore user provided path */
+
+    strcat(pathname, "ffmpeg");
 
     for (; feed; feed = feed->next) {
 

libavcodec/Makefile

@@ -973,8 +973,7 @@ OBJS-$(CONFIG_AAC_ADTSTOASC_BSF)          += aac_adtstoasc_bsf.o aacadtsdec.o \
 OBJS-$(CONFIG_CHOMP_BSF)                  += chomp_bsf.o
 OBJS-$(CONFIG_DUMP_EXTRADATA_BSF)         += dump_extradata_bsf.o
 OBJS-$(CONFIG_DCA_CORE_BSF)               += dca_core_bsf.o
-OBJS-$(CONFIG_EXTRACT_EXTRADATA_BSF)      += extract_extradata_bsf.o    \
-                                             h2645_parse.o
+OBJS-$(CONFIG_EXTRACT_EXTRADATA_BSF)      += extract_extradata_bsf.o
 OBJS-$(CONFIG_H264_MP4TOANNEXB_BSF)       += h264_mp4toannexb_bsf.o
 OBJS-$(CONFIG_HEVC_MP4TOANNEXB_BSF)       += hevc_mp4toannexb_bsf.o
 OBJS-$(CONFIG_IMX_DUMP_HEADER_BSF)        += imx_dump_header_bsf.o

libavcodec/aac_adtstoasc_bsf.c

@@ -49,14 +49,14 @@ static int aac_adtstoasc_filter(AVBSFContext *bsfc, AVPacket *out)
     if (ret < 0)
         return ret;
 
-    if (bsfc->par_in->extradata && in->size >= 2 && (AV_RB16(in->data) >> 4) != 0xfff)
-        goto finish;
-
     if (in->size < AAC_ADTS_HEADER_SIZE)
         goto packet_too_small;
 
     init_get_bits(&gb, in->data, AAC_ADTS_HEADER_SIZE * 8);
 
+    if (bsfc->par_in->extradata && show_bits(&gb, 12) != 0xfff)
+        goto finish;
+
     if (avpriv_aac_parse_header(&gb, &hdr) < 0) {
         av_log(bsfc, AV_LOG_ERROR, "Error parsing ADTS frame header!\n");
         ret = AVERROR_INVALIDDATA;

libavcodec/aac_defines.h

@@ -35,7 +35,6 @@
 #define AAC_RENAME(x)       x ## _fixed
 #define AAC_RENAME_32(x)    x ## _fixed_32
 typedef int                 INTFLOAT;
-typedef unsigned            UINTFLOAT;  ///< Equivalent to INTFLOAT, Used as temporal cast to avoid undefined sign overflow operations.
 typedef int64_t             INT64FLOAT;
 typedef int16_t             SHORTFLOAT;
 typedef SoftFloat           AAC_FLOAT;
@@ -46,7 +45,7 @@ typedef int                 AAC_SIGNE;
 #define Q30(x)              (int)((x)*1073741824.0 + 0.5)
 #define Q31(x)              (int)((x)*2147483648.0 + 0.5)
 #define RANGE15(x)          x
-#define GET_GAIN(x, y)      (-(y) * (1 << (x))) + 1024
+#define GET_GAIN(x, y)      (-(y) << (x)) + 1024
 #define AAC_MUL16(x, y)     (int)(((int64_t)(x) * (y) + 0x8000) >> 16)
 #define AAC_MUL26(x, y)     (int)(((int64_t)(x) * (y) + 0x2000000) >> 26)
 #define AAC_MUL30(x, y)     (int)(((int64_t)(x) * (y) + 0x20000000) >> 30)
@@ -73,7 +72,7 @@ typedef int                 AAC_SIGNE;
 #define AAC_MSUB31_V3(x, y, z)    (int)((((int64_t)(x) * (z)) - \
                                       ((int64_t)(y) * (z)) + \
                                         0x40000000) >> 31)
-#define AAC_HALF_SUM(x, y)  (((x) >> 1) + ((y) >> 1))
+#define AAC_HALF_SUM(x, y)  (x) >> 1 + (y) >> 1
 #define AAC_SRA_R(x, y)     (int)(((x) + (1 << ((y) - 1))) >> (y))
 
 #else
@@ -84,7 +83,6 @@ typedef int                 AAC_SIGNE;
 #define AAC_RENAME(x)       x
 #define AAC_RENAME_32(x)    x
 typedef float               INTFLOAT;
-typedef float               UINTFLOAT;
 typedef float               INT64FLOAT;
 typedef float               SHORTFLOAT;
 typedef float               AAC_FLOAT;

libavcodec/aacdec.c

@@ -431,8 +431,6 @@ static int read_payload_length_info(struct LATMContext *ctx, GetBitContext *gb)
     if (ctx->frame_length_type == 0) {
         int mux_slot_length = 0;
         do {
-            if (get_bits_left(gb) < 8)
-                return AVERROR_INVALIDDATA;
             tmp = get_bits(gb, 8);
             mux_slot_length += tmp;
         } while (tmp == 255);
@@ -462,7 +460,7 @@ static int read_audio_mux_element(struct LATMContext *latmctx,
     }
     if (latmctx->audio_mux_version_A == 0) {
         int mux_slot_length_bytes = read_payload_length_info(latmctx, gb);
-        if (mux_slot_length_bytes < 0 || mux_slot_length_bytes * 8LL > get_bits_left(gb)) {
+        if (mux_slot_length_bytes * 8 > get_bits_left(gb)) {
             av_log(latmctx->aac_ctx.avctx, AV_LOG_ERROR, "incomplete frame\n");
             return AVERROR_INVALIDDATA;
         } else if (mux_slot_length_bytes * 8 + 256 < get_bits_left(gb)) {

libavcodec/aacdec_fixed.c

@@ -125,7 +125,7 @@ static inline int *DEC_SQUAD(int *dst, unsigned idx)
 static inline int *DEC_UPAIR(int *dst, unsigned idx, unsigned sign)
 {
     dst[0] = (idx & 15) * (1 - (sign & 0xFFFFFFFE));
-    dst[1] = (idx >> 4 & 15) * (1 - ((sign & 1) * 2));
+    dst[1] = (idx >> 4 & 15) * (1 - ((sign & 1) << 1));
 
     return dst + 2;
 }
@@ -134,16 +134,16 @@ static inline int *DEC_UQUAD(int *dst, unsigned idx, unsigned sign)
 {
     unsigned nz = idx >> 12;
 
-    dst[0] = (idx & 3) * (1 + (((int)sign >> 31) * 2));
+    dst[0] = (idx & 3) * (1 + (((int)sign >> 31) << 1));
     sign <<= nz & 1;
     nz >>= 1;
-    dst[1] = (idx >> 2 & 3) * (1 + (((int)sign >> 31) * 2));
+    dst[1] = (idx >> 2 & 3) * (1 + (((int)sign >> 31) << 1));
     sign <<= nz & 1;
     nz >>= 1;
-    dst[2] = (idx >> 4 & 3) * (1 + (((int)sign >> 31) * 2));
+    dst[2] = (idx >> 4 & 3) * (1 + (((int)sign >> 31) << 1));
     sign <<= nz & 1;
     nz >>= 1;
-    dst[3] = (idx >> 6 & 3) * (1 + (((int)sign >> 31) * 2));
+    dst[3] = (idx >> 6 & 3) * (1 + (((int)sign >> 31) << 1));
 
     return dst + 4;
 }
@@ -171,25 +171,20 @@ static void subband_scale(int *dst, int *src, int scale, int offset, int len)
 
     s = offset - (s >> 2);
 
-    if (s > 31) {
-        for (i=0; i<len; i++) {
-            dst[i] = 0;
-        }
-    } else if (s > 0) {
+    if (s > 0) {
         round = 1 << (s-1);
         for (i=0; i<len; i++) {
             out = (int)(((int64_t)src[i] * c) >> 32);
             dst[i] = ((int)(out+round) >> s) * ssign;
         }
-    } else if (s > -32) {
+    }
+    else {
         s = s + 32;
         round = 1 << (s-1);
         for (i=0; i<len; i++) {
             out = (int)((int64_t)((int64_t)src[i] * c + round) >> s);
-            dst[i] = out * (unsigned)ssign;
+            dst[i] = out * ssign;
         }
-    } else {
-        av_log(NULL, AV_LOG_ERROR, "Overflow in subband_scale()\n");
     }
 }
 
@@ -208,12 +203,8 @@ static void noise_scale(int *coefs, int scale, int band_energy, int len)
     c /= band_energy;
     s = 21 + nlz - (s >> 2);
 
-    if (s > 31) {
-        for (i=0; i<len; i++) {
-            coefs[i] = 0;
-        }
-    } else if (s >= 0) {
-        round = s ? 1 << (s-1) : 0;
+    if (s > 0) {
+        round = 1 << (s-1);
         for (i=0; i<len; i++) {
             out = (int)(((int64_t)coefs[i] * c) >> 32);
             coefs[i] = ((int)(out+round) >> s) * ssign;
@@ -305,12 +296,8 @@ static av_always_inline void predict(PredictorState *ps, int *coef,
     if (output_enable) {
         int shift = 28 - pv.exp;
 
-        if (shift < 31) {
-            if (shift > 0) {
-                *coef += (unsigned)((pv.mant + (1 << (shift - 1))) >> shift);
-            } else
-                *coef += (unsigned)pv.mant << -shift;
-        }
+        if (shift < 31)
+            *coef += (pv.mant + (1 << (shift - 1))) >> shift;
     }
 
     e0 = av_int2sf(*coef, 2);
@@ -375,9 +362,7 @@ static void apply_dependent_coupling_fixed(AACContext *ac,
                     shift = (gain-1024) >> 3;
                 }
 
-                if (shift < -31) {
-                    // Nothing to do
-                } else if (shift < 0) {
+                if (shift < 0) {
                     shift = -shift;
                     round = 1 << (shift - 1);
 
@@ -394,7 +379,7 @@ static void apply_dependent_coupling_fixed(AACContext *ac,
                         for (k = offsets[i]; k < offsets[i + 1]; k++) {
                             tmp = (int)(((int64_t)src[group * 128 + k] * c + \
                                         (int64_t)0x1000000000) >> 37);
-                            dest[group * 128 + k] += tmp * (1U << shift);
+                            dest[group * 128 + k] += tmp << shift;
                         }
                     }
                 }
@@ -434,7 +419,7 @@ static void apply_independent_coupling_fixed(AACContext *ac,
     else {
       for (i = 0; i < len; i++) {
           tmp = (int)(((int64_t)src[i] * c + (int64_t)0x1000000000) >> 37);
-          dest[i] += tmp * (1 << shift);
+          dest[i] += tmp << shift;
       }
     }
 }

libavcodec/aacdec_template.c

@@ -406,15 +406,11 @@ static uint64_t sniff_channel_order(uint8_t (*layout_map)[3], int tags)
 /**
  * Save current output configuration if and only if it has been locked.
  */
-static int push_output_configuration(AACContext *ac) {
-    int pushed = 0;
-
+static void push_output_configuration(AACContext *ac) {
     if (ac->oc[1].status == OC_LOCKED || ac->oc[0].status == OC_NONE) {
         ac->oc[0] = ac->oc[1];
-        pushed = 1;
     }
     ac->oc[1].status = OC_NONE;
-    return pushed;
 }
 
 /**
@@ -1281,8 +1277,6 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics,
     const MPEG4AudioConfig *const m4ac = &ac->oc[1].m4ac;
     const int aot = m4ac->object_type;
     const int sampling_index = m4ac->sampling_index;
-    int ret_fail = AVERROR_INVALIDDATA;
-
     if (aot != AOT_ER_AAC_ELD) {
         if (get_bits1(gb)) {
             av_log(ac->avctx, AV_LOG_ERROR, "Reserved bit set.\n");
@@ -1333,10 +1327,8 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics,
                 ics->num_swb       =    ff_aac_num_swb_512[sampling_index];
                 ics->tns_max_bands =  ff_tns_max_bands_512[sampling_index];
             }
-            if (!ics->num_swb || !ics->swb_offset) {
-                ret_fail = AVERROR_BUG;
-                goto fail;
-            }
+            if (!ics->num_swb || !ics->swb_offset)
+                return AVERROR_BUG;
         } else {
             ics->swb_offset    =    ff_swb_offset_1024[sampling_index];
             ics->num_swb       =   ff_aac_num_swb_1024[sampling_index];
@@ -1360,8 +1352,7 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics,
                 if (aot == AOT_ER_AAC_LD) {
                     av_log(ac->avctx, AV_LOG_ERROR,
                            "LTP in ER AAC LD not yet implemented.\n");
-                    ret_fail = AVERROR_PATCHWELCOME;
-                    goto fail;
+                    return AVERROR_PATCHWELCOME;
                 }
                 if ((ics->ltp.present = get_bits(gb, 1)))
                     decode_ltp(&ics->ltp, gb, ics->max_sfb);
@@ -1380,7 +1371,7 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics,
     return 0;
 fail:
     ics->max_sfb = 0;
-    return ret_fail;
+    return AVERROR_INVALIDDATA;
 }
 
 /**
@@ -1967,17 +1958,16 @@ static int decode_ics(AACContext *ac, SingleChannelElement *sce,
     global_gain = get_bits(gb, 8);
 
     if (!common_window && !scale_flag) {
-        ret = decode_ics_info(ac, ics, gb);
-        if (ret < 0)
-            goto fail;
+        if (decode_ics_info(ac, ics, gb) < 0)
+            return AVERROR_INVALIDDATA;
     }
 
     if ((ret = decode_band_types(ac, sce->band_type,
                                  sce->band_type_run_end, gb, ics)) < 0)
-        goto fail;
+        return ret;
     if ((ret = decode_scalefactors(ac, sce->sf, gb, global_gain, ics,
                                   sce->band_type, sce->band_type_run_end)) < 0)
-        goto fail;
+        return ret;
 
     pulse_present = 0;
     if (!scale_flag) {
@@ -1985,48 +1975,37 @@ static int decode_ics(AACContext *ac, SingleChannelElement *sce,
             if (ics->window_sequence[0] == EIGHT_SHORT_SEQUENCE) {
                 av_log(ac->avctx, AV_LOG_ERROR,
                        "Pulse tool not allowed in eight short sequence.\n");
-                ret = AVERROR_INVALIDDATA;
-                goto fail;
+                return AVERROR_INVALIDDATA;
             }
             if (decode_pulses(&pulse, gb, ics->swb_offset, ics->num_swb)) {
                 av_log(ac->avctx, AV_LOG_ERROR,
                        "Pulse data corrupt or invalid.\n");
-                ret = AVERROR_INVALIDDATA;
-                goto fail;
+                return AVERROR_INVALIDDATA;
             }
         }
         tns->present = get_bits1(gb);
-        if (tns->present && !er_syntax) {
-            ret = decode_tns(ac, tns, gb, ics);
-            if (ret < 0)
-                goto fail;
-        }
+        if (tns->present && !er_syntax)
+            if (decode_tns(ac, tns, gb, ics) < 0)
+                return AVERROR_INVALIDDATA;
         if (!eld_syntax && get_bits1(gb)) {
             avpriv_request_sample(ac->avctx, "SSR");
-            ret = AVERROR_PATCHWELCOME;
-            goto fail;
+            return AVERROR_PATCHWELCOME;
         }
         // I see no textual basis in the spec for this occurring after SSR gain
         // control, but this is what both reference and real implmentations do
-        if (tns->present && er_syntax) {
-            ret = decode_tns(ac, tns, gb, ics);
-            if (ret < 0)
-                goto fail;
-        }
+        if (tns->present && er_syntax)
+            if (decode_tns(ac, tns, gb, ics) < 0)
+                return AVERROR_INVALIDDATA;
     }
 
-    ret = decode_spectrum_and_dequant(ac, out, gb, sce->sf, pulse_present,
-                                    &pulse, ics, sce->band_type);
-    if (ret < 0)
-        goto fail;
+    if (decode_spectrum_and_dequant(ac, out, gb, sce->sf, pulse_present,
+                                    &pulse, ics, sce->band_type) < 0)
+        return AVERROR_INVALIDDATA;
 
     if (ac->oc[1].m4ac.object_type == AOT_AAC_MAIN && !common_window)
         apply_prediction(ac, sce);
 
     return 0;
-fail:
-    tns->present = 0;
-    return ret;
 }
 
 /**
@@ -2198,11 +2177,7 @@ static int decode_cce(AACContext *ac, GetBitContext *gb, ChannelElement *che)
     coup->coupling_point += get_bits1(gb) || (coup->coupling_point >> 1);
 
     sign  = get_bits(gb, 1);
-#if USE_FIXED
-    scale = get_bits(gb, 2);
-#else
-    scale = cce_scale[get_bits(gb, 2)];
-#endif
+    scale = AAC_RENAME(cce_scale)[get_bits(gb, 2)];
 
     if ((ret = decode_ics(ac, sce, gb, 0, 0)))
         return ret;
@@ -2216,10 +2191,6 @@ static int decode_cce(AACContext *ac, GetBitContext *gb, ChannelElement *che)
             cge = coup->coupling_point == AFTER_IMDCT ? 1 : get_bits1(gb);
             gain = cge ? get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60: 0;
             gain_cache = GET_GAIN(scale, gain);
-#if USE_FIXED
-            if ((abs(gain_cache)-1024) >> 3 > 30)
-                return AVERROR(ERANGE);
-#endif
         }
         if (coup->coupling_point == AFTER_IMDCT) {
             coup->gain[c][0] = gain_cache;
@@ -2237,10 +2208,6 @@ static int decode_cce(AACContext *ac, GetBitContext *gb, ChannelElement *che)
                                     t >>= 1;
                                 }
                                 gain_cache = GET_GAIN(scale, t) * s;
-#if USE_FIXED
-                                if ((abs(gain_cache)-1024) >> 3 > 30)
-                                    return AVERROR(ERANGE);
-#endif
                             }
                         }
                         coup->gain[c][idx] = gain_cache;
@@ -2414,7 +2381,7 @@ static int decode_extension_payload(AACContext *ac, GetBitContext *gb, int cnt,
  * @param   decode  1 if tool is used normally, 0 if tool is used in LTP.
  * @param   coef    spectral coefficients
  */
-static void apply_tns(INTFLOAT coef_param[1024], TemporalNoiseShaping *tns,
+static void apply_tns(INTFLOAT coef[1024], TemporalNoiseShaping *tns,
                       IndividualChannelStream *ics, int decode)
 {
     const int mmm = FFMIN(ics->tns_max_bands, ics->max_sfb);
@@ -2422,7 +2389,6 @@ static void apply_tns(INTFLOAT coef_param[1024], TemporalNoiseShaping *tns,
     int bottom, top, order, start, end, size, inc;
     INTFLOAT lpc[TNS_MAX_ORDER];
     INTFLOAT tmp[TNS_MAX_ORDER+1];
-    UINTFLOAT *coef = coef_param;
 
     for (w = 0; w < ics->num_windows; w++) {
         bottom = ics->num_swb;
@@ -2452,7 +2418,7 @@ static void apply_tns(INTFLOAT coef_param[1024], TemporalNoiseShaping *tns,
                 // ar filter
                 for (m = 0; m < size; m++, start += inc)
                     for (i = 1; i <= FFMIN(m, order); i++)
-                        coef[start] -= AAC_MUL26((INTFLOAT)coef[start - i * inc], lpc[i - 1]);
+                        coef[start] -= AAC_MUL26(coef[start - i * inc], lpc[i - 1]);
             } else {
                 // ma filter
                 for (m = 0; m < size; m++, start += inc) {
@@ -3060,13 +3026,7 @@ static int aac_decode_frame_int(AVCodecContext *avctx, void *data,
         case TYPE_PCE: {
             uint8_t layout_map[MAX_ELEM_ID*4][3];
             int tags;
-
-            int pushed = push_output_configuration(ac);
-            if (pce_found && !pushed) {
-                err = AVERROR_INVALIDDATA;
-                goto fail;
-            }
-
+            push_output_configuration(ac);
             tags = decode_pce(avctx, &ac->oc[1].m4ac, layout_map, gb,
                               payload_alignment);
             if (tags < 0) {

libavcodec/aacenc_ltp.c

@@ -74,8 +74,8 @@ void ff_aac_ltp_insert_new_frame(AACEncContext *s)
 
 static void get_lag(float *buf, const float *new, LongTermPrediction *ltp)
 {
-    int i, j, lag = 0, max_corr = 0;
-    float max_ratio = 0.0f;
+    int i, j, lag, max_corr = 0;
+    float max_ratio;
     for (i = 0; i < 2048; i++) {
         float corr, s0 = 0.0f, s1 = 0.0f;
         const int start = FFMAX(0, i - 1024);

libavcodec/aacps.c

@@ -499,13 +499,13 @@ static void map_idx_34_to_20(int8_t *par_mapped, const int8_t *par, int full)
 static void map_val_34_to_20(INTFLOAT par[PS_MAX_NR_IIDICC])
 {
 #if USE_FIXED
-    par[ 0] = (int)(((int64_t)(par[ 0] + (unsigned)(par[ 1]>>1)) * 1431655765 + \
+    par[ 0] = (int)(((int64_t)(par[ 0] + (par[ 1]>>1)) * 1431655765 + \
                       0x40000000) >> 31);
-    par[ 1] = (int)(((int64_t)((par[ 1]>>1) + (unsigned)par[ 2]) * 1431655765 + \
+    par[ 1] = (int)(((int64_t)((par[ 1]>>1) + par[ 2]) * 1431655765 + \
                       0x40000000) >> 31);
-    par[ 2] = (int)(((int64_t)(par[ 3] + (unsigned)(par[ 4]>>1)) * 1431655765 + \
+    par[ 2] = (int)(((int64_t)(par[ 3] + (par[ 4]>>1)) * 1431655765 + \
                       0x40000000) >> 31);
-    par[ 3] = (int)(((int64_t)((par[ 4]>>1) + (unsigned)par[ 5]) * 1431655765 + \
+    par[ 3] = (int)(((int64_t)((par[ 4]>>1) + par[ 5]) * 1431655765 + \
                       0x40000000) >> 31);
 #else
     par[ 0] = (2*par[ 0] +   par[ 1]) * 0.33333333f;
@@ -692,17 +692,26 @@ static void decorrelation(PSContext *ps, INTFLOAT (*out)[32][2], const INTFLOAT
     for (i = 0; i < NR_PAR_BANDS[is34]; i++) {
         for (n = n0; n < nL; n++) {
             int decayed_peak;
+            int denom;
+
             decayed_peak = (int)(((int64_t)peak_decay_factor * \
                                            peak_decay_nrg[i] + 0x40000000) >> 31);
             peak_decay_nrg[i] = FFMAX(decayed_peak, power[i][n]);
-            power_smooth[i] += (power[i][n] + 2LL - power_smooth[i]) >> 2;
-            peak_decay_diff_smooth[i] += (peak_decay_nrg[i] + 2LL - power[i][n] - \
-                                          peak_decay_diff_smooth[i]) >> 2;
-
-            if (peak_decay_diff_smooth[i]) {
-                transient_gain[i][n] = FFMIN(power_smooth[i]*43691LL / peak_decay_diff_smooth[i], 1<<16);
-            } else
-                transient_gain[i][n] = 1 << 16;
+            power_smooth[i] += (power[i][n] - power_smooth[i] + 2) >> 2;
+            peak_decay_diff_smooth[i] += (peak_decay_nrg[i] - power[i][n] - \
+                                          peak_decay_diff_smooth[i] + 2) >> 2;
+            denom = peak_decay_diff_smooth[i] + (peak_decay_diff_smooth[i] >> 1);
+            if (denom > power_smooth[i]) {
+              int p = power_smooth[i];
+              while (denom < 0x40000000) {
+                denom <<= 1;
+                p <<= 1;
+              }
+              transient_gain[i][n] = p / (denom >> 16);
+            }
+            else {
+              transient_gain[i][n] = 1 << 16;
+            }
         }
     }
 #else
@@ -933,7 +942,7 @@ static void stereo_processing(PSContext *ps, INTFLOAT (*l)[32][2], INTFLOAT (*r)
             int stop  = ps->border_position[e+1];
             INTFLOAT width = Q30(1.f) / ((stop - start) ? (stop - start) : 1);
 #if USE_FIXED
-            width = FFMIN(2U*width, INT_MAX);
+            width <<= 1;
 #endif
             b = k_to_i[k];
             h[0][0] = H11[0][e][b];
@@ -966,7 +975,7 @@ static void stereo_processing(PSContext *ps, INTFLOAT (*l)[32][2], INTFLOAT (*r)
                 h_step[1][3] = AAC_MSUB31_V3(H22[1][e+1][b], h[1][3], width);
             }
             ps->dsp.stereo_interpolate[!PS_BASELINE && ps->enable_ipdopd](
-                l[k] + 1 + start, r[k] + 1 + start,
+                l[k] + start + 1, r[k] + start + 1,
                 h, h_step, stop - start);
         }
     }

libavcodec/aacpsdsp_template.c

@@ -129,12 +129,12 @@ static void ps_decorrelate_c(INTFLOAT (*out)[2], INTFLOAT (*delay)[2],
             INTFLOAT apd_im = in_im;
             in_re = AAC_MSUB30(link_delay_re, fractional_delay_re,
                     link_delay_im, fractional_delay_im);
-            in_re -= (UINTFLOAT)a_re;
+            in_re -= a_re;
             in_im = AAC_MADD30(link_delay_re, fractional_delay_im,
                     link_delay_im, fractional_delay_re);
-            in_im -= (UINTFLOAT)a_im;
-            ap_delay[m][n+5][0] = apd_re + (UINTFLOAT)AAC_MUL31(ag[m], in_re);
-            ap_delay[m][n+5][1] = apd_im + (UINTFLOAT)AAC_MUL31(ag[m], in_im);
+            in_im -= a_im;
+            ap_delay[m][n+5][0] = apd_re + AAC_MUL31(ag[m], in_re);
+            ap_delay[m][n+5][1] = apd_im + AAC_MUL31(ag[m], in_im);
         }
         out[n][0] = AAC_MUL16(transient_gain[n], in_re);
         out[n][1] = AAC_MUL16(transient_gain[n], in_im);

libavcodec/aacsbr_fixed.c

@@ -288,8 +288,6 @@ static void sbr_hf_inverse_filter(SBRDSPContext *dsp,
         shift = a00.exp;
         if (shift >= 3)
             alpha0[k][0] = 0x7fffffff;
-        else if (shift <= -30)
-            alpha0[k][0] = 0;
         else {
             a00.mant <<= 1;
             shift = 2-shift;
@@ -304,8 +302,6 @@ static void sbr_hf_inverse_filter(SBRDSPContext *dsp,
         shift = a01.exp;
         if (shift >= 3)
             alpha0[k][1] = 0x7fffffff;
-        else if (shift <= -30)
-            alpha0[k][1] = 0;
         else {
             a01.mant <<= 1;
             shift = 2-shift;
@@ -319,8 +315,6 @@ static void sbr_hf_inverse_filter(SBRDSPContext *dsp,
         shift = a10.exp;
         if (shift >= 3)
             alpha1[k][0] = 0x7fffffff;
-        else if (shift <= -30)
-            alpha1[k][0] = 0;
         else {
             a10.mant <<= 1;
             shift = 2-shift;
@@ -335,8 +329,6 @@ static void sbr_hf_inverse_filter(SBRDSPContext *dsp,
         shift = a11.exp;
         if (shift >= 3)
             alpha1[k][1] = 0x7fffffff;
-        else if (shift <= -30)
-            alpha1[k][1] = 0;
         else {
             a11.mant <<= 1;
             shift = 2-shift;
@@ -437,7 +429,6 @@ static void sbr_gain_calc(AACContext *ac, SpectralBandReplication *sbr,
                                                 av_add_sf(FLOAT_1, sbr->e_curr[e][m]),
                                                 av_add_sf(FLOAT_1, sbr->q_mapped[e][m]))));
                 }
-                sbr->gain[e][m] = av_add_sf(sbr->gain[e][m], FLOAT_MIN);
             }
             for (m = sbr->f_tablelim[k] - sbr->kx[1]; m < sbr->f_tablelim[k + 1] - sbr->kx[1]; m++) {
                 sum[0] = av_add_sf(sum[0], sbr->e_origmapped[e][m]);
@@ -576,33 +567,20 @@ static void sbr_hf_assemble(int Y1[38][64][2],
 
                 SoftFloat *in  = sbr->s_m[e];
                 for (m = 0; m+1 < m_max; m+=2) {
-                    int shift2;
-                    shift = 22 - in[m  ].exp;
-                    shift2= 22 - in[m+1].exp;
-                    if (shift < 1 || shift2 < 1) {
-                        av_log(NULL, AV_LOG_ERROR, "Overflow in sbr_hf_assemble, shift=%d,%d\n", shift, shift2);
-                        return;
-                    }
-                    if (shift < 32) {
-                        round = 1 << (shift-1);
-                        out[2*m  ] += (in[m  ].mant * A + round) >> shift;
-                    }
+                  shift = 22 - in[m  ].exp;
+                  round = 1 << (shift-1);
+                  out[2*m  ] += (in[m  ].mant * A + round) >> shift;
 
-                    if (shift2 < 32) {
-                        round = 1 << (shift2-1);
-                        out[2*m+2] += (in[m+1].mant * B + round) >> shift2;
-                    }
+                  shift = 22 - in[m+1].exp;
+                  round = 1 << (shift-1);
+                  out[2*m+2] += (in[m+1].mant * B + round) >> shift;
                 }
                 if(m_max&1)
                 {
-                    shift = 22 - in[m  ].exp;
-                    if (shift < 1) {
-                        av_log(NULL, AV_LOG_ERROR, "Overflow in sbr_hf_assemble, shift=%d\n", shift);
-                        return;
-                    } else if (shift < 32) {
-                        round = 1 << (shift-1);
-                        out[2*m  ] += (in[m  ].mant * A + round) >> shift;
-                    }
+                  shift = 22 - in[m  ].exp;
+                  round = 1 << (shift-1);
+
+                  out[2*m  ] += (in[m  ].mant * A + round) >> shift;
                 }
             }
             indexnoise = (indexnoise + m_max) & 0x1ff;

libavcodec/aacsbr_template.c

@@ -624,26 +624,24 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
     int abs_bord_trail = 16;
     int num_rel_lead, num_rel_trail;
     unsigned bs_num_env_old = ch_data->bs_num_env;
-    int bs_frame_class, bs_num_env;
 
     ch_data->bs_freq_res[0] = ch_data->bs_freq_res[ch_data->bs_num_env];
     ch_data->bs_amp_res = sbr->bs_amp_res_header;
     ch_data->t_env_num_env_old = ch_data->t_env[bs_num_env_old];
 
-    switch (bs_frame_class = get_bits(gb, 2)) {
+    switch (ch_data->bs_frame_class = get_bits(gb, 2)) {
     case FIXFIX:
-        bs_num_env = 1 << get_bits(gb, 2);
-        if (bs_num_env > 4) {
-            av_log(ac->avctx, AV_LOG_ERROR,
-                   "Invalid bitstream, too many SBR envelopes in FIXFIX type SBR frame: %d\n",
-                   bs_num_env);
-            return -1;
-        }
-        ch_data->bs_num_env = bs_num_env;
+        ch_data->bs_num_env                 = 1 << get_bits(gb, 2);
         num_rel_lead                        = ch_data->bs_num_env - 1;
         if (ch_data->bs_num_env == 1)
             ch_data->bs_amp_res = 0;
 
+        if (ch_data->bs_num_env > 4) {
+            av_log(ac->avctx, AV_LOG_ERROR,
+                   "Invalid bitstream, too many SBR envelopes in FIXFIX type SBR frame: %d\n",
+                   ch_data->bs_num_env);
+            return -1;
+        }
 
         ch_data->t_env[0]                   = 0;
         ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;
@@ -691,15 +689,14 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
         abs_bord_trail                     += get_bits(gb, 2);
         num_rel_lead                        = get_bits(gb, 2);
         num_rel_trail                       = get_bits(gb, 2);
-        bs_num_env                          = num_rel_lead + num_rel_trail + 1;
+        ch_data->bs_num_env                 = num_rel_lead + num_rel_trail + 1;
 
-        if (bs_num_env > 5) {
+        if (ch_data->bs_num_env > 5) {
             av_log(ac->avctx, AV_LOG_ERROR,
                    "Invalid bitstream, too many SBR envelopes in VARVAR type SBR frame: %d\n",
-                   bs_num_env);
+                   ch_data->bs_num_env);
             return -1;
         }
-        ch_data->bs_num_env = bs_num_env;
 
         ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;
 
@@ -714,7 +711,6 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
         get_bits1_vector(gb, ch_data->bs_freq_res + 1, ch_data->bs_num_env);
         break;
     }
-    ch_data->bs_frame_class = bs_frame_class;
 
     av_assert0(bs_pointer >= 0);
     if (bs_pointer > ch_data->bs_num_env + 1) {

libavcodec/aarch64/simple_idct_neon.S

@@ -61,37 +61,37 @@ endconst
         br              x10
 .endm
 
-.macro smull1 a, b, c
+.macro smull1 a b c
         smull           \a, \b, \c
 .endm
 
-.macro smlal1 a, b, c
+.macro smlal1 a b c
         smlal           \a, \b, \c
 .endm
 
-.macro smlsl1 a, b, c
+.macro smlsl1 a b c
         smlsl           \a, \b, \c
 .endm
 
-.macro idct_col4_top y1, y2, y3, y4, i, l
-        smull\i         v7.4S,  \y3\l, z2
-        smull\i         v16.4S, \y3\l, z6
-        smull\i         v17.4S, \y2\l, z1
+.macro idct_col4_top y1 y2 y3 y4 i l
+        smull\i         v7.4S,  \y3\().\l, z2
+        smull\i         v16.4S, \y3\().\l, z6
+        smull\i         v17.4S, \y2\().\l, z1
         add             v19.4S, v23.4S, v7.4S
-        smull\i         v18.4S, \y2\l, z3
+        smull\i         v18.4S, \y2\().\l, z3
         add             v20.4S, v23.4S, v16.4S
-        smull\i         v5.4S,  \y2\l, z5
+        smull\i         v5.4S,  \y2\().\l, z5
         sub             v21.4S, v23.4S, v16.4S
-        smull\i         v6.4S,  \y2\l, z7
+        smull\i         v6.4S,  \y2\().\l, z7
         sub             v22.4S, v23.4S, v7.4S
 
-        smlal\i         v17.4S, \y4\l, z3
-        smlsl\i         v18.4S, \y4\l, z7
-        smlsl\i         v5.4S,  \y4\l, z1
-        smlsl\i         v6.4S,  \y4\l, z5
+        smlal\i         v17.4S, \y4\().\l, z3
+        smlsl\i         v18.4S, \y4\().\l, z7
+        smlsl\i         v5.4S,  \y4\().\l, z1
+        smlsl\i         v6.4S,  \y4\().\l, z5
 .endm
 
-.macro idct_row4_neon y1, y2, y3, y4, pass
+.macro idct_row4_neon y1 y2 y3 y4 pass
         ld1             {\y1\().2D-\y2\().2D}, [x2], #32
         movi            v23.4S, #1<<2, lsl #8
         orr             v5.16B, \y1\().16B, \y2\().16B
@@ -101,7 +101,7 @@ endconst
         mov             x3, v5.D[1]
         smlal           v23.4S, \y1\().4H, z4
 
-        idct_col4_top   \y1, \y2, \y3, \y4, 1, .4H
+        idct_col4_top   \y1 \y2 \y3 \y4 1 4H
 
         cmp             x3, #0
         beq             \pass\()f
@@ -153,7 +153,7 @@ endconst
         trn2            \y4\().4S, v17.4S, v19.4S
 .endm
 
-.macro declare_idct_col4_neon i, l
+.macro declare_idct_col4_neon i l
 function idct_col4_neon\i
         dup             v23.4H, z4c
 .if \i == 1
@@ -164,14 +164,14 @@ function idct_col4_neon\i
 .endif
         smull           v23.4S, v23.4H, z4
 
-        idct_col4_top   v24, v25, v26, v27, \i, \l
+        idct_col4_top   v24 v25 v26 v27 \i \l
 
         mov             x4, v28.D[\i - 1]
         mov             x5, v29.D[\i - 1]
         cmp             x4, #0
         beq             1f
 
-        smull\i         v7.4S,  v28\l,  z4
+        smull\i         v7.4S,  v28.\l, z4
         add             v19.4S, v19.4S, v7.4S
         sub             v20.4S, v20.4S, v7.4S
         sub             v21.4S, v21.4S, v7.4S
@@ -181,17 +181,17 @@ function idct_col4_neon\i
         cmp             x5, #0
         beq             2f
 
-        smlal\i         v17.4S, v29\l, z5
-        smlsl\i         v18.4S, v29\l, z1
-        smlal\i         v5.4S,  v29\l, z7
-        smlal\i         v6.4S,  v29\l, z3
+        smlal\i         v17.4S, v29.\l, z5
+        smlsl\i         v18.4S, v29.\l, z1
+        smlal\i         v5.4S,  v29.\l, z7
+        smlal\i         v6.4S,  v29.\l, z3
 
 2:      mov             x5, v31.D[\i - 1]
         cmp             x4, #0
         beq             3f
 
-        smull\i         v7.4S,  v30\l, z6
-        smull\i         v16.4S, v30\l, z2
+        smull\i         v7.4S,  v30.\l, z6
+        smull\i         v16.4S, v30.\l, z2
         add             v19.4S, v19.4S, v7.4S
         sub             v22.4S, v22.4S, v7.4S
         sub             v20.4S, v20.4S, v16.4S
@@ -200,10 +200,10 @@ function idct_col4_neon\i
 3:      cmp             x5, #0
         beq             4f
 
-        smlal\i         v17.4S, v31\l, z7
-        smlsl\i         v18.4S, v31\l, z5
-        smlal\i         v5.4S,  v31\l, z3
-        smlsl\i         v6.4S,  v31\l, z1
+        smlal\i         v17.4S, v31.\l, z7
+        smlsl\i         v18.4S, v31.\l, z5
+        smlal\i         v5.4S,  v31.\l, z3
+        smlsl\i         v6.4S,  v31.\l, z1
 
 4:      addhn           v7.4H, v19.4S, v17.4S
         addhn2          v7.8H, v20.4S, v18.4S
@@ -219,14 +219,14 @@ function idct_col4_neon\i
 endfunc
 .endm
 
-declare_idct_col4_neon 1, .4H
-declare_idct_col4_neon 2, .8H
+declare_idct_col4_neon 1 4H
+declare_idct_col4_neon 2 8H
 
 function ff_simple_idct_put_neon, export=1
         idct_start      x2
 
-        idct_row4_neon  v24, v25, v26, v27, 1
-        idct_row4_neon  v28, v29, v30, v31, 2
+        idct_row4_neon  v24 v25 v26 v27 1
+        idct_row4_neon  v28 v29 v30 v31 2
         bl              idct_col4_neon1
 
         sqshrun         v1.8B,  v7.8H, #COL_SHIFT-16
@@ -263,8 +263,8 @@ endfunc
 function ff_simple_idct_add_neon, export=1
         idct_start      x2
 
-        idct_row4_neon  v24, v25, v26, v27, 1
-        idct_row4_neon  v28, v29, v30, v31, 2
+        idct_row4_neon  v24 v25 v26 v27 1
+        idct_row4_neon  v28 v29 v30 v31 2
         bl              idct_col4_neon1
 
         sshr            v1.8H, V7.8H, #COL_SHIFT-16
@@ -328,8 +328,8 @@ function ff_simple_idct_neon, export=1
         idct_start      x0
 
         mov             x2,  x0
-        idct_row4_neon  v24, v25, v26, v27, 1
-        idct_row4_neon  v28, v29, v30, v31, 2
+        idct_row4_neon  v24 v25 v26 v27 1
+        idct_row4_neon  v28 v29 v30 v31 2
         add             x2, x2, #-128
         bl              idct_col4_neon1
 

libavcodec/ac3dec.c

@@ -761,31 +761,30 @@ static void ac3_upmix_delay(AC3DecodeContext *s)
  * @param[in] default_band_struct default band structure table
  * @param[out] num_bands number of bands (optionally NULL)
  * @param[out] band_sizes array containing the number of bins in each band (optionally NULL)
- * @param[in,out] band_struct current band structure
  */
 static void decode_band_structure(GetBitContext *gbc, int blk, int eac3,
                                   int ecpl, int start_subband, int end_subband,
                                   const uint8_t *default_band_struct,
-                                  int *num_bands, uint8_t *band_sizes,
-                                  uint8_t *band_struct, int band_struct_size)
+                                  int *num_bands, uint8_t *band_sizes)
 {
     int subbnd, bnd, n_subbands, n_bands=0;
     uint8_t bnd_sz[22];
+    uint8_t coded_band_struct[22];
+    const uint8_t *band_struct;
 
     n_subbands = end_subband - start_subband;
 
-    if (!blk)
-        memcpy(band_struct, default_band_struct, band_struct_size);
-
-    av_assert0(band_struct_size >= start_subband + n_subbands);
-
-    band_struct += start_subband + 1;
-
     /* decode band structure from bitstream or use default */
     if (!eac3 || get_bits1(gbc)) {
         for (subbnd = 0; subbnd < n_subbands - 1; subbnd++) {
-            band_struct[subbnd] = get_bits1(gbc);
+            coded_band_struct[subbnd] = get_bits1(gbc);
         }
+        band_struct = coded_band_struct;
+    } else if (!blk) {
+        band_struct = &default_band_struct[start_subband+1];
+    } else {
+        /* no change in band structure */
+        return;
     }
 
     /* calculate number of bands and band sizes based on band structure.
@@ -864,8 +863,7 @@ static inline int spx_strategy(AC3DecodeContext *s, int blk)
                           start_subband, end_subband,
                           ff_eac3_default_spx_band_struct,
                           &s->num_spx_bands,
-                          s->spx_band_sizes,
-                          s->spx_band_struct, sizeof(s->spx_band_struct));
+                          s->spx_band_sizes);
     return 0;
 }
 
@@ -1002,8 +1000,7 @@ static inline int coupling_strategy(AC3DecodeContext *s, int blk,
         decode_band_structure(bc, blk, s->eac3, 0, cpl_start_subband,
                               cpl_end_subband,
                               ff_eac3_default_cpl_band_struct,
-                              &s->num_cpl_bands, s->cpl_band_sizes,
-                              s->cpl_band_struct, sizeof(s->cpl_band_struct));
+                              &s->num_cpl_bands, s->cpl_band_sizes);
     } else {
         /* coupling not in use */
         for (ch = 1; ch <= fbw_channels; ch++) {
@@ -1389,7 +1386,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk)
     for (ch = 1; ch <= s->channels; ch++) {
         int audio_channel = 0;
         INTFLOAT gain;
-        if (s->channel_mode == AC3_CHMODE_DUALMONO && ch <= 2)
+        if (s->channel_mode == AC3_CHMODE_DUALMONO)
             audio_channel = 2-ch;
         if (s->heavy_compression && s->compression_exists[audio_channel])
             gain = s->heavy_dynamic_range[audio_channel];

libavcodec/ac3dec.h

@@ -128,7 +128,6 @@ typedef struct AC3DecodeContext {
     int phase_flags_in_use;                 ///< phase flags in use                     (phsflginu)
     int phase_flags[AC3_MAX_CPL_BANDS];     ///< phase flags                            (phsflg)
     int num_cpl_bands;                      ///< number of coupling bands               (ncplbnd)
-    uint8_t cpl_band_struct[AC3_MAX_CPL_BANDS];
     uint8_t cpl_band_sizes[AC3_MAX_CPL_BANDS]; ///< number of coeffs in each coupling band
     int firstchincpl;                       ///< first channel in coupling
     int first_cpl_coords[AC3_MAX_CHANNELS]; ///< first coupling coordinates states      (firstcplcos)
@@ -145,7 +144,6 @@ typedef struct AC3DecodeContext {
     int spx_dst_start_freq;                     ///< spx starting frequency bin for copying (copystartmant)
                                                 ///< the copy region ends at the start of the spx region.
     int num_spx_bands;                          ///< number of spx bands                    (nspxbnds)
-    uint8_t spx_band_struct[SPX_MAX_BANDS];
     uint8_t spx_band_sizes[SPX_MAX_BANDS];      ///< number of bins in each spx band
     uint8_t first_spx_coords[AC3_MAX_CHANNELS]; ///< first spx coordinates states           (firstspxcos)
     INTFLOAT spx_noise_blend[AC3_MAX_CHANNELS][SPX_MAX_BANDS]; ///< spx noise blending factor  (nblendfact)

libavcodec/ac3dec_fixed.c

@@ -65,11 +65,11 @@ static void scale_coefs (
     int len)
 {
     int i, shift, round;
-    unsigned mul;
+    int16_t mul;
     int temp, temp1, temp2, temp3, temp4, temp5, temp6, temp7;
 
     mul = (dynrng & 0x1f) + 0x20;
-    shift = 4 - (sign_extend(dynrng, 9) >> 5);
+    shift = 4 - ((dynrng << 23) >> 28);
     if (shift > 0 ) {
       round = 1 << (shift-1);
       for (i=0; i<len; i+=8) {

libavcodec/acelp_pitch_delay.c

@@ -135,7 +135,7 @@ float ff_amr_set_fixed_gain(float fixed_gain_factor, float fixed_mean_energy,
         ff_exp10(0.05 *
               (avpriv_scalarproduct_float_c(pred_table, prediction_error, 4) +
                energy_mean)) /
-        sqrtf(fixed_mean_energy ? fixed_mean_energy : 1.0);
+        sqrtf(fixed_mean_energy);
 
     // update quantified prediction error energy history
     memmove(&prediction_error[0], &prediction_error[1],

libavcodec/amrwbdec.c

@@ -611,7 +611,7 @@ static float voice_factor(float *p_vector, float p_gain,
                                                           AMRWB_SFR_SIZE) *
                     f_gain * f_gain;
 
-    return (p_ener - f_ener) / (p_ener + f_ener + 0.01);
+    return (p_ener - f_ener) / (p_ener + f_ener);
 }
 
 /**

libavcodec/ansi.c

@@ -80,6 +80,10 @@ static av_cold int decode_init(AVCodecContext *avctx)
     AnsiContext *s = avctx->priv_data;
     avctx->pix_fmt = AV_PIX_FMT_PAL8;
 
+    s->frame = av_frame_alloc();
+    if (!s->frame)
+        return AVERROR(ENOMEM);
+
     /* defaults */
     s->font        = avpriv_vga16_font;
     s->font_height = 16;
@@ -94,11 +98,6 @@ static av_cold int decode_init(AVCodecContext *avctx)
         av_log(avctx, AV_LOG_ERROR, "Invalid dimensions %d %d\n", avctx->width, avctx->height);
         return AVERROR(EINVAL);
     }
-
-    s->frame = av_frame_alloc();
-    if (!s->frame)
-        return AVERROR(ENOMEM);
-
     return 0;
 }
 

libavcodec/apedec.c

@@ -1412,7 +1412,6 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data,
     int32_t *sample24;
     int i, ch, ret;
     int blockstodecode;
-    uint64_t decoded_buffer_size;
 
     /* this should never be negative, but bad things will happen if it is, so
        check it just to make sure. */
@@ -1468,7 +1467,7 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data,
                 skip_bits_long(&s->gb, offset);
         }
 
-        if (!nblocks || nblocks > INT_MAX / 2 / sizeof(*s->decoded_buffer) - 8) {
+        if (!nblocks || nblocks > INT_MAX) {
             av_log(avctx, AV_LOG_ERROR, "Invalid sample count: %"PRIu32".\n",
                    nblocks);
             return AVERROR_INVALIDDATA;
@@ -1494,9 +1493,8 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data,
         blockstodecode = s->samples;
 
     /* reallocate decoded sample buffer if needed */
-    decoded_buffer_size = 2LL * FFALIGN(blockstodecode, 8) * sizeof(*s->decoded_buffer);
-    av_assert0(decoded_buffer_size <= INT_MAX);
-    av_fast_malloc(&s->decoded_buffer, &s->decoded_size, decoded_buffer_size);
+    av_fast_malloc(&s->decoded_buffer, &s->decoded_size,
+                   2 * FFALIGN(blockstodecode, 8) * sizeof(*s->decoded_buffer));
     if (!s->decoded_buffer)
         return AVERROR(ENOMEM);
     memset(s->decoded_buffer, 0, s->decoded_size);

libavcodec/avcodec.h

@@ -1583,16 +1583,6 @@ enum AVPacketSideDataType {
      * to the AVSphericalMapping structure.
      */
     AV_PKT_DATA_SPHERICAL,
-
-    /**
-     * The number of side data elements (in fact a bit more than it).
-     * This is not part of the public API/ABI in the sense that it may
-     * change when new side data types are added.
-     * This must stay the last enum value.
-     * If its value becomes huge, some code using it
-     * needs to be updated as it assumes it to be smaller than other limits.
-     */
-    AV_PKT_DATA_NB
 };
 
 #define AV_PKT_DATA_QUALITY_FACTOR AV_PKT_DATA_QUALITY_STATS //DEPRECATED

libavcodec/avpacket.c

@@ -296,20 +296,9 @@ int av_packet_add_side_data(AVPacket *pkt, enum AVPacketSideDataType type,
                             uint8_t *data, size_t size)
 {
     AVPacketSideData *tmp;
-    int i, elems = pkt->side_data_elems;
+    int elems = pkt->side_data_elems;
 
-    for (i = 0; i < elems; i++) {
-        AVPacketSideData *sd = &pkt->side_data[i];
-
-        if (sd->type == type) {
-            av_free(sd->data);
-            sd->data = data;
-            sd->size = size;
-            return 0;
-        }
-    }
-
-    if ((unsigned)elems + 1 > AV_PKT_DATA_NB)
+    if ((unsigned)elems + 1 > INT_MAX / sizeof(*pkt->side_data))
         return AVERROR(ERANGE);
 
     tmp = av_realloc(pkt->side_data, (elems + 1) * sizeof(*tmp));
@@ -447,9 +436,6 @@ int av_packet_split_side_data(AVPacket *pkt){
             p-= size+5;
         }
 
-        if (i > AV_PKT_DATA_NB)
-            return AVERROR(ERANGE);
-
         pkt->side_data = av_malloc_array(i, sizeof(*pkt->side_data));
         if (!pkt->side_data)
             return AVERROR(ENOMEM);

libavcodec/bmp.c

@@ -133,11 +133,8 @@ static int bmp_decode_frame(AVCodecContext *avctx,
         alpha = bytestream_get_le32(&buf);
     }
 
-    ret = ff_set_dimensions(avctx, width, height > 0 ? height : -(unsigned)height);
-    if (ret < 0) {
-        av_log(avctx, AV_LOG_ERROR, "Failed to set dimensions %d %d\n", width, height);
-        return AVERROR_INVALIDDATA;
-    }
+    avctx->width  = width;
+    avctx->height = height > 0 ? height : -(unsigned)height;
 
     avctx->pix_fmt = AV_PIX_FMT_NONE;
 

libavcodec/bmvvideo.c

@@ -107,7 +107,7 @@ static int decode_bmv_frame(const uint8_t *source, int src_len, uint8_t *frame,
                     if (src < source || src >= source_end)
                         return AVERROR_INVALIDDATA;
                     shift += 2;
-                    val |= (unsigned)*src << shift;
+                    val |= *src << shift;
                     if (*src & 0xC)
                         break;
                 }

libavcodec/cavs.c

@@ -537,7 +537,8 @@ void ff_cavs_inter(AVSContext *h, enum cavs_mb mb_type)
 static inline void scale_mv(AVSContext *h, int *d_x, int *d_y,
                             cavs_vector *src, int distp)
 {
-    int64_t den = h->scale_den[FFMAX(src->ref, 0)];
+    int den = h->scale_den[FFMAX(src->ref, 0)];
+
     *d_x = (src->x * distp * den + 256 + FF_SIGNBIT(src->x)) >> 9;
     *d_y = (src->y * distp * den + 256 + FF_SIGNBIT(src->y)) >> 9;
 }
@@ -612,15 +613,8 @@ void ff_cavs_mv(AVSContext *h, enum cavs_mv_loc nP, enum cavs_mv_loc nC,
         mv_pred_median(h, mvP, mvA, mvB, mvC);
 
     if (mode < MV_PRED_PSKIP) {
-        int mx = get_se_golomb(&h->gb) + (unsigned)mvP->x;
-        int my = get_se_golomb(&h->gb) + (unsigned)mvP->y;
-
-        if (mx != (int16_t)mx || my != (int16_t)my) {
-            av_log(h->avctx, AV_LOG_ERROR, "MV %d %d out of supported range\n", mx, my);
-        } else {
-            mvP->x = mx;
-            mvP->y = my;
-        }
+        mvP->x += get_se_golomb(&h->gb);
+        mvP->y += get_se_golomb(&h->gb);
     }
     set_mvs(mvP, size);
 }

libavcodec/cavsdec.c

@@ -465,7 +465,7 @@ static inline void mv_pred_direct(AVSContext *h, cavs_vector *pmv_fw,
                                   cavs_vector *col_mv)
 {
     cavs_vector *pmv_bw = pmv_fw + MV_BWD_OFFS;
-    unsigned den = h->direct_den[col_mv->ref];
+    int den = h->direct_den[col_mv->ref];
     int m = FF_SIGNBIT(col_mv->x);
 
     pmv_fw->dist = h->dist[1];
@@ -615,7 +615,7 @@ static inline int decode_residual_inter(AVSContext *h)
 
     /* get quantizer */
     if (h->cbp && !h->qp_fixed)
-        h->qp = (h->qp + (unsigned)get_se_golomb(&h->gb)) & 63;
+        h->qp = (h->qp + get_se_golomb(&h->gb)) & 63;
     for (block = 0; block < 4; block++)
         if (h->cbp & (1 << block))
             decode_residual_block(h, &h->gb, inter_dec, 0, h->qp,
@@ -1031,10 +1031,6 @@ static int decode_pic(AVSContext *h)
     h->scale_den[1] = h->dist[1] ? 512/h->dist[1] : 0;
     if (h->cur.f->pict_type == AV_PICTURE_TYPE_B) {
         h->sym_factor = h->dist[0] * h->scale_den[1];
-        if (FFABS(h->sym_factor) > 32768) {
-            av_log(h->avctx, AV_LOG_ERROR, "sym_factor %d too large\n", h->sym_factor);
-            return AVERROR_INVALIDDATA;
-        }
     } else {
         h->direct_den[0] = h->dist[0] ? 16384 / h->dist[0] : 0;
         h->direct_den[1] = h->dist[1] ? 16384 / h->dist[1] : 0;

libavcodec/cdxl.c

@@ -275,11 +275,11 @@ static int cdxl_decode_frame(AVCodecContext *avctx, void *data,
     else
         aligned_width = FFALIGN(c->avctx->width, 16);
     c->padded_bits  = aligned_width - c->avctx->width;
-    if (c->video_size < aligned_width * avctx->height * (int64_t)c->bpp / 8)
+    if (c->video_size < aligned_width * avctx->height * c->bpp / 8)
         return AVERROR_INVALIDDATA;
-    if (!encoding && c->palette_size && c->bpp <= 8 && c->format != CHUNKY) {
+    if (!encoding && c->palette_size && c->bpp <= 8) {
         avctx->pix_fmt = AV_PIX_FMT_PAL8;
-    } else if (encoding == 1 && (c->bpp == 6 || c->bpp == 8) && c->format != CHUNKY) {
+    } else if (encoding == 1 && (c->bpp == 6 || c->bpp == 8)) {
         if (c->palette_size != (1 << (c->bpp - 1)))
             return AVERROR_INVALIDDATA;
         avctx->pix_fmt = AV_PIX_FMT_BGR24;

libavcodec/cfhd.c

@@ -258,11 +258,6 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
             s->coded_height = data;
         } else if (tag == 101) {
             av_log(avctx, AV_LOG_DEBUG, "Bits per component: %"PRIu16"\n", data);
-            if (data < 1 || data > 31) {
-                av_log(avctx, AV_LOG_ERROR, "Bits per component %d is invalid\n", data);
-                ret = AVERROR(EINVAL);
-                break;
-            }
             s->bpc = data;
         } else if (tag == 12) {
             av_log(avctx, AV_LOG_DEBUG, "Channel Count: %"PRIu16"\n", data);
@@ -322,22 +317,22 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
             s->prescale_shift[2] = (data >> 6) & 0x7;
             av_log(avctx, AV_LOG_DEBUG, "Prescale shift (VC-5): %x\n", data);
         } else if (tag == 27) {
+            s->plane[s->channel_num].band[0][0].width  = data;
+            s->plane[s->channel_num].band[0][0].stride = data;
             av_log(avctx, AV_LOG_DEBUG, "Lowpass width %"PRIu16"\n", data);
             if (data < 3 || data > s->plane[s->channel_num].band[0][0].a_width) {
                 av_log(avctx, AV_LOG_ERROR, "Invalid lowpass width\n");
                 ret = AVERROR(EINVAL);
                 break;
             }
-            s->plane[s->channel_num].band[0][0].width  = data;
-            s->plane[s->channel_num].band[0][0].stride = data;
         } else if (tag == 28) {
+            s->plane[s->channel_num].band[0][0].height = data;
             av_log(avctx, AV_LOG_DEBUG, "Lowpass height %"PRIu16"\n", data);
-            if (data < 3 || data > s->plane[s->channel_num].band[0][0].a_height) {
+            if (data < 3 || data > s->plane[s->channel_num].band[0][0].height) {
                 av_log(avctx, AV_LOG_ERROR, "Invalid lowpass height\n");
                 ret = AVERROR(EINVAL);
                 break;
             }
-            s->plane[s->channel_num].band[0][0].height = data;
         } else if (tag == 1)
             av_log(avctx, AV_LOG_DEBUG, "Sample type? %"PRIu16"\n", data);
         else if (tag == 10) {
@@ -368,39 +363,39 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
                 av_log(avctx, AV_LOG_DEBUG, "Tag/Value = %x %x\n", tag2, val2);
             }
         } else if (tag == 41) {
+            s->plane[s->channel_num].band[s->level][s->subband_num].width  = data;
+            s->plane[s->channel_num].band[s->level][s->subband_num].stride = FFALIGN(data, 8);
             av_log(avctx, AV_LOG_DEBUG, "Highpass width %i channel %i level %i subband %i\n", data, s->channel_num, s->level, s->subband_num);
             if (data < 3) {
                 av_log(avctx, AV_LOG_ERROR, "Invalid highpass width\n");
                 ret = AVERROR(EINVAL);
                 break;
             }
-            s->plane[s->channel_num].band[s->level][s->subband_num].width  = data;
-            s->plane[s->channel_num].band[s->level][s->subband_num].stride = FFALIGN(data, 8);
         } else if (tag == 42) {
+            s->plane[s->channel_num].band[s->level][s->subband_num].height = data;
             av_log(avctx, AV_LOG_DEBUG, "Highpass height %i\n", data);
             if (data < 3) {
                 av_log(avctx, AV_LOG_ERROR, "Invalid highpass height\n");
                 ret = AVERROR(EINVAL);
                 break;
             }
-            s->plane[s->channel_num].band[s->level][s->subband_num].height = data;
         } else if (tag == 49) {
+            s->plane[s->channel_num].band[s->level][s->subband_num].width  = data;
+            s->plane[s->channel_num].band[s->level][s->subband_num].stride = FFALIGN(data, 8);
             av_log(avctx, AV_LOG_DEBUG, "Highpass width2 %i\n", data);
             if (data < 3) {
                 av_log(avctx, AV_LOG_ERROR, "Invalid highpass width2\n");
                 ret = AVERROR(EINVAL);
                 break;
             }
-            s->plane[s->channel_num].band[s->level][s->subband_num].width  = data;
-            s->plane[s->channel_num].band[s->level][s->subband_num].stride = FFALIGN(data, 8);
         } else if (tag == 50) {
+            s->plane[s->channel_num].band[s->level][s->subband_num].height = data;
             av_log(avctx, AV_LOG_DEBUG, "Highpass height2 %i\n", data);
             if (data < 3) {
                 av_log(avctx, AV_LOG_ERROR, "Invalid highpass height2\n");
                 ret = AVERROR(EINVAL);
                 break;
             }
-            s->plane[s->channel_num].band[s->level][s->subband_num].height = data;
         } else if (tag == 71) {
             s->codebook = data;
             av_log(avctx, AV_LOG_DEBUG, "Codebook %i\n", s->codebook);
@@ -409,12 +404,12 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
             av_log(avctx, AV_LOG_DEBUG, "Other codebook? %i\n", s->codebook);
         } else if (tag == 70) {
             av_log(avctx, AV_LOG_DEBUG, "Subsampling or bit-depth flag? %i\n", data);
-            if (!(data == 10 || data == 12)) {
+            s->bpc = data;
+            if (!(s->bpc == 10 || s->bpc == 12)) {
                 av_log(avctx, AV_LOG_ERROR, "Invalid bits per channel\n");
                 ret = AVERROR(EINVAL);
                 break;
             }
-            s->bpc = data;
         } else if (tag == 84) {
             av_log(avctx, AV_LOG_DEBUG, "Sample format? %i\n", data);
             if (data == 1)
@@ -506,7 +501,7 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
             int highpass_a_width = s->plane[s->channel_num].band[s->level][s->subband_num].a_width;
             int highpass_a_height = s->plane[s->channel_num].band[s->level][s->subband_num].a_height;
             int highpass_stride = s->plane[s->channel_num].band[s->level][s->subband_num].stride;
-            int expected;
+            int expected = highpass_height * highpass_stride;
             int a_expected = highpass_a_height * highpass_a_width;
             int level, run, coeff;
             int count = 0, bytes;
@@ -517,12 +512,11 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
                 goto end;
             }
 
-            if (highpass_height > highpass_a_height || highpass_width > highpass_a_width || a_expected < highpass_height * (uint64_t)highpass_stride) {
+            if (highpass_height > highpass_a_height || highpass_width > highpass_a_width || a_expected < expected) {
                 av_log(avctx, AV_LOG_ERROR, "Too many highpass coefficients\n");
                 ret = AVERROR(EINVAL);
                 goto end;
             }
-            expected = highpass_height * highpass_stride;
 
             av_log(avctx, AV_LOG_DEBUG, "Start subband coeffs plane %i level %i codebook %i expected %i\n", s->channel_num, s->level, s->codebook, expected);
 
@@ -663,7 +657,7 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
             output = s->plane[plane].subband[0];
             for (i = 0; i < lowpass_height * 2; i++) {
                 for (j = 0; j < lowpass_width * 2; j++)
-                    output[j] *= 4;
+                    output[j] <<= 2;
 
                 output += lowpass_width * 2;
             }
@@ -716,7 +710,7 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
         output = s->plane[plane].subband[0];
         for (i = 0; i < lowpass_height * 2; i++) {
             for (j = 0; j < lowpass_width * 2; j++)
-                output[j] *= 4;
+                output[j] <<= 2;
 
             output += lowpass_width * 2;
         }

libavcodec/cinepak.c

@@ -322,6 +322,9 @@ static int cinepak_decode (CinepakContext *s)
     int           y0 = 0;
     int           encoded_buf_size;
 
+    if (s->size < 10)
+        return AVERROR_INVALIDDATA;
+
     frame_flags = s->data[0];
     num_strips  = AV_RB16 (&s->data[8]);
     encoded_buf_size = AV_RB24(&s->data[1]);
@@ -436,9 +439,6 @@ static int cinepak_decode_frame(AVCodecContext *avctx,
     s->data = buf;
     s->size = buf_size;
 
-    if (s->size < 10)
-        return AVERROR_INVALIDDATA;
-
     if ((ret = ff_reget_buffer(avctx, s->frame)) < 0)
         return ret;
 

libavcodec/clearvideo.c

@@ -185,8 +185,8 @@ static inline int decode_block(CLVContext *ctx, int16_t *blk, int has_ac,
     const int t3 = OP( 2408 * blk[5 * step] - 1609 * blk[3 * step]);    \
     const int t4 = OP( 1108 * blk[2 * step] - 2676 * blk[6 * step]);    \
     const int t5 = OP( 2676 * blk[2 * step] + 1108 * blk[6 * step]);    \
-    const int t6 = ((blk[0 * step] + blk[4 * step]) * (1 << dshift)) + bias;  \
-    const int t7 = ((blk[0 * step] - blk[4 * step]) * (1 << dshift)) + bias;  \
+    const int t6 = ((blk[0 * step] + blk[4 * step]) << dshift) + bias;  \
+    const int t7 = ((blk[0 * step] - blk[4 * step]) << dshift) + bias;  \
     const int t8 = t0 + t2;                                             \
     const int t9 = t0 - t2;                                             \
     const int tA = 181 * (t9 + (t1 - t3)) + 0x80 >> 8;                  \
@@ -297,11 +297,6 @@ static int clv_decode_frame(AVCodecContext *avctx, void *data,
     c->pic->pict_type = frame_type & 0x20 ? AV_PICTURE_TYPE_I : AV_PICTURE_TYPE_P;
 
     if (frame_type & 0x2) {
-        if (buf_size < c->mb_width * c->mb_height) {
-            av_log(avctx, AV_LOG_ERROR, "Packet too small\n");
-            return AVERROR_INVALIDDATA;
-        }
-
         bytestream2_get_be32(&gb); // frame size;
         c->ac_quant        = bytestream2_get_byte(&gb);
         c->luma_dc_quant   = 32;

libavcodec/cllc.c

@@ -29,10 +29,6 @@
 #include "avcodec.h"
 #include "internal.h"
 
-#define VLC_BITS 7
-#define VLC_DEPTH 2
-
-
 typedef struct CLLCContext {
     AVCodecContext *avctx;
     BswapDSPContext bdsp;
@@ -55,13 +51,6 @@ static int read_code_table(CLLCContext *ctx, GetBitContext *gb, VLC *vlc)
 
     num_lens = get_bits(gb, 5);
 
-    if (num_lens > VLC_BITS * VLC_DEPTH) {
-        vlc->table = NULL;
-
-        av_log(ctx->avctx, AV_LOG_ERROR, "To long VLCs %d\n", num_lens);
-        return AVERROR_INVALIDDATA;
-    }
-
     for (i = 0; i < num_lens; i++) {
         num_codes      = get_bits(gb, 9);
         num_codes_sum += num_codes;
@@ -81,15 +70,11 @@ static int read_code_table(CLLCContext *ctx, GetBitContext *gb, VLC *vlc)
 
             count++;
         }
-        if (prefix > (65535 - 256)/2) {
-            vlc->table = NULL;
-            return AVERROR_INVALIDDATA;
-        }
 
         prefix <<= 1;
     }
 
-    return ff_init_vlc_sparse(vlc, VLC_BITS, count, bits, 1, 1,
+    return ff_init_vlc_sparse(vlc, 7, count, bits, 1, 1,
                               codes, 2, 2, symbols, 1, 1, 0);
 }
 
@@ -116,7 +101,7 @@ static int read_argb_line(CLLCContext *ctx, GetBitContext *gb, int *top_left,
     for (i = 0; i < ctx->avctx->width; i++) {
         /* Always get the alpha component */
         UPDATE_CACHE(bits, gb);
-        GET_VLC(code, bits, gb, vlc[0].table, VLC_BITS, VLC_DEPTH);
+        GET_VLC(code, bits, gb, vlc[0].table, 7, 2);
 
         pred[0] += code;
         dst[0]   = pred[0];
@@ -125,21 +110,21 @@ static int read_argb_line(CLLCContext *ctx, GetBitContext *gb, int *top_left,
         if (dst[0]) {
             /* Red */
             UPDATE_CACHE(bits, gb);
-            GET_VLC(code, bits, gb, vlc[1].table, VLC_BITS, VLC_DEPTH);
+            GET_VLC(code, bits, gb, vlc[1].table, 7, 2);
 
             pred[1] += code;
             dst[1]   = pred[1];
 
             /* Green */
             UPDATE_CACHE(bits, gb);
-            GET_VLC(code, bits, gb, vlc[2].table, VLC_BITS, VLC_DEPTH);
+            GET_VLC(code, bits, gb, vlc[2].table, 7, 2);
 
             pred[2] += code;
             dst[2]   = pred[2];
 
             /* Blue */
             UPDATE_CACHE(bits, gb);
-            GET_VLC(code, bits, gb, vlc[3].table, VLC_BITS, VLC_DEPTH);
+            GET_VLC(code, bits, gb, vlc[3].table, 7, 2);
 
             pred[3] += code;
             dst[3]   = pred[3];
@@ -181,7 +166,7 @@ static int read_rgb24_component_line(CLLCContext *ctx, GetBitContext *gb,
     /* Simultaneously read and restore the line */
     for (i = 0; i < ctx->avctx->width; i++) {
         UPDATE_CACHE(bits, gb);
-        GET_VLC(code, bits, gb, vlc->table, VLC_BITS, VLC_DEPTH);
+        GET_VLC(code, bits, gb, vlc->table, 7, 2);
 
         pred  += code;
         dst[0] = pred;
@@ -210,7 +195,7 @@ static int read_yuv_component_line(CLLCContext *ctx, GetBitContext *gb,
     /* Simultaneously read and restore the line */
     for (i = 0; i < ctx->avctx->width >> is_chroma; i++) {
         UPDATE_CACHE(bits, gb);
-        GET_VLC(code, bits, gb, vlc->table, VLC_BITS, VLC_DEPTH);
+        GET_VLC(code, bits, gb, vlc->table, 7, 2);
 
         pred     += code;
         outbuf[i] = pred;

libavcodec/cngdec.c

@@ -147,7 +147,7 @@ static int cng_decode_frame(AVCodecContext *avctx, void *data,
         return ret;
     buf_out = (int16_t *)frame->data[0];
     for (i = 0; i < avctx->frame_size; i++)
-        buf_out[i] = av_clip_int16(p->filter_out[i + p->order]);
+        buf_out[i] = p->filter_out[i + p->order];
     memcpy(p->filter_out, p->filter_out + avctx->frame_size,
            p->order * sizeof(*p->filter_out));
 

libavcodec/dcadsp.c

@@ -320,7 +320,7 @@ static void dmix_sub_c(int32_t *dst, const int32_t *src, int coeff, ptrdiff_t le
     int i;
 
     for (i = 0; i < len; i++)
-        dst[i] -= (unsigned)mul15(src[i], coeff);
+        dst[i] -= mul15(src[i], coeff);
 }
 
 static void dmix_add_c(int32_t *dst, const int32_t *src, int coeff, ptrdiff_t len)

libavcodec/dds.c

@@ -39,7 +39,7 @@
 
 #define DDPF_FOURCC    (1 <<  2)
 #define DDPF_PALETTE   (1 <<  5)
-#define DDPF_NORMALMAP (1U << 31)
+#define DDPF_NORMALMAP (1 << 31)
 
 enum DDSPostProc {
     DDS_NONE = 0,
@@ -687,7 +687,7 @@ static int dds_decode(AVCodecContext *avctx, void *data,
                     (frame->data[1][2+i*4]<<0)+
                     (frame->data[1][1+i*4]<<8)+
                     (frame->data[1][0+i*4]<<16)+
-                    ((unsigned)frame->data[1][3+i*4]<<24)
+                    (frame->data[1][3+i*4]<<24)
             );
         }
         frame->palette_has_changed = 1;
@@ -718,7 +718,7 @@ static int dds_decode(AVCodecContext *avctx, void *data,
                         (frame->data[1][2+i*4]<<0)+
                         (frame->data[1][1+i*4]<<8)+
                         (frame->data[1][0+i*4]<<16)+
-                        ((unsigned)frame->data[1][3+i*4]<<24)
+                        (frame->data[1][3+i*4]<<24)
                 );
 
             frame->palette_has_changed = 1;

libavcodec/dfa.c

@@ -67,8 +67,7 @@ static int decode_tsw1(GetByteContext *gb, uint8_t *frame, int width, int height
     const uint8_t *frame_start = frame;
     const uint8_t *frame_end   = frame + width * height;
     int mask = 0x10000, bitbuf = 0;
-    int v, count;
-    unsigned segments;
+    int v, count, segments;
     unsigned offset;
 
     segments = bytestream2_get_le32(gb);
@@ -176,7 +175,7 @@ static int decode_dds1(GetByteContext *gb, uint8_t *frame, int width, int height
                 return AVERROR_INVALIDDATA;
             frame += v;
         } else {
-            if (frame_end - frame < width + 4)
+            if (frame_end - frame < width + 3)
                 return AVERROR_INVALIDDATA;
             frame[0] = frame[1] =
             frame[width] = frame[width + 1] =  bytestream2_get_byte(gb);
@@ -250,7 +249,7 @@ static int decode_wdlt(GetByteContext *gb, uint8_t *frame, int width, int height
         segments = bytestream2_get_le16u(gb);
         while ((segments & 0xC000) == 0xC000) {
             unsigned skip_lines = -(int16_t)segments;
-            int64_t delta = -((int16_t)segments * (int64_t)width);
+            unsigned delta = -((int16_t)segments * width);
             if (frame_end - frame <= delta || y + lines + skip_lines > height)
                 return AVERROR_INVALIDDATA;
             frame    += delta;

libavcodec/dirac_dwt.h

@@ -93,16 +93,16 @@ void ff_spatial_idwt_slice2(DWTContext *d, int y);
 
 // shared stuff for simd optimizations
 #define COMPOSE_53iL0(b0, b1, b2)\
-    (b1 - ((int)(b0 + (unsigned)(b2) + 2) >> 2))
+    (b1 - ((b0 + b2 + 2) >> 2))
 
 #define COMPOSE_DIRAC53iH0(b0, b1, b2)\
-    (b1 + ((int)(b0 + (unsigned)(b2) + 1) >> 1))
+    (b1 + ((b0 + b2 + 1) >> 1))
 
 #define COMPOSE_DD97iH0(b0, b1, b2, b3, b4)\
-    (int)(((unsigned)(b2) + ((int)(-b0 + 9U*b1 + 9U*b3 - b4 + 8) >> 4)))
+    (b2 + ((-b0 + 9*b1 + 9*b3 - b4 + 8) >> 4))
 
 #define COMPOSE_DD137iL0(b0, b1, b2, b3, b4)\
-    (int)(((unsigned)(b2) - ((int)(-b0 + 9U*b1 + 9U*b3 - b4 + 16) >> 5)))
+    (b2 - ((-b0 + 9*b1 + 9*b3 - b4 + 16) >> 5))
 
 #define COMPOSE_HAARiL0(b0, b1)\
     (b0 - ((b1 + 1) >> 1))
@@ -111,22 +111,22 @@ void ff_spatial_idwt_slice2(DWTContext *d, int y);
     (b0 + b1)
 
 #define COMPOSE_FIDELITYiL0(b0, b1, b2, b3, b4, b5, b6, b7, b8)\
-    ((unsigned)b4 - ((int)(-8*(b0+(unsigned)b8) + 21*(b1+(unsigned)b7) - 46*(b2+(unsigned)b6) + 161*(b3+(unsigned)b5) + 128) >> 8))
+    (b4 - ((-8*(b0+b8) + 21*(b1+b7) - 46*(b2+b6) + 161*(b3+b5) + 128) >> 8))
 
 #define COMPOSE_FIDELITYiH0(b0, b1, b2, b3, b4, b5, b6, b7, b8)\
-    ((unsigned)b4 + ((int)(-2*(b0+(unsigned)b8) + 10*(b1+(unsigned)b7) - 25*(b2+(unsigned)b6) +  81*(b3+(unsigned)b5) + 128) >> 8))
+    (b4 + ((-2*(b0+b8) + 10*(b1+b7) - 25*(b2+b6) + 81*(b3+b5) + 128) >> 8))
 
 #define COMPOSE_DAUB97iL1(b0, b1, b2)\
-    ((unsigned)(b1) - ((int)(1817*(b0 + (unsigned)b2) + 2048) >> 12))
+    (b1 - ((1817*(b0 + b2) + 2048) >> 12))
 
 #define COMPOSE_DAUB97iH1(b0, b1, b2)\
-    ((unsigned)(b1) - ((int)( 113*(b0 + (unsigned)b2) + 64) >> 7))
+    (b1 - (( 113*(b0 + b2) + 64) >> 7))
 
 #define COMPOSE_DAUB97iL0(b0, b1, b2)\
-    ((unsigned)(b1) + ((int)( 217*(b0 + (unsigned)b2) + 2048) >> 12))
+    (b1 + (( 217*(b0 + b2) + 2048) >> 12))
 
 #define COMPOSE_DAUB97iH0(b0, b1, b2)\
-    ((unsigned)(b1) + ((int)(6497*(b0 + (unsigned)b2) + 2048) >> 12))
+    (b1 + ((6497*(b0 + b2) + 2048) >> 12))
 
 
 #endif /* AVCODEC_DWT_H */

libavcodec/dirac_dwt_template.c

@@ -49,7 +49,7 @@ static void RENAME(vertical_compose53iL0)(uint8_t *_b0, uint8_t *_b1, uint8_t *_
     TYPE *b1 = (TYPE *)_b1;
     TYPE *b2 = (TYPE *)_b2;
     for (i = 0; i < width; i++)
-        b1[i] -= (int)(b0[i] + (unsigned)b2[i] + 2) >> 2;
+        b1[i] -= (b0[i] + b2[i] + 2) >> 2;
 }
 
 static av_always_inline void RENAME(interleave)(TYPE *dst, TYPE *src0, TYPE *src1, int w2,

libavcodec/dirac_vlc.c

@@ -37,7 +37,7 @@
 
 #define APPEND_RESIDUE(N, M)                                                   \
     N          |= M >> (N ## _bits);                                           \
-    N ## _bits  = (N ## _bits + (M ## _bits)) & 0x3F
+    N ## _bits +=      (M ## _bits)
 
 int ff_dirac_golomb_read_32bit(DiracGolombLUT *lut_ctx, const uint8_t *buf,
                                int bytes, uint8_t *_dst, int coeffs)
@@ -216,14 +216,9 @@ static void generate_offset_lut(DiracGolombLUT *lut, int off)
         INIT_RESIDUE(res);
         SET_RESIDUE(res, idx, LUT_BITS);
 
+        l->preamble      = CONVERT_TO_RESIDUE(res >> (RSIZE_BITS - off), off);
         l->preamble_bits = off;
-        if (off) {
-            l->preamble  = CONVERT_TO_RESIDUE(res >> (RSIZE_BITS - off), off);
-            l->sign      = ((l->preamble >> (RSIZE_BITS - l->preamble_bits)) & 1) ? -1 : +1;
-        } else {
-            l->preamble  = 0;
-            l->sign = 1;
-        }
+        l->sign = ((l->preamble >> (RSIZE_BITS - l->preamble_bits)) & 1) ? -1 : +1;
 
         search_for_golomb(l, res << off, LUT_BITS - off);
     }

libavcodec/diracdec.c

@@ -249,7 +249,7 @@ enum dirac_subband {
 /* magic number division by 3 from schroedinger */
 static inline int divide3(int x)
 {
-    return (int)((x+1U)*21845 + 10922) >> 16;
+    return ((x+1)*21845 + 10922) >> 16;
 }
 
 static DiracFrame *remove_frame(DiracFrame *framelist[], int picnum)
@@ -442,7 +442,7 @@ static av_cold int dirac_decode_end(AVCodecContext *avctx)
 static inline int coeff_unpack_golomb(GetBitContext *gb, int qfactor, int qoffset)
 {
     int coeff = dirac_get_se_golomb(gb);
-    const unsigned sign = FFSIGN(coeff);
+    const int sign = FFSIGN(coeff);
     if (coeff)
         coeff = sign*((sign * coeff * qfactor + qoffset) >> 2);
     return coeff;
@@ -454,8 +454,7 @@ static inline int coeff_unpack_golomb(GetBitContext *gb, int qfactor, int qoffse
     static inline void coeff_unpack_arith_##n(DiracArith *c, int qfactor, int qoffset, \
                                               SubBand *b, type *buf, int x, int y) \
     { \
-        int sign, sign_pred = 0, pred_ctx = CTX_ZPZN_F1; \
-        unsigned coeff; \
+        int coeff, sign, sign_pred = 0, pred_ctx = CTX_ZPZN_F1; \
         const int mstride = -(b->stride >> (1+b->pshift)); \
         if (b->parent) { \
             const type *pbuf = (type *)b->parent->ibuf; \
@@ -586,7 +585,7 @@ static inline void codeblock(DiracContext *s, SubBand *b,
     } \
 
 INTRA_DC_PRED(8, int16_t)
-INTRA_DC_PRED(10, uint32_t)
+INTRA_DC_PRED(10, int32_t)
 
 /**
  * Dirac Specification ->
@@ -824,7 +823,7 @@ static int decode_hq_slice(DiracContext *s, DiracSlice *slice, uint8_t *tmp_buf)
     skip_bits_long(gb, 8*s->highquality.prefix_bytes);
     quant_idx = get_bits(gb, 8);
 
-    if (quant_idx > DIRAC_MAX_QUANT_INDEX - 1) {
+    if (quant_idx > DIRAC_MAX_QUANT_INDEX) {
         av_log(s->avctx, AV_LOG_ERROR, "Invalid quantization index - %i\n", quant_idx);
         return AVERROR_INVALIDDATA;
     }
@@ -1161,10 +1160,6 @@ static int dirac_unpack_prediction_parameters(DiracContext *s)
                 s->globalmc[ref].perspective[0]  = dirac_get_se_golomb(gb);
                 s->globalmc[ref].perspective[1]  = dirac_get_se_golomb(gb);
             }
-            if (s->globalmc[ref].perspective_exp + (uint64_t)s->globalmc[ref].zrs_exp > 30) {
-                return AVERROR_INVALIDDATA;
-            }
-
         }
     }
 
@@ -1183,11 +1178,6 @@ static int dirac_unpack_prediction_parameters(DiracContext *s)
 
     if (get_bits1(gb)) {
         s->weight_log2denom = get_interleaved_ue_golomb(gb);
-        if (s->weight_log2denom < 1 || s->weight_log2denom > 8) {
-            av_log(s->avctx, AV_LOG_ERROR, "weight_log2denom unsupported or invalid\n");
-            s->weight_log2denom = 1;
-            return AVERROR_INVALIDDATA;
-        }
         s->weight[0] = dirac_get_se_golomb(gb);
         if (s->num_refs == 2)
             s->weight[1] = dirac_get_se_golomb(gb);
@@ -1422,7 +1412,7 @@ static void decode_block_params(DiracContext *s, DiracArith arith[8], DiracBlock
     if (!block->ref) {
         pred_block_dc(block, stride, x, y);
         for (i = 0; i < 3; i++)
-            block->u.dc[i] += (unsigned)dirac_get_arith_int(arith+1+i, CTX_DC_F1, CTX_DC_DATA);
+            block->u.dc[i] += dirac_get_arith_int(arith+1+i, CTX_DC_F1, CTX_DC_DATA);
         return;
     }
 
@@ -2057,9 +2047,9 @@ static int get_delayed_pic(DiracContext *s, AVFrame *picture, int *got_frame)
 
     if (out) {
         out->reference ^= DELAYED_PIC_REF;
+        *got_frame = 1;
         if((ret = av_frame_ref(picture, out->avframe)) < 0)
             return ret;
-        *got_frame = 1;
     }
 
     return 0;

libavcodec/diracdsp.c

@@ -159,10 +159,10 @@ static void put_signed_rect_clamped_ ## PX ## bit_c(uint8_t *_dst, int dst_strid
     int32_t *src = (int32_t *)_src;                                                                     \
     for (y = 0; y < height; y++) {                                                                      \
         for (x = 0; x < width; x+=4) {                                                                  \
-            dst[x  ] = av_clip_uintp2(src[x  ] + (1U << (PX - 1)), PX);                                  \
-            dst[x+1] = av_clip_uintp2(src[x+1] + (1U << (PX - 1)), PX);                                  \
-            dst[x+2] = av_clip_uintp2(src[x+2] + (1U << (PX - 1)), PX);                                  \
-            dst[x+3] = av_clip_uintp2(src[x+3] + (1U << (PX - 1)), PX);                                  \
+            dst[x  ] = av_clip_uintp2(src[x  ] + (1 << (PX - 1)), PX);                                  \
+            dst[x+1] = av_clip_uintp2(src[x+1] + (1 << (PX - 1)), PX);                                  \
+            dst[x+2] = av_clip_uintp2(src[x+2] + (1 << (PX - 1)), PX);                                  \
+            dst[x+3] = av_clip_uintp2(src[x+3] + (1 << (PX - 1)), PX);                                  \
         }                                                                                               \
         dst += dst_stride >> 1;                                                                         \
         src += src_stride >> 2;                                                                         \
@@ -199,7 +199,7 @@ static void dequant_subband_ ## PX ## _c(uint8_t *src, uint8_t *dst, ptrdiff_t s
         for (i = 0; i < tot_h; i++) {                                                      \
             c = *src_r++;                                                                  \
             sign = FFSIGN(c)*(!!c);                                                        \
-            c = (FFABS(c)*(unsigned)qf + qs) >> 2;                                                   \
+            c = (FFABS(c)*qf + qs) >> 2;                                                   \
             *dst_r++ = c*sign;                                                             \
         }                                                                                  \
         src += tot_h << (sizeof(PX) >> 1);                                                 \

libavcodec/dnxhd_parser.c

@@ -29,6 +29,8 @@
 
 typedef struct {
     ParseContext pc;
+    int interlaced;
+    int cur_field; /* first field is 0, second is 1 */
     int cur_byte;
     int remaining;
     int w, h;
@@ -54,6 +56,8 @@ static int dnxhd_find_frame_end(DNXHDParserContext *dctx,
     uint64_t state = pc->state64;
     int pic_found = pc->frame_start_found;
     int i = 0;
+    int interlaced = dctx->interlaced;
+    int cur_field = dctx->cur_field;
 
     if (!pic_found) {
         for (i = 0; i < buf_size; i++) {
@@ -61,6 +65,8 @@ static int dnxhd_find_frame_end(DNXHDParserContext *dctx,
             if (ff_dnxhd_check_header_prefix(state & 0xffffffffff00LL) != 0) {
                 i++;
                 pic_found = 1;
+                interlaced = (state&2)>>1; /* byte following the 5-byte header prefix */
+                cur_field = state&1;
                 dctx->cur_byte = 0;
                 dctx->remaining = 0;
                 break;
@@ -81,23 +87,23 @@ static int dnxhd_find_frame_end(DNXHDParserContext *dctx,
                 dctx->w = (state >> 32) & 0xFFFF;
             } else if (dctx->cur_byte == 42) {
                 int cid = (state >> 32) & 0xFFFFFFFF;
-                int remaining;
 
                 if (cid <= 0)
                     continue;
 
-                remaining = avpriv_dnxhd_get_frame_size(cid);
-                if (remaining <= 0) {
-                    remaining = dnxhd_get_hr_frame_size(cid, dctx->w, dctx->h);
-                    if (remaining <= 0)
-                        continue;
+                dctx->remaining = avpriv_dnxhd_get_frame_size(cid);
+                if (dctx->remaining <= 0) {
+                    dctx->remaining = dnxhd_get_hr_frame_size(cid, dctx->w, dctx->h);
+                    if (dctx->remaining <= 0)
+                        return dctx->remaining;
                 }
-                dctx->remaining = remaining;
-                if (buf_size - i + 47 >= dctx->remaining) {
+                if (buf_size - i >= dctx->remaining && (!dctx->interlaced || dctx->cur_field)) {
                     int remaining = dctx->remaining;
 
                     pc->frame_start_found = 0;
                     pc->state64 = -1;
+                    dctx->interlaced = interlaced;
+                    dctx->cur_field = 0;
                     dctx->cur_byte = 0;
                     dctx->remaining = 0;
                     return remaining;
@@ -114,6 +120,8 @@ static int dnxhd_find_frame_end(DNXHDParserContext *dctx,
 
             pc->frame_start_found = 0;
             pc->state64 = -1;
+            dctx->interlaced = interlaced;
+            dctx->cur_field = 0;
             dctx->cur_byte = 0;
             dctx->remaining = 0;
             return remaining;
@@ -121,6 +129,8 @@ static int dnxhd_find_frame_end(DNXHDParserContext *dctx,
     }
     pc->frame_start_found = pic_found;
     pc->state64 = state;
+    dctx->interlaced = interlaced;
+    dctx->cur_field = cur_field;
     return END_NOT_FOUND;
 }
 

libavcodec/dnxhddec.c

@@ -298,18 +298,14 @@ static int dnxhd_decode_header(DNXHDContext *ctx, AVFrame *frame,
     if (ctx->mb_height > 68 && ff_dnxhd_check_header_prefix_hr(header_prefix)) {
         ctx->data_offset = 0x170 + (ctx->mb_height << 2);
     } else {
-        if (ctx->mb_height > 68) {
+        if (ctx->mb_height > 68 ||
+            (ctx->mb_height << frame->interlaced_frame) > (ctx->height + 15) >> 4) {
             av_log(ctx->avctx, AV_LOG_ERROR,
                    "mb height too big: %d\n", ctx->mb_height);
             return AVERROR_INVALIDDATA;
         }
         ctx->data_offset = 0x280;
     }
-    if ((ctx->mb_height << frame->interlaced_frame) > (ctx->height + 15) >> 4) {
-        av_log(ctx->avctx, AV_LOG_ERROR,
-                "mb height too big: %d\n", ctx->mb_height);
-        return AVERROR_INVALIDDATA;
-    }
 
     if (buf_size < ctx->data_offset) {
         av_log(ctx->avctx, AV_LOG_ERROR,

libavcodec/dss_sp.c

@@ -33,7 +33,7 @@
 
 #define DSS_SP_FRAME_SIZE        42
 #define DSS_SP_SAMPLE_COUNT     (66 * SUBFRAMES)
-#define DSS_SP_FORMULA(a, b, c) ((int)((((a) * (1 << 15)) + (b) * (unsigned)(c)) + 0x4000) >> 15)
+#define DSS_SP_FORMULA(a, b, c) (((((a) << 15) + (b) * (c)) + 0x4000) >> 15)
 
 typedef struct DssSpSubframe {
     int16_t gain;
@@ -499,7 +499,7 @@ static void dss_sp_scale_vector(int32_t *vec, int bits, int size)
             vec[i] = vec[i] >> -bits;
     else
         for (i = 0; i < size; i++)
-            vec[i] = vec[i] * (1 << bits);
+            vec[i] = vec[i] << bits;
 }
 
 static void dss_sp_update_buf(int32_t *hist, int32_t *vector)
@@ -524,12 +524,12 @@ static void dss_sp_shift_sq_sub(const int32_t *filter_buf,
         tmp = dst[a] * filter_buf[0];
 
         for (i = 14; i > 0; i--)
-            tmp -= error_buf[i] * (unsigned)filter_buf[i];
+            tmp -= error_buf[i] * filter_buf[i];
 
         for (i = 14; i > 0; i--)
             error_buf[i] = error_buf[i - 1];
 
-        tmp = (int)(tmp + 4096U) >> 13;
+        tmp = (tmp + 4096) >> 13;
 
         error_buf[1] = tmp;
 

libavcodec/dvbsubdec.c

@@ -24,7 +24,6 @@
 #include "bytestream.h"
 #include "internal.h"
 #include "libavutil/colorspace.h"
-#include "libavutil/imgutils.h"
 #include "libavutil/opt.h"
 
 #define DVBSUB_PAGE_SEGMENT     0x10
@@ -1160,9 +1159,9 @@ static int dvbsub_parse_clut_segment(AVCodecContext *avctx,
                 return AVERROR_INVALIDDATA;
         }
 
-        if (depth & 0x80 && entry_id < 4)
+        if (depth & 0x80)
             clut->clut4[entry_id] = RGBA(r,g,b,255 - alpha);
-        else if (depth & 0x40 && entry_id < 16)
+        else if (depth & 0x40)
             clut->clut16[entry_id] = RGBA(r,g,b,255 - alpha);
         else if (depth & 0x20)
             clut->clut256[entry_id] = RGBA(r,g,b,255 - alpha);
@@ -1185,7 +1184,6 @@ static int dvbsub_parse_region_segment(AVCodecContext *avctx,
     DVBSubObject *object;
     DVBSubObjectDisplay *display;
     int fill;
-    int ret;
 
     if (buf_size < 10)
         return AVERROR_INVALIDDATA;
@@ -1214,12 +1212,6 @@ static int dvbsub_parse_region_segment(AVCodecContext *avctx,
     region->height = AV_RB16(buf);
     buf += 2;
 
-    ret = av_image_check_size(region->width, region->height, 0, avctx);
-    if (ret < 0) {
-        region->width= region->height= 0;
-        return ret;
-    }
-
     if (region->width * region->height != region->buf_size) {
         av_free(region->pbuf);
 

libavcodec/dvdsubdec.c

@@ -60,7 +60,7 @@ static void yuv_a_to_rgba(const uint8_t *ycbcr, const uint8_t *alpha, uint32_t *
         cb = *ycbcr++;
         YUV_TO_RGB1_CCIR(cb, cr);
         YUV_TO_RGB2_CCIR(r, g, b, y);
-        *rgba++ = ((unsigned)*alpha++ << 24) | (r << 16) | (g << 8) | b;
+        *rgba++ = (*alpha++ << 24) | (r << 16) | (g << 8) | b;
     }
 }
 
@@ -189,12 +189,12 @@ static void guess_palette(DVDSubContext* ctx,
                 r = (((subtitle_color >> 16) & 0xff) * level) >> 8;
                 g = (((subtitle_color >> 8) & 0xff) * level) >> 8;
                 b = (((subtitle_color >> 0) & 0xff) * level) >> 8;
-                rgba_palette[i] = b | (g << 8) | (r << 16) | ((alpha[i] * 17U) << 24);
+                rgba_palette[i] = b | (g << 8) | (r << 16) | ((alpha[i] * 17) << 24);
                 color_used[colormap[i]] = (i + 1);
                 j++;
             } else {
                 rgba_palette[i] = (rgba_palette[color_used[colormap[i]] - 1] & 0x00ffffff) |
-                                    ((alpha[i] * 17U) << 24);
+                                    ((alpha[i] * 17) << 24);
             }
         }
     }

libavcodec/dxv.c

@@ -335,9 +335,6 @@ static int dxv_decompress_raw(AVCodecContext *avctx)
     DXVContext *ctx = avctx->priv_data;
     GetByteContext *gbc = &ctx->gbc;
 
-    if (bytestream2_get_bytes_left(gbc) < ctx->tex_size)
-        return AVERROR_INVALIDDATA;
-
     bytestream2_get_buffer(gbc, ctx->tex_data, ctx->tex_size);
     return 0;
 }

libavcodec/eamad.c

@@ -284,7 +284,7 @@ static int decode_frame(AVCodecContext *avctx,
 
     if (avctx->width != width || avctx->height != height) {
         av_frame_unref(s->last_frame);
-        if((width * (int64_t)height)/2048*7 > bytestream2_get_bytes_left(&gb))
+        if((width * height)/2048*7 > bytestream2_get_bytes_left(&gb))
             return AVERROR_INVALIDDATA;
         if ((ret = ff_set_dimensions(avctx, width, height)) < 0)
             return ret;

libavcodec/eatqi.c

@@ -112,7 +112,7 @@ static inline void tqi_idct_put(AVCodecContext *avctx, AVFrame *frame,
 
 static void tqi_calculate_qtable(TqiContext *t, int quant)
 {
-    const int64_t qscale = (215 - 2*quant)*5;
+    const int qscale = (215 - 2*quant)*5;
     int i;
 
     t->intra_matrix[0] = (ff_inv_aanscales[0] * ff_mpeg1_default_intra_matrix[0]) >> 11;

libavcodec/exr.c

@@ -220,9 +220,9 @@ static union av_intfloat32 exr_half2float(uint16_t hf)
  *
  * @return normalized 16-bit unsigned int
  */
-static inline uint16_t exr_flt2uint(int32_t v)
+static inline uint16_t exr_flt2uint(uint32_t v)
 {
-    int32_t exp = v >> 23;
+    unsigned int exp = v >> 23;
     // "HACK": negative values result in exp<  0, so clipping them to 0
     // is also handled by this condition, avoids explicit check for sign bit.
     if (exp <= 127 + 7 - 24) // we would shift out all bits anyway
@@ -866,7 +866,7 @@ static int pxr24_uncompress(EXRContext *s, const uint8_t *src,
                 in     = ptr[2] + td->xsize;
 
                 for (j = 0; j < td->xsize; ++j) {
-                    uint32_t diff = ((unsigned)*(ptr[0]++) << 24) |
+                    uint32_t diff = (*(ptr[0]++) << 24) |
                                     (*(ptr[1]++) << 16) |
                                     (*(ptr[2]++) << 8);
                     pixel += diff;
@@ -1062,7 +1062,7 @@ static int decode_block(AVCodecContext *avctx, void *tdata,
     line_offset = AV_RL64(s->gb.buffer + jobnr * 8);
 
     if (s->is_tile) {
-        if (buf_size < 20 || line_offset > buf_size - 20)
+        if (line_offset > buf_size - 20)
             return AVERROR_INVALIDDATA;
 
         src  = buf + line_offset + 20;
@@ -1073,7 +1073,7 @@ static int decode_block(AVCodecContext *avctx, void *tdata,
         tileLevelY = AV_RL32(src - 8);
 
         data_size = AV_RL32(src - 4);
-        if (data_size <= 0 || data_size > buf_size - line_offset - 20)
+        if (data_size <= 0 || data_size > buf_size)
             return AVERROR_INVALIDDATA;
 
         if (tileLevelX || tileLevelY) { /* tile level, is not the full res level */
@@ -1106,7 +1106,7 @@ static int decode_block(AVCodecContext *avctx, void *tdata,
         td->channel_line_size = td->xsize * s->current_channel_offset;/* uncompress size of one line */
         uncompressed_size = td->channel_line_size * (uint64_t)td->ysize;/* uncompress size of the block */
     } else {
-        if (buf_size < 8 || line_offset > buf_size - 8)
+        if (line_offset > buf_size - 8)
             return AVERROR_INVALIDDATA;
 
         src  = buf + line_offset + 8;
@@ -1116,7 +1116,7 @@ static int decode_block(AVCodecContext *avctx, void *tdata,
             return AVERROR_INVALIDDATA;
 
         data_size = AV_RL32(src - 4);
-        if (data_size <= 0 || data_size > buf_size - line_offset - 8)
+        if (data_size <= 0 || data_size > buf_size)
             return AVERROR_INVALIDDATA;
 
         td->ysize          = FFMIN(s->scan_lines_per_block, s->ymax - line + 1); /* s->ydelta - line ?? */

libavcodec/extract_extradata_bsf.c

@@ -78,7 +78,7 @@ static int extract_extradata_h2645(AVBSFContext *ctx, AVPacket *pkt,
     ret = ff_h2645_packet_split(&h2645_pkt, pkt->data, pkt->size,
                                 ctx, 0, 0, ctx->par_in->codec_id, 1);
     if (ret < 0)
-        goto fail;
+        return ret;
 
     for (i = 0; i < h2645_pkt.nb_nals; i++) {
         H2645NAL *nal = &h2645_pkt.nals[i];
@@ -101,17 +101,14 @@ static int extract_extradata_h2645(AVBSFContext *ctx, AVPacket *pkt,
 
         if (s->remove) {
             filtered_buf = av_buffer_alloc(pkt->size + AV_INPUT_BUFFER_PADDING_SIZE);
-            if (!filtered_buf) {
-                ret = AVERROR(ENOMEM);
+            if (!filtered_buf)
                 goto fail;
-            }
             filtered_data = filtered_buf->data;
         }
 
         extradata = av_malloc(extradata_size + AV_INPUT_BUFFER_PADDING_SIZE);
         if (!extradata) {
             av_buffer_unref(&filtered_buf);
-            ret = AVERROR(ENOMEM);
             goto fail;
         }
 

libavcodec/ffjni.c

@@ -85,7 +85,7 @@ JNIEnv *ff_jni_get_env(void *log_ctx)
         av_log(log_ctx, AV_LOG_ERROR, "The specified JNI version is not supported\n");
         break;
     default:
-        av_log(log_ctx, AV_LOG_ERROR, "Failed to get the JNI environment attached to this thread\n");
+        av_log(log_ctx, AV_LOG_ERROR, "Failed to get the JNI environment attached to this thread");
         break;
     }
 
@@ -303,11 +303,6 @@ int ff_jni_init_jfields(JNIEnv *env, void *jfields, const struct FFJniField *jfi
 
             last_clazz = *(jclass*)((uint8_t*)jfields + jfields_mapping[i].offset) =
                     global ? (*env)->NewGlobalRef(env, clazz) : clazz;
-
-            if (global) {
-                (*env)->DeleteLocalRef(env, clazz);
-            }
-
         } else {
 
             if (!last_clazz) {

libavcodec/ffv1dec.c

@@ -45,8 +45,7 @@ static inline av_flatten int get_symbol_inline(RangeCoder *c, uint8_t *state,
     if (get_rac(c, state + 0))
         return 0;
     else {
-        int i, e;
-        unsigned a;
+        int i, e, a;
         e = 0;
         while (get_rac(c, state + 1 + FFMIN(e, 9))) { // 1..10
             e++;
@@ -354,7 +353,7 @@ static int read_quant_table(RangeCoder *c, int16_t *quant_table, int scale)
     memset(state, 128, sizeof(state));
 
     for (v = 0; i < 128; v++) {
-        unsigned len = get_symbol(c, state, 0) + 1U;
+        unsigned len = get_symbol(c, state, 0) + 1;
 
         if (len > 128 - i || !len)
             return AVERROR_INVALIDDATA;
@@ -699,7 +698,7 @@ static int read_header(FFV1Context *f)
     } else {
         const uint8_t *p = c->bytestream_end;
         for (f->slice_count = 0;
-             f->slice_count < MAX_SLICES && 3 + 5*!!f->ec < p - c->bytestream_start;
+             f->slice_count < MAX_SLICES && 3 < p - c->bytestream_start;
              f->slice_count++) {
             int trailer = 3 + 5*!!f->ec;
             int size = AV_RB24(p-trailer);
@@ -899,7 +898,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac
             const uint8_t *src[4];
             uint8_t *dst[4];
             ff_thread_await_progress(&f->last_picture, INT_MAX, 0);
-            for (j = 0; j < desc->nb_components; j++) {
+            for (j = 0; j < 4; j++) {
                 int pixshift = desc->comp[j].depth > 8;
                 int sh = (j == 1 || j == 2) ? f->chroma_h_shift : 0;
                 int sv = (j == 1 || j == 2) ? f->chroma_v_shift : 0;
@@ -907,12 +906,6 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac
                          (fs->slice_y >> sv) + ((fs->slice_x >> sh) << pixshift);
                 src[j] = f->last_picture.f->data[j] + f->last_picture.f->linesize[j] *
                          (fs->slice_y >> sv) + ((fs->slice_x >> sh) << pixshift);
-
-            }
-            if (desc->flags & AV_PIX_FMT_FLAG_PAL ||
-                desc->flags & AV_PIX_FMT_FLAG_PSEUDOPAL) {
-                dst[1] = p->data[1];
-                src[1] = f->last_picture.f->data[1];
             }
             av_image_copy(dst, p->linesize, src,
                           f->last_picture.f->linesize,

libavcodec/ffv1dec_template.c

@@ -96,7 +96,7 @@ static av_always_inline void RENAME(decode_line)(FFV1Context *s, int w,
         }
 
         if (sign)
-            diff = -(unsigned)diff;
+            diff = -diff;
 
         sample[1][x] = av_mod_uintp2(RENAME(predict)(sample[1] + x, sample[0] + x) + diff, bits);
     }
@@ -149,7 +149,7 @@ static void RENAME(decode_rgb_frame)(FFV1Context *s, uint8_t *src[3], int w, int
             }
 
             if (lbd)
-                *((uint32_t*)(src[0] + x*4 + stride[0]*y)) = b + ((unsigned)g<<8) + ((unsigned)r<<16) + ((unsigned)a<<24);
+                *((uint32_t*)(src[0] + x*4 + stride[0]*y)) = b + (g<<8) + (r<<16) + (a<<24);
             else if (sizeof(TYPE) == 4) {
                 *((uint16_t*)(src[0] + x*2 + stride[0]*y)) = g;
                 *((uint16_t*)(src[1] + x*2 + stride[1]*y)) = b;

libavcodec/fic.c

@@ -85,26 +85,26 @@ static const uint8_t fic_header[7] = { 0, 0, 1, 'F', 'I', 'C', 'V' };
 
 static av_always_inline void fic_idct(int16_t *blk, int step, int shift, int rnd)
 {
-    const unsigned t0 =  27246 * blk[3 * step] + 18405 * blk[5 * step];
-    const unsigned t1 =  27246 * blk[5 * step] - 18405 * blk[3 * step];
-    const unsigned t2 =   6393 * blk[7 * step] + 32139 * blk[1 * step];
-    const unsigned t3 =   6393 * blk[1 * step] - 32139 * blk[7 * step];
-    const unsigned t4 = 5793U * ((int)(t2 + t0 + 0x800) >> 12);
-    const unsigned t5 = 5793U * ((int)(t3 + t1 + 0x800) >> 12);
-    const unsigned t6 = t2 - t0;
-    const unsigned t7 = t3 - t1;
-    const unsigned t8 =  17734 * blk[2 * step] - 42813 * blk[6 * step];
-    const unsigned t9 =  17734 * blk[6 * step] + 42814 * blk[2 * step];
-    const unsigned tA = (blk[0 * step] - blk[4 * step]) * 32768 + rnd;
-    const unsigned tB = (blk[0 * step] + blk[4 * step]) * 32768 + rnd;
-    blk[0 * step] = (int)(  t4       + t9 + tB) >> shift;
-    blk[1 * step] = (int)(  t6 + t7  + t8 + tA) >> shift;
-    blk[2 * step] = (int)(  t6 - t7  - t8 + tA) >> shift;
-    blk[3 * step] = (int)(  t5       - t9 + tB) >> shift;
-    blk[4 * step] = (int)( -t5       - t9 + tB) >> shift;
-    blk[5 * step] = (int)(-(t6 - t7) - t8 + tA) >> shift;
-    blk[6 * step] = (int)(-(t6 + t7) + t8 + tA) >> shift;
-    blk[7 * step] = (int)( -t4       + t9 + tB) >> shift;
+    const int t0 =  27246 * blk[3 * step] + 18405 * blk[5 * step];
+    const int t1 =  27246 * blk[5 * step] - 18405 * blk[3 * step];
+    const int t2 =   6393 * blk[7 * step] + 32139 * blk[1 * step];
+    const int t3 =   6393 * blk[1 * step] - 32139 * blk[7 * step];
+    const int t4 = 5793 * (t2 + t0 + 0x800 >> 12);
+    const int t5 = 5793 * (t3 + t1 + 0x800 >> 12);
+    const int t6 = t2 - t0;
+    const int t7 = t3 - t1;
+    const int t8 =  17734 * blk[2 * step] - 42813 * blk[6 * step];
+    const int t9 =  17734 * blk[6 * step] + 42814 * blk[2 * step];
+    const int tA = (blk[0 * step] - blk[4 * step] << 15) + rnd;
+    const int tB = (blk[0 * step] + blk[4 * step] << 15) + rnd;
+    blk[0 * step] = (  t4       + t9 + tB) >> shift;
+    blk[1 * step] = (  t6 + t7  + t8 + tA) >> shift;
+    blk[2 * step] = (  t6 - t7  - t8 + tA) >> shift;
+    blk[3 * step] = (  t5       - t9 + tB) >> shift;
+    blk[4 * step] = ( -t5       - t9 + tB) >> shift;
+    blk[5 * step] = (-(t6 - t7) - t8 + tA) >> shift;
+    blk[6 * step] = (-(t6 + t7) + t8 + tA) >> shift;
+    blk[7 * step] = ( -t4       + t9 + tB) >> shift;
 }
 
 static void fic_idct_put(uint8_t *dst, int stride, int16_t *block)

libavcodec/flacdec.c

@@ -205,12 +205,12 @@ static int get_metadata_size(const uint8_t *buf, int buf_size)
     buf += 4;
     do {
         if (buf_end - buf < 4)
-            return AVERROR_INVALIDDATA;
+            return 0;
         flac_parse_block_header(buf, &metadata_last, NULL, &metadata_size);
         buf += 4;
         if (buf_end - buf < metadata_size) {
             /* need more data in order to read the complete header */
-            return AVERROR_INVALIDDATA;
+            return 0;
         }
         buf += metadata_size;
     } while (!metadata_last);
@@ -298,7 +298,7 @@ static int decode_subframe_fixed(FLACContext *s, int32_t *decoded,
     if (pred_order > 2)
         c = b - decoded[pred_order-2] + decoded[pred_order-3];
     if (pred_order > 3)
-        d = c - decoded[pred_order-2] + 2U*decoded[pred_order-3] - decoded[pred_order-4];
+        d = c - decoded[pred_order-2] + 2*decoded[pred_order-3] - decoded[pred_order-4];
 
     switch (pred_order) {
     case 0:
@@ -456,7 +456,7 @@ static inline int decode_subframe(FLACContext *s, int channel)
         return AVERROR_INVALIDDATA;
     }
 
-    if (wasted && wasted < 32) {
+    if (wasted) {
         int i;
         for (i = 0; i < s->blocksize; i++)
             decoded[i] = (unsigned)decoded[i] << wasted;

libavcodec/flicvideo.c

@@ -199,9 +199,6 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
     num_chunks = bytestream2_get_le16(&g2);
     bytestream2_skip(&g2, 8);  /* skip padding */
 
-    if (frame_size < 16)
-        return AVERROR_INVALIDDATA;
-
     frame_size -= 16;
 
     /* iterate through the chunks */
@@ -272,14 +269,10 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
             while (compressed_lines > 0) {
                 if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
                     break;
-                if (y_ptr > pixel_limit)
-                    return AVERROR_INVALIDDATA;
                 line_packets = bytestream2_get_le16(&g2);
                 if ((line_packets & 0xC000) == 0xC000) {
                     // line skip opcode
                     line_packets = -line_packets;
-                    if (line_packets > s->avctx->height)
-                        return AVERROR_INVALIDDATA;
                     y_ptr += line_packets * s->frame->linesize[0];
                 } else if ((line_packets & 0xC000) == 0x4000) {
                     av_log(avctx, AV_LOG_ERROR, "Undefined opcode (%x) in DELTA_FLI\n", line_packets);
@@ -328,8 +321,6 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
         case FLI_LC:
             /* line compressed */
             starting_line = bytestream2_get_le16(&g2);
-            if (starting_line >= s->avctx->height)
-                return AVERROR_INVALIDDATA;
             y_ptr = 0;
             y_ptr += starting_line * s->frame->linesize[0];
 
@@ -528,8 +519,6 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
     if (frame_size > buf_size)
         frame_size = buf_size;
 
-    if (frame_size < 16)
-        return AVERROR_INVALIDDATA;
     frame_size -= 16;
 
     /* iterate through the chunks */
@@ -566,13 +555,9 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
             while (compressed_lines > 0) {
                 if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
                     break;
-                if (y_ptr > pixel_limit)
-                    return AVERROR_INVALIDDATA;
                 line_packets = bytestream2_get_le16(&g2);
                 if (line_packets < 0) {
                     line_packets = -line_packets;
-                    if (line_packets > s->avctx->height)
-                        return AVERROR_INVALIDDATA;
                     y_ptr += line_packets * s->frame->linesize[0];
                 } else {
                     compressed_lines--;
@@ -819,8 +804,6 @@ static int flic_decode_frame_24BPP(AVCodecContext *avctx,
     if (frame_size > buf_size)
         frame_size = buf_size;
 
-    if (frame_size < 16)
-        return AVERROR_INVALIDDATA;
     frame_size -= 16;
 
     /* iterate through the chunks */
@@ -857,13 +840,9 @@ static int flic_decode_frame_24BPP(AVCodecContext *avctx,
             while (compressed_lines > 0) {
                 if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
                     break;
-                if (y_ptr > pixel_limit)
-                    return AVERROR_INVALIDDATA;
                 line_packets = bytestream2_get_le16(&g2);
                 if (line_packets < 0) {
                     line_packets = -line_packets;
-                    if (line_packets > s->avctx->height)
-                        return AVERROR_INVALIDDATA;
                     y_ptr += line_packets * s->frame->linesize[0];
                 } else {
                     compressed_lines--;

libavcodec/fmvc.c

@@ -459,7 +459,7 @@ static int decode_frame(AVCodecContext *avctx,
             int size, offset, start = 0;
 
             offset = bytestream2_get_le16(gb);
-            if (offset >= s->nb_blocks)
+            if (offset > s->nb_blocks)
                 return AVERROR_INVALIDDATA;
 
             size = bytestream2_get_le16(gb);
@@ -561,9 +561,6 @@ static av_cold int decode_init(AVCodecContext *avctx)
     }
 
     s->nb_blocks = s->xb * s->yb;
-    if (!s->nb_blocks)
-        return AVERROR_INVALIDDATA;
-
     s->blocks = av_calloc(s->nb_blocks, sizeof(*s->blocks));
     if (!s->blocks)
         return AVERROR(ENOMEM);
@@ -596,8 +593,8 @@ static av_cold int decode_init(AVCodecContext *avctx)
     s->bpp = avctx->bits_per_coded_sample >> 3;
     s->buffer_size = avctx->width * avctx->height * 4;
     s->pbuffer_size = avctx->width * avctx->height * 4;
-    s->buffer = av_mallocz(s->buffer_size);
-    s->pbuffer = av_mallocz(s->pbuffer_size);
+    s->buffer = av_malloc(s->buffer_size);
+    s->pbuffer = av_malloc(s->pbuffer_size);
     if (!s->buffer || !s->pbuffer)
         return AVERROR(ENOMEM);
 

libavcodec/g722.c

@@ -88,14 +88,14 @@ static inline void s_zero(int cur_diff, struct G722Band *band)
         ACCUM(3, band->diff_mem[2], 1);
         ACCUM(2, band->diff_mem[1], 1);
         ACCUM(1, band->diff_mem[0], 1);
-        ACCUM(0, cur_diff * 2, 1);
+        ACCUM(0, cur_diff << 1, 1);
     } else {
         ACCUM(5, band->diff_mem[4], 0);
         ACCUM(4, band->diff_mem[3], 0);
         ACCUM(3, band->diff_mem[2], 0);
         ACCUM(2, band->diff_mem[1], 0);
         ACCUM(1, band->diff_mem[0], 0);
-        ACCUM(0, cur_diff * 2, 0);
+        ACCUM(0, cur_diff << 1, 0);
     }
     #undef ACCUM
     band->s_zero = s_zero;
@@ -119,14 +119,14 @@ static void do_adaptive_prediction(struct G722Band *band, const int cur_diff)
     band->part_reconst_mem[0] = cur_part_reconst;
 
     band->pole_mem[1] = av_clip((sg[0] * av_clip(band->pole_mem[0], -8191, 8191) >> 5) +
-                                (sg[1] * 128) + (band->pole_mem[1] * 127 >> 7), -12288, 12288);
+                                (sg[1] << 7) + (band->pole_mem[1] * 127 >> 7), -12288, 12288);
 
     limit = 15360 - band->pole_mem[1];
     band->pole_mem[0] = av_clip(-192 * sg[0] + (band->pole_mem[0] * 255 >> 8), -limit, limit);
 
     s_zero(cur_diff, band);
 
-    cur_qtzd_reconst = av_clip_int16((band->s_predictor + cur_diff) * 2);
+    cur_qtzd_reconst = av_clip_int16((band->s_predictor + cur_diff) << 1);
     band->s_predictor = av_clip_int16(band->s_zero +
                                       (band->pole_mem[0] * cur_qtzd_reconst >> 15) +
                                       (band->pole_mem[1] * band->prev_qtzd_reconst >> 15));

libavcodec/g723_1.c

@@ -41,7 +41,7 @@ int ff_g723_1_scale_vector(int16_t *dst, const int16_t *vector, int length)
     bits= FFMAX(bits, 0);
 
     for (i = 0; i < length; i++)
-        dst[i] = (vector[i] * (1 << bits)) >> 3;
+        dst[i] = vector[i] << bits >> 3;
 
     return bits - 3;
 }
@@ -125,9 +125,9 @@ static void lsp2lpc(int16_t *lpc)
     for (j = 0; j < LPC_ORDER; j++) {
         int index     = (lpc[j] >> 7) & 0x1FF;
         int offset    = lpc[j] & 0x7f;
-        int temp1     = cos_tab[index] * (1 << 16);
+        int temp1     = cos_tab[index] << 16;
         int temp2     = (cos_tab[index + 1] - cos_tab[index]) *
-                          (((offset << 8) + 0x80) << 1);
+                          ((offset << 8) + 0x80) << 1;
 
         lpc[j] = -(av_sat_dadd32(1 << 15, temp1 + temp2) >> 16);
     }
@@ -138,11 +138,11 @@ static void lsp2lpc(int16_t *lpc)
      */
     /* Initialize with values in Q28 */
     f1[0] = 1 << 28;
-    f1[1] = (lpc[0] + lpc[2]) * (1 << 14);
+    f1[1] = (lpc[0] << 14) + (lpc[2] << 14);
     f1[2] = lpc[0] * lpc[2] + (2 << 28);
 
     f2[0] = 1 << 28;
-    f2[1] = (lpc[1] + lpc[3]) * (1 << 14);
+    f2[1] = (lpc[1] << 14) + (lpc[3] << 14);
     f2[2] = lpc[1] * lpc[3] + (2 << 28);
 
     /*
@@ -162,8 +162,8 @@ static void lsp2lpc(int16_t *lpc)
 
         f1[0] >>= 1;
         f2[0] >>= 1;
-        f1[1] = ((lpc[2 * i]     * 65536 >> i) + f1[1]) >> 1;
-        f2[1] = ((lpc[2 * i + 1] * 65536 >> i) + f2[1]) >> 1;
+        f1[1] = ((lpc[2 * i]     << 16 >> i) + f1[1]) >> 1;
+        f2[1] = ((lpc[2 * i + 1] << 16 >> i) + f2[1]) >> 1;
     }
 
     /* Convert polynomial coefficients to LPC coefficients */
@@ -171,8 +171,8 @@ static void lsp2lpc(int16_t *lpc)
         int64_t ff1 = f1[i + 1] + f1[i];
         int64_t ff2 = f2[i + 1] - f2[i];
 
-        lpc[i] = av_clipl_int32(((ff1 + ff2) * 8) + (1 << 15)) >> 16;
-        lpc[LPC_ORDER - i - 1] = av_clipl_int32(((ff1 - ff2) * 8) +
+        lpc[i] = av_clipl_int32(((ff1 + ff2) << 3) + (1 << 15)) >> 16;
+        lpc[LPC_ORDER - i - 1] = av_clipl_int32(((ff1 - ff2) << 3) +
                                                 (1 << 15)) >> 16;
     }
 }

libavcodec/g723_1.h

@@ -55,7 +55,7 @@
  * @param b 16 bit multiplier
  */
 #define MULL2(a, b) \
-        ((((a) >> 16) * (b) * 2) + (((a) & 0xffff) * (b) >> 15))
+        ((((a) >> 16) * (b) << 1) + (((a) & 0xffff) * (b) >> 15))
 
 /**
  * G723.1 frame types

libavcodec/g723_1dec.c

@@ -488,7 +488,7 @@ static void residual_interp(int16_t *buf, int16_t *out, int lag,
                           (FRAME_LEN - lag) * sizeof(*out));
     } else {  /* Unvoiced */
         for (i = 0; i < FRAME_LEN; i++) {
-            *rseed = (int16_t)(*rseed * 521 + 259);
+            *rseed = *rseed * 521 + 259;
             out[i] = gain * *rseed >> 15;
         }
         memset(buf, 0, (FRAME_LEN + PITCH_MAX) * sizeof(*buf));
@@ -517,7 +517,7 @@ static void residual_interp(int16_t *buf, int16_t *out, int lag,
                       (iir_coef)[n - 1] * ((dest)[m - n] >> in_shift);\
         }\
 \
-        (dest)[m] = av_clipl_int32(((src)[m] * 65536) + (filter * 8) +\
+        (dest)[m] = av_clipl_int32(((src)[m] << 16) + (filter << 3) +\
                                    (1 << 15)) >> res_shift;\
     }\
 }
@@ -664,7 +664,7 @@ static int estimate_sid_gain(G723_1_Context *p)
         t = p->sid_gain << shift;
     else
         t = p->sid_gain >> -shift;
-    x = av_clipl_int32(t * (int64_t)cng_filt[0] >> 16);
+    x = t * cng_filt[0] >> 16;
 
     if (x >= cng_bseg[2])
         return 0x3F;
@@ -695,13 +695,13 @@ static int estimate_sid_gain(G723_1_Context *p)
     if (y <= 0) {
         t = seg * 32 + (val + 1 << seg2);
         t = t * t - x;
-        val = (seg2 - 1) * 16 + val;
+        val = (seg2 - 1 << 4) + val;
         if (t >= y)
             val++;
     } else {
         t = seg * 32 + (val - 1 << seg2);
         t = t * t - x;
-        val = (seg2 - 1) * 16 + val;
+        val = (seg2 - 1 << 4) + val;
         if (t >= y)
             val--;
     }
@@ -733,7 +733,7 @@ static void generate_noise(G723_1_Context *p)
         off[i * 2 + 1] = ((t >> 1) & 1) + SUBFRAME_LEN;
         t >>= 2;
         for (j = 0; j < 11; j++) {
-            signs[i * 11 + j] = ((t & 1) * 2 - 1)  * (1 << 14);
+            signs[i * 11 + j] = (t & 1) * 2 - 1 << 14;
             t >>= 1;
         }
     }
@@ -777,7 +777,7 @@ static void generate_noise(G723_1_Context *p)
         sum = 0;
         if (shift < 0) {
            for (j = 0; j < SUBFRAME_LEN * 2; j++) {
-               t      = vector_ptr[j] * (1 << -shift);
+               t      = vector_ptr[j] << -shift;
                sum   += t * t;
                tmp[j] = t;
            }
@@ -815,7 +815,7 @@ static void generate_noise(G723_1_Context *p)
         if (shift < 0)
            x >>= -shift;
         else
-           x *= 1 << shift;
+           x <<= shift;
         x = av_clip(x, -10000, 10000);
 
         for (j = 0; j < 11; j++) {
@@ -904,7 +904,7 @@ static int g723_1_decode_frame(AVCodecContext *avctx, void *data,
                                              &p->subframe[i], p->cur_rate);
                 /* Get the total excitation */
                 for (j = 0; j < SUBFRAME_LEN; j++) {
-                    int v = av_clip_int16(vector_ptr[j] * 2);
+                    int v = av_clip_int16(vector_ptr[j] << 1);
                     vector_ptr[j] = av_clip_int16(v + acb_vector[j]);
                 }
                 vector_ptr += SUBFRAME_LEN;

libavcodec/g726.c

@@ -269,7 +269,7 @@ static int16_t g726_decode(G726Context* c, int I)
         c->se += mult(i2f(c->a[i] >> 2, &f), &c->sr[i]);
     c->se >>= 1;
 
-    return av_clip(re_signal * 4, -0xffff, 0xffff);
+    return av_clip(re_signal << 2, -0xffff, 0xffff);
 }
 
 static av_cold int g726_reset(G726Context *c)

libavcodec/h264_cabac.c

@@ -2347,41 +2347,22 @@ decode_intra_mb:
     if (CHROMA444(h) && IS_8x8DCT(mb_type)){
         int i;
         uint8_t *nnz_cache = sl->non_zero_count_cache;
-        if (h->sei.unregistered.x264_build < 151U) {
-            for (i = 0; i < 2; i++){
-                if (sl->left_type[LEFT(i)] && !IS_8x8DCT(sl->left_type[LEFT(i)])) {
-                    nnz_cache[3+8* 1 + 2*8*i]=
-                    nnz_cache[3+8* 2 + 2*8*i]=
-                    nnz_cache[3+8* 6 + 2*8*i]=
-                    nnz_cache[3+8* 7 + 2*8*i]=
-                    nnz_cache[3+8*11 + 2*8*i]=
-                    nnz_cache[3+8*12 + 2*8*i]= IS_INTRA(mb_type) ? 64 : 0;
-                }
-            }
-            if (sl->top_type && !IS_8x8DCT(sl->top_type)){
-                uint32_t top_empty = !IS_INTRA(mb_type) ? 0 : 0x40404040;
-                AV_WN32A(&nnz_cache[4+8* 0], top_empty);
-                AV_WN32A(&nnz_cache[4+8* 5], top_empty);
-                AV_WN32A(&nnz_cache[4+8*10], top_empty);
-            }
-        } else {
-            for (i = 0; i < 2; i++){
-                if (sl->left_type[LEFT(i)] && !IS_8x8DCT(sl->left_type[LEFT(i)])) {
-                    nnz_cache[3+8* 1 + 2*8*i]=
-                    nnz_cache[3+8* 2 + 2*8*i]=
-                    nnz_cache[3+8* 6 + 2*8*i]=
-                    nnz_cache[3+8* 7 + 2*8*i]=
-                    nnz_cache[3+8*11 + 2*8*i]=
-                    nnz_cache[3+8*12 + 2*8*i]= !IS_INTRA_PCM(sl->left_type[LEFT(i)]) ? 0 : 64;
-                }
-            }
-            if (sl->top_type && !IS_8x8DCT(sl->top_type)){
-                uint32_t top_empty = !IS_INTRA_PCM(sl->top_type) ? 0 : 0x40404040;
-                AV_WN32A(&nnz_cache[4+8* 0], top_empty);
-                AV_WN32A(&nnz_cache[4+8* 5], top_empty);
-                AV_WN32A(&nnz_cache[4+8*10], top_empty);
+        for (i = 0; i < 2; i++){
+            if (sl->left_type[LEFT(i)] && !IS_8x8DCT(sl->left_type[LEFT(i)])) {
+                nnz_cache[3+8* 1 + 2*8*i]=
+                nnz_cache[3+8* 2 + 2*8*i]=
+                nnz_cache[3+8* 6 + 2*8*i]=
+                nnz_cache[3+8* 7 + 2*8*i]=
+                nnz_cache[3+8*11 + 2*8*i]=
+                nnz_cache[3+8*12 + 2*8*i]= IS_INTRA(mb_type) ? 64 : 0;
             }
         }
+        if (sl->top_type && !IS_8x8DCT(sl->top_type)){
+            uint32_t top_empty = !IS_INTRA(mb_type) ? 0 : 0x40404040;
+            AV_WN32A(&nnz_cache[4+8* 0], top_empty);
+            AV_WN32A(&nnz_cache[4+8* 5], top_empty);
+            AV_WN32A(&nnz_cache[4+8*10], top_empty);
+        }
     }
     h->cur_pic.mb_type[mb_xy] = mb_type;
 
@@ -2389,6 +2370,14 @@ decode_intra_mb:
         const uint8_t *scan, *scan8x8;
         const uint32_t *qmul;
 
+        if(IS_INTERLACED(mb_type)){
+            scan8x8 = sl->qscale ? h->field_scan8x8 : h->field_scan8x8_q0;
+            scan    = sl->qscale ? h->field_scan : h->field_scan_q0;
+        }else{
+            scan8x8 = sl->qscale ? h->zigzag_scan8x8 : h->zigzag_scan8x8_q0;
+            scan    = sl->qscale ? h->zigzag_scan : h->zigzag_scan_q0;
+        }
+
         // decode_cabac_mb_dqp
         if(get_cabac_noinline( &sl->cabac, &sl->cabac_state[60 + (sl->last_qscale_diff != 0)])){
             int val = 1;
@@ -2419,14 +2408,6 @@ decode_intra_mb:
         }else
             sl->last_qscale_diff=0;
 
-        if(IS_INTERLACED(mb_type)){
-            scan8x8 = sl->qscale ? h->field_scan8x8 : h->field_scan8x8_q0;
-            scan    = sl->qscale ? h->field_scan : h->field_scan_q0;
-        }else{
-            scan8x8 = sl->qscale ? h->zigzag_scan8x8 : h->zigzag_scan8x8_q0;
-            scan    = sl->qscale ? h->zigzag_scan : h->zigzag_scan_q0;
-        }
-
         decode_cabac_luma_residual(h, sl, scan, scan8x8, pixel_shift, mb_type, cbp, 0);
         if (CHROMA444(h)) {
             decode_cabac_luma_residual(h, sl, scan, scan8x8, pixel_shift, mb_type, cbp, 1);

libavcodec/h264_cavlc.c

@@ -1102,9 +1102,17 @@ decode_intra_mb:
         const uint8_t *scan, *scan8x8;
         const int max_qp = 51 + 6 * (h->ps.sps->bit_depth_luma - 8);
 
+        if(IS_INTERLACED(mb_type)){
+            scan8x8 = sl->qscale ? h->field_scan8x8_cavlc : h->field_scan8x8_cavlc_q0;
+            scan    = sl->qscale ? h->field_scan : h->field_scan_q0;
+        }else{
+            scan8x8 = sl->qscale ? h->zigzag_scan8x8_cavlc : h->zigzag_scan8x8_cavlc_q0;
+            scan    = sl->qscale ? h->zigzag_scan : h->zigzag_scan_q0;
+        }
+
         dquant= get_se_golomb(&sl->gb);
 
-        sl->qscale += (unsigned)dquant;
+        sl->qscale += dquant;
 
         if (((unsigned)sl->qscale) > max_qp){
             if (sl->qscale < 0) sl->qscale += max_qp + 1;
@@ -1118,14 +1126,6 @@ decode_intra_mb:
         sl->chroma_qp[0] = get_chroma_qp(h->ps.pps, 0, sl->qscale);
         sl->chroma_qp[1] = get_chroma_qp(h->ps.pps, 1, sl->qscale);
 
-        if(IS_INTERLACED(mb_type)){
-            scan8x8 = sl->qscale ? h->field_scan8x8_cavlc : h->field_scan8x8_cavlc_q0;
-            scan    = sl->qscale ? h->field_scan : h->field_scan_q0;
-        }else{
-            scan8x8 = sl->qscale ? h->zigzag_scan8x8_cavlc : h->zigzag_scan8x8_cavlc_q0;
-            scan    = sl->qscale ? h->zigzag_scan : h->zigzag_scan_q0;
-        }
-
         if ((ret = decode_luma_residual(h, sl, gb, scan, scan8x8, pixel_shift, mb_type, cbp, 0)) < 0 ) {
             return -1;
         }

libavcodec/h264_mb.c

@@ -637,7 +637,7 @@ static av_always_inline void hl_decode_mb_predict_luma(const H264Context *h,
                 uint8_t *const ptr = dest_y + block_offset[i];
                 const int dir      = sl->intra4x4_pred_mode_cache[scan8[i]];
                 if (transform_bypass && h->ps.sps->profile_idc == 244 && dir <= 1) {
-                    if (h->sei.unregistered.x264_build < 151U) {
+                    if (h->sei.unregistered.x264_build != -1) {
                         h->hpc.pred8x8l_add[dir](ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);
                     } else
                         h->hpc.pred8x8l_filter_add[dir](ptr, sl->mb + (i * 16 + p * 256 << pixel_shift),

libavcodec/h264_parse.c

@@ -26,31 +26,29 @@
 
 int ff_h264_pred_weight_table(GetBitContext *gb, const SPS *sps,
                               const int *ref_count, int slice_type_nos,
-                              H264PredWeightTable *pwt,
-                              int picture_structure, void *logctx)
+                              H264PredWeightTable *pwt, void *logctx)
 {
     int list, i, j;
     int luma_def, chroma_def;
 
     pwt->use_weight             = 0;
     pwt->use_weight_chroma      = 0;
-
     pwt->luma_log2_weight_denom = get_ue_golomb(gb);
+    if (sps->chroma_format_idc)
+        pwt->chroma_log2_weight_denom = get_ue_golomb(gb);
+
     if (pwt->luma_log2_weight_denom > 7U) {
         av_log(logctx, AV_LOG_ERROR, "luma_log2_weight_denom %d is out of range\n", pwt->luma_log2_weight_denom);
         pwt->luma_log2_weight_denom = 0;
     }
-    luma_def = 1 << pwt->luma_log2_weight_denom;
-
-    if (sps->chroma_format_idc) {
-        pwt->chroma_log2_weight_denom = get_ue_golomb(gb);
-        if (pwt->chroma_log2_weight_denom > 7U) {
-            av_log(logctx, AV_LOG_ERROR, "chroma_log2_weight_denom %d is out of range\n", pwt->chroma_log2_weight_denom);
-            pwt->chroma_log2_weight_denom = 0;
-        }
-        chroma_def = 1 << pwt->chroma_log2_weight_denom;
+    if (pwt->chroma_log2_weight_denom > 7U) {
+        av_log(logctx, AV_LOG_ERROR, "chroma_log2_weight_denom %d is out of range\n", pwt->chroma_log2_weight_denom);
+        pwt->chroma_log2_weight_denom = 0;
     }
 
+    luma_def   = 1 << pwt->luma_log2_weight_denom;
+    chroma_def = 1 << pwt->chroma_log2_weight_denom;
+
     for (list = 0; list < 2; list++) {
         pwt->luma_weight_flag[list]   = 0;
         pwt->chroma_weight_flag[list] = 0;
@@ -61,9 +59,6 @@ int ff_h264_pred_weight_table(GetBitContext *gb, const SPS *sps,
             if (luma_weight_flag) {
                 pwt->luma_weight[i][list][0] = get_se_golomb(gb);
                 pwt->luma_weight[i][list][1] = get_se_golomb(gb);
-                if ((int8_t)pwt->luma_weight[i][list][0] != pwt->luma_weight[i][list][0] ||
-                    (int8_t)pwt->luma_weight[i][list][1] != pwt->luma_weight[i][list][1])
-                    goto out_range_weight;
                 if (pwt->luma_weight[i][list][0] != luma_def ||
                     pwt->luma_weight[i][list][1] != 0) {
                     pwt->use_weight             = 1;
@@ -81,9 +76,6 @@ int ff_h264_pred_weight_table(GetBitContext *gb, const SPS *sps,
                     for (j = 0; j < 2; j++) {
                         pwt->chroma_weight[i][list][j][0] = get_se_golomb(gb);
                         pwt->chroma_weight[i][list][j][1] = get_se_golomb(gb);
-                        if ((int8_t)pwt->chroma_weight[i][list][j][0] != pwt->chroma_weight[i][list][j][0] ||
-                            (int8_t)pwt->chroma_weight[i][list][j][1] != pwt->chroma_weight[i][list][j][1])
-                            goto out_range_weight;
                         if (pwt->chroma_weight[i][list][j][0] != chroma_def ||
                             pwt->chroma_weight[i][list][j][1] != 0) {
                             pwt->use_weight_chroma        = 1;
@@ -100,15 +92,11 @@ int ff_h264_pred_weight_table(GetBitContext *gb, const SPS *sps,
             }
 
             // for MBAFF
-            if (picture_structure == PICT_FRAME) {
-                pwt->luma_weight[16 + 2 * i][list][0] = pwt->luma_weight[16 + 2 * i + 1][list][0] = pwt->luma_weight[i][list][0];
-                pwt->luma_weight[16 + 2 * i][list][1] = pwt->luma_weight[16 + 2 * i + 1][list][1] = pwt->luma_weight[i][list][1];
-                if (sps->chroma_format_idc) {
-                    for (j = 0; j < 2; j++) {
-                        pwt->chroma_weight[16 + 2 * i][list][j][0] = pwt->chroma_weight[16 + 2 * i + 1][list][j][0] = pwt->chroma_weight[i][list][j][0];
-                        pwt->chroma_weight[16 + 2 * i][list][j][1] = pwt->chroma_weight[16 + 2 * i + 1][list][j][1] = pwt->chroma_weight[i][list][j][1];
-                    }
-                }
+            pwt->luma_weight[16 + 2 * i][list][0] = pwt->luma_weight[16 + 2 * i + 1][list][0] = pwt->luma_weight[i][list][0];
+            pwt->luma_weight[16 + 2 * i][list][1] = pwt->luma_weight[16 + 2 * i + 1][list][1] = pwt->luma_weight[i][list][1];
+            for (j = 0; j < 2; j++) {
+                pwt->chroma_weight[16 + 2 * i][list][j][0] = pwt->chroma_weight[16 + 2 * i + 1][list][j][0] = pwt->chroma_weight[i][list][j][0];
+                pwt->chroma_weight[16 + 2 * i][list][j][1] = pwt->chroma_weight[16 + 2 * i + 1][list][j][1] = pwt->chroma_weight[i][list][j][1];
             }
         }
         if (slice_type_nos != AV_PICTURE_TYPE_B)
@@ -116,9 +104,6 @@ int ff_h264_pred_weight_table(GetBitContext *gb, const SPS *sps,
     }
     pwt->use_weight = pwt->use_weight || pwt->use_weight_chroma;
     return 0;
-out_range_weight:
-    avpriv_request_sample(logctx, "Out of range weight\n");
-    return AVERROR_INVALIDDATA;
 }
 
 /**

libavcodec/h264_parse.h

@@ -55,8 +55,7 @@ typedef struct H264POCContext {
 
 int ff_h264_pred_weight_table(GetBitContext *gb, const SPS *sps,
                               const int *ref_count, int slice_type_nos,
-                              H264PredWeightTable *pwt,
-                              int picture_structure, void *logctx);
+                              H264PredWeightTable *pwt, void *logctx);
 
 /**
  * Check if the top & left blocks are available if needed & change the

libavcodec/h264_parser.c

@@ -202,7 +202,7 @@ static int scan_mmco_reset(AVCodecParserContext *s, GetBitContext *gb,
     if ((p->ps.pps->weighted_pred && slice_type_nos == AV_PICTURE_TYPE_P) ||
         (p->ps.pps->weighted_bipred_idc == 1 && slice_type_nos == AV_PICTURE_TYPE_B))
         ff_h264_pred_weight_table(gb, p->ps.sps, ref_count, slice_type_nos,
-                                  &pwt, p->picture_structure, logctx);
+                                  &pwt, logctx);
 
     if (get_bits1(gb)) { // adaptive_ref_pic_marking_mode_flag
         int i;

libavcodec/h264_picture.c

@@ -109,6 +109,7 @@ int ff_h264_ref_picture(H264Context *h, H264Picture *dst, H264Picture *src)
     dst->poc           = src->poc;
     dst->frame_num     = src->frame_num;
     dst->mmco_reset    = src->mmco_reset;
+    dst->pic_id        = src->pic_id;
     dst->long_ref      = src->long_ref;
     dst->mbaff         = src->mbaff;
     dst->field_picture = src->field_picture;

libavcodec/h264_slice.c

@@ -1423,14 +1423,14 @@ static int h264_field_start(H264Context *h, const H264SliceContext *sl,
      * We have to do that before the "dummy" in-between frame allocation,
      * since that can modify h->cur_pic_ptr. */
     if (h->first_field) {
-        int last_field = last_pic_structure == PICT_BOTTOM_FIELD;
         av_assert0(h->cur_pic_ptr);
         av_assert0(h->cur_pic_ptr->f->buf[0]);
         assert(h->cur_pic_ptr->reference != DELAYED_PIC_REF);
 
         /* Mark old field/frame as completed */
-        if (h->cur_pic_ptr->tf.owner[last_field] == h->avctx) {
-            ff_thread_report_progress(&h->cur_pic_ptr->tf, INT_MAX, last_field);
+        if (h->cur_pic_ptr->tf.owner == h->avctx) {
+            ff_thread_report_progress(&h->cur_pic_ptr->tf, INT_MAX,
+                                      last_pic_structure == PICT_BOTTOM_FIELD);
         }
 
         /* figure out if we have a complementary field pair */
@@ -1568,9 +1568,7 @@ static int h264_field_start(H264Context *h, const H264SliceContext *sl,
             return AVERROR_INVALIDDATA;
         }
     } else {
-        int field = h->picture_structure == PICT_BOTTOM_FIELD;
         release_unused_pictures(h, 0);
-        h->cur_pic_ptr->tf.owner[field] = h->avctx;
     }
     /* Some macroblocks can be accessed before they're available in case
     * of lost slices, MBAFF or threading. */
@@ -1780,13 +1778,9 @@ static int h264_slice_header_parse(const H264Context *h, H264SliceContext *sl,
     }
     if ((pps->weighted_pred && sl->slice_type_nos == AV_PICTURE_TYPE_P) ||
         (pps->weighted_bipred_idc == 1 &&
-         sl->slice_type_nos == AV_PICTURE_TYPE_B)) {
-        ret = ff_h264_pred_weight_table(&sl->gb, sps, sl->ref_count,
-                                  sl->slice_type_nos, &sl->pwt,
-                                  picture_structure, h->avctx);
-        if (ret < 0)
-            return ret;
-    }
+         sl->slice_type_nos == AV_PICTURE_TYPE_B))
+        ff_h264_pred_weight_table(&sl->gb, sps, sl->ref_count,
+                                  sl->slice_type_nos, &sl->pwt, h->avctx);
 
     sl->explicit_ref_marking = 0;
     if (nal->ref_idc) {
@@ -1805,7 +1799,7 @@ static int h264_slice_header_parse(const H264Context *h, H264SliceContext *sl,
     }
 
     sl->last_qscale_diff = 0;
-    tmp = pps->init_qp + (unsigned)get_se_golomb(&sl->gb);
+    tmp = pps->init_qp + get_se_golomb(&sl->gb);
     if (tmp > 51 + 6 * (sps->bit_depth_luma - 8)) {
         av_log(h->avctx, AV_LOG_ERROR, "QP %u out of range\n", tmp);
         return AVERROR_INVALIDDATA;
@@ -1835,19 +1829,17 @@ static int h264_slice_header_parse(const H264Context *h, H264SliceContext *sl,
             sl->deblocking_filter ^= 1;  // 1<->0
 
         if (sl->deblocking_filter) {
-            int slice_alpha_c0_offset_div2 = get_se_golomb(&sl->gb);
-            int slice_beta_offset_div2     = get_se_golomb(&sl->gb);
-            if (slice_alpha_c0_offset_div2 >  6 ||
-                slice_alpha_c0_offset_div2 < -6 ||
-                slice_beta_offset_div2 >  6     ||
-                slice_beta_offset_div2 < -6) {
+            sl->slice_alpha_c0_offset = get_se_golomb(&sl->gb) * 2;
+            sl->slice_beta_offset     = get_se_golomb(&sl->gb) * 2;
+            if (sl->slice_alpha_c0_offset >  12 ||
+                sl->slice_alpha_c0_offset < -12 ||
+                sl->slice_beta_offset >  12     ||
+                sl->slice_beta_offset < -12) {
                 av_log(h->avctx, AV_LOG_ERROR,
                        "deblocking filter parameters %d %d out of range\n",
-                       slice_alpha_c0_offset_div2, slice_beta_offset_div2);
+                       sl->slice_alpha_c0_offset, sl->slice_beta_offset);
                 return AVERROR_INVALIDDATA;
             }
-            sl->slice_alpha_c0_offset = slice_alpha_c0_offset_div2 * 2;
-            sl->slice_beta_offset     = slice_beta_offset_div2 * 2;
         }
     }
 
@@ -1894,8 +1886,7 @@ static int h264_slice_init(H264Context *h, H264SliceContext *sl,
 
     if (sl->slice_type_nos == AV_PICTURE_TYPE_B && !sl->direct_spatial_mv_pred)
         ff_h264_direct_dist_scale_factor(h, sl);
-    if (!h->setup_finished)
-        ff_h264_direct_ref_list_init(h, sl);
+    ff_h264_direct_ref_list_init(h, sl);
 
     if (h->avctx->skip_loop_filter >= AVDISCARD_ALL ||
         (h->avctx->skip_loop_filter >= AVDISCARD_NONKEY &&

libavcodec/h264dec.h

@@ -415,7 +415,6 @@ typedef struct H264Context {
     uint8_t (*mvd_table[2])[2];
     uint8_t *direct_table;
 
-    uint8_t scan_padding[16];
     uint8_t zigzag_scan[16];
     uint8_t zigzag_scan8x8[64];
     uint8_t zigzag_scan8x8_cavlc[64];

libavcodec/h264idct_template.c

@@ -40,10 +40,10 @@ void FUNCC(ff_h264_idct_add)(uint8_t *_dst, int16_t *_block, int stride)
     block[0] += 1 << 5;
 
     for(i=0; i<4; i++){
-        const SUINT z0=  block[i + 4*0]     +  (unsigned)block[i + 4*2];
-        const SUINT z1=  block[i + 4*0]     -  (unsigned)block[i + 4*2];
-        const SUINT z2= (block[i + 4*1]>>1) -  (unsigned)block[i + 4*3];
-        const SUINT z3=  block[i + 4*1]     + (unsigned)(block[i + 4*3]>>1);
+        const SUINT z0=  block[i + 4*0]     +  block[i + 4*2];
+        const SUINT z1=  block[i + 4*0]     -  block[i + 4*2];
+        const SUINT z2= (block[i + 4*1]>>1) -  block[i + 4*3];
+        const SUINT z3=  block[i + 4*1]     + (block[i + 4*3]>>1);
 
         block[i + 4*0]= z0 + z3;
         block[i + 4*1]= z1 + z2;
@@ -91,10 +91,10 @@ void FUNCC(ff_h264_idct8_add)(uint8_t *_dst, int16_t *_block, int stride){
         const int a5 = -block[i+1*8] + block[i+7*8] + block[i+5*8] + (block[i+5*8]>>1);
         const int a7 =  block[i+3*8] + block[i+5*8] + block[i+1*8] + (block[i+1*8]>>1);
 
-        const int b1 = (a7>>2) + (unsigned)a1;
-        const int b3 =  (unsigned)a3 + (a5>>2);
-        const int b5 = (a3>>2) - (unsigned)a5;
-        const int b7 =  (unsigned)a7 - (a1>>2);
+        const int b1 = (a7>>2) + a1;
+        const int b3 =  a3 + (a5>>2);
+        const int b5 = (a3>>2) - a5;
+        const int b7 =  a7 - (a1>>2);
 
         block[i+0*8] = b0 + b7;
         block[i+7*8] = b0 - b7;
@@ -107,10 +107,10 @@ void FUNCC(ff_h264_idct8_add)(uint8_t *_dst, int16_t *_block, int stride){
     }
     for( i = 0; i < 8; i++ )
     {
-        const unsigned a0 =  block[0+i*8] + (unsigned)block[4+i*8];
-        const unsigned a2 =  block[0+i*8] - (unsigned)block[4+i*8];
-        const unsigned a4 = (block[2+i*8]>>1) - (unsigned)block[6+i*8];
-        const unsigned a6 = (block[6+i*8]>>1) + (unsigned)block[2+i*8];
+        const unsigned a0 =  block[0+i*8] + block[4+i*8];
+        const unsigned a2 =  block[0+i*8] - block[4+i*8];
+        const unsigned a4 = (block[2+i*8]>>1) - block[6+i*8];
+        const unsigned a6 = (block[6+i*8]>>1) + block[2+i*8];
 
         const unsigned b0 = a0 + a6;
         const unsigned b2 = a2 + a4;

libavcodec/hevc_cabac.c

@@ -635,10 +635,8 @@ int ff_hevc_cu_qp_delta_abs(HEVCContext *s)
             suffix_val += 1 << k;
             k++;
         }
-        if (k == CABAC_MAX_BIN) {
+        if (k == CABAC_MAX_BIN)
             av_log(s->avctx, AV_LOG_ERROR, "CABAC_MAX_BIN : %d\n", k);
-            return AVERROR_INVALIDDATA;
-        }
 
         while (k--)
             suffix_val += get_cabac_bypass(&s->HEVClc->cc) << k;

libavcodec/hevc_filter.c

@@ -470,7 +470,7 @@ static int get_pcm(HEVCContext *s, int x, int y)
 
 #define TC_CALC(qp, bs)                                                 \
     tctable[av_clip((qp) + DEFAULT_INTRA_TC_OFFSET * ((bs) - 1) +       \
-                    (tc_offset & -2),                                   \
+                    (tc_offset >> 1 << 1),                              \
                     0, MAX_QP + DEFAULT_INTRA_TC_OFFSET)]
 
 static void deblocking_filter_CTB(HEVCContext *s, int x0, int y0)

libavcodec/hevc_ps.c

@@ -170,12 +170,6 @@ int ff_hevc_decode_short_term_rps(GetBitContext *gb, AVCodecContext *avctx,
             }
         }
 
-        if (k >= FF_ARRAY_ELEMS(rps->used)) {
-            av_log(avctx, AV_LOG_ERROR,
-                   "Invalid num_delta_pocs: %d\n", k);
-            return AVERROR_INVALIDDATA;
-        }
-
         rps->num_delta_pocs    = k;
         rps->num_negative_pics = k0;
         // sort in increasing order (smallest first)
@@ -225,12 +219,6 @@ int ff_hevc_decode_short_term_rps(GetBitContext *gb, AVCodecContext *avctx,
             prev = 0;
             for (i = 0; i < rps->num_negative_pics; i++) {
                 delta_poc = get_ue_golomb_long(gb) + 1;
-                if (delta_poc < 1 || delta_poc > 32768) {
-                    av_log(avctx, AV_LOG_ERROR,
-                        "Invalid value of delta_poc: %d\n",
-                        delta_poc);
-                    return AVERROR_INVALIDDATA;
-                }
                 prev -= delta_poc;
                 rps->delta_poc[i] = prev;
                 rps->used[i]      = get_bits1(gb);
@@ -238,12 +226,6 @@ int ff_hevc_decode_short_term_rps(GetBitContext *gb, AVCodecContext *avctx,
             prev = 0;
             for (i = 0; i < nb_positive_pics; i++) {
                 delta_poc = get_ue_golomb_long(gb) + 1;
-                if (delta_poc < 1 || delta_poc > 32768) {
-                    av_log(avctx, AV_LOG_ERROR,
-                        "Invalid value of delta_poc: %d\n",
-                        delta_poc);
-                    return AVERROR_INVALIDDATA;
-                }
                 prev += delta_poc;
                 rps->delta_poc[rps->num_negative_pics + i] = prev;
                 rps->used[rps->num_negative_pics + i]      = get_bits1(gb);
@@ -550,7 +532,7 @@ err:
 static void decode_vui(GetBitContext *gb, AVCodecContext *avctx,
                        int apply_defdispwin, HEVCSPS *sps)
 {
-    VUI backup_vui, *vui = &sps->vui;
+    VUI *vui          = &sps->vui;
     GetBitContext backup;
     int sar_present, alt = 0;
 
@@ -618,14 +600,13 @@ static void decode_vui(GetBitContext *gb, AVCodecContext *avctx,
     vui->field_seq_flag                = get_bits1(gb);
     vui->frame_field_info_present_flag = get_bits1(gb);
 
-    // Backup context in case an alternate header is detected
-    memcpy(&backup, gb, sizeof(backup));
-    memcpy(&backup_vui, vui, sizeof(backup_vui));
     if (get_bits_left(gb) >= 68 && show_bits_long(gb, 21) == 0x100000) {
         vui->default_display_window_flag = 0;
         av_log(avctx, AV_LOG_WARNING, "Invalid default display window\n");
     } else
         vui->default_display_window_flag = get_bits1(gb);
+    // Backup context in case an alternate header is detected
+    memcpy(&backup, gb, sizeof(backup));
 
     if (vui->default_display_window_flag) {
         int vert_mult  = 1 + (sps->chroma_format_idc < 2);
@@ -652,19 +633,18 @@ static void decode_vui(GetBitContext *gb, AVCodecContext *avctx,
         }
     }
 
-timing_info:
     vui->vui_timing_info_present_flag = get_bits1(gb);
 
     if (vui->vui_timing_info_present_flag) {
-        if( get_bits_left(gb) < 66 && !alt) {
+        if( get_bits_left(gb) < 66) {
             // The alternate syntax seem to have timing info located
             // at where def_disp_win is normally located
             av_log(avctx, AV_LOG_WARNING,
                    "Strange VUI timing information, retrying...\n");
-            memcpy(vui, &backup_vui, sizeof(backup_vui));
+            vui->default_display_window_flag = 0;
+            memset(&vui->def_disp_win, 0, sizeof(vui->def_disp_win));
             memcpy(gb, &backup, sizeof(backup));
             alt = 1;
-            goto timing_info;
         }
         vui->vui_num_units_in_tick               = get_bits_long(gb, 32);
         vui->vui_time_scale                      = get_bits_long(gb, 32);
@@ -682,15 +662,6 @@ timing_info:
 
     vui->bitstream_restriction_flag = get_bits1(gb);
     if (vui->bitstream_restriction_flag) {
-        if (get_bits_left(gb) < 8 && !alt) {
-            av_log(avctx, AV_LOG_WARNING,
-                   "Strange VUI bitstream restriction information, retrying"
-                   " from timing information...\n");
-            memcpy(vui, &backup_vui, sizeof(backup_vui));
-            memcpy(gb, &backup, sizeof(backup));
-            alt = 1;
-            goto timing_info;
-        }
         vui->tiles_fixed_structure_flag              = get_bits1(gb);
         vui->motion_vectors_over_pic_boundaries_flag = get_bits1(gb);
         vui->restricted_ref_pic_lists_flag           = get_bits1(gb);
@@ -700,16 +671,6 @@ timing_info:
         vui->log2_max_mv_length_horizontal           = get_ue_golomb_long(gb);
         vui->log2_max_mv_length_vertical             = get_ue_golomb_long(gb);
     }
-
-    if (get_bits_left(gb) < 1 && !alt) {
-        // XXX: Alternate syntax when sps_range_extension_flag != 0?
-        av_log(avctx, AV_LOG_WARNING,
-               "Overread in VUI, retrying from timing information...\n");
-        memcpy(vui, &backup_vui, sizeof(backup_vui));
-        memcpy(gb, &backup, sizeof(backup));
-        alt = 1;
-        goto timing_info;
-    }
 }
 
 static void set_default_scaling_list_data(ScalingList *sl)
@@ -790,7 +751,7 @@ static int scaling_list_data(GetBitContext *gb, AVCodecContext *avctx, ScalingLi
                                   ff_hevc_diag_scan8x8_x[i];
 
                     scaling_list_delta_coef = get_se_golomb(gb);
-                    next_coef = (next_coef + 256U + scaling_list_delta_coef) % 256;
+                    next_coef = (next_coef + scaling_list_delta_coef + 256) % 256;
                     sl->sl[size_id][matrix_id][pos] = next_coef;
                 }
             }
@@ -972,9 +933,9 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id,
         sps->temporal_layer[i].max_dec_pic_buffering = get_ue_golomb_long(gb) + 1;
         sps->temporal_layer[i].num_reorder_pics      = get_ue_golomb_long(gb);
         sps->temporal_layer[i].max_latency_increase  = get_ue_golomb_long(gb) - 1;
-        if (sps->temporal_layer[i].max_dec_pic_buffering > (unsigned)HEVC_MAX_DPB_SIZE) {
+        if (sps->temporal_layer[i].max_dec_pic_buffering > HEVC_MAX_DPB_SIZE) {
             av_log(avctx, AV_LOG_ERROR, "sps_max_dec_pic_buffering_minus1 out of range: %d\n",
-                   sps->temporal_layer[i].max_dec_pic_buffering - 1U);
+                   sps->temporal_layer[i].max_dec_pic_buffering - 1);
             return AVERROR_INVALIDDATA;
         }
         if (sps->temporal_layer[i].num_reorder_pics > sps->temporal_layer[i].max_dec_pic_buffering - 1) {
@@ -1047,10 +1008,10 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id,
         sps->pcm.log2_min_pcm_cb_size = get_ue_golomb_long(gb) + 3;
         sps->pcm.log2_max_pcm_cb_size = sps->pcm.log2_min_pcm_cb_size +
                                         get_ue_golomb_long(gb);
-        if (FFMAX(sps->pcm.bit_depth, sps->pcm.bit_depth_chroma) > sps->bit_depth) {
+        if (sps->pcm.bit_depth > sps->bit_depth) {
             av_log(avctx, AV_LOG_ERROR,
-                   "PCM bit depth (%d, %d) is greater than normal bit depth (%d)\n",
-                   sps->pcm.bit_depth, sps->pcm.bit_depth_chroma, sps->bit_depth);
+                   "PCM bit depth (%d) is greater than normal bit depth (%d)\n",
+                   sps->pcm.bit_depth, sps->bit_depth);
             return AVERROR_INVALIDDATA;
         }
 
@@ -1471,7 +1432,6 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb, AVCodecContext *avctx,
     int i, ret = 0;
     unsigned int pps_id = 0;
     ptrdiff_t nal_size;
-    unsigned log2_parallel_merge_level_minus2;
 
     AVBufferRef *pps_buf;
     HEVCPPS *pps = av_mallocz(sizeof(*pps));
@@ -1642,22 +1602,20 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb, AVCodecContext *avctx,
         pps->deblocking_filter_override_enabled_flag = get_bits1(gb);
         pps->disable_dbf                             = get_bits1(gb);
         if (!pps->disable_dbf) {
-            int beta_offset_div2 = get_se_golomb(gb);
-            int tc_offset_div2   = get_se_golomb(gb) ;
-            if (beta_offset_div2 < -6 || beta_offset_div2 > 6) {
+            pps->beta_offset = get_se_golomb(gb) * 2;
+            pps->tc_offset = get_se_golomb(gb) * 2;
+            if (pps->beta_offset/2 < -6 || pps->beta_offset/2 > 6) {
                 av_log(avctx, AV_LOG_ERROR, "pps_beta_offset_div2 out of range: %d\n",
-                       beta_offset_div2);
+                       pps->beta_offset/2);
                 ret = AVERROR_INVALIDDATA;
                 goto err;
             }
-            if (tc_offset_div2 < -6 || tc_offset_div2 > 6) {
+            if (pps->tc_offset/2 < -6 || pps->tc_offset/2 > 6) {
                 av_log(avctx, AV_LOG_ERROR, "pps_tc_offset_div2 out of range: %d\n",
-                       tc_offset_div2);
+                       pps->tc_offset/2);
                 ret = AVERROR_INVALIDDATA;
                 goto err;
             }
-            pps->beta_offset = 2 * beta_offset_div2;
-            pps->tc_offset   = 2 *   tc_offset_div2;
         }
     }
 
@@ -1669,14 +1627,13 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb, AVCodecContext *avctx,
             goto err;
     }
     pps->lists_modification_present_flag = get_bits1(gb);
-    log2_parallel_merge_level_minus2     = get_ue_golomb_long(gb);
-    if (log2_parallel_merge_level_minus2 > sps->log2_ctb_size) {
+    pps->log2_parallel_merge_level       = get_ue_golomb_long(gb) + 2;
+    if (pps->log2_parallel_merge_level > sps->log2_ctb_size) {
         av_log(avctx, AV_LOG_ERROR, "log2_parallel_merge_level_minus2 out of range: %d\n",
-               log2_parallel_merge_level_minus2);
+               pps->log2_parallel_merge_level - 2);
         ret = AVERROR_INVALIDDATA;
         goto err;
     }
-    pps->log2_parallel_merge_level       = log2_parallel_merge_level_minus2 + 2;
 
     pps->slice_header_extension_present_flag = get_bits1(gb);
 

libavcodec/hevc_ps.h

@@ -285,8 +285,8 @@ typedef struct HEVCPPS {
     uint8_t chroma_qp_offset_list_enabled_flag;
     uint8_t diff_cu_chroma_qp_offset_depth;
     uint8_t chroma_qp_offset_list_len_minus1;
-    int8_t  cb_qp_offset_list[6];
-    int8_t  cr_qp_offset_list[6];
+    int8_t  cb_qp_offset_list[5];
+    int8_t  cr_qp_offset_list[5];
     uint8_t log2_sao_offset_scale_luma;
     uint8_t log2_sao_offset_scale_chroma;
 

libavcodec/hevc_refs.c

@@ -439,7 +439,7 @@ static int add_candidate_ref(HEVCContext *s, RefPicList *list,
 {
     HEVCFrame *ref = find_ref_idx(s, poc);
 
-    if (ref == s->ref || list->nb_refs >= HEVC_MAX_REFS)
+    if (ref == s->ref)
         return AVERROR_INVALIDDATA;
 
     if (!ref) {

libavcodec/hevc_sei.c

@@ -145,7 +145,7 @@ static int decode_nal_sei_display_orientation(HEVCContext *s)
     return 0;
 }
 
-static int decode_pic_timing(HEVCContext *s, int size)
+static int decode_pic_timing(HEVCContext *s)
 {
     GetBitContext *gb = &s->HEVClc->gb;
     HEVCSPS *sps;
@@ -166,12 +166,8 @@ static int decode_pic_timing(HEVCContext *s, int size)
         }
         get_bits(gb, 2);                   // source_scan_type
         get_bits(gb, 1);                   // duplicate_flag
-        skip_bits1(gb);
-        size--;
     }
-    skip_bits_long(gb, 8 * size);
-
-    return 0;
+    return 1;
 }
 
 static int decode_registered_user_data_closed_caption(HEVCContext *s, int size)
@@ -301,8 +297,9 @@ static int decode_nal_sei_prefix(HEVCContext *s, int type, int size)
         return decode_nal_sei_display_orientation(s);
     case SEI_TYPE_PICTURE_TIMING:
         {
-            int ret = decode_pic_timing(s, size);
+            int ret = decode_pic_timing(s);
             av_log(s->avctx, AV_LOG_DEBUG, "Skipped PREFIX SEI %d\n", type);
+            skip_bits(gb, 8 * size);
             return ret;
         }
     case SEI_TYPE_MASTERING_DISPLAY_INFO:
@@ -344,15 +341,11 @@ static int decode_nal_sei_message(HEVCContext *s)
     av_log(s->avctx, AV_LOG_DEBUG, "Decoding SEI\n");
 
     while (byte == 0xFF) {
-        if (get_bits_left(gb) < 16 || payload_type > INT_MAX - 255)
-            return AVERROR_INVALIDDATA;
         byte          = get_bits(gb, 8);
         payload_type += byte;
     }
     byte = 0xFF;
     while (byte == 0xFF) {
-        if (get_bits_left(gb) < 8 + 8LL*payload_size)
-            return AVERROR_INVALIDDATA;
         byte          = get_bits(gb, 8);
         payload_size += byte;
     }

libavcodec/hevcdec.c

@@ -138,7 +138,7 @@ fail:
     return AVERROR(ENOMEM);
 }
 
-static int pred_weight_table(HEVCContext *s, GetBitContext *gb)
+static void pred_weight_table(HEVCContext *s, GetBitContext *gb)
 {
     int i = 0;
     int j = 0;
@@ -181,12 +181,6 @@ static int pred_weight_table(HEVCContext *s, GetBitContext *gb)
             for (j = 0; j < 2; j++) {
                 int delta_chroma_weight_l0 = get_se_golomb(gb);
                 int delta_chroma_offset_l0 = get_se_golomb(gb);
-
-                if (   (int8_t)delta_chroma_weight_l0 != delta_chroma_weight_l0
-                    || delta_chroma_offset_l0 < -(1<<17) || delta_chroma_offset_l0 > (1<<17)) {
-                    return AVERROR_INVALIDDATA;
-                }
-
                 s->sh.chroma_weight_l0[i][j] = (1 << s->sh.chroma_log2_weight_denom) + delta_chroma_weight_l0;
                 s->sh.chroma_offset_l0[i][j] = av_clip((delta_chroma_offset_l0 - ((128 * s->sh.chroma_weight_l0[i][j])
                                                                                     >> s->sh.chroma_log2_weight_denom) + 128), -128, 127);
@@ -223,12 +217,6 @@ static int pred_weight_table(HEVCContext *s, GetBitContext *gb)
                 for (j = 0; j < 2; j++) {
                     int delta_chroma_weight_l1 = get_se_golomb(gb);
                     int delta_chroma_offset_l1 = get_se_golomb(gb);
-
-                    if (   (int8_t)delta_chroma_weight_l1 != delta_chroma_weight_l1
-                        || delta_chroma_offset_l1 < -(1<<17) || delta_chroma_offset_l1 > (1<<17)) {
-                        return AVERROR_INVALIDDATA;
-                    }
-
                     s->sh.chroma_weight_l1[i][j] = (1 << s->sh.chroma_log2_weight_denom) + delta_chroma_weight_l1;
                     s->sh.chroma_offset_l1[i][j] = av_clip((delta_chroma_offset_l1 - ((128 * s->sh.chroma_weight_l1[i][j])
                                                                                         >> s->sh.chroma_log2_weight_denom) + 128), -128, 127);
@@ -241,7 +229,6 @@ static int pred_weight_table(HEVCContext *s, GetBitContext *gb)
             }
         }
     }
-    return 0;
 }
 
 static int decode_lt_rps(HEVCContext *s, LongTermRPS *rps, GetBitContext *gb)
@@ -260,8 +247,6 @@ static int decode_lt_rps(HEVCContext *s, LongTermRPS *rps, GetBitContext *gb)
         nb_sps = get_ue_golomb_long(gb);
     nb_sh = get_ue_golomb_long(gb);
 
-    if (nb_sps > sps->num_long_term_ref_pics_sps)
-        return AVERROR_INVALIDDATA;
     if (nb_sh + (uint64_t)nb_sps > FF_ARRAY_ELEMS(rps->poc))
         return AVERROR_INVALIDDATA;
 
@@ -285,16 +270,12 @@ static int decode_lt_rps(HEVCContext *s, LongTermRPS *rps, GetBitContext *gb)
 
         delta_poc_msb_present = get_bits1(gb);
         if (delta_poc_msb_present) {
-            int64_t delta = get_ue_golomb_long(gb);
-            int64_t poc;
+            int delta = get_ue_golomb_long(gb);
 
             if (i && i != nb_sps)
                 delta += prev_delta_msb;
 
-            poc = rps->poc[i] + s->poc - delta * max_poc_lsb - s->sh.pic_order_cnt_lsb;
-            if (poc != (int32_t)poc)
-                return AVERROR_INVALIDDATA;
-            rps->poc[i] = poc;
+            rps->poc[i] += s->poc - delta * max_poc_lsb - s->sh.pic_order_cnt_lsb;
             prev_delta_msb = delta;
         }
     }
@@ -604,7 +585,7 @@ static int hls_slice_header(HEVCContext *s)
         }
 
         /* 8.3.1 */
-        if (sh->first_slice_in_pic_flag && s->temporal_id == 0 &&
+        if (s->temporal_id == 0 &&
             s->nal_unit_type != HEVC_NAL_TRAIL_N &&
             s->nal_unit_type != HEVC_NAL_TSA_N   &&
             s->nal_unit_type != HEVC_NAL_STSA_N  &&
@@ -695,9 +676,7 @@ static int hls_slice_header(HEVCContext *s)
 
             if ((s->ps.pps->weighted_pred_flag   && sh->slice_type == HEVC_SLICE_P) ||
                 (s->ps.pps->weighted_bipred_flag && sh->slice_type == HEVC_SLICE_B)) {
-                int ret = pred_weight_table(s, gb);
-                if (ret < 0)
-                    return ret;
+                pred_weight_table(s, gb);
             }
 
             sh->max_num_merge_cand = 5 - get_ue_golomb_long(gb);
@@ -2792,25 +2771,25 @@ static int decode_nal_unit(HEVCContext *s, const H2645NAL *nal)
         if (ret < 0)
             return ret;
 
-        if (s->sh.first_slice_in_pic_flag) {
-            if (s->max_ra == INT_MAX) {
-                if (s->nal_unit_type == HEVC_NAL_CRA_NUT || IS_BLA(s)) {
-                    s->max_ra = s->poc;
-                } else {
-                    if (IS_IDR(s))
-                        s->max_ra = INT_MIN;
-                }
-            }
-
-            if ((s->nal_unit_type == HEVC_NAL_RASL_R || s->nal_unit_type == HEVC_NAL_RASL_N) &&
-                s->poc <= s->max_ra) {
-                s->is_decoded = 0;
-                break;
+        if (s->max_ra == INT_MAX) {
+            if (s->nal_unit_type == HEVC_NAL_CRA_NUT || IS_BLA(s)) {
+                s->max_ra = s->poc;
             } else {
-                if (s->nal_unit_type == HEVC_NAL_RASL_R && s->poc > s->max_ra)
+                if (IS_IDR(s))
                     s->max_ra = INT_MIN;
             }
+        }
 
+        if ((s->nal_unit_type == HEVC_NAL_RASL_R || s->nal_unit_type == HEVC_NAL_RASL_N) &&
+            s->poc <= s->max_ra) {
+            s->is_decoded = 0;
+            break;
+        } else {
+            if (s->nal_unit_type == HEVC_NAL_RASL_R && s->poc > s->max_ra)
+                s->max_ra = INT_MIN;
+        }
+
+        if (s->sh.first_slice_in_pic_flag) {
             ret = hevc_frame_start(s);
             if (ret < 0)
                 return ret;
@@ -2995,7 +2974,7 @@ static int verify_md5(HEVCContext *s, AVFrame *frame)
     return 0;
 }
 
-static int hevc_decode_extradata(HEVCContext *s, uint8_t *buf, int length, int first)
+static int hevc_decode_extradata(HEVCContext *s, uint8_t *buf, int length)
 {
     AVCodecContext *avctx = s->avctx;
     GetByteContext gb;
@@ -3057,7 +3036,7 @@ static int hevc_decode_extradata(HEVCContext *s, uint8_t *buf, int length, int f
 
     /* export stream parameters from the first SPS */
     for (i = 0; i < FF_ARRAY_ELEMS(s->ps.sps_list); i++) {
-        if (first && s->ps.sps_list[i]) {
+        if (s->ps.sps_list[i]) {
             const HEVCSPS *sps = (const HEVCSPS*)s->ps.sps_list[i]->data;
             export_stream_params(s->avctx, &s->ps, sps);
             break;
@@ -3087,7 +3066,7 @@ static int hevc_decode_frame(AVCodecContext *avctx, void *data, int *got_output,
     new_extradata = av_packet_get_side_data(avpkt, AV_PKT_DATA_NEW_EXTRADATA,
                                             &new_extradata_size);
     if (new_extradata && new_extradata_size > 0) {
-        ret = hevc_decode_extradata(s, new_extradata, new_extradata_size, 0);
+        ret = hevc_decode_extradata(s, new_extradata, new_extradata_size);
         if (ret < 0)
             return ret;
     }
@@ -3370,7 +3349,7 @@ static av_cold int hevc_decode_init(AVCodecContext *avctx)
         s->threads_number = 1;
 
     if (avctx->extradata_size > 0 && avctx->extradata) {
-        ret = hevc_decode_extradata(s, avctx->extradata, avctx->extradata_size, 1);
+        ret = hevc_decode_extradata(s, avctx->extradata, avctx->extradata_size);
         if (ret < 0) {
             hevc_decode_free(avctx);
             return ret;

libavcodec/hevcdsp_template.c

@@ -121,7 +121,7 @@ static void FUNC(dequant)(int16_t *coeffs, int16_t log2_size)
     } else {
         for (y = 0; y < size; y++) {
             for (x = 0; x < size; x++) {
-                *coeffs = *(uint16_t*)coeffs << -shift;
+                *coeffs = *coeffs << -shift;
                 coeffs++;
             }
         }
@@ -593,7 +593,7 @@ static void FUNC(put_hevc_pel_bi_w_pixels)(uint8_t *_dst, ptrdiff_t _dststride,
     ox1     = ox1 * (1 << (BIT_DEPTH - 8));
     for (y = 0; y < height; y++) {
         for (x = 0; x < width; x++) {
-            dst[x] = av_clip_pixel(( (src[x] << (14 - BIT_DEPTH)) * wx1 + src2[x] * wx0 + (ox0 + ox1 + 1) * (1 << log2Wd)) >> (log2Wd + 1));
+            dst[x] = av_clip_pixel(( (src[x] << (14 - BIT_DEPTH)) * wx1 + src2[x] * wx0 + ((ox0 + ox1 + 1) << log2Wd)) >> (log2Wd + 1));
         }
         src  += srcstride;
         dst  += dststride;
@@ -915,7 +915,7 @@ static void FUNC(put_hevc_qpel_bi_w_h)(uint8_t *_dst, ptrdiff_t _dststride, uint
     for (y = 0; y < height; y++) {
         for (x = 0; x < width; x++)
             dst[x] = av_clip_pixel(((QPEL_FILTER(src, 1) >> (BIT_DEPTH - 8)) * wx1 + src2[x] * wx0 +
-                                    ((ox0 + ox1 + 1) * (1 << log2Wd))) >> (log2Wd + 1));
+                                    ((ox0 + ox1 + 1) << log2Wd)) >> (log2Wd + 1));
         src  += srcstride;
         dst  += dststride;
         src2 += MAX_PB_SIZE;
@@ -970,7 +970,7 @@ static void FUNC(put_hevc_qpel_bi_w_v)(uint8_t *_dst, ptrdiff_t _dststride, uint
     for (y = 0; y < height; y++) {
         for (x = 0; x < width; x++)
             dst[x] = av_clip_pixel(((QPEL_FILTER(src, srcstride) >> (BIT_DEPTH - 8)) * wx1 + src2[x] * wx0 +
-                                    ((ox0 + ox1 + 1) * (1 << log2Wd))) >> (log2Wd + 1));
+                                    ((ox0 + ox1 + 1) << log2Wd)) >> (log2Wd + 1));
         src  += srcstride;
         dst  += dststride;
         src2 += MAX_PB_SIZE;
@@ -1051,7 +1051,7 @@ static void FUNC(put_hevc_qpel_bi_w_hv)(uint8_t *_dst, ptrdiff_t _dststride, uin
     for (y = 0; y < height; y++) {
         for (x = 0; x < width; x++)
             dst[x] = av_clip_pixel(((QPEL_FILTER(tmp, MAX_PB_SIZE) >> 6) * wx1 + src2[x] * wx0 +
-                                    ((ox0 + ox1 + 1) * (1 << log2Wd))) >> (log2Wd + 1));
+                                    ((ox0 + ox1 + 1) << log2Wd)) >> (log2Wd + 1));
         tmp  += MAX_PB_SIZE;
         dst  += dststride;
         src2 += MAX_PB_SIZE;
@@ -1355,7 +1355,7 @@ static void FUNC(put_hevc_epel_bi_w_h)(uint8_t *_dst, ptrdiff_t _dststride, uint
     for (y = 0; y < height; y++) {
         for (x = 0; x < width; x++)
             dst[x] = av_clip_pixel(((EPEL_FILTER(src, 1) >> (BIT_DEPTH - 8)) * wx1 + src2[x] * wx0 +
-                                    ((ox0 + ox1 + 1) * (1 << log2Wd))) >> (log2Wd + 1));
+                                    ((ox0 + ox1 + 1) << log2Wd)) >> (log2Wd + 1));
         src  += srcstride;
         dst  += dststride;
         src2 += MAX_PB_SIZE;
@@ -1407,7 +1407,7 @@ static void FUNC(put_hevc_epel_bi_w_v)(uint8_t *_dst, ptrdiff_t _dststride, uint
     for (y = 0; y < height; y++) {
         for (x = 0; x < width; x++)
             dst[x] = av_clip_pixel(((EPEL_FILTER(src, srcstride) >> (BIT_DEPTH - 8)) * wx1 + src2[x] * wx0 +
-                                    ((ox0 + ox1 + 1) * (1 << log2Wd))) >> (log2Wd + 1));
+                                    ((ox0 + ox1 + 1) << log2Wd)) >> (log2Wd + 1));
         src  += srcstride;
         dst  += dststride;
         src2 += MAX_PB_SIZE;
@@ -1486,7 +1486,7 @@ static void FUNC(put_hevc_epel_bi_w_hv)(uint8_t *_dst, ptrdiff_t _dststride, uin
     for (y = 0; y < height; y++) {
         for (x = 0; x < width; x++)
             dst[x] = av_clip_pixel(((EPEL_FILTER(tmp, MAX_PB_SIZE) >> 6) * wx1 + src2[x] * wx0 +
-                                    ((ox0 + ox1 + 1) * (1 << log2Wd))) >> (log2Wd + 1));
+                                    ((ox0 + ox1 + 1) << log2Wd)) >> (log2Wd + 1));
         tmp  += MAX_PB_SIZE;
         dst  += dststride;
         src2 += MAX_PB_SIZE;

libavcodec/hevcpred_template.c

@@ -35,7 +35,7 @@ static av_always_inline void FUNC(intra_pred)(HEVCContext *s, int x0, int y0,
 #define MVF(x, y) \
     (s->ref->tab_mvf[(x) + (y) * min_pu_width])
 #define MVF_PU(x, y) \
-    MVF(PU(x0 + ((x) * (1 << hshift))), PU(y0 + ((y) * (1 << vshift))))
+    MVF(PU(x0 + ((x) << hshift)), PU(y0 + ((y) << vshift)))
 #define IS_INTRA(x, y) \
     (MVF_PU(x, y).pred_flag == PF_INTRA)
 #define MIN_TB_ADDR_ZS(x, y) \

libavcodec/hq_hqa.c

@@ -68,11 +68,11 @@ static int hq_decode_block(HQContext *c, GetBitContext *gb, int16_t block[64],
     memset(block, 0, 64 * sizeof(*block));
 
     if (!is_hqa) {
-        block[0] = get_sbits(gb, 9) * 64;
+        block[0] = get_sbits(gb, 9) << 6;
         q = ff_hq_quants[qsel][is_chroma][get_bits(gb, 2)];
     } else {
         q = ff_hq_quants[qsel][is_chroma][get_bits(gb, 2)];
-        block[0] = get_sbits(gb, 9) * 64;
+        block[0] = get_sbits(gb, 9) << 6;
     }
 
     for (;;) {
@@ -83,7 +83,7 @@ static int hq_decode_block(HQContext *c, GetBitContext *gb, int16_t block[64],
         pos += ff_hq_ac_skips[val];
         if (pos >= 64)
             break;
-        block[ff_zigzag_direct[pos]] = (int)(ff_hq_ac_syms[val] * (unsigned)q[pos]) >> 12;
+        block[ff_zigzag_direct[pos]] = (ff_hq_ac_syms[val] * q[pos]) >> 12;
         pos++;
     }
 

libavcodec/hqxdsp.c

@@ -39,18 +39,18 @@ static inline void idct_col(int16_t *blk, const uint8_t *quant)
     s6 = (int) blk[6 * 8] * quant[6 * 8];
     s7 = (int) blk[7 * 8] * quant[7 * 8];
 
-    t0  =  (int)(s3 * 19266U + s5 * 12873U) >> 15;
-    t1  =  (int)(s5 * 19266U - s3 * 12873U) >> 15;
-    t2  = ((int)(s7 * 4520U  + s1 * 22725U) >> 15) - t0;
-    t3  = ((int)(s1 * 4520U  - s7 * 22725U) >> 15) - t1;
+    t0  =  (s3 * 19266 + s5 * 12873) >> 15;
+    t1  =  (s5 * 19266 - s3 * 12873) >> 15;
+    t2  = ((s7 * 4520  + s1 * 22725) >> 15) - t0;
+    t3  = ((s1 * 4520  - s7 * 22725) >> 15) - t1;
     t4  = t0 * 2 + t2;
     t5  = t1 * 2 + t3;
     t6  = t2 - t3;
     t7  = t3 * 2 + t6;
-    t8  = (int)(t6 * 11585U) >> 14;
-    t9  = (int)(t7 * 11585U) >> 14;
-    tA  = (int)(s2 * 8867U - s6 * 21407U) >> 14;
-    tB  = (int)(s6 * 8867U + s2 * 21407U) >> 14;
+    t8  = (t6 * 11585) >> 14;
+    t9  = (t7 * 11585) >> 14;
+    tA  = (s2 * 8867 - s6 * 21407) >> 14;
+    tB  = (s6 * 8867 + s2 * 21407) >> 14;
     tC  = (s0 >> 1) - (s4 >> 1);
     tD  = (s4 >> 1) * 2 + tC;
     tE  = tC - (tA >> 1);

libavcodec/htmlsubtitles.c

@@ -46,17 +46,15 @@ typedef struct SrtStack {
 
 static void rstrip_spaces_buf(AVBPrint *buf)
 {
-    if (av_bprint_is_complete(buf))
-        while (buf->len > 0 && buf->str[buf->len - 1] == ' ')
-            buf->str[--buf->len] = 0;
+    while (buf->len > 0 && buf->str[buf->len - 1] == ' ')
+        buf->str[--buf->len] = 0;
 }
 
-int ff_htmlmarkup_to_ass(void *log_ctx, AVBPrint *dst, const char *in)
+void ff_htmlmarkup_to_ass(void *log_ctx, AVBPrint *dst, const char *in)
 {
     char *param, buffer[128], tmp[128];
     int len, tag_close, sptr = 1, line_start = 1, an = 0, end = 0;
     SrtStack stack[16];
-    int closing_brace_missing = 0;
 
     stack[0].tag[0] = 0;
     strcpy(stack[0].param[PARAM_SIZE],  "{\\fs}");
@@ -84,20 +82,11 @@ int ff_htmlmarkup_to_ass(void *log_ctx, AVBPrint *dst, const char *in)
                         and all microdvd like styles such as {Y:xxx} */
             len = 0;
             an += sscanf(in, "{\\an%*1u}%n", &len) >= 0 && len > 0;
-
-            if (!closing_brace_missing) {
-                if (   (an != 1 && in[1] == '\\')
-                    || (in[1] && strchr("CcFfoPSsYy", in[1]) && in[2] == ':')) {
-                    char *bracep = strchr(in+2, '}');
-                    if (bracep) {
-                        in = bracep;
-                        break;
-                    } else
-                        closing_brace_missing = 1;
-                }
-            }
-
-            av_bprint_chars(dst, *in, 1);
+            if ((an != 1 && (len = 0, sscanf(in, "{\\%*[^}]}%n", &len) >= 0 && len > 0)) ||
+                (len = 0, sscanf(in, "{%*1[CcFfoPSsYy]:%*[^}]}%n", &len) >= 0 && len > 0)) {
+                in += len - 1;
+            } else
+                av_bprint_chars(dst, *in, 1);
             break;
         case '<':
             tag_close = in[1] == '/';
@@ -182,13 +171,8 @@ int ff_htmlmarkup_to_ass(void *log_ctx, AVBPrint *dst, const char *in)
             line_start = 0;
     }
 
-    if (!av_bprint_is_complete(dst))
-        return AVERROR(ENOMEM);
-
     while (dst->len >= 2 && !strncmp(&dst->str[dst->len - 2], "\\N", 2))
         dst->len -= 2;
     dst->str[dst->len] = 0;
     rstrip_spaces_buf(dst);
-
-    return 0;
 }