Bump minor versions after branching 4.3

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-06-08 22:49:04 +02:00
387 changed files with 2352 additions and 4578 deletions
--- a/702
+++ b/702
@@ -1,708 +1,6 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.

-version 4.3.4:
- fate: update reference files after the recent dash manifest muxer changes
- avformat/webmdashenc: fix on-demand profile string
- Update for FFmpeg 4.3.4
- avcodec/diracdec: avoid signed integer overflow in global mv
- avcodec/takdsp: Fix integer overflow in decorrelate_sf()
- avcodec/apedec: fix a integer overflow in long_filter_high_3800()
- avfilter/vf_subtitles: pass storage size to libass
- avformat/aqtitledec: Skip unrepresentable durations
- avformat/cafdec: Do not store empty keys in read_info_chunk()
- avformat/mxfdec: Do not clear array in mxf_read_strong_ref_array() before writing
- avformat/mxfdec: Check for avio_read() failure in mxf_read_strong_ref_array()
- avformat/mxfdec: Check count in mxf_read_strong_ref_array()
- avformat/hls: Check target_duration
- avcodec/pixlet: Avoid signed integer overflow in scaling in filterfn()
- avformat/matroskadec: Check pre_ns
- avcodec/sonic: Use unsigned for predictor_k to avoid undefined behavior
- avcodec/mjpegbdec: Set buf_size
- avformat/matroskadec: Use rounded down duration in get_cue_desc() check
- avcodec/g729_parser: Check channels
- avformat/avidec: Check height
- avformat/rmdec: Better duplicate tags check
- avformat/mov: Disallow empty sidx
- avformat/matroskadec: Check duration
- avformat/mov: Corner case encryption error cleanup in mov_read_senc()
- avcodec/jpeglsdec: Fix if( code style
- avcodec/jpeglsdec: Check get_ur_golomb_jpegls() for error
- avcodec/motion_est: fix indention of ff_get_best_fcode()
- avcodec/motion_est: Fix xy indexing on range violation in ff_get_best_fcode()
- avcodec/jpeglsdec: Increase range for N in ls_get_code_runterm() by using unsigned
- avformat/matroskadec: Check desc_bytes
- avformat/utils: Fix invalid NULL pointer operation in ff_parse_key_value()
- avformat/matroskadec: Fix infinite loop with bz decompression
- avformat/mov: Check size before subtraction
- avcodec/apedec: Fix integer overflows in predictor_update_3930()
- avcodec/apedec: fix integer overflow in 8bit samples
- avformat/flvdec: timestamps cannot use the full int64 range
- avcodec/vqavideo: reset accounting on error
- avcodec/alacdsp: fix integer overflow in decorrelate_stereo()
- avformat/4xm: Check for duplicate track ids
- avformat/4xm: Consider max_streams on reallocating tracks array
- avformat/mov: Check next offset in mov_read_dref()
- avformat/vivo: Favor setting fps from explicit fractions
- avformat/vivo: Do not use the general expression evaluator for parsing a floating point value
- avformat/mxfdec: Check for duplicate mxf_read_index_entry_array()
- avcodec/apedec: Change avg to uint32_t
- avformat/mov: Disallow duplicate smdm
- avformat/mov: Check for EOF in mov_read_glbl()
- avcodec/vp3: Check version in all cases when VP4 code is not built
- avformat/mov: Check channels for mov_parse_stsd_audio()
- avformat/avidec: Check read_odml_index() for failure
- avformat/aiffdec: Use av_rescale() for bitrate
- avformat/aiffdec: sanity check block_align
- avformat/aiffdec: Check sample_rate
- avcodec/flac_parser: Consider AV_INPUT_BUFFER_PADDING_SIZE
- avcodec/libdav1d: free the Dav1dData packet on dav1d_send_data() failure
- configure: Add missing libshine->mpegaudioheader dependency
-
-version 4.3.3:
- avcodec/ttadsp: Fix integer overflows in tta_filter_process_c()
- avutil/mathematics: Document av_rescale_rnd() behavior on non int64 results
- avformat/matroskadec: Reset state also on failure in matroska_reset_status()
- avformat/wavdec: Check smv_block_size
- avformat/rmdec: Check for multiple audio_stream_info
- avcodec/apedec: Use 64bit to avoid overflow
- avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830()
- oavformat/avidec: Check offset in odml
- avformat/mpegts: use actually read packet size in mpegts_resync special case
- avfilter/scale_npp: fix non-aligned output frame dimensions
- Update for 4.3.3
- swscale/alphablend: Fix slice handling
- avcodec/apedec: Fix integer overflow in filter_fast_3320()
- avcodec/mxpegdec: Check for AVDISCARD_ALL
- avcodec/flicvideo: Check remaining bytes in FLI*COPY
- avcodec/cbs_h265_syntax_template: Limit sps_num_palette_predictor_initializer_minus1 to 127
- avcodec/snowdec: Maintain avmv buffer
- avcodec/mpeg12dec: Do not put mpeg_f_code into an invalid state on error return
- avcodec/mpegvideo_enc: Limit bitrate tolerance to the representable
- avcodec/apedec: Fix integer overflow in intermediate
- avformat/mvdec: Do not set invalid sample rate
- avformat/sbgdec: Check for t0 overflow in expand_tseq()
- avformat/rmdec: Use 64bit for intermediate for DEINT_ID_INT4
- avformat/sbgdec: Check opt_duration and start for overflow
- avformat/mov: Check for duplicate clli
- avformat/jacosubdec: Check for min in t overflow in get_shift()
- avformat/mxfdec: check channel number in mxf_get_d10_aes3_packet()
- avcodec/utils: don't return negative values in av_get_audio_frame_duration()
- avcodec/jpeg2000dec: Check that atom header is within bytsetream
- avcodec/apedec: Fix 2 integer overflows in filter_3800()
- avcodec/xpmdec: Move allocations down after more error checks
- avformat/mov: Check dts for overflow in mov_read_trun()
- avformat/avidec: Use 64bit for frame number in odml index parsing
- avcodec/mjpegbdec: Skip SOS on AVDISCARD_ALL as does mjpeg
- avcodec/mjpegdec: Check for bits left in mjpeg_decode_scan_progressive_ac()
- avformat/adtsenc: return value check for init_get_bits in adts_decode_extradata
- avcodec/webp: Check available space in loop in decode_entropy_coded_image()
- avcodec/h264dec: use picture parameters in ff_print_debug_info2()
- avcodec/vc1dec: ff_print_debug_info() does not support WMV3 field_mode
- avcodec/frame_thread_encoder: Free AVCodecContext structure on error during init
- avcodec/faxcompr: Check for end of input in cmode == 1 in decode_group3_2d_line()
- avcodec/vc1dec: Disable error concealment for *IMAGE
- avcodec/sbrdsp_fixed: Fix negation overflow in sbr_neg_odd_64_c()
- avformat/wtvdec: Check for EOF before seeking back in parse_media_type()
- avformat/mpc8: Check first keyframe position for overflow
- avformat/wavdec: Use 64bit in new_pos computation
- avformat/sbgdec: Check for overflow in timestamp preparation
- avformat/dsicin: Check packet size for overflow
- avformat/dsfdec: Change order of operations in bitrate computation
- avformat/bfi: check nframes
- avformat/avidec: fix position overflow in avi_load_index()
- avformat/asfdec_f: Check sizeX against padding
- avformat/aiffdec: Check for size overflow in header parsing
- avcodec/aaccoder: Add minimal bias in search_for_ms()
- avformat/mov: Avoid undefined overflow in time_offset calculation
- avfilter/af_drmeter: Check that there is data
- avfilter/vf_fftdnoiz: Use lrintf() in export_row8()
- avfilter/vf_mestimate: Check b_count
- avformat/mov: do not ignore errors in mov_metadata_hmmt()
- avformat/mxfdec: Check size for shrinking
- avcodec/dnxhddec: check and propagate function return value
- swscale/slice: Fix wrong return on error
- avcodec/aacdec_template: Avoid some invalid values to be set by decode_audio_specific_config_gb()
- swscale/slice: Check slice for allocation failure
- avformat/matroskadec: Fix handling of huge default durations
- avcodec/lpc: check for zero err in normalization in compute_lpc_coefs()
- avformat/ftp: Check for av_strtok() failure
- tools/cws2fws: Check read() for failure
- avcodec/cpia: Fix missing src_size update
- avcodec/clearvideo: Check tile_size to be not too large
- avcodec/utils: Use 64bit for intermediate in AV_CODEC_ID_ADPCM_THP* duration calculation
- avformat/rmdec: Check old_format len for overflow
- avformat/realtextdec: Check the pts difference before using it for the duration computation
- avformat/qcp: Avoid negative nb_rates
- avformat/nutdec: Check tmp_size
- avformat/msf: Check that channels doesnt overflow during extradata construction
- avformat/mpc8: Check for position overflow in mpc8_handle_chunk()
- avformat/iff: Use 64bit in duration computation
- avformat/dxa: Check fps to be within the supported range more precissely
- avcodec/iff: Only write palette to plane 1 if its PAL8
- avformat/tta: Check for EOF in index reading loop
- Update missed irc links
- avformat/rpl: The associative law doesnt hold for signed integers in C
- avcodec/faxcompr: Check available bits in decode_uncompressed()
- avcodec/faxcompr: Check if bits are available before reading in cmode == 9 || cmode == 10
- avformat/utils: check dts/duration to be representable before using them
- avcodec/utils: do "calc from frame_bytes, channels, and block_align" in 64bit
- avcodec/ttadata: Add sentinel at the end of ff_tta_shift_1
- avformat/mov: Check for duplicate mdcv
- avfilter/vf_dctdnoiz: Check threads
- avfilter/vf_ciescope: Fix undefined behavior in rgb_to_xy() with black
- avformat/rpl: Check for EOF and zero framesize
- avcodec/vc2enc: Check for non negative slice bounds
- avformat/rpl: Use 64bit in bitrate computation and check it
- avcodec/svq1enc: Do not print debug RD value before it has been computed
- avcodec/aacpsy: Check bandwidth
- avcodec/aacenc: Do not divide by lambda_count if it is 0
- avcodec/aacenc: Use FLT_EPSILON for lambda minimum
- avformat/cinedec: Fix index_entries size check
- avfilter/vf_yadif: Fix handing of tiny images
- avfilter/vf_vmafmotion: Check dimensions
- avformat/movenc: Check pal_size before use
- avcodec/lpc: Avoid floating point division by 0
- avcodec/aacpsy: Avoid floating point division by 0 of norm_fac
- avcodec/aacenc: Avoid 0 lambda
- avcodec/exr: x/ymax cannot be INT_MAX
- avformat/avio: Check av_opt_copy() for failure
- avcodec/clearvideo: Check for 0 tile_shift
- avcodec/vc1: Check remaining bits in ff_vc1_parse_frame_header()
- avformat/mov: Ignore duplicate CoLL
- avformat/mov: Limit nb_chapter_tracks to input size
- avformat/utils: Use 64bit earlier in r_frame_rate check
- avcodec/alsdec: Fix decoding error with mono audio files
- avformat/mvdec: Check sample rate in parse_audio_var()
- avcodec/faxcompr: Check for end of bitstream in decode_group3_1d_line() and decode_group3_2d_line()
- avcodec/utils: treat PAL8 for jpegs similar to other colorspaces
- avcodec/jpeglsdec: Set alpha plane in PAL8 so image is not 100% transparent
- avformat/asfdec_o: Use ff_get_extradata()
- avformat/id3v2: Check end for overflow in id3v2_parse()
- avformat/wtvdec: Improve size overflow checks in parse_chunks()
- avcodec/faxcompr: Check remaining bits on error in decode_group3_1d_line()
- avcodec/utils: Check ima wav duration for overflow
- avcodec/rv10: Execute whole size check earlier for rv20
- avformat/cafdec: Check channels
- avcodec/dpx: Check bits_per_color earlier
- avformat/mvi: Check audio_data_size to be non negative
- avcodec/pnm_parser: Check image size addition for overflow
- avcodec/h265_metadata_bsf: Check nb_units before accessing the first in h265_metadata_update_fragment()
- avformat/rmdec: use larger intermediate type for audio_framesize * sub_packet_h check
- avcodec/h264_slice: Check input SPS in ff_h264_update_thread_context()
- avformat/mpc8: check for size overflow in mpc8_get_chunk_header()
- avformat/mov: Do not zero memory that is written too or unused
- avcodec/mpegvideo: Update chroma_?_shift in ff_mpv_common_frame_size_change()
- avformat/mov: Ignore multiple STSC / STCO
- avformat/utils: Extend overflow check in dts wrap in compute_pkt_fields()
- avfilter/vf_scale: Fix adding 0 to NULL (which is UB) in scale_slice()
- avutil/common: Add FF_PTR_ADD()
- avformat/wtvdec: Check size in SBE2_STREAM_DESC_EVENT / stream2_guid
- tools/target_dec_fuzzer: Adjust threshold for H264
- avformat/cafdec: Do not build an index if all packets are the same
- avformat/vividas: Use equals check with n in read_sb_block()
- avcodec/sonic: Use unsigned temporary in predictor_calc_error()
- avformat/jacosubdec: Use 64bit intermediate for start/end timestamp shift
- avformat/flvdec: Check array entry number
- avcodec/h264_slice: Check sps in h264_slice_header_init()
- avformat/movenc: Avoid loosing cluster array on failure
- avformat/avidec: Check for dv streams before using priv_data in parse ##dc/##wb
- avformat/mov: Check sample size for overflow in mov_parse_stsd_audio()
- avformat/sbgdec: Check for overflow in last loop in expand_timestamps()
- avcodec/ffwavesynth: Avoid signed integer overflow in phi_at()
- avcodec/mpeg4videoenc: Check extradata malloc()
- avcodec/speedhq: Width < 8 is not supported
- avformat/matroskadec: Check for EOF in resync loop
- avcodec/utils: Use more bits for intermediate for AV_CODEC_ID_ADPCM_MS
- avcodec/jpegls: Check A[Q] for overflow in ff_jpegls_update_state_regular()
- avformat/voc_packet: prevent remaining size from becoming negative in ff_voc_get_packet()
- avutil/timecode: Avoid fps overflow
- avformat/mvi: Check audio size for more overflows
- avcodec/flacdec: Avoid undefined shift in error case
- avcodec/ffv1dec: Check if trailer is available
- avcodec/4xm: Check pre_gb in decode_i_block()
- avformat/mvdec: Allocate extradata only once
- avcodec/dcadsp: Fix integer overflow in dmix_add_c()
- avformat/flvdec: Check double before cast in parse_keyframes_index()
- avformat/paf: Check for EOF before allocation in read_header()
- avcodec/aacdec_template: Avoid undefined negation in imdct_and_windowing_eld()
- avformat/lxfdec: Fix multiple integer overflows related to track_size
- avcodec/exr: skip bottom clearing loop when its outside the image
- avutil/parseutils: Check sign in av_parse_time()
- avformat/aiffdec: Check that SSND is at least 8 bytes
- avformat/dcstr: Check sample rate
- avcodec/alsdec: Check bitstream input in read_block()
- avformat/mov: Extend data_size check in mov_read_udta_string()
- avformat/aadec: Check for EOF while reading chapters
- avformat/voc_packet: Add a basic check on max_size
- avformat/microdvddec: use 64bit for durations
- avcodec/h264_slice: clear old slice POC values on parsing failure
- avfilter/overlay_cuda: check av_buffer_ref result
- avfilter/overlay_cuda: hold explicit reference to hw_device_ctx
- avformat/url: add ff_make_absolulte_url2 to be able to test windows path cases
- avformat/url: fix ff_make_absolute_url with Windows file paths
- Revert "avcodec: Add FF_CODEC_CAP_INIT_CLEANUP"
- fftools/ffplay: do not write out of rdft visualization texture
- avfilter/overlay_cuda: fix framesync with embedded PGS subtitle
- avcodec/mxpegdec: Fix memleaks upon init failure
- avcodec/mjpegdec: Fix memleak upon init failure
- avfilter/af_headphone: Fix stack buffer overflow
- avfilter/af_headphone: Don't overrun array
- avfilter/af_headphone: Fix segfault when using very short streams
- avfilter/af_headphone: Check for the existence of samples
- avfilter/af_headphone: Remove always true check
- avfilter/af_headphone: Don't use uninitialized buffer in log message
- avformat/segment: Fix error messages
- avformat/segment: Free SegmentListEntries in deinit, not write_trailer
- avformat/segment: Fix leak and invalid free of AVIOContext
- avformat/segment: Fix leak of string on error
- avformat/segment: Fix segfault when error happens and segment list is output
- avformat/segment: Fix segfault on allocation error, avoid allocation
- avformat/segment: Fix leak of duration/framenumber lists upon error
- avformat/segment: Don't overwrite AVCodecParameters after init
- avformat/dashdec: Reset pointer to NULL after freeing it
- libavformat/dashdec: Fix issue with dash on Windows
- avformat/dashdec: Fix memleak on allocation error, avoid allocation
- avformat/dashdec: Fix memleaks on error to add representation to dynarray
- avformat/dashdec: Fix leak of representation languages
- avformat/dashdec: Fix leak of string on error when parsing representation
- avformat/dashdec: Fix leak of representation on error
- avformat/dashdec: Remove unused index of representation
- avformat/dashdec: Fix memleaks upon read_header failure
- avformat/dashdec: Check allocation of AVProgram
- avformat/dashdec, hls: Update correct pointer to AVDictionary
- avformat/dashdec: Fix leak of AVDictionary on error
- avformat/dashdec: Free subtitle representations on exit
- avformat/dashdec: Free strings as soon as they aren't needed anymore
- avformat/dashdec: Don't overwrite and leak old initialization fragments
- avformat/dashdec: Don't leave representation in inconsistent state on error
- avformat/dashdec: Remove dead code
- avformat/spdifenc: Fix leak upon error
- avformat/wavenc: Fix leak and segfault on reallocation error
- avformat/mpegenc: Avoid adding invalid packet to queue
- avformat/mpegenc: Fix leak in case trailer is never written
- avformat/mpegenc: Ensure packet queue stays valid
- avformat/mxfenc: Never set codec_ul UID to NULL
- avcodec/frame_thread_encoder: Fix segfault on allocation error
- avformat/utils: Add av_assert1 to preclude NULL + len, len != 0
- avformat/utils: Fix undefined NULL + 0
- avcodec/g722enc: Validate parameters before using them
- avcodec/g722enc: Cleanup generically on init failure
- avcodec/opusdec: Return error upon error
- avcodec/wavpack: Fix leak on init failure
- avcodec/pthread_slice: Don't use static variable, fix race
- avcodec/a64multienc: Fix memleak upon init failure
- avformat/flacenc: Fix memleak when writing attached pictures fails
- avcodec/mpeg12enc: Always initialize MPEG-2 intra VLC table lengths
- avcodec/fft_template, fft_init_table: Make ff_fft_init() thread-safe
- avformat/asfdec_o: Don't segfault with lots of attached pics
- avcodec/mss4: Fix memleaks upon allocation error
- avformat/apngdec: Fix size/overflow checks
- avformat/apngdec: Return error for incomplete header
- avformat/jacosubdec: Fix unintended fallthrough
- avcodec/bitstream: Consistently treat symbol as VLC_TYPE
- avcodec/vp3: Check allocations of VLCs
- avcodec/vp3: Fix memleak upon init failure
- avcodec/movtextenc: Fix undefined left shifts outside the range of int
- avcodec/movtextenc: Fix memleak on (re)allocation error
- avcodec/movtextenc: Don't presume every style to have a font
- avcodec/movtextenc: Reset array counter after freeing array
- avcodec/movtextenc: Fix potential use of uninitialized value
- avcodec/movtextenc: fix writing to bytestream on BE arches
- avcodec/movtextdec: Fix leaks on (re)allocation failure
- avcodec/movtextdec: Simplify checking for invalid extradata
- avcodec/movtextdec: Fix leaks of strings upon reallocation failure
- avcodec/movtextdec: Reset counter of fonts when freeing them
- avcodec/sheervideo: Don't leave context in inconsistent state upon error
- avfilter/vf_minterpolate: Fix left shift of negative value
- avfilter/vf_minterpolate: Reject too small dimensions
- avformat/movenc: Don't forget to free fragment buffers
- avformat/movenc: Free old vos_data before overwriting it
- avformat/movenc: Fix segfault when remuxing rtp hint stream
- avcodec/dvenc: Fix undefined left shift of negative numbers
- avformat/movenc: Fix stack overflow when remuxing timecode tracks
- avcodec/utils: Also free encoder extradata on avcodec_open2() error
- avcodec/utils: Don't forget cleaning up when allocating priv_data fails
- avcodec/utils: Improve check for freeing codec private options
- swresample/audioconvert: Fix left shift of negative value
- avcodec/utils: Only call codec->close if init has been called
- avformat/movenc: Fix segfault upon allocation error
- avformat/swfdec: Reorder allocations/initializations
- avformat/swfdec: Fix memleaks on error
- avformat/dashdec: Avoid double free on error
- avformat/tedcaptionsdec: Fix leak of AVBPrint upon error
- avformat/swfenc: Fix memleak upon write_header error
- avformat/rmdec: Fix potential crash on allocation failure
- avformat/rmdec: Actually return value < 0 on read_header failure
- avformat/avidec: Fix memleak when error happens after creating DV stream
- avcodec/mpegaudiodec_template: Check return value of subdecoder
- avcodec/j2kenc: Fix leaks on init failure
- avcodec/flashsv2enc: Check allocations for success before usage
- avcodec/flashsvenc: Avoid allocation of buffer, fix memleak
- avcodec/ac3enc_template: Don't free uninitialized pointers on error
- avcodec/svq3: Fix segfault on allocation error, avoid allocations
- avcodec/sonic: Fix leaks upon allocation errors
- avcodec/qtrleenc: Fix memleak upon allocation failure
- avcodec/ffv1enc: Fix memleaks on init failure
- avcodec/ffv1: Fix segfaults on allocation error
- avcodec/mlpenc: Fix memleak upon init failure
- avcodec/indeo5: Fix memleaks upon allocation error
- avcodec/ivi: Fix segfault on allocation error
- avcodec/magicyuvenc: Fix memleak upon init failure
- avcodec/gif: Fix leaks upon allocation error
- avcodec/avrndec: Fix memleak on error
- avcodec/avrndec: Check allocation for success
- avcodec/atrac1: Check allocation of AVFloatDSPContext
- avfilter/vf_subtitles: Fix leaks on failure
- avfilter/vf_uspp: Fix potential leak of dict on error
- avfilter/lavfutils: Fix memleak when avformat_find_stream_info() fails
- avfilter/lavfutils: Don't use uninitialized pointers for freeing
- avcodec/binkaudio: Don't use static storage for context-dependent data
- avcodec/bink: Fix memleak upon init failure
- avcodec/wnv1: Use LE bitstream reader, avoid copying packet, fix memleak
- avcodec/truemotion2: Avoid duplicating array, fix memleak
- avfilter/af_headphone: Fix leak of channel layouts list on error
- avfilter/af_headphone: Fix segfault upon allocation failure
- avfilter/vf_signature: Fix leak of string upon error
- avfilter/vf_signature: Fix leak of inpads' names
- avfilter/af_aiir: Fix segfault and leak upon allocation failure
- avfilter/vf_premultiply: Fix leak of names of inpads
- avfilter/af_anequalizer: Fix memleak when inserting pad fails
- avfilter/af_amerge: Fix segfault upon allocation failure
- avfilter/af_aformat: Add uninit function
- avfilter/vf_hwdownload: Fix leak of formats list upon error
- avfilter/formats: Fix double frees and memleaks on error
- avfilter/af_channelmap: Fix double-free of AVFilterChannelLayouts on error
- avfilter/vf_alphamerge: Fix double-free of AVFilterFormats on error
- avfilter/vf_overlay: Fix double-free of AVFilterFormats on error
- avfilter/vf_remap: Fix double-free of AVFilterFormats on error
- avfilter/vf_showpalette: Fix double-free of AVFilterFormats on error
- avfilter/af_amix: Fix double-free of AVFilterChannelLayouts on error
- avfilter/af_amix: Don't needlessly reallocate table
- avfilter/vf_vpp_qsv: Fix leak of AVFilterFormats on error
- avfilter/vf_paletteuse: Fix leaks of AVFilterFormats on error
- avfilter/graphparser: Fix memleak when linking filters fails
- fftools/ffmpeg: Fix leak of AVFilterInOut in case of error
- avfilter/graphparser: Check allocations for success
- avfilter/graphparser: Don't set pointer to one beyond '\0' of string
- avfilter/graphparser: Fix leaks when parsing inputs fails
- avfilter/af_afir: Fix leak of AVFilterChannelLayout in case of error
- avformat/mlvdec: Only store dimensions after having validated them
- avformat/mlvdec: Don't leak open AVIOContexts on error
- avformat/mlvdec: Check for existence of AVIOContext before using it
- avformat/hls: Fix memleak when url is empty
- avfilter/formats: Fix heap-buffer overflow when merging channel layouts
- Revert "lavfi/avfiltergraph: add check before free the format"
- avfilter/formats: Leave lists' ownership unchanged upon merge failure
- avformat/mpegts: Don't leave context in inconsistent state upon error
- avformat/sierravmd: Don't return packets for non-existing stream
- avformat/vividas: Check allocation for success
- avformat/vividas: Check return value before storing it in smaller type
- avformat/webmdashenc: Avoid allocations, fix memleak
- avformat/webmdashenc: Fix segfault when no filename is given when live
- avformat/matroskadec: Avoid undefined pointer arithmetic
- avformat/mxfdec: Fix memleak upon repeating tags
- avformat/mxfdec: Fix memleak when parsing tag fails
- avformat/mxfdec: Fix memleak when adding element to array fails
-
-
-version 4.3.2:
- avcodec/hapdec: Change compressed_offset to unsigned 32bit
- avformat/rmdec: Check codec_length without overflow
- avformat/mov: Check element count in mov_metadata_hmmt()
- avcodec/vp8: Move end check into MB loop in vp78_decode_mv_mb_modes()
- avcodec/fits: Check gcount and pcount being non negative
- avformat/nutdec: Check timebase count against main header length
- avformat/electronicarts: Clear partial_packet on error
- avformat/r3d: Check samples before computing duration
- avcodec/pnm_parser: Check av_image_get_buffer_size() for failure
- avformat/wavdec: Consider AV_INPUT_BUFFER_PADDING_SIZE in set_spdif()
- avformat/rmdec: Check remaining space in debug av_log() loop
- avformat/flvdec: Treat high ts byte as unsigned
- avformat/samidec: Sanity check pts
- avcodec/jpeg2000dec: Check atom_size in jp2_find_codestream()
- avformat/avidec: Use 64bit in get_duration()
- avformat/mov: Check for duplicate st3d
- avformat/mvdec: Check for EOF in read_index()
- avcodec/jpeglsdec: Fix k=16 in ls_get_code_regular()
- avformat/id3v2: Check the return from avio_get_str()
- avcodec/hevc_sei: Check payload size in decode_nal_sei_message()
- libavutil/eval: Remove CONFIG_TRAPV special handling
- avformat/wtvdec: Check len in parse_chunks() to avoid overflow
- avformat/asfdec_f: Add an additional check for the extradata size
- avformat/3dostr: Check sample_rate
- avformat/4xm: Make audio_frame_count 64bit
- avformat/mov: Use av_mul_q() to avoid integer overflows
- avcodec/vp9dsp_template: Fix integer overflows in itxfm_wrapper
- avformat/rmdec: Reorder operations to avoid overflow
- avcodec/mxpegdec: fix SOF counting
- avcodec/rscc: Check inflated_buf size whan it is used
- avformat/mvdec: Sanity check SAMPLE_WIDTH
- avcodec/nvenc: fix timestamp offset ticks logic
- avformat/rmdec: Fix codecdata_length overflow check
- avcodec/simple_idct: Fix undefined integer overflow in idct4row()
- avformat/wavdec: Check block_align vs. channels before combining them
- avformat/tta: Use 64bit intermediate for index
- avformat/soxdec: Check channels to be positive
- avformat/smacker: Check for too small pts_inc
- avformat/sbgdec: Use av_sat_add64() in str_to_time()
- avcodec/cscd: Check output len in zlib as in lzo
- avcodec/vp3: Check input amount in theora_decode_header()
- avformat/wavdec: Check avio_get_str16le() for failure
- avformat/flvdec: Check for EOF in amf_skip_tag()
- avformat/aiffdec: Check size before subtraction in get_aiff_header()
- avformat/electronicarts: More chunk_size checks
- avcodec/cfhd: check peak.offset
- avformat/tedcaptionsdec: Check for overflow in parse_int()
- avformat/nuv: Check channels
- avcodec/siren: Increase noise category 5 and 6
- avformat/mpc8: Check size before implicitly converting to int
- avformat/nutdec: Fix integer overflow in count computation
- avformat/mvi: Use 64bit for testing dimensions
- avformat/utils: Check dts in update_initial_timestamps() more
- avformat/mpsubdec: Use av_sat_add/sub64() in fracval handling
- avformat/flvdec: Check for avio_read() failure in amf_get_string()
- avformat/flvdec: Check for nesting depth in amf_skip_tag()
- avformat/flvdec: Check for nesting depth in amf_parse_object()
- avformat/asfdec_o: Check for EOF in asf_read_marker()
- avformat/flvdec: Use av_sat_add64() for pts computation
- avformat/utils: Check dts - (1<<pts_wrap_bits) overflow
- avformat/bfi: Check chunk_header
- avformat/ads: Check size
- avformat/iff: Check block align also for ID_MAUD
- avcodec/utils: Check for integer overflow in get_audio_frame_duration() for ADPCM_DTK
- avformat/fitsdec: Better size checks
- avformat/mxfdec: Fix integer overflow in next position in mxf_read_local_tags()
- avformat/avidec: dv does not support palettes
- avformat/dhav: Break out of infinite dhav search loop
- libavformat/utils: consider avio_size() failure in ffio_limit()
- avformat/nistspheredec: Check bits_per_coded_sample and channels
- avformat/asfdec_o: Check size vs. offset in detect_unknown_subobject()
- avformat/utils: check for integer overflow in av_get_frame_filename2()
- avutil/timecode: Avoid undefined behavior with large framenum
- avformat/mov: Check a.size before computing next_root_atom
- avformat/sbgdec: Reduce the amount of floating point in str_to_time()
- avformat/mxfdec: Free all types for both Descriptors
- uavformat/rsd: check for EOF in extradata
- avcodec/wmaprodec: Check packet size
- avformat/dhav: Check position for overflow
- avcodec/rasc: Check frame before clearing
- avformat/vividas: Check number of audio channels
- avcodec/alsdec: Fix integer overflow with quant_cof
- avformat/mpegts: Fix argument type for av_log
- avformat/cafdec: clip sample rate
- avcodec/ffv1dec: Fix off by 1 error with quant tables
- avformat/mpegts: Increase pcr_incr width to 64bit
- avcodec/utils: Check bitrate for overflow in get_bit_rate()
- avformat/mov: Check if hoov is at the end
- avcodec/hevc_ps: check scaling_list_dc_coef
- avformat/iff: Check data_size
- avformat/matroskadec: Sanity check codec_id/track type
- avformat/rpl: Check the number of streams
- avformat/vividas: Check sample_rate
- avformat/vividas: Make len signed
- avcodec/h264idct_template: Fix integer overflow in ff_h264_chroma422_dc_dequant_idct()
- avformat/dsfdec: Check block_align more completely
- avformat/mpc8: Check remaining space in mpc8_parse_seektable()
- avformat/id3v2: Sanity check tlen before alloc and uncompress
- avformat/vqf: Check len for COMM chunks
- avformat/mov: Avoid overflow in end computation in mov_read_custom()
- avcodec/hevc_cabac: Limit value in coeff_abs_level_remaining_decode() tighter
- avformat/cafdec: Check the return code from av_add_index_entry()
- avformat/cafdec: Check for EOF in index read loop
- avformat/cafdec: Check that bytes_per_packet and frames_per_packet are non negative
- avformat/mpc8: correct integer overflow in mpc8_parse_seektable()
- avformat/mpc8: correct 32bit timestamp truncation
- avcodec/exr: Check ymin vs. h
- avformat/avs: Use 64bit for the avio_tell() output
- avformat/wavdec: More complete size check in find_guid()
- avcodec/mv30: Use unsigned in idct_1d()
- avformat/iff: Check size before skip
- avformat/rmdec: Check for EOF in index packet reading
- avcodec/vp3dsp: Use unsigned constant to avoid undefined integer overflow in ff_vp3dsp_set_bounding_values()
- avformat/icodec: Check for zero streams and stream creation failure
- avformat/icodec: Factor failure code out in read_header()
- avformat/bintext: Check width
- avformat/sbgdec: Check that end is not before start
- avformat/lvfdec: Check stream_index before use
- avformat/au: cleanup on EOF return in au_read_annotation()
- avformat/mpegts: Limit copied data to space
- avformat/bintext: Check width in idf_read_header()
- avformat/iff: check size against INT64_MAX
- avformat/vividas: improve extradata packing checks in track_header()
- avformat/paf: Check for EOF in read_table()
- avformat/gxf: Check pkt_len
- avformat/aiffdec: Check packet size
- avformat/concatdec: use av_strstart()
- avformat/wavdec: Refuse to read chunks bigger than the filesize in w64_read_header()
- avformat/rsd: Check size and start before computing duration
- avformat/vividas: better check of current_sb_entry
- avformat/iff: More completely check body_size
- avformat/vividas use avpriv_set_pts_info()
- avformat/xwma: Check for EOF in dpds_table read code
- avcodec/utils: Check sample rate before use for AV_CODEC_ID_BINKAUDIO_DCT in get_audio_frame_duration()
- avcodec/dirac_parser: do not offset AV_NOPTS_OFFSET
- avformat/rmdec: Make expected_len 64bit
- avformat/pcm: Check block_align
- avformat/lrcdec: Clip timestamps
- avutil/mathematics: Use av_sat_add64() for the last addition in av_add_stable()
- avformat/electronicarts: Check for EOF in each iteration of the loop in ea_read_packet()
- avformat/ifv: Check that total frames do not overflow
- avcodec/vp9dsp_template: Fix some overflows in iadst8_1d()
- avcodec/fits: Check bscale
- avformat/nistspheredec: Check bps
- avformat/jacosubdec: Use 64bit inside get_shift()
- avformat/genh: Check block_align
- avformat/mvi: Check count for overflow
- avcodec/magicyuv: Check slice size before reading flags and pred
- avformat/asfdec_f: Check for negative ext_len
- avformat/bethsoftvid: Check image dimensions before use
- avformat/genh: Check block_align for how it will be used in SDX2_DPCM
- avformat/au: Check for EOF in au_read_annotation()
- avformat/vividas: Check for zero v_size
- avformat/segafilm: Do not assume AV_CODEC_ID_NONE is 0
- avformat/segafilm: Check that there is a stream
- avformat/wtvdec: Check dir_length
- avformat/ffmetadec: finalize AVBPrint on errors
- avcodec/decode/ff_get_buffer: Check for overflow in FFALIGN()
- avcodec/exr: Check limits to avoid overflow in delta computation
- avformat/boadec: Check that channels and block_align are set
- avformat/asfdec_f: Check name_len for overflow
- avcodec/h264idct_template: Fix integer overflow in ff_h264_chroma422_dc_dequant_idct()
- avformat/sbgdec: Check for timestamp overflow in parse_time_sequence()
- avcodec/aacdec_fixed: Limit index in vector_pow43()
- avformat/kvag: Fix integer overflow in bitrate computation
- avcodec/h264_slice: fix undefined integer overflow with POC in error concealment
- avformat/rmdec: sanity check coded_framesize
- avformat/flvdec: Check for EOF in amf_parse_object()
- avcodec/mv30: Fix multiple integer overflows
- avcodec/smacker: Check remaining bits in SMK_BLK_FULL
- avcodec/cook: Check subpacket index against max
- avcodec/utils: Check for overflow with ATRAC* in get_audio_frame_duration()
- avcodec/hevcpred_template: Fix diagonal chroma availability in 4:2:2 edge case in intra_pred
- avformat/icodec: Change order of operations to avoid NULL dereference
- avcodec/exr: Fix overflow with many blocks
- avcodec/vp9dsp_template: Fix integer overflows in idct16_1d()
- avcodec/ansi: Check initial dimensions
- avcodec/hevcdec: Check slice_cb_qp_offset / slice_cr_qp_offset
- avcodec/sonic: Check for overread
- avformat/subviewerdec: fail on AV_NOPTS_VALUE
- avcodec/exr: Check line size for overflow
- avcodec/exr: Check xdelta, ydelta
- avcodec/celp_filters: Avoid invalid negation in ff_celp_lp_synthesis_filter()
- avcodec/takdsp: Fix negative shift in decorrelate_sf()
- avcodec/dxtory: Fix negative stride shift in dx2_decode_slice_420()
- avformat/asfdec_f: Change order or operations slightly
- avformat/dxa: Use av_rescale() for duration computation
- avcodec/vc1_block: Fix integer overflow in ac value
- avcodec/mv30: Fix several integer overflows in idct_1d()
- avformat/iff: Check data_size not overflowing int64
- avcodec/dxtory: Fix negative shift in dx2_decode_slice_410()
- avcodec/sonic: Check channels before deallocating
- avformat/vividas: Check for EOF in first loop in track_header()
- avformat/wvdec: Check rate for overflow
- avcodec/ansi: Check nb_args for overflow
- avformat/wc3movie: Cleanup on wc3_read_header() failure
- avformat/wc3movie: Move wc3_read_close() up
- avcodec/tiff: Fix default white level
- avcodec/diracdsp: Fix integer anomaly in dequant_subband_*
- avutil/fixed_dsp: Fix integer overflows in butterflies_fixed_c()
- avcodec/mv30: Check remaining mask in decode_inter()
- avcodec/wmalosslessdec: Check remaining space before padding and channel residue
- avformat/cdg: Fix integer overflow in duration computation
- avcodec/mpc: Fix multiple numerical overflows in ff_mpc_dequantize_and_synth()
- avcodec/agm: Fix off by 1 error in decode_inter_plane()
- avformat/electronicarts: Check if there are any streams
- avcodec/ffwavesynth: Fix integer overflow in wavesynth_synth_sample / WS_SINE
- avcodec/vp9dsp_template: Fix integer overflow in iadst8_1d()
- avformat/avidec: Fix io_fsize overflow
- avcodec/cfhd: Check transform type
- avcodec/tiff: Check jpeg context against jpeg frame parameters
- avcodec/tiff: Restrict tag order based on specification
- avcodec/tiff: Avoid abort with DNG RAW TIFF with YA8
- avcodec/tiff: Check the linearization table size
- avformat/siff: Reject audio packets without audio stream
- avformat/mpeg: Check avio_read() return value in get_pts()
- avcodec/tiff: Check bpp/bppcount for 0
- avcodec/snowdec: Sanity check hcoeff
- avformat/mov: Check comp_brand_size
- avformat/ape: Error out in case of EOF in the header
- avcodec/alac: Check decorr_shift to avoid invalid shift
- avcodec/tdsc: Fix tile checks
- opusdec: do not fail when LBRR frames are present
- configure: update copyright year
- avfilter/vf_framerate: fix infinite loop with 1-frame input
- avformat/url: Change () position in ff_make_absolute_url()
- avformat/mpegts: make sure mpegts_read_header always stops at the first pmt
- avformat/alp: fix handling of TUN files
- avformat/argo_asf: fix handling of v1.1 files
- swscale/x86/yuv2rgb: fix crashes when loading alpha from unaligned buffers
- lavf/url: fix relative url parsing when the query string or fragment has a colon
- avformat/libsrt: fix cleanups on failed libsrt_open() and libsrt_setup()
- avcodec/cuviddec: backport extradata fixes
- avcodec/cuviddec: handle arbitrarily sized extradata
- lavf/srt: fix build fail when used the libsrt 1.4.1
- avformat/libsrt: close listen fd in listener mode
- lavf/url: rewrite ff_make_absolute_url() using ff_url_decompose().
- lavf/url: add ff_url_decompose().
- avcodec/cbs_av1: fix setting FrameWidth in frame_size_with_refs()
- avcodec/cbs_av1: use a more appropiate AV1ReferenceFrameState pointer variable name
- avcodec/cbs_av1: fix handling reference frames on show_existing_frame frames
- avcodec/cbs_av1: infer frame_type in show_existing_frame frames earlier
- avcodec/cbs_av1: add OrderHint to CodedBitstreamAV1Context
- avcodec/cbs_av1: infer frame_type when parsing a show_existing_frame frame
- cbs_av1: Fix test for presence of buffer_removal_time element
- avcodec/cbs_av1: fix storage size for render_{width,height}_minus_1
- lavc: Lower MediaFoundation audio encoder priority.
- x86/yuv2rgb: fix crashes when storing data on unaligned buffers
- checkasm/vf_blend: use the correct depth parameters to initialize the blend modes
- x86/vf_blend: fix warnings about trailing empty parameters
- x86/h264_deblock: fix warning about trailing empty parameter
- avutil/x86inc: fix warnings when assembling with Nasm 2.15
-
-
-version 4.3.1:
- avcodec/tiff: Check input space in dng_decode_jpeg()
- avcodec/mjpeg_parser: Adjust size rejection threshold
- avcodec/cbs_jpeg: Fix uninitialized end index in cbs_jpeg_split_fragment()
- avformat/sdp: Fix potential write beyond end of buffer
- avformat/mm: Check for existence of audio stream
- avformat/mov: Fix unaligned read of uint32_t and endian-dependance in mov_read_default
- avcodec/apedec: Fix undefined integer overflow with 24bit
- avcodec/loco: Fix integer overflow with large values from loco_get_rice()
- avformat/smjpegdec: Check the existence of referred streams
- avcodec/tiff: Check frame parameters before blit for DNG
- avcodec/mjpegdec: Limit bayer to single plane outputting format
- avcodec/pnmdec: Fix misaligned reads
- avcodec/mv30: Fix integer overflows in idct2_1d()
- avcodec/hcadec: Check total_band_count against imdct_in size
- avcodec/scpr3: Fix out of array access with dectab
- avcodec/tiff: Do not overrun the array ends in dng_blit()
- avcodec/dstdec: Replace AC overread check by sample rate check
- dnn_backend_native: Add overflow check for length calculation.
- avcodec/h264_metadata_bsf: Fix invalid av_freep
- avcodec/cbs_h265: set default VUI parameters when vui_parameters_present_flag is false
- avcodec/av1_parser: initialize avctx->pix_fmt
- avcodec/av1_parser: add missing parsing for RGB pixel format signaling
- avcodec/av1_parser: set context values outside the OBU parsing loop
- avutil/avsscanf: Add () to avoid integer overflow in scanexp()
- avformat/utils: reorder duration computation to avoid overflow
- avcodec/pngdec: Check for fctl after idat
- avformat/hls: Pass a copy of the URL for probing
- avutil/common: Fix integer overflow in av_ceil_log2_c()
- avcodec/wmalosslessdec: fix overflow with pred in revert_cdlms
- avformat/mvdec: Fix integer overflow with billions of channels
- avformat/microdvddec: skip malformed lines without frame number.
- dnn_backend_native: check operand index
- dnn_backend_native.c: refine code for fail case
- avformat/mov: fix memleaks
- libavformat/mov: Fix memleaks when demuxing DV audio
- avcodec/cbs_av1: Fix writing uvlc numbers >= INT_MAX
- avformat/avc, mxfenc: Avoid allocation of H264 SPS structure, fix memleak
- avcodec/bitstream: Don't check for undefined behaviour after it happened
- avformat/aviobuf: Also return truncated buffer in avio_get_dyn_buf()
- avformat/aviobuf: Don't check for overflow after it happened
-
 version 4.3:
 - v360 filter
 - Intel QSV-accelerated MJPEG decoding
--- a/2
+++ b/2
@@ -1 +1 @@
-4.3.4
+4.2.git
--- a/15
+++ b/15
@@ -1,15 +0,0 @@
-
-              ┌────────────────────────────────────┐
-              │ RELEASE NOTES for FFmpeg 4.3 "4:3" │
-              └────────────────────────────────────┘
-
-   The FFmpeg Project proudly presents FFmpeg 4.3 "4:3", about 10
-   months after the release of FFmpeg 4.2.
-
-   A complete Changelog is available at the root of the project, and the
-   complete Git history on https://git.ffmpeg.org/gitweb/ffmpeg.git
-
-   We hope you will like this release as much as we enjoyed working on it, and
-   as usual, if you have any questions about it, or any FFmpeg related topic,
-   feel free to join us on the #ffmpeg IRC channel (on irc.libera.chat) or ask
-   on the mailing-lists.
--- a/6
+++ b/6
@@ -532,7 +532,7 @@ die(){

 If you think configure made a mistake, make sure you are using the latest
 version from Git.  If the latest version fails, report the problem to the
-ffmpeg-user@ffmpeg.org mailing list or IRC #ffmpeg on irc.libera.chat.
+ffmpeg-user@ffmpeg.org mailing list or IRC #ffmpeg on irc.freenode.net.
 EOF
    if disabled logging; then
        cat <<EOF
@@ -3236,7 +3236,7 @@ librav1e_encoder_deps="librav1e"
 librav1e_encoder_select="extract_extradata_bsf"
 librsvg_decoder_deps="librsvg"
 libshine_encoder_deps="libshine"
-libshine_encoder_select="audio_frame_queue mpegaudioheader"
+libshine_encoder_select="audio_frame_queue"
 libspeex_decoder_deps="libspeex"
 libspeex_encoder_deps="libspeex"
 libspeex_encoder_select="audio_frame_queue"
@@ -7513,7 +7513,7 @@ cat > $TMPH <<EOF
 #define FFMPEG_CONFIG_H
 #define FFMPEG_CONFIGURATION "$(c_escape $FFMPEG_CONFIGURATION)"
 #define FFMPEG_LICENSE "$(c_escape $license)"
-#define CONFIG_THIS_YEAR 2021
+#define CONFIG_THIS_YEAR 2020
 #define FFMPEG_DATADIR "$(eval c_escape $datadir)"
 #define AVCONV_DATADIR "$(eval c_escape $datadir)"
 #define CC_IDENT "$(c_escape ${cc_ident:-Unknown compiler})"
--- a/doc/Doxyfile
+++ b/doc/Doxyfile
@@ -38,7 +38,7 @@ PROJECT_NAME           = FFmpeg
 # could be handy for archiving the generated documentation or if some version
 # control system is used.

-PROJECT_NUMBER         = 4.3.4
+PROJECT_NUMBER         =

 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
--- a/doc/decoders.texi
+++ b/doc/decoders.texi
@@ -317,7 +317,7 @@ list are dropped. You may use the special @code{*} string to match all pages,
 or @code{subtitle} to match all subtitle pages.
 Default value is *.
@item txt_default_region
-Set default character set used for decoding, a value between 0 and 87 (see
+Set default G0 character set used for decoding, a value between 0 and 80 (see
 ETS 300 706, Section 15, Table 32). Default value is -1, which does not
 override the libzvbi default. This option is needed for some legacy level 1.0
 transmissions which cannot signal the proper charset.
--- a/doc/writing_filters.txt
+++ b/doc/writing_filters.txt
@@ -418,4 +418,4 @@ done:

 When all of this is done, you can submit your patch to the ffmpeg-devel
 mailing-list for review.  If you need any help, feel free to come on our IRC
-channel, #ffmpeg-devel on irc.libera.chat.
+channel, #ffmpeg-devel on irc.freenode.net.
--- a/fftools/ffmpeg.c
+++ b/fftools/ffmpeg.c
@@ -528,7 +528,6 @@ static void ffmpeg_cleanup(int ret)
        for (j = 0; j < fg->nb_outputs; j++) {
            OutputFilter *ofilter = fg->outputs[j];

-            avfilter_inout_free(&ofilter->out_tmp);
            av_freep(&ofilter->name);
            av_freep(&ofilter->formats);
            av_freep(&ofilter->channel_layouts);
--- a/fftools/ffplay.c
+++ b/fftools/ffplay.c
@@ -1151,8 +1151,6 @@ static void video_audio_display(VideoState *s)
        if (realloc_texture(&s->vis_texture, SDL_PIXELFORMAT_ARGB8888, s->width, s->height, SDL_BLENDMODE_NONE, 1) < 0)
            return;

-        if (s->xpos >= s->width)
-            s->xpos = 0;
        nb_display_channels= FFMIN(nb_display_channels, 2);
        if (rdft_bits != s->rdft_bits) {
            av_rdft_end(s->rdft);
@@ -1202,6 +1200,8 @@ static void video_audio_display(VideoState *s)
        }
        if (!s->paused)
            s->xpos++;
+        if (s->xpos >= s->width)
+            s->xpos= s->xleft;
    }
 }

--- a/libavcodec/4xm.c
+++ b/libavcodec/4xm.c
@@ -498,8 +498,8 @@ static int decode_i_block(FourXContext *f, int16_t *block)
 {
    int code, i, j, level, val;

-    if (get_bits_left(&f->pre_gb) < 2) {
-        av_log(f->avctx, AV_LOG_ERROR, "%d bits left before decode_i_block()\n", get_bits_left(&f->pre_gb));
+    if (get_bits_left(&f->gb) < 2){
+        av_log(f->avctx, AV_LOG_ERROR, "%d bits left before decode_i_block()\n", get_bits_left(&f->gb));
        return AVERROR_INVALIDDATA;
    }

--- a/libavcodec/a64multienc.c
+++ b/libavcodec/a64multienc.c
@@ -407,7 +407,6 @@ AVCodec ff_a64multi_encoder = {
    .close          = a64multi_close_encoder,
    .pix_fmts       = (const enum AVPixelFormat[]) {AV_PIX_FMT_GRAY8, AV_PIX_FMT_NONE},
    .capabilities   = AV_CODEC_CAP_DELAY,
-    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
 };
 #endif
 #if CONFIG_A64MULTI5_ENCODER
@@ -422,6 +421,5 @@ AVCodec ff_a64multi5_encoder = {
    .close          = a64multi_close_encoder,
    .pix_fmts       = (const enum AVPixelFormat[]) {AV_PIX_FMT_GRAY8, AV_PIX_FMT_NONE},
    .capabilities   = AV_CODEC_CAP_DELAY,
-    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
 };
 #endif
--- a/libavcodec/aaccoder.c
+++ b/libavcodec/aaccoder.c
@@ -843,25 +843,25 @@ static void search_for_ms(AACEncContext *s, ChannelElement *cpe)
                                                    sce0->ics.swb_sizes[g],
                                                    sce0->sf_idx[w*16+g],
                                                    sce0->band_type[w*16+g],
-                                                    lambda / (band0->threshold + FLT_MIN), INFINITY, &b1, NULL, 0);
+                                                    lambda / band0->threshold, INFINITY, &b1, NULL, 0);
                        dist1 += quantize_band_cost(s, &sce1->coeffs[start + (w+w2)*128],
                                                    R34,
                                                    sce1->ics.swb_sizes[g],
                                                    sce1->sf_idx[w*16+g],
                                                    sce1->band_type[w*16+g],
-                                                    lambda / (band1->threshold + FLT_MIN), INFINITY, &b2, NULL, 0);
+                                                    lambda / band1->threshold, INFINITY, &b2, NULL, 0);
                        dist2 += quantize_band_cost(s, M,
                                                    M34,
                                                    sce0->ics.swb_sizes[g],
                                                    mididx,
                                                    midcb,
-                                                    lambda / (minthr + FLT_MIN), INFINITY, &b3, NULL, 0);
+                                                    lambda / minthr, INFINITY, &b3, NULL, 0);
                        dist2 += quantize_band_cost(s, S,
                                                    S34,
                                                    sce1->ics.swb_sizes[g],
                                                    sididx,
                                                    sidcb,
-                                                    mslambda / (minthr * bmax + FLT_MIN), INFINITY, &b4, NULL, 0);
+                                                    mslambda / (minthr * bmax), INFINITY, &b4, NULL, 0);
                        B0 += b1+b2;
                        B1 += b3+b4;
                        dist1 -= b1+b2;
--- a/libavcodec/aacdec_fixed.c
+++ b/libavcodec/aacdec_fixed.c
@@ -155,9 +155,9 @@ static void vector_pow43(int *coefs, int len)
    for (i=0; i<len; i++) {
        coef = coefs[i];
        if (coef < 0)
-            coef = -(int)ff_cbrt_tab_fixed[(-coef) & 8191];
+            coef = -(int)ff_cbrt_tab_fixed[-coef];
        else
-            coef =  (int)ff_cbrt_tab_fixed[  coef  & 8191];
+            coef = (int)ff_cbrt_tab_fixed[coef];
        coefs[i] = coef;
    }
 }
--- a/libavcodec/aacdec_template.c
+++ b/libavcodec/aacdec_template.c
@@ -974,18 +974,14 @@ static int decode_audio_specific_config_gb(AACContext *ac,
 {
    int i, ret;
    GetBitContext gbc = *gb;
-    MPEG4AudioConfig m4ac_bak = *m4ac;

-    if ((i = ff_mpeg4audio_get_config_gb(m4ac, &gbc, sync_extension, avctx)) < 0) {
-        *m4ac = m4ac_bak;
+    if ((i = ff_mpeg4audio_get_config_gb(m4ac, &gbc, sync_extension, avctx)) < 0)
        return AVERROR_INVALIDDATA;
-    }

    if (m4ac->sampling_index > 12) {
        av_log(avctx, AV_LOG_ERROR,
               "invalid sampling rate index %d\n",
               m4ac->sampling_index);
-        *m4ac = m4ac_bak;
        return AVERROR_INVALIDDATA;
    }
    if (m4ac->object_type == AOT_ER_AAC_LD &&
@@ -993,7 +989,6 @@ static int decode_audio_specific_config_gb(AACContext *ac,
        av_log(avctx, AV_LOG_ERROR,
               "invalid low delay sampling rate index %d\n",
               m4ac->sampling_index);
-        *m4ac = m4ac_bak;
        return AVERROR_INVALIDDATA;
    }

@@ -2812,7 +2807,7 @@ static void imdct_and_windowing_ld(AACContext *ac, SingleChannelElement *sce)

 static void imdct_and_windowing_eld(AACContext *ac, SingleChannelElement *sce)
 {
-    UINTFLOAT *in   = sce->coeffs;
+    INTFLOAT *in    = sce->coeffs;
    INTFLOAT *out   = sce->ret;
    INTFLOAT *saved = sce->saved;
    INTFLOAT *buf  = ac->buf_mdct;
--- a/libavcodec/aacenc.c
+++ b/libavcodec/aacenc.c
@@ -28,7 +28,6 @@
 *              TODOs:
 * add sane pulse detection
 ***********************************/
-#include <float.h>

 #include "libavutil/libm.h"
 #include "libavutil/thread.h"
@@ -857,7 +856,7 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
                /* Not so fast though */
                ratio = sqrtf(ratio);
            }
-            s->lambda = av_clipf(s->lambda * ratio, FLT_EPSILON, 65536.f);
+            s->lambda = FFMIN(s->lambda * ratio, 65536.f);

            /* Keep iterating if we must reduce and lambda is in the sky */
            if (ratio > 0.9f && ratio < 1.1f) {
@@ -902,7 +901,7 @@ static av_cold int aac_encode_end(AVCodecContext *avctx)
 {
    AACEncContext *s = avctx->priv_data;

-    av_log(avctx, AV_LOG_INFO, "Qavg: %.3f\n", s->lambda_count ? s->lambda_sum / s->lambda_count : NAN);
+    av_log(avctx, AV_LOG_INFO, "Qavg: %.3f\n", s->lambda_sum / s->lambda_count);

    ff_mdct_end(&s->mdct1024);
    ff_mdct_end(&s->mdct128);
--- a/libavcodec/aacpsy.c
+++ b/libavcodec/aacpsy.c
@@ -308,9 +308,6 @@ static av_cold int psy_3gpp_init(FFPsyContext *ctx) {
    const int bandwidth    = ctx->cutoff ? ctx->cutoff : AAC_CUTOFF(ctx->avctx);
    const float num_bark   = calc_bark((float)bandwidth);

-    if (bandwidth <= 0)
-        return AVERROR(EINVAL);
-
    ctx->model_priv_data = av_mallocz(sizeof(AacPsyContext));
    if (!ctx->model_priv_data)
        return AVERROR(ENOMEM);
@@ -797,7 +794,7 @@ static void psy_3gpp_analyze_channel(FFPsyContext *ctx, int channel,

        if (pe < 1.15f * desired_pe) {
            /* 6.6.1.3.6 "Final threshold modification by linearization" */
-            norm_fac = norm_fac ? 1.0f / norm_fac : 0;
+            norm_fac = 1.0f / norm_fac;
            for (w = 0; w < wi->num_windows*16; w += 16) {
                for (g = 0; g < num_bands; g++) {
                    AacPsyBand *band = &pch->band[w+g];
--- a/libavcodec/ac3enc_template.c
+++ b/libavcodec/ac3enc_template.c
@@ -43,7 +43,7 @@ int AC3_NAME(allocate_sample_buffers)(AC3EncodeContext *s)

    FF_ALLOC_OR_GOTO(s->avctx, s->windowed_samples, AC3_WINDOW_SIZE *
                     sizeof(*s->windowed_samples), alloc_fail);
-    FF_ALLOCZ_ARRAY_OR_GOTO(s->avctx, s->planar_samples, s->channels, sizeof(*s->planar_samples),
+    FF_ALLOC_ARRAY_OR_GOTO(s->avctx, s->planar_samples, s->channels, sizeof(*s->planar_samples),
                     alloc_fail);
    for (ch = 0; ch < s->channels; ch++) {
        FF_ALLOCZ_OR_GOTO(s->avctx, s->planar_samples[ch],
--- a/libavcodec/agm.c
+++ b/libavcodec/agm.c
@@ -423,8 +423,8 @@ static int decode_inter_plane(AGMContext *s, GetBitContext *gb, int size,
                int map = s->map[x];

                if (orig_mv_x >= -32) {
-                    if (y * 8 + mv_y < 0 || y * 8 + mv_y + 8 > h ||
-                        x * 8 + mv_x < 0 || x * 8 + mv_x + 8 > w)
+                    if (y * 8 + mv_y < 0 || y * 8 + mv_y + 8 >= h ||
+                        x * 8 + mv_x < 0 || x * 8 + mv_x + 8 >= w)
                        return AVERROR_INVALIDDATA;

                    copy_block8(frame->data[plane] + (s->blocks_h - 1 - y) * 8 * frame->linesize[plane] + x * 8,
--- a/libavcodec/alac.c
+++ b/libavcodec/alac.c
@@ -302,9 +302,6 @@ static int decode_element(AVCodecContext *avctx, AVFrame *frame, int ch_index,
        decorr_shift       = get_bits(&alac->gb, 8);
        decorr_left_weight = get_bits(&alac->gb, 8);

-        if (channels == 2 && decorr_left_weight && decorr_shift > 31)
-            return AVERROR_INVALIDDATA;
-
        for (ch = 0; ch < channels; ch++) {
            prediction_type[ch]   = get_bits(&alac->gb, 4);
            lpc_quant[ch]         = get_bits(&alac->gb, 4);
--- a/libavcodec/alacdsp.c
+++ b/libavcodec/alacdsp.c
@@ -34,7 +34,7 @@ static void decorrelate_stereo(int32_t *buffer[2], int nb_samples,
        a = buffer[0][i];
        b = buffer[1][i];

-        a -= (int)(b * (unsigned)decorr_left_weight) >> decorr_shift;
+        a -= (b * decorr_left_weight) >> decorr_shift;
        b += a;

        buffer[0][i] = b;
--- a/libavcodec/allcodecs.c
+++ b/libavcodec/allcodecs.c
@@ -679,7 +679,9 @@ extern AVCodec ff_xsub_decoder;
 /* external libraries */
 extern AVCodec ff_aac_at_encoder;
 extern AVCodec ff_aac_at_decoder;
+extern AVCodec ff_aac_mf_encoder;
 extern AVCodec ff_ac3_at_decoder;
+extern AVCodec ff_ac3_mf_encoder;
 extern AVCodec ff_adpcm_ima_qt_at_decoder;
 extern AVCodec ff_alac_at_encoder;
 extern AVCodec ff_alac_at_decoder;
@@ -691,6 +693,7 @@ extern AVCodec ff_ilbc_at_decoder;
 extern AVCodec ff_mp1_at_decoder;
 extern AVCodec ff_mp2_at_decoder;
 extern AVCodec ff_mp3_at_decoder;
+extern AVCodec ff_mp3_mf_encoder;
 extern AVCodec ff_pcm_alaw_at_encoder;
 extern AVCodec ff_pcm_alaw_at_decoder;
 extern AVCodec ff_pcm_mulaw_at_encoder;
@@ -754,8 +757,6 @@ extern AVCodec ff_idf_decoder;

 /* external libraries, that shouldn't be used by default if one of the
 * above is available */
-extern AVCodec ff_aac_mf_encoder;
-extern AVCodec ff_ac3_mf_encoder;
 extern AVCodec ff_h263_v4l2m2m_encoder;
 extern AVCodec ff_libaom_av1_decoder;
 extern AVCodec ff_libopenh264_encoder;
@@ -788,7 +789,6 @@ extern AVCodec ff_mjpeg_cuvid_decoder;
 extern AVCodec ff_mjpeg_qsv_encoder;
 extern AVCodec ff_mjpeg_qsv_decoder;
 extern AVCodec ff_mjpeg_vaapi_encoder;
-extern AVCodec ff_mp3_mf_encoder;
 extern AVCodec ff_mpeg1_cuvid_decoder;
 extern AVCodec ff_mpeg2_cuvid_decoder;
 extern AVCodec ff_mpeg2_qsv_encoder;
--- a/libavcodec/alsdec.c
+++ b/libavcodec/alsdec.c
@@ -762,7 +762,7 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
            }

            for (k = 2; k < opt_order; k++)
-                quant_cof[k] = (quant_cof[k] * (1U << 14)) + (add_base << 13);
+                quant_cof[k] = (quant_cof[k] * (1 << 14)) + (add_base << 13);
        }
    }

@@ -1016,10 +1016,6 @@ static int read_block(ALSDecContext *ctx, ALSBlockData *bd)
    ALSSpecificConfig *sconf = &ctx->sconf;

    *bd->shift_lsbs = 0;
-
-    if (get_bits_left(gb) < 1)
-        return AVERROR_INVALIDDATA;
-
    // read block type flag and read the samples accordingly
    if (get_bits1(gb)) {
        ret = read_var_block_data(ctx, bd);
@@ -1632,7 +1628,7 @@ static int read_frame_data(ALSDecContext *ctx, unsigned int ra_frame)
    AVCodecContext *avctx    = ctx->avctx;
    GetBitContext *gb = &ctx->gb;
    unsigned int div_blocks[32];                ///< block sizes.
-    int c;
+    unsigned int c;
    unsigned int js_blocks[2];
    uint32_t bs_info = 0;
    int ret;
@@ -1810,17 +1806,14 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame_ptr,
    else
        ctx->cur_frame_length = sconf->frame_length;

-    ctx->highest_decoded_channel = -1;
+    ctx->highest_decoded_channel = 0;
    // decode the frame data
    if ((invalid_frame = read_frame_data(ctx, ra_frame)) < 0)
        av_log(ctx->avctx, AV_LOG_WARNING,
               "Reading frame data failed. Skipping RA unit.\n");

-    if (ctx->highest_decoded_channel == -1) {
-        av_log(ctx->avctx, AV_LOG_WARNING,
-               "No channel data decoded.\n");
+    if (ctx->highest_decoded_channel == 0)
        return AVERROR_INVALIDDATA;
-    }

    ctx->frame_id++;

--- a/libavcodec/ansi.c
+++ b/libavcodec/ansi.c
@@ -431,8 +431,7 @@ static int decode_frame(AVCodecContext *avctx,
                    s->args[s->nb_args] = FFMAX(s->args[s->nb_args], 0) * 10 + buf[0] - '0';
                break;
            case ';':
-                if (s->nb_args < MAX_NB_ARGS)
-                    s->nb_args++;
+                s->nb_args++;
                if (s->nb_args < MAX_NB_ARGS)
                    s->args[s->nb_args] = 0;
                break;
@@ -475,11 +474,6 @@ static av_cold int decode_close(AVCodecContext *avctx)
    return 0;
 }

-static const AVCodecDefault ansi_defaults[] = {
-    { "max_pixels", "640*480" },
-    { NULL },
-};
-
 AVCodec ff_ansi_decoder = {
    .name           = "ansi",
    .long_name      = NULL_IF_CONFIG_SMALL("ASCII/ANSI art"),
@@ -491,5 +485,4 @@ AVCodec ff_ansi_decoder = {
    .decode         = decode_frame,
    .capabilities   = AV_CODEC_CAP_DR1,
    .caps_internal  = FF_CODEC_CAP_INIT_THREADSAFE,
-    .defaults       = ansi_defaults,
 };
--- a/libavcodec/apedec.c
+++ b/libavcodec/apedec.c
@@ -102,7 +102,7 @@ typedef struct APEFilter {
    int16_t *historybuffer; ///< filter memory
    int16_t *delay;         ///< filtered values

-    uint32_t avg;
+    int avg;
 } APEFilter;

 typedef struct APERice {
@@ -852,7 +852,7 @@ static av_always_inline int filter_fast_3320(APEPredictor *p,
    }

    predictionA = p->buf[delayA] * 2U - p->buf[delayA - 1];
-    p->lastA[filter] = decoded + (unsigned)((int32_t)(predictionA  * p->coeffsA[filter][0]) >> 9);
+    p->lastA[filter] = decoded + ((int32_t)(predictionA  * p->coeffsA[filter][0]) >> 9);

    if ((decoded ^ predictionA) > 0)
        p->coeffsA[filter][0]++;
@@ -882,8 +882,8 @@ static av_always_inline int filter_3800(APEPredictor *p,
        return predictionA;
    }
    d2 =  p->buf[delayA];
-    d1 = (p->buf[delayA] - (unsigned)p->buf[delayA - 1]) * 2;
-    d0 =  p->buf[delayA] + ((p->buf[delayA - 2] - (unsigned)p->buf[delayA - 1]) * 8);
+    d1 = (p->buf[delayA] - p->buf[delayA - 1]) * 2U;
+    d0 =  p->buf[delayA] + ((p->buf[delayA - 2] - p->buf[delayA - 1]) * 8U);
    d3 =  p->buf[delayB] * 2U - p->buf[delayB - 1];
    d4 =  p->buf[delayB];

@@ -928,7 +928,7 @@ static void long_filter_high_3800(int32_t *buffer, int order, int shift, int len
            dotprod += delay[j] * (unsigned)coeffs[j];
            coeffs[j] += ((delay[j] >> 31) | 1) * sign;
        }
-        buffer[i] -= (unsigned)(dotprod >> shift);
+        buffer[i] -= dotprod >> shift;
        for (j = 0; j < order - 1; j++)
            delay[j] = delay[j + 1];
        delay[order - 1] = buffer[i];
@@ -952,7 +952,7 @@ static void long_filter_ehigh_3830(int32_t *buffer, int length)
        for (j = 7; j > 0; j--)
            delay[j] = delay[j - 1];
        delay[0] = buffer[i];
-        buffer[i] -= (unsigned)(dotprod >> 9);
+        buffer[i] -= dotprod >> 9;
    }
 }

@@ -1061,13 +1061,13 @@ static av_always_inline int predictor_update_3930(APEPredictor *p,
                                                  const int delayA)
 {
    int32_t predictionA, sign;
-    uint32_t d0, d1, d2, d3;
+    int32_t d0, d1, d2, d3;

    p->buf[delayA]     = p->lastA[filter];
    d0 = p->buf[delayA    ];
-    d1 = p->buf[delayA    ] - (unsigned)p->buf[delayA - 1];
-    d2 = p->buf[delayA - 1] - (unsigned)p->buf[delayA - 2];
-    d3 = p->buf[delayA - 2] - (unsigned)p->buf[delayA - 3];
+    d1 = p->buf[delayA    ] - p->buf[delayA - 1];
+    d2 = p->buf[delayA - 1] - p->buf[delayA - 2];
+    d3 = p->buf[delayA - 2] - p->buf[delayA - 3];

    predictionA = d0 * p->coeffsA[filter][0] +
                  d1 * p->coeffsA[filter][1] +
@@ -1078,10 +1078,10 @@ static av_always_inline int predictor_update_3930(APEPredictor *p,
    p->filterA[filter] = p->lastA[filter] + ((int)(p->filterA[filter] * 31U) >> 5);

    sign = APESIGN(decoded);
-    p->coeffsA[filter][0] += (((int32_t)d0 < 0) * 2 - 1) * sign;
-    p->coeffsA[filter][1] += (((int32_t)d1 < 0) * 2 - 1) * sign;
-    p->coeffsA[filter][2] += (((int32_t)d2 < 0) * 2 - 1) * sign;
-    p->coeffsA[filter][3] += (((int32_t)d3 < 0) * 2 - 1) * sign;
+    p->coeffsA[filter][0] += ((d0 < 0) * 2 - 1) * sign;
+    p->coeffsA[filter][1] += ((d1 < 0) * 2 - 1) * sign;
+    p->coeffsA[filter][2] += ((d2 < 0) * 2 - 1) * sign;
+    p->coeffsA[filter][3] += ((d3 < 0) * 2 - 1) * sign;

    return p->filterA[filter];
 }
@@ -1309,7 +1309,7 @@ static void do_apply_filter(APEContext *ctx, int version, APEFilter *f,
            absres = res < 0 ? -(unsigned)res : res;
            if (absres)
                *f->adaptcoeffs = APESIGN(res) *
-                                  (8 << ((absres > f->avg * 3LL) + (absres > (f->avg + f->avg / 3))));
+                                  (8 << ((absres > f->avg * 3) + (absres > f->avg * 4 / 3)));
                /* equivalent to the following code
                    if (absres <= f->avg * 4 / 3)
                        *f->adaptcoeffs = APESIGN(res) * 8;
@@ -1559,7 +1559,7 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data,
        for (ch = 0; ch < s->channels; ch++) {
            sample8 = (uint8_t *)frame->data[ch];
            for (i = 0; i < blockstodecode; i++)
-                *sample8++ = (s->decoded[ch][i] + 0x80U) & 0xff;
+                *sample8++ = (s->decoded[ch][i] + 0x80) & 0xff;
        }
        break;
    case 16:
@@ -1573,7 +1573,7 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data,
        for (ch = 0; ch < s->channels; ch++) {
            sample24 = (int32_t *)frame->data[ch];
            for (i = 0; i < blockstodecode; i++)
-                *sample24++ = s->decoded[ch][i] * 256U;
+                *sample24++ = s->decoded[ch][i] * 256;
        }
        break;
    }
--- a/libavcodec/atrac1.c
+++ b/libavcodec/atrac1.c
@@ -362,10 +362,6 @@ static av_cold int atrac1_decode_init(AVCodecContext *avctx)
    ff_atrac_generate_tables();

    q->fdsp = avpriv_float_dsp_alloc(avctx->flags & AV_CODEC_FLAG_BITEXACT);
-    if (!q->fdsp) {
-        atrac1_decode_end(avctx);
-        return AVERROR(ENOMEM);
-    }

    q->bands[0] = q->low;
    q->bands[1] = q->mid;
--- a/libavcodec/av1_parser.c
+++ b/libavcodec/av1_parser.c
@@ -45,10 +45,6 @@ static const enum AVPixelFormat pix_fmts_12bit[2][2] = {
    { AV_PIX_FMT_YUV422P12, AV_PIX_FMT_YUV420P12 },
 };

-static const enum AVPixelFormat pix_fmts_rgb[3] = {
-    AV_PIX_FMT_GBRP, AV_PIX_FMT_GBRP10, AV_PIX_FMT_GBRP12,
-};
-
 static int av1_parser_parse(AVCodecParserContext *ctx,
                            AVCodecContext *avctx,
                            const uint8_t **out_data, int *out_size,
@@ -57,8 +53,6 @@ static int av1_parser_parse(AVCodecParserContext *ctx,
    AV1ParseContext *s = ctx->priv_data;
    CodedBitstreamFragment *td = &s->temporal_unit;
    CodedBitstreamAV1Context *av1 = s->cbc->priv_data;
-    AV1RawSequenceHeader *seq;
-    AV1RawColorConfig *color;
    int ret;

    *out_data = data;
@@ -92,12 +86,11 @@ static int av1_parser_parse(AVCodecParserContext *ctx,
        goto end;
    }

-    seq = av1->sequence_header;
-    color = &seq->color_config;
-
    for (int i = 0; i < td->nb_units; i++) {
        CodedBitstreamUnit *unit = &td->units[i];
        AV1RawOBU *obu = unit->content;
+        AV1RawSequenceHeader *seq = av1->sequence_header;
+        AV1RawColorConfig *color = &seq->color_config;
        AV1RawFrameHeader *frame;
        int frame_type;

@@ -134,6 +127,9 @@ static int av1_parser_parse(AVCodecParserContext *ctx,
            ctx->key_frame = frame_type == AV1_FRAME_KEY;
        }

+        avctx->profile = seq->seq_profile;
+        avctx->level   = seq->seq_level_idx[0];
+
        switch (frame_type) {
        case AV1_FRAME_KEY:
        case AV1_FRAME_INTRA_ONLY:
@@ -147,44 +143,33 @@ static int av1_parser_parse(AVCodecParserContext *ctx,
            break;
        }
        ctx->picture_structure = AV_PICTURE_STRUCTURE_FRAME;
-    }

-    switch (av1->bit_depth) {
-    case 8:
-        ctx->format = color->mono_chrome ? AV_PIX_FMT_GRAY8
-                                         : pix_fmts_8bit [color->subsampling_x][color->subsampling_y];
-        break;
-    case 10:
-        ctx->format = color->mono_chrome ? AV_PIX_FMT_GRAY10
-                                         : pix_fmts_10bit[color->subsampling_x][color->subsampling_y];
-        break;
-    case 12:
-        ctx->format = color->mono_chrome ? AV_PIX_FMT_GRAY12
-                                         : pix_fmts_12bit[color->subsampling_x][color->subsampling_y];
-        break;
-    }
-    av_assert2(ctx->format != AV_PIX_FMT_NONE);
+        switch (av1->bit_depth) {
+        case 8:
+            ctx->format = color->mono_chrome ? AV_PIX_FMT_GRAY8
+                                             : pix_fmts_8bit [color->subsampling_x][color->subsampling_y];
+            break;
+        case 10:
+            ctx->format = color->mono_chrome ? AV_PIX_FMT_GRAY10
+                                             : pix_fmts_10bit[color->subsampling_x][color->subsampling_y];
+            break;
+        case 12:
+            ctx->format = color->mono_chrome ? AV_PIX_FMT_GRAY12
+                                             : pix_fmts_12bit[color->subsampling_x][color->subsampling_y];
+            break;
+        }
+        av_assert2(ctx->format != AV_PIX_FMT_NONE);

-    if (!color->subsampling_x && !color->subsampling_y &&
-        color->matrix_coefficients       == AVCOL_SPC_RGB &&
-        color->color_primaries           == AVCOL_PRI_BT709 &&
-        color->transfer_characteristics  == AVCOL_TRC_IEC61966_2_1)
-        ctx->format = pix_fmts_rgb[color->high_bitdepth + color->twelve_bit];
+        avctx->colorspace = (enum AVColorSpace) color->matrix_coefficients;
+        avctx->color_primaries = (enum AVColorPrimaries) color->color_primaries;
+        avctx->color_trc = (enum AVColorTransferCharacteristic) color->transfer_characteristics;
+        avctx->color_range = color->color_range ? AVCOL_RANGE_JPEG : AVCOL_RANGE_MPEG;

-    avctx->pix_fmt = ctx->format;
-
-    avctx->profile = seq->seq_profile;
-    avctx->level   = seq->seq_level_idx[0];
-
-    avctx->colorspace = (enum AVColorSpace) color->matrix_coefficients;
-    avctx->color_primaries = (enum AVColorPrimaries) color->color_primaries;
-    avctx->color_trc = (enum AVColorTransferCharacteristic) color->transfer_characteristics;
-    avctx->color_range = color->color_range ? AVCOL_RANGE_JPEG : AVCOL_RANGE_MPEG;
-
-    if (ctx->width != avctx->width || ctx->height != avctx->height) {
-        ret = ff_set_dimensions(avctx, ctx->width, ctx->height);
-        if (ret < 0)
-            goto end;
+        if (ctx->width != avctx->width || ctx->height != avctx->height) {
+            ret = ff_set_dimensions(avctx, ctx->width, ctx->height);
+            if (ret < 0)
+                goto end;
+        }
    }

    if (avctx->framerate.num)
--- a/libavcodec/avrndec.c
+++ b/libavcodec/avrndec.c
@@ -54,8 +54,6 @@ static av_cold int init(AVCodecContext *avctx)
        }

        a->mjpeg_avctx = avcodec_alloc_context3(codec);
-        if (!a->mjpeg_avctx)
-            return AVERROR(ENOMEM);

        av_dict_set(&thread_opt, "threads", "1", 0); // Is this needed ?
        a->mjpeg_avctx->refcounted_frames = 1;
@@ -171,5 +169,5 @@ AVCodec ff_avrn_decoder = {
    .close          = end,
    .decode         = decode_frame,
    .max_lowres     = 3,
-    .caps_internal  = FF_CODEC_CAP_INIT_THREADSAFE | FF_CODEC_CAP_INIT_CLEANUP,
+    .caps_internal  = FF_CODEC_CAP_INIT_THREADSAFE,
 };
--- a/libavcodec/bink.c
+++ b/libavcodec/bink.c
@@ -1381,8 +1381,10 @@ static av_cold int decode_init(AVCodecContext *avctx)
    ff_hpeldsp_init(&c->hdsp, avctx->flags);
    ff_binkdsp_init(&c->binkdsp);

-    if ((ret = init_bundles(c)) < 0)
+    if ((ret = init_bundles(c)) < 0) {
+        free_bundles(c);
        return ret;
+    }

    if (c->version == 'b') {
        if (!binkb_initialised) {
@@ -1422,5 +1424,4 @@ AVCodec ff_bink_decoder = {
    .decode         = decode_frame,
    .flush          = flush,
    .capabilities   = AV_CODEC_CAP_DR1,
-    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
 };
--- a/libavcodec/binkaudio.c
+++ b/libavcodec/binkaudio.c
@@ -40,6 +40,8 @@
 #include "rdft.h"
 #include "wma_freqs.h"

+static float quant_table[96];
+
 #define MAX_CHANNELS 2
 #define BINK_BLOCK_MAX_SIZE (MAX_CHANNELS << 11)

@@ -56,7 +58,6 @@ typedef struct BinkAudioContext {
    float root;
    DECLARE_ALIGNED(32, FFTSample, coeffs)[BINK_BLOCK_MAX_SIZE];
    float previous[MAX_CHANNELS][BINK_BLOCK_MAX_SIZE / 16];  ///< coeffs from previous audio block
-    float quant_table[96];
    AVPacket *pkt;
    union {
        RDFTContext rdft;
@@ -115,7 +116,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
        s->root = s->frame_len / (sqrt(s->frame_len) * 32768.0);
    for (i = 0; i < 96; i++) {
        /* constant is result of 0.066399999/log10(M_E) */
-        s->quant_table[i] = expf(i * 0.15289164787221953823f) * s->root;
+        quant_table[i] = expf(i * 0.15289164787221953823f) * s->root;
    }

    /* calculate number of bands */
@@ -196,7 +197,7 @@ static int decode_block(BinkAudioContext *s, float **out, int use_dct)
            return AVERROR_INVALIDDATA;
        for (i = 0; i < s->num_bands; i++) {
            int value = get_bits(gb, 8);
-            quant[i]  = s->quant_table[FFMIN(value, 95)];
+            quant[i]  = quant_table[FFMIN(value, 95)];
        }

        k = 0;
--- a/libavcodec/bitstream.c
+++ b/libavcodec/bitstream.c
@@ -129,7 +129,7 @@ static int alloc_table(VLC *vlc, int size, int use_static)

 typedef struct VLCcode {
    uint8_t bits;
-    VLC_TYPE symbol;
+    uint16_t symbol;
    /** codeword, with the first bit-to-be-read in the msb
     * (even if intended for a little-endian bitstream reader) */
    uint32_t code;
@@ -162,9 +162,9 @@ static int build_table(VLC *vlc, int table_nb_bits, int nb_codes,
    uint32_t code;
    volatile VLC_TYPE (* volatile table)[2]; // the double volatile is needed to prevent an internal compiler error in gcc 4.2

+    table_size = 1 << table_nb_bits;
    if (table_nb_bits > 30)
       return AVERROR(EINVAL);
-    table_size = 1 << table_nb_bits;
    table_index = alloc_table(vlc, table_size, flags & INIT_VLC_USE_NEW_STATIC);
    ff_dlog(NULL, "new table index=%d size=%d\n", table_index, table_size);
    if (table_index < 0)
--- a/libavcodec/cbs.c
+++ b/libavcodec/cbs.c
@@ -693,11 +693,11 @@ static int cbs_insert_unit(CodedBitstreamContext *ctx,
            memmove(units + position + 1, units + position,
                    (frag->nb_units - position) * sizeof(*units));
    } else {
-        units = av_malloc_array(frag->nb_units*2 + 1, sizeof(*units));
+        units = av_malloc_array(frag->nb_units + 1, sizeof(*units));
        if (!units)
            return AVERROR(ENOMEM);

-        frag->nb_units_allocated = 2*frag->nb_units_allocated + 1;
+        ++frag->nb_units_allocated;

        if (position > 0)
            memcpy(units, frag->units, position * sizeof(*units));
--- a/libavcodec/cbs_av1.c
+++ b/libavcodec/cbs_av1.c
@@ -125,9 +125,8 @@ static int cbs_av1_write_uvlc(CodedBitstreamContext *ctx, PutBitContext *pbc,
        put_bits(pbc, 1, 1);
    } else {
        zeroes = av_log2(value + 1);
-        v = value - (1U << zeroes) + 1;
-        put_bits(pbc, zeroes, 0);
-        put_bits(pbc, 1, 1);
+        v = value - (1 << zeroes) + 1;
+        put_bits(pbc, zeroes + 1, 1);
        put_bits(pbc, zeroes, v);
    }

@@ -712,11 +711,10 @@ static size_t cbs_av1_get_payload_bytes_left(GetBitContext *gbc)

 #define infer(name, value) do { \
        if (current->name != (value)) { \
-            av_log(ctx->log_ctx, AV_LOG_ERROR, \
+            av_log(ctx->log_ctx, AV_LOG_WARNING, "Warning: " \
                   "%s does not match inferred value: " \
                   "%"PRId64", but should be %"PRId64".\n", \
                   #name, (int64_t)current->name, (int64_t)(value)); \
-            return AVERROR_INVALIDDATA; \
        } \
    } while (0)

--- a/libavcodec/cbs_av1.h
+++ b/libavcodec/cbs_av1.h
@@ -158,8 +158,8 @@ typedef struct AV1RawFrameHeader {
    uint8_t  use_superres;
    uint8_t  coded_denom;
    uint8_t  render_and_frame_size_different;
-    uint16_t render_width_minus_1;
-    uint16_t render_height_minus_1;
+    uint8_t  render_width_minus_1;
+    uint8_t  render_height_minus_1;

    uint8_t found_ref[AV1_REFS_PER_FRAME];

@@ -429,7 +429,6 @@ typedef struct CodedBitstreamAV1Context {
    int operating_point_idc;

    int bit_depth;
-    int order_hint;
    int frame_width;
    int frame_height;
    int upscaled_width;
--- a/libavcodec/cbs_av1_syntax_template.c
+++ b/libavcodec/cbs_av1_syntax_template.c
@@ -366,7 +366,7 @@ static int FUNC(set_frame_refs)(CodedBitstreamContext *ctx, RWContext *rw,
    for (i = 0; i < AV1_NUM_REF_FRAMES; i++)
        shifted_order_hints[i] = cur_frame_hint +
                                 cbs_av1_get_relative_dist(seq, priv->ref[i].order_hint,
-                                                           priv->order_hint);
+                                                           current->order_hint);

    latest_order_hint = shifted_order_hints[current->last_frame_idx];
    earliest_order_hint = shifted_order_hints[current->golden_frame_idx];
@@ -541,7 +541,7 @@ static int FUNC(frame_size_with_refs)(CodedBitstreamContext *ctx, RWContext *rw,
            }

            priv->upscaled_width = ref->upscaled_width;
-            priv->frame_width    = priv->upscaled_width;
+            priv->frame_width    = ref->frame_width;
            priv->frame_height   = ref->frame_height;
            priv->render_width   = ref->render_width;
            priv->render_height  = ref->render_height;
@@ -993,7 +993,7 @@ static int FUNC(skip_mode_params)(CodedBitstreamContext *ctx, RWContext *rw,
        for (i = 0; i < AV1_REFS_PER_FRAME; i++) {
            ref_hint = priv->ref[current->ref_frame_idx[i]].order_hint;
            dist = cbs_av1_get_relative_dist(seq, ref_hint,
-                                             priv->order_hint);
+                                             current->order_hint);
            if (dist < 0) {
                if (forward_idx < 0 ||
                    cbs_av1_get_relative_dist(seq, ref_hint,
@@ -1261,10 +1261,10 @@ static int FUNC(uncompressed_header)(CodedBitstreamContext *ctx, RWContext *rw,
        flag(show_existing_frame);

        if (current->show_existing_frame) {
-            AV1ReferenceFrameState *ref;
+            AV1ReferenceFrameState *frame;

            fb(3, frame_to_show_map_idx);
-            ref = &priv->ref[current->frame_to_show_map_idx];
+            frame = &priv->ref[current->frame_to_show_map_idx];

            if (seq->decoder_model_info_present_flag &&
                !seq->timing_info.equal_picture_interval) {
@@ -1275,24 +1275,12 @@ static int FUNC(uncompressed_header)(CodedBitstreamContext *ctx, RWContext *rw,
            if (seq->frame_id_numbers_present_flag)
                fb(id_len, display_frame_id);

-            infer(frame_type, ref->frame_type);
-            if (current->frame_type == AV1_FRAME_KEY) {
+            if (frame->frame_type == AV1_FRAME_KEY)
                infer(refresh_frame_flags, all_frames);
-
-                // Section 7.21
-                infer(current_frame_id, ref->frame_id);
-                priv->upscaled_width  = ref->upscaled_width;
-                priv->frame_width     = ref->frame_width;
-                priv->frame_height    = ref->frame_height;
-                priv->render_width    = ref->render_width;
-                priv->render_height   = ref->render_height;
-                priv->bit_depth       = ref->bit_depth;
-                priv->order_hint      = ref->order_hint;
-            } else
+            else
                infer(refresh_frame_flags, 0);

-            // Section 7.20
-            goto update_refs;
+            return 0;
        }

        fb(2, frame_type);
@@ -1378,7 +1366,6 @@ static int FUNC(uncompressed_header)(CodedBitstreamContext *ctx, RWContext *rw,
        fb(order_hint_bits, order_hint);
    else
        infer(order_hint, 0);
-    priv->order_hint = current->order_hint;

    if (frame_is_intra || current->error_resilient_mode)
        infer(primary_ref_frame, AV1_PRIMARY_REF_NONE);
@@ -1394,7 +1381,7 @@ static int FUNC(uncompressed_header)(CodedBitstreamContext *ctx, RWContext *rw,
                    int in_temporal_layer = (op_pt_idc >>  priv->temporal_id    ) & 1;
                    int in_spatial_layer  = (op_pt_idc >> (priv->spatial_id + 8)) & 1;
                    if (seq->operating_point_idc[i] == 0 ||
-                        (in_temporal_layer && in_spatial_layer)) {
+                        in_temporal_layer || in_spatial_layer) {
                        fbs(seq->decoder_model_info.buffer_removal_time_length_minus_1 + 1,
                            buffer_removal_time[i], 1, i);
                    }
@@ -1554,16 +1541,6 @@ static int FUNC(uncompressed_header)(CodedBitstreamContext *ctx, RWContext *rw,

    CHECK(FUNC(film_grain_params)(ctx, rw, current));

-    av_log(ctx->log_ctx, AV_LOG_DEBUG, "Frame %d:  size %dx%d  "
-           "upscaled %d  render %dx%d  subsample %dx%d  "
-           "bitdepth %d  tiles %dx%d.\n", priv->order_hint,
-           priv->frame_width, priv->frame_height, priv->upscaled_width,
-           priv->render_width, priv->render_height,
-           seq->color_config.subsampling_x + 1,
-           seq->color_config.subsampling_y + 1, priv->bit_depth,
-           priv->tile_rows, priv->tile_cols);
-
-update_refs:
    for (i = 0; i < AV1_NUM_REF_FRAMES; i++) {
        if (current->refresh_frame_flags & (1 << i)) {
            priv->ref[i] = (AV1ReferenceFrameState) {
@@ -1578,11 +1555,20 @@ update_refs:
                .subsampling_x  = seq->color_config.subsampling_x,
                .subsampling_y  = seq->color_config.subsampling_y,
                .bit_depth      = priv->bit_depth,
-                .order_hint     = priv->order_hint,
+                .order_hint     = current->order_hint,
            };
        }
    }

+    av_log(ctx->log_ctx, AV_LOG_DEBUG, "Frame %d:  size %dx%d  "
+           "upscaled %d  render %dx%d  subsample %dx%d  "
+           "bitdepth %d  tiles %dx%d.\n", current->order_hint,
+           priv->frame_width, priv->frame_height, priv->upscaled_width,
+           priv->render_width, priv->render_height,
+           seq->color_config.subsampling_x + 1,
+           seq->color_config.subsampling_y + 1, priv->bit_depth,
+           priv->tile_rows, priv->tile_cols);
+
    return 0;
 }

--- a/libavcodec/cbs_h2645.c
+++ b/libavcodec/cbs_h2645.c
@@ -408,11 +408,10 @@ static int cbs_h2645_read_more_rbsp_data(GetBitContext *gbc)

 #define infer(name, value) do { \
        if (current->name != (value)) { \
-            av_log(ctx->log_ctx, AV_LOG_ERROR, \
+            av_log(ctx->log_ctx, AV_LOG_WARNING, "Warning: " \
                   "%s does not match inferred value: " \
                   "%"PRId64", but should be %"PRId64".\n", \
                   #name, (int64_t)current->name, (int64_t)(value)); \
-            return AVERROR_INVALIDDATA; \
        } \
    } while (0)

--- a/libavcodec/cbs_h265_syntax_template.c
+++ b/libavcodec/cbs_h265_syntax_template.c
@@ -728,7 +728,7 @@ static int FUNC(sps_scc_extension)(CodedBitstreamContext *ctx, RWContext *rw,

        flag(sps_palette_predictor_initializer_present_flag);
        if (current->sps_palette_predictor_initializer_present_flag) {
-            ue(sps_num_palette_predictor_initializer_minus1, 0, 127);
+            ue(sps_num_palette_predictor_initializer_minus1, 0, 128);
            for (comp = 0; comp < (current->chroma_format_idc ? 3 : 1); comp++) {
                int bit_depth = comp == 0 ? current->bit_depth_luma_minus8 + 8
                                          : current->bit_depth_chroma_minus8 + 8;
@@ -744,32 +744,6 @@ static int FUNC(sps_scc_extension)(CodedBitstreamContext *ctx, RWContext *rw,
    return 0;
 }

-static int FUNC(vui_parameters_default)(CodedBitstreamContext *ctx,
-                                        RWContext *rw, H265RawVUI *current,
-                                        H265RawSPS *sps)
-{
-    infer(aspect_ratio_idc, 0);
-
-    infer(video_format,             5);
-    infer(video_full_range_flag,    0);
-    infer(colour_primaries,         2);
-    infer(transfer_characteristics, 2);
-    infer(matrix_coefficients,      2);
-
-    infer(chroma_sample_loc_type_top_field,    0);
-    infer(chroma_sample_loc_type_bottom_field, 0);
-
-    infer(tiles_fixed_structure_flag,    0);
-    infer(motion_vectors_over_pic_boundaries_flag, 1);
-    infer(min_spatial_segmentation_idc,  0);
-    infer(max_bytes_per_pic_denom,       2);
-    infer(max_bits_per_min_cu_denom,     1);
-    infer(log2_max_mv_length_horizontal, 15);
-    infer(log2_max_mv_length_vertical,   15);
-
-    return 0;
-}
-
 static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw,
                     H265RawSPS *current)
 {
@@ -934,8 +908,6 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw,
    flag(vui_parameters_present_flag);
    if (current->vui_parameters_present_flag)
        CHECK(FUNC(vui_parameters)(ctx, rw, &current->vui, current));
-    else
-        CHECK(FUNC(vui_parameters_default)(ctx, rw, &current->vui, current));

    flag(sps_extension_present_flag);
    if (current->sps_extension_present_flag) {
--- a/libavcodec/cbs_jpeg.c
+++ b/libavcodec/cbs_jpeg.c
@@ -149,7 +149,6 @@ static int cbs_jpeg_split_fragment(CodedBitstreamContext *ctx,
            break;
        } else if (marker == JPEG_MARKER_SOS) {
            next_marker = -1;
-            end = start;
            for (i = start; i + 1 < frag->data_size; i++) {
                if (frag->data[i] != 0xff)
                    continue;
--- a/libavcodec/celp_filters.c
+++ b/libavcodec/celp_filters.c
@@ -65,11 +65,11 @@ int ff_celp_lp_synthesis_filter(int16_t *out, const int16_t *filter_coeffs,
    int i,n;

    for (n = 0; n < buffer_length; n++) {
-        int sum = rounder, sum1;
+        int sum = -rounder, sum1;
        for (i = 1; i <= filter_length; i++)
-            sum -= (unsigned)(filter_coeffs[i-1] * out[n-i]);
+            sum += (unsigned)(filter_coeffs[i-1] * out[n-i]);

-        sum1 = ((sum >> 12) + in[n]) >> shift;
+        sum1 = ((-sum >> 12) + in[n]) >> shift;
        sum  = av_clip_int16(sum1);

        if (stop_on_overflow && sum != sum1)
--- a/libavcodec/cfhd.c
+++ b/libavcodec/cfhd.c
@@ -503,10 +503,6 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
                avpriv_report_missing_feature(avctx, "Transform type of %"PRIu16, data);
                ret = AVERROR_PATCHWELCOME;
                break;
-            } else if (data == 1) {
-                av_log(avctx, AV_LOG_ERROR, "unsupported transform type\n");
-                ret = AVERROR_PATCHWELCOME;
-                break;
            }
            av_log(avctx, AV_LOG_DEBUG, "Transform-type? %"PRIu16"\n", data);
        } else if (abstag >= 0x4000 && abstag <= 0x40ff) {
@@ -611,12 +607,6 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
            s->peak.level   = 0;
        } else if (tag == -74 && s->peak.offset) {
            s->peak.level = data;
-            if (s->peak.offset < 4 - bytestream2_tell(&s->peak.base) ||
-                s->peak.offset > 4 + bytestream2_get_bytes_left(&s->peak.base)
-            ) {
-                ret = AVERROR_INVALIDDATA;
-                goto end;
-            }
            bytestream2_seek(&s->peak.base, s->peak.offset - 4, SEEK_CUR);
        } else
            av_log(avctx, AV_LOG_DEBUG,  "Unknown tag %i data %x\n", tag, data);
--- a/libavcodec/clearvideo.c
+++ b/libavcodec/clearvideo.c
@@ -665,8 +665,8 @@ static av_cold int clv_decode_init(AVCodecContext *avctx)
    }

    c->tile_shift = av_log2(c->tile_size);
-    if (1U << c->tile_shift != c->tile_size || c->tile_shift < 1 || c->tile_shift > 30) {
-        av_log(avctx, AV_LOG_ERROR, "Tile size: %d, is not power of 2 > 1 and < 2^31\n", c->tile_size);
+    if (1U << c->tile_shift != c->tile_size) {
+        av_log(avctx, AV_LOG_ERROR, "Tile size: %d, is not power of 2.\n", c->tile_size);
        return AVERROR_INVALIDDATA;
    }

--- a/libavcodec/cook.c
+++ b/libavcodec/cook.c
@@ -1084,10 +1084,6 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)
    ff_audiodsp_init(&q->adsp);

    while (bytestream2_get_bytes_left(&gb)) {
-        if (s >= FFMIN(MAX_SUBPACKETS, avctx->block_align)) {
-            avpriv_request_sample(avctx, "subpackets > %d", FFMIN(MAX_SUBPACKETS, avctx->block_align));
-            return AVERROR_PATCHWELCOME;
-        }
        /* 8 for mono, 16 for stereo, ? for multichannel
           Swap to right endianness so we don't need to care later on. */
        q->subpacket[s].cookversion      = bytestream2_get_be32(&gb);
@@ -1219,6 +1215,10 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)

        q->num_subpackets++;
        s++;
+        if (s > FFMIN(MAX_SUBPACKETS, avctx->block_align)) {
+            avpriv_request_sample(avctx, "subpackets > %d", FFMIN(MAX_SUBPACKETS, avctx->block_align));
+            return AVERROR_PATCHWELCOME;
+        }
    }

    /* Try to catch some obviously faulty streams, otherwise it might be exploitable */
--- a/libavcodec/cpia.c
+++ b/libavcodec/cpia.c
@@ -111,7 +111,6 @@ static int cpia_decode_frame(AVCodecContext *avctx,
        // Read line length, two byte little endian
        linelength = AV_RL16(src);
        src += 2;
-        src_size -= 2;

        if (src_size < linelength) {
            frame->decode_error_flags = FF_DECODE_ERROR_INVALID_BITSTREAM;
--- a/libavcodec/cscd.c
+++ b/libavcodec/cscd.c
@@ -93,7 +93,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
    case 1: { // zlib compression
 #if CONFIG_ZLIB
        unsigned long dlen = c->decomp_size;
-        if (uncompress(c->decomp_buf, &dlen, &buf[2], buf_size - 2) != Z_OK || dlen != c->decomp_size) {
+        if (uncompress(c->decomp_buf, &dlen, &buf[2], buf_size - 2) != Z_OK) {
            av_log(avctx, AV_LOG_ERROR, "error during zlib decompression\n");
            return AVERROR_INVALIDDATA;
        }
--- a/libavcodec/cuviddec.c
+++ b/libavcodec/cuviddec.c
@@ -88,7 +88,7 @@ typedef struct CuvidContext
    CUVIDDECODECAPS caps8, caps10, caps12;

    CUVIDPARSERPARAMS cuparseinfo;
-    CUVIDEOFORMATEX *cuparse_ext;
+    CUVIDEOFORMATEX cuparse_ext;

    CudaFunctions *cudl;
    CuvidFunctions *cvdl;
@@ -684,7 +684,6 @@ static av_cold int cuvid_decode_end(AVCodecContext *avctx)
    av_buffer_unref(&ctx->hwdevice);

    av_freep(&ctx->key_frame);
-    av_freep(&ctx->cuparse_ext);

    cuvid_free_functions(&ctx->cvdl);

@@ -794,8 +793,6 @@ static av_cold int cuvid_decode_init(AVCodecContext *avctx)
    CUVIDSOURCEDATAPACKET seq_pkt;
    CUcontext cuda_ctx = NULL;
    CUcontext dummy;
-    uint8_t *extradata;
-    int extradata_size;
    int ret = 0;

    enum AVPixelFormat pix_fmts[3] = { AV_PIX_FMT_CUDA,
@@ -892,8 +889,11 @@ static av_cold int cuvid_decode_init(AVCodecContext *avctx)
    ctx->cudl = device_hwctx->internal->cuda_dl;

    memset(&ctx->cuparseinfo, 0, sizeof(ctx->cuparseinfo));
+    memset(&ctx->cuparse_ext, 0, sizeof(ctx->cuparse_ext));
    memset(&seq_pkt, 0, sizeof(seq_pkt));

+    ctx->cuparseinfo.pExtVideoInfo = &ctx->cuparse_ext;
+
    switch (avctx->codec->id) {
 #if CONFIG_H264_CUVID_DECODER
    case AV_CODEC_ID_H264:
@@ -947,26 +947,17 @@ static av_cold int cuvid_decode_init(AVCodecContext *avctx)

    if (avctx->codec->bsfs) {
        const AVCodecParameters *par = avctx->internal->bsf->par_out;
-        extradata = par->extradata;
-        extradata_size = par->extradata_size;
-    } else {
-        extradata = avctx->extradata;
-        extradata_size = avctx->extradata_size;
+        ctx->cuparse_ext.format.seqhdr_data_length = par->extradata_size;
+        memcpy(ctx->cuparse_ext.raw_seqhdr_data,
+               par->extradata,
+               FFMIN(sizeof(ctx->cuparse_ext.raw_seqhdr_data), par->extradata_size));
+    } else if (avctx->extradata_size > 0) {
+        ctx->cuparse_ext.format.seqhdr_data_length = avctx->extradata_size;
+        memcpy(ctx->cuparse_ext.raw_seqhdr_data,
+               avctx->extradata,
+               FFMIN(sizeof(ctx->cuparse_ext.raw_seqhdr_data), avctx->extradata_size));
    }

-    ctx->cuparse_ext = av_mallocz(sizeof(*ctx->cuparse_ext)
-            + FFMAX(extradata_size - (int)sizeof(ctx->cuparse_ext->raw_seqhdr_data), 0));
-    if (!ctx->cuparse_ext) {
-        ret = AVERROR(ENOMEM);
-        goto error;
-    }
-
-    if (extradata_size > 0)
-        memcpy(ctx->cuparse_ext->raw_seqhdr_data, extradata, extradata_size);
-    ctx->cuparse_ext->format.seqhdr_data_length = extradata_size;
-
-    ctx->cuparseinfo.pExtVideoInfo = ctx->cuparse_ext;
-
    ctx->key_frame = av_mallocz(ctx->nb_surfaces * sizeof(int));
    if (!ctx->key_frame) {
        ret = AVERROR(ENOMEM);
@@ -995,8 +986,8 @@ static av_cold int cuvid_decode_init(AVCodecContext *avctx)
    if (ret < 0)
        goto error;

-    seq_pkt.payload = ctx->cuparse_ext->raw_seqhdr_data;
-    seq_pkt.payload_size = ctx->cuparse_ext->format.seqhdr_data_length;
+    seq_pkt.payload = ctx->cuparse_ext.raw_seqhdr_data;
+    seq_pkt.payload_size = ctx->cuparse_ext.format.seqhdr_data_length;

    if (seq_pkt.payload && seq_pkt.payload_size) {
        ret = CHECK_CU(ctx->cvdl->cuvidParseVideoData(ctx->cuparser, &seq_pkt));
@@ -1055,8 +1046,8 @@ static void cuvid_flush(AVCodecContext *avctx)
    if (ret < 0)
        goto error;

-    seq_pkt.payload = ctx->cuparse_ext->raw_seqhdr_data;
-    seq_pkt.payload_size = ctx->cuparse_ext->format.seqhdr_data_length;
+    seq_pkt.payload = ctx->cuparse_ext.raw_seqhdr_data;
+    seq_pkt.payload_size = ctx->cuparse_ext.format.seqhdr_data_length;

    if (seq_pkt.payload && seq_pkt.payload_size) {
        ret = CHECK_CU(ctx->cvdl->cuvidParseVideoData(ctx->cuparser, &seq_pkt));
--- a/libavcodec/dcadsp.c
+++ b/libavcodec/dcadsp.c
@@ -328,7 +328,7 @@ static void dmix_add_c(int32_t *dst, const int32_t *src, int coeff, ptrdiff_t le
    int i;

    for (i = 0; i < len; i++)
-        dst[i] += (unsigned)mul15(src[i], coeff);
+        dst[i] += mul15(src[i], coeff);
 }

 static void dmix_scale_c(int32_t *dst, int scale, ptrdiff_t len)
--- a/libavcodec/decode.c
+++ b/libavcodec/decode.c
@@ -1858,8 +1858,7 @@ int ff_get_buffer(AVCodecContext *avctx, AVFrame *frame, int flags)
    int ret;

    if (avctx->codec_type == AVMEDIA_TYPE_VIDEO) {
-        if ((unsigned)avctx->width > INT_MAX - STRIDE_ALIGN ||
-            (ret = av_image_check_size2(FFALIGN(avctx->width, STRIDE_ALIGN), avctx->height, avctx->max_pixels, AV_PIX_FMT_NONE, 0, avctx)) < 0 || avctx->pix_fmt<0) {
+        if ((ret = av_image_check_size2(FFALIGN(avctx->width, STRIDE_ALIGN), avctx->height, avctx->max_pixels, AV_PIX_FMT_NONE, 0, avctx)) < 0 || avctx->pix_fmt<0) {
            av_log(avctx, AV_LOG_ERROR, "video_get_buffer: image parameters invalid\n");
            ret = AVERROR(EINVAL);
            goto fail;
--- a/libavcodec/dirac_parser.c
+++ b/libavcodec/dirac_parser.c
@@ -215,7 +215,7 @@ static int dirac_combine_frame(AVCodecParserContext *s, AVCodecContext *avctx,
            int64_t pts = AV_RB32(cur_pu + 13);
            if (s->last_pts == 0 && s->last_dts == 0)
                s->dts = pts - 1;
-            else if (s->last_dts != AV_NOPTS_VALUE)
+            else
                s->dts = s->last_dts + 1;
            s->pts = pts;
            if (!avctx->has_b_frames && (cur_pu[4] & 0x03))
--- a/libavcodec/diracdec.c
+++ b/libavcodec/diracdec.c
@@ -1431,8 +1431,8 @@ static void global_mv(DiracContext *s, DiracBlock *block, int x, int y, int ref)
    int *c      = s->globalmc[ref].perspective;

    int64_t m   = (1<<ep) - (c[0]*(int64_t)x + c[1]*(int64_t)y);
-    int64_t mx  = m * (uint64_t)((A[0][0] * (int64_t)x + A[0][1]*(int64_t)y) + (1LL<<ez) * b[0]);
-    int64_t my  = m * (uint64_t)((A[1][0] * (int64_t)x + A[1][1]*(int64_t)y) + (1LL<<ez) * b[1]);
+    int64_t mx  = m * (int64_t)((A[0][0] * (int64_t)x + A[0][1]*(int64_t)y) + (1LL<<ez) * b[0]);
+    int64_t my  = m * (int64_t)((A[1][0] * (int64_t)x + A[1][1]*(int64_t)y) + (1LL<<ez) * b[1]);

    block->u.mv[ref][0] = (mx + (1<<(ez+ep))) >> (ez+ep);
    block->u.mv[ref][1] = (my + (1<<(ez+ep))) >> (ez+ep);
--- a/libavcodec/diracdsp.c
+++ b/libavcodec/diracdsp.c
@@ -198,9 +198,9 @@ static void dequant_subband_ ## PX ## _c(uint8_t *src, uint8_t *dst, ptrdiff_t s
        PX c, sign, *src_r = (PX *)src, *dst_r = (PX *)dst;                                \
        for (i = 0; i < tot_h; i++) {                                                      \
            c = *src_r++;                                                                  \
-            if     (c < 0) c = -((-(unsigned)c*qf + qs) >> 2);                             \
-            else if(c > 0) c =  (( (unsigned)c*qf + qs) >> 2);                             \
-            *dst_r++ = c;                                                                  \
+            sign = FFSIGN(c)*(!!c);                                                        \
+            c = (FFABS(c)*(unsigned)qf + qs) >> 2;                                                   \
+            *dst_r++ = c*sign;                                                             \
        }                                                                                  \
        src += tot_h << (sizeof(PX) >> 1);                                                 \
        dst += stride;                                                                     \
--- a/libavcodec/dnxhddec.c
+++ b/libavcodec/dnxhddec.c
@@ -110,7 +110,6 @@ static av_cold int dnxhd_decode_init(AVCodecContext *avctx)

 static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth)
 {
-    int ret;
    if (cid != ctx->cid) {
        int index;

@@ -130,26 +129,19 @@ static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth)
        ff_free_vlc(&ctx->dc_vlc);
        ff_free_vlc(&ctx->run_vlc);

-        if ((ret = init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,
+        init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,
                 ctx->cid_table->ac_bits, 1, 1,
-                 ctx->cid_table->ac_codes, 2, 2, 0)) < 0)
-            goto out;
-        if ((ret = init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12,
+                 ctx->cid_table->ac_codes, 2, 2, 0);
+        init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12,
                 ctx->cid_table->dc_bits, 1, 1,
-                 ctx->cid_table->dc_codes, 1, 1, 0)) < 0)
-            goto out;
-        if ((ret = init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,
+                 ctx->cid_table->dc_codes, 1, 1, 0);
+        init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,
                 ctx->cid_table->run_bits, 1, 1,
-                 ctx->cid_table->run_codes, 2, 2, 0)) < 0)
-            goto out;
+                 ctx->cid_table->run_codes, 2, 2, 0);

        ctx->cid = cid;
    }
-    ret = 0;
-out:
-    if (ret < 0)
-        av_log(ctx->avctx, AV_LOG_ERROR, "init_vlc failed\n");
-    return ret;
+    return 0;
 }

 static int dnxhd_get_profile(int cid)
--- a/libavcodec/dpx.c
+++ b/libavcodec/dpx.c
@@ -206,9 +206,6 @@ static int decode_frame(AVCodecContext *avctx,
        return AVERROR_PATCHWELCOME;
    }

-    if (bits_per_color > 32)
-        return AVERROR_INVALIDDATA;
-
    buf += 820;
    avctx->sample_aspect_ratio.num = read32(&buf, endian);
    avctx->sample_aspect_ratio.den = read32(&buf, endian);
--- a/libavcodec/dstdec.c
+++ b/libavcodec/dstdec.c
@@ -56,6 +56,7 @@ static const int8_t probs_code_pred_coeff[3][3] = {
 typedef struct ArithCoder {
    unsigned int a;
    unsigned int c;
+    int overread;
 } ArithCoder;

 typedef struct Table {
@@ -85,12 +86,6 @@ static av_cold int decode_init(AVCodecContext *avctx)
        return AVERROR_PATCHWELCOME;
    }

-    // the sample rate is only allowed to be 64,128,256 * 44100 by ISO/IEC 14496-3:2005(E)
-    // We are a bit more tolerant here, but this check is needed to bound the size and duration
-    if (avctx->sample_rate > 512 * 44100)
-        return AVERROR_INVALIDDATA;
-
-
    if (DST_SAMPLES_PER_FRAME(avctx->sample_rate) & 7) {
        return AVERROR_PATCHWELCOME;
    }
@@ -186,6 +181,7 @@ static void ac_init(ArithCoder *ac, GetBitContext *gb)
 {
    ac->a = 4095;
    ac->c = get_bits(gb, 12);
+    ac->overread = 0;
 }

 static av_always_inline void ac_get(ArithCoder *ac, GetBitContext *gb, int p, int *e)
@@ -205,6 +201,8 @@ static av_always_inline void ac_get(ArithCoder *ac, GetBitContext *gb, int p, in
    if (ac->a < 2048) {
        int n = 11 - av_log2(ac->a);
        ac->a <<= n;
+        if (get_bits_left(gb) < n)
+            ac->overread ++;
        ac->c = (ac->c << n) | get_bits(gb, n);
    }
 }
@@ -357,6 +355,9 @@ static int decode_frame(AVCodecContext *avctx, void *data,
                prob = 128;
            }

+            if (ac->overread > 16)
+                return AVERROR_INVALIDDATA;
+
            ac_get(ac, gb, prob, &residual);
            v = ((predict >> 15) ^ residual) & 1;
            dsd[((i >> 3) * channels + ch) << 2] |= v << (7 - (i & 0x7 ));
--- a/libavcodec/dvenc.c
+++ b/libavcodec/dvenc.c
@@ -215,8 +215,8 @@ static av_always_inline int dv_guess_dct_mode(DVVideoContext *s, uint8_t *data,
    if (s->avctx->flags & AV_CODEC_FLAG_INTERLACED_DCT) {
        int ps = s->ildct_cmp(NULL, data, NULL, linesize, 8) - 400;
        if (ps > 0) {
-            int is = s->ildct_cmp(NULL, data,            NULL, linesize * 2, 4) +
-                     s->ildct_cmp(NULL, data + linesize, NULL, linesize * 2, 4);
+            int is = s->ildct_cmp(NULL, data,            NULL, linesize << 1, 4) +
+                     s->ildct_cmp(NULL, data + linesize, NULL, linesize << 1, 4);
            return ps > is;
        }
    }
@@ -511,7 +511,7 @@ static av_always_inline int dv_init_enc_block(EncBlockInfo* bi, uint8_t *data, i

    if (data) {
        if (DV_PROFILE_IS_HD(s->sys)) {
-            s->get_pixels(blk, data, linesize * (1 << bi->dct_mode));
+            s->get_pixels(blk, data, linesize << bi->dct_mode);
            s->fdct[0](blk);
        } else {
            bi->dct_mode = dv_guess_dct_mode(s, data, linesize);
@@ -860,7 +860,7 @@ static int dv_encode_video_segment(AVCodecContext *avctx, void *arg)

        qnos[mb_index] = DV_PROFILE_IS_HD(s->sys) ? 1 : 15;

-        y_ptr    = s->frame->data[0] + (mb_y * s->frame->linesize[0] + mb_x) * 8;
+        y_ptr    = s->frame->data[0] + ((mb_y * s->frame->linesize[0] + mb_x) << 3);
        linesize = s->frame->linesize[0];

        if (s->sys->height == 1080 && mb_y < 134)
@@ -874,12 +874,12 @@ static int dv_encode_video_segment(AVCodecContext *avctx, void *arg)
        if ((s->sys->pix_fmt == AV_PIX_FMT_YUV420P)                      ||
            (s->sys->pix_fmt == AV_PIX_FMT_YUV411P && mb_x >= (704 / 8)) ||
            (s->sys->height >= 720 && mb_y != 134)) {
-            y_stride = s->frame->linesize[0] * (1 << (3*!enc_blk->dct_mode));
+            y_stride = s->frame->linesize[0] << (3*!enc_blk->dct_mode);
        } else {
            y_stride = 16;
        }
        y_ptr    = s->frame->data[0] +
-                   (mb_y * s->frame->linesize[0] + mb_x) * 8;
+                   ((mb_y * s->frame->linesize[0] + mb_x) << 3);
        linesize = s->frame->linesize[0];

        if (s->sys->video_stype == 4) { /* SD 422 */
@@ -898,17 +898,17 @@ static int dv_encode_video_segment(AVCodecContext *avctx, void *arg)
        enc_blk += 4;

        /* initializing chrominance blocks */
-        c_offset = ((mb_y >>  (s->sys->pix_fmt == AV_PIX_FMT_YUV420P)) * s->frame->linesize[1] +
-                    (mb_x >> ((s->sys->pix_fmt == AV_PIX_FMT_YUV411P) ? 2 : 1))) * 8;
+        c_offset = (((mb_y >>  (s->sys->pix_fmt == AV_PIX_FMT_YUV420P)) * s->frame->linesize[1] +
+                     (mb_x >> ((s->sys->pix_fmt == AV_PIX_FMT_YUV411P) ? 2 : 1))) << 3);
        for (j = 2; j; j--) {
            uint8_t *c_ptr = s->frame->data[j] + c_offset;
            linesize = s->frame->linesize[j];
-            y_stride = (mb_y == 134) ? 8 : (s->frame->linesize[j] * (1 << (3*!enc_blk->dct_mode)));
+            y_stride = (mb_y == 134) ? 8 : (s->frame->linesize[j] << (3*!enc_blk->dct_mode));
            if (s->sys->pix_fmt == AV_PIX_FMT_YUV411P && mb_x >= (704 / 8)) {
                uint8_t *d;
                uint8_t *b = scratch;
                for (i = 0; i < 8; i++) {
-                    d      = c_ptr + linesize * 8;
+                    d      = c_ptr + (linesize << 3);
                    b[0]   = c_ptr[0];
                    b[1]   = c_ptr[1];
                    b[2]   = c_ptr[2];
--- a/libavcodec/dxtory.c
+++ b/libavcodec/dxtory.c
@@ -456,7 +456,7 @@ static int dx2_decode_slice_410(GetBitContext *gb, AVFrame *frame,
            V[x >> 2] = decode_sym(gb, lru[2]) ^ 0x80;
        }

-        Y += ystride * 4;
+        Y += ystride << 2;
        U += ustride;
        V += vstride;
    }
@@ -501,7 +501,7 @@ static int dx2_decode_slice_420(GetBitContext *gb, AVFrame *frame,
            V[x >> 1] = decode_sym(gb, lru[2]) ^ 0x80;
        }

-        Y += ystride * 2;
+        Y += ystride << 1;
        U += ustride;
        V += vstride;
    }
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -1051,9 +1051,6 @@ static int decode_block(AVCodecContext *avctx, void *tdata,
        if ((col + td->xsize) != s->xdelta)/* not the last tile of the line */
            axmax = 0; /* doesn't add pixel at the right of the datawindow */

-        if (td->xsize * (uint64_t)s->current_channel_offset > INT_MAX)
-            return AVERROR_INVALIDDATA;
-
        td->channel_line_size = td->xsize * s->current_channel_offset;/* uncompress size of one line */
        uncompressed_size = td->channel_line_size * (uint64_t)td->ysize;/* uncompress size of the block */
    } else {
@@ -1073,9 +1070,6 @@ static int decode_block(AVCodecContext *avctx, void *tdata,
        td->ysize          = FFMIN(s->scan_lines_per_block, s->ymax - line + 1); /* s->ydelta - line ?? */
        td->xsize          = s->xdelta;

-        if (td->xsize * (uint64_t)s->current_channel_offset > INT_MAX)
-            return AVERROR_INVALIDDATA;
-
        td->channel_line_size = td->xsize * s->current_channel_offset;/* uncompress size of one line */
        uncompressed_size = td->channel_line_size * (uint64_t)td->ysize;/* uncompress size of the block */

@@ -1499,28 +1493,15 @@ static int decode_header(EXRContext *s, AVFrame *frame)
            continue;
        } else if ((var_size = check_header_variable(s, "dataWindow", "box2i",
                                                     31)) >= 0) {
-            int xmin, ymin, xmax, ymax;
            if (!var_size) {
                ret = AVERROR_INVALIDDATA;
                goto fail;
            }

-            xmin   = bytestream2_get_le32(&s->gb);
-            ymin   = bytestream2_get_le32(&s->gb);
-            xmax   = bytestream2_get_le32(&s->gb);
-            ymax   = bytestream2_get_le32(&s->gb);
-
-            if (xmin > xmax || ymin > ymax ||
-                ymax == INT_MAX || xmax == INT_MAX ||
-                (unsigned)xmax - xmin >= INT_MAX ||
-                (unsigned)ymax - ymin >= INT_MAX) {
-                ret = AVERROR_INVALIDDATA;
-                goto fail;
-            }
-            s->xmin = xmin;
-            s->xmax = xmax;
-            s->ymin = ymin;
-            s->ymax = ymax;
+            s->xmin   = bytestream2_get_le32(&s->gb);
+            s->ymin   = bytestream2_get_le32(&s->gb);
+            s->xmax   = bytestream2_get_le32(&s->gb);
+            s->ymax   = bytestream2_get_le32(&s->gb);
            s->xdelta = (s->xmax - s->xmin) + 1;
            s->ydelta = (s->ymax - s->ymin) + 1;

@@ -1753,9 +1734,7 @@ static int decode_frame(AVCodecContext *avctx, void *data,
        s->ymin > s->ymax                  ||
        s->xdelta != s->xmax - s->xmin + 1 ||
        s->xmax >= s->w                    ||
-        s->ymax >= s->h                    ||
-        s->ydelta == 0xFFFFFFFF || s->xdelta == 0xFFFFFFFF
-    ) {
+        s->ymax >= s->h) {
        av_log(avctx, AV_LOG_ERROR, "Wrong or missing size information.\n");
        return AVERROR_INVALIDDATA;
    }
@@ -1786,7 +1765,7 @@ static int decode_frame(AVCodecContext *avctx, void *data,
    if ((ret = ff_thread_get_buffer(avctx, &frame, 0)) < 0)
        return ret;

-    if (bytestream2_get_bytes_left(&s->gb)/8 < nb_blocks)
+    if (bytestream2_get_bytes_left(&s->gb) < nb_blocks * 8)
        return AVERROR_INVALIDDATA;

    // check offset table and recreate it if need
@@ -1815,7 +1794,7 @@ static int decode_frame(AVCodecContext *avctx, void *data,
    // Zero out the start if ymin is not 0
    for (i = 0; i < planes; i++) {
        ptr = picture->data[i];
-        for (y = 0; y < FFMIN(s->ymin, s->h); y++) {
+        for (y = 0; y < s->ymin; y++) {
            memset(ptr, 0, out_line_size);
            ptr += picture->linesize[i];
        }
@@ -1826,14 +1805,13 @@ static int decode_frame(AVCodecContext *avctx, void *data,
    avctx->execute2(avctx, decode_block, s->thread_data, NULL, nb_blocks);

    // Zero out the end if ymax+1 is not h
-    if ((s->ymax+1) < avctx->height)
-        for (i = 0; i < planes; i++) {
-            ptr = picture->data[i] + ((s->ymax+1) * picture->linesize[i]);
-            for (y = s->ymax + 1; y < avctx->height; y++) {
-                memset(ptr, 0, out_line_size);
-                ptr += picture->linesize[i];
-            }
+    for (i = 0; i < planes; i++) {
+        ptr = picture->data[i] + ((s->ymax+1) * picture->linesize[i]);
+        for (y = s->ymax + 1; y < avctx->height; y++) {
+            memset(ptr, 0, out_line_size);
+            ptr += picture->linesize[i];
        }
+    }

    picture->pict_type = AV_PICTURE_TYPE_I;
    *got_frame = 1;
--- a/libavcodec/faxcompr.c
+++ b/libavcodec/faxcompr.c
@@ -141,8 +141,6 @@ static int decode_uncompressed(AVCodecContext *avctx, GetBitContext *gb,
                return AVERROR_INVALIDDATA;
            }
            cwi = 10 - av_log2(cwi);
-            if (get_bits_left(gb) < cwi + 1)
-                return AVERROR_INVALIDDATA;
            skip_bits(gb, cwi + 1);
            if (cwi > 5) {
                newmode = get_bits1(gb);
@@ -208,8 +206,6 @@ static int decode_group3_1d_line(AVCodecContext *avctx, GetBitContext *gb,
    unsigned int run = 0;
    unsigned int t;
    for (;;) {
-        if (get_bits_left(gb) <= 0)
-            return AVERROR_INVALIDDATA;
        t    = get_vlc2(gb, ccitt_vlc[mode].table, 9, 2);
        run += t;
        if (t < 64) {
@@ -228,7 +224,7 @@ static int decode_group3_1d_line(AVCodecContext *avctx, GetBitContext *gb,
            run       = 0;
            mode      = !mode;
        } else if ((int)t == -1) {
-            if (get_bits_left(gb) > 12 && show_bits(gb, 12) == 15) {
+            if (show_bits(gb, 12) == 15) {
                int ret;
                skip_bits(gb, 12);
                ret = decode_uncompressed(avctx, gb, &pix_left, &runs, runend, &mode);
@@ -255,10 +251,7 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
    unsigned int offs = 0, run = 0;

    while (offs < width) {
-        int cmode;
-        if (get_bits_left(gb) <= 0)
-            return AVERROR_INVALIDDATA;
-        cmode = get_vlc2(gb, ccitt_group3_2d_vlc.table, 9, 1);
+        int cmode = get_vlc2(gb, ccitt_group3_2d_vlc.table, 9, 1);
        if (cmode == -1) {
            av_log(avctx, AV_LOG_ERROR, "Incorrect mode VLC\n");
            return AVERROR_INVALIDDATA;
@@ -280,8 +273,6 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
            for (k = 0; k < 2; k++) {
                run = 0;
                for (;;) {
-                    if (get_bits_left(gb) <= 0)
-                        return AVERROR_INVALIDDATA;
                    t = get_vlc2(gb, ccitt_vlc[mode].table, 9, 2);
                    if (t == -1) {
                        av_log(avctx, AV_LOG_ERROR, "Incorrect code\n");
@@ -305,10 +296,7 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
                mode = !mode;
            }
        } else if (cmode == 9 || cmode == 10) {
-            int xxx;
-            if (get_bits_left(gb) < 3)
-                return AVERROR_INVALIDDATA;
-            xxx = get_bits(gb, 3);
+            int xxx = get_bits(gb, 3);
            if (cmode == 9 && xxx == 7) {
                int ret;
                int pix_left = width - offs;
--- a/libavcodec/fft_init_table.c
+++ b/libavcodec/fft_init_table.c
@@ -51,8 +51,6 @@
 * @file
 * definitions and initialization of LUT table for FFT
 */
-#include "libavutil/thread.h"
-
 #include "libavcodec/fft_table.h"

 const int32_t ff_w_tab_sr[MAX_FFT_SIZE/(4*16)] = {
@@ -316,29 +314,15 @@ const int32_t ff_w_tab_sr[MAX_FFT_SIZE/(4*16)] = {

 uint16_t ff_fft_offsets_lut[21845];

-static void fft_lut_init(uint16_t *table, int off, int size, int *index)
+void ff_fft_lut_init(uint16_t *table, int off, int size, int *index)
 {
    if (size < 16) {
        table[*index] = off >> 2;
        (*index)++;
    }
    else {
-        fft_lut_init(table, off,                   size >> 1, index);
-        fft_lut_init(table, off +     (size >> 1), size >> 2, index);
-        fft_lut_init(table, off + 3 * (size >> 2), size >> 2, index);
+        ff_fft_lut_init(table, off, size>>1, index);
+        ff_fft_lut_init(table, off+(size>>1), size>>2, index);
+        ff_fft_lut_init(table, off+3*(size>>2), size>>2, index);
    }
 }
-
-static void fft_lut_init_start(void)
-{
-    int n = 0;
-
-    fft_lut_init(ff_fft_offsets_lut, 0, 1 << 17, &n);
-}
-
-void ff_fft_lut_init(void)
-{
-    static AVOnce init_once = AV_ONCE_INIT;
-
-    ff_thread_once(&init_once, fft_lut_init_start);
-}
--- a/libavcodec/fft_table.h
+++ b/libavcodec/fft_table.h
@@ -61,6 +61,6 @@

 extern const int32_t ff_w_tab_sr[];
 extern uint16_t ff_fft_offsets_lut[];
-void ff_fft_lut_init(void);
+void ff_fft_lut_init(uint16_t *table, int off, int size, int *index);

 #endif /* AVCODEC_FFT_TABLE_H */
--- a/libavcodec/fft_template.c
+++ b/libavcodec/fft_template.c
@@ -35,6 +35,13 @@

 #if FFT_FIXED_32
 #include "fft_table.h"
+
+static void av_cold fft_lut_init(void)
+{
+    int n = 0;
+    ff_fft_lut_init(ff_fft_offsets_lut, 0, 1 << 17, &n);
+}
+
 #else /* FFT_FIXED_32 */

 /* cos(2*pi*x/n) for 0<=x<=n/4, followed by its reverse */
@@ -229,7 +236,10 @@ av_cold int ff_fft_init(FFTContext *s, int nbits, int inverse)
 #endif

 #if FFT_FIXED_32
-    ff_fft_lut_init();
+    {
+        static AVOnce control = AV_ONCE_INIT;
+        ff_thread_once(&control, fft_lut_init);
+    }
 #else /* FFT_FIXED_32 */
 #if FFT_FLOAT
    if (ARCH_AARCH64) ff_fft_init_aarch64(s);
--- a/libavcodec/ffv1.c
+++ b/libavcodec/ffv1.c
@@ -115,11 +115,12 @@ av_cold int ff_ffv1_init_slices_state(FFV1Context *f)

 av_cold int ff_ffv1_init_slice_contexts(FFV1Context *f)
 {
-    int i, max_slice_count = f->num_h_slices * f->num_v_slices;
+    int i;

-    av_assert0(max_slice_count > 0);
+    f->max_slice_count = f->num_h_slices * f->num_v_slices;
+    av_assert0(f->max_slice_count > 0);

-    for (i = 0; i < max_slice_count; i++) {
+    for (i = 0; i < f->max_slice_count; i++) {
        int sx          = i % f->num_h_slices;
        int sy          = i / f->num_h_slices;
        int sxs         = f->avctx->width  *  sx      / f->num_h_slices;
@@ -151,7 +152,6 @@ av_cold int ff_ffv1_init_slice_contexts(FFV1Context *f)
            goto memfail;
        }
    }
-    f->max_slice_count = max_slice_count;
    return 0;

 memfail:
--- a/libavcodec/ffv1dec.c
+++ b/libavcodec/ffv1dec.c
@@ -786,7 +786,7 @@ static int read_header(FFV1Context *f)

            if (f->version == 2) {
                int idx = get_symbol(c, state, 0);
-                if (idx >= (unsigned)f->quant_table_count) {
+                if (idx > (unsigned)f->quant_table_count) {
                    av_log(f->avctx, AV_LOG_ERROR,
                           "quant_table_index out of range\n");
                    return AVERROR_INVALIDDATA;
@@ -888,10 +888,8 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac
        int trailer = 3 + 5*!!f->ec;
        int v;

-        if (i || f->version > 2) {
-            if (trailer > buf_p - buf) v = INT_MAX;
-            else                       v = AV_RB24(buf_p-trailer) + trailer;
-        } else                         v = buf_p - c->bytestream_start;
+        if (i || f->version > 2) v = AV_RB24(buf_p-trailer) + trailer;
+        else                     v = buf_p - c->bytestream_start;
        if (buf_p - c->bytestream_start < v) {
            av_log(avctx, AV_LOG_ERROR, "Slice pointer chain broken\n");
            ff_thread_report_progress(&f->picture, INT_MAX, 0);
--- a/libavcodec/ffv1enc.c
+++ b/libavcodec/ffv1enc.c
@@ -1354,5 +1354,4 @@ AVCodec ff_ffv1_encoder = {
    .defaults       = ffv1_defaults,
 #endif
    .priv_class     = &ffv1_class,
-    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
 };
--- a/libavcodec/ffwavesynth.c
+++ b/libavcodec/ffwavesynth.c
@@ -188,7 +188,7 @@ static uint64_t frac64(uint64_t a, uint64_t b)

 static uint64_t phi_at(struct ws_interval *in, int64_t ts)
 {
-    uint64_t dt = ts - (uint64_t)in->ts_start;
+    uint64_t dt = ts - in->ts_start;
    uint64_t dt2 = dt & 1 ? /* dt * (dt - 1) / 2 without overflow */
                   dt * ((dt - 1) >> 1) : (dt >> 1) * (dt - 1);
    return in->phi0 + dt * in->dphi0 + dt2 * in->ddphi;
@@ -373,7 +373,7 @@ static void wavesynth_synth_sample(struct wavesynth_context *ws, int64_t ts,
        in->amp  += in->damp;
        switch (in->type) {
            case WS_SINE:
-                val = amp * (unsigned)ws->sin[in->phi >> (64 - SIN_BITS)];
+                val = amp * ws->sin[in->phi >> (64 - SIN_BITS)];
                in->phi  += in->dphi;
                in->dphi += in->ddphi;
                break;
@@ -444,7 +444,7 @@ static int wavesynth_decode(AVCodecContext *avc, void *rframe, int *rgot_frame,
    if (r < 0)
        return r;
    pcm = (int16_t *)frame->data[0];
-    for (s = 0; s < duration; s++, ts+=(uint64_t)1) {
+    for (s = 0; s < duration; s++, ts++) {
        memset(channels, 0, avc->channels * sizeof(*channels));
        if (ts >= ws->next_ts)
            wavesynth_enter_intervals(ws, ts);
@@ -452,7 +452,7 @@ static int wavesynth_decode(AVCodecContext *avc, void *rframe, int *rgot_frame,
        for (c = 0; c < avc->channels; c++)
            *(pcm++) = channels[c] >> 16;
    }
-    ws->cur_ts += (uint64_t)duration;
+    ws->cur_ts += duration;
    *rgot_frame = 1;
    return packet->size;
 }
--- a/libavcodec/fits.c
+++ b/libavcodec/fits.c
@@ -187,8 +187,6 @@ int avpriv_fits_header_parse_line(void *avcl, FITSHeader *header, const uint8_t
            header->blank = t;
            header->blank_found = 1;
        } else if (!strcmp(keyword, "BSCALE") && sscanf(value, "%lf", &d) == 1) {
-            if (d <= 0)
-                return AVERROR_INVALIDDATA;
            header->bscale = d;
        } else if (!strcmp(keyword, "BZERO") && sscanf(value, "%lf", &d) == 1) {
            header->bzero = d;
@@ -205,12 +203,8 @@ int avpriv_fits_header_parse_line(void *avcl, FITSHeader *header, const uint8_t
        } else if (!strcmp(keyword, "GROUPS") && sscanf(value, "%c", &c) == 1) {
            header->groups = (c == 'T');
        } else if (!strcmp(keyword, "GCOUNT") && sscanf(value, "%"SCNd64"", &t) == 1) {
-            if (t < 0 || t > INT_MAX)
-                return AVERROR_INVALIDDATA;
            header->gcount = t;
        } else if (!strcmp(keyword, "PCOUNT") && sscanf(value, "%"SCNd64"", &t) == 1) {
-            if (t < 0 || t > INT_MAX)
-                return AVERROR_INVALIDDATA;
            header->pcount = t;
        }
        dict_set_if_not_null(metadata, keyword, value);
--- a/libavcodec/flac_parser.c
+++ b/libavcodec/flac_parser.c
@@ -55,7 +55,6 @@

 /** largest possible size of flac header */
 #define MAX_FRAME_HEADER_SIZE 16
-#define MAX_FRAME_VERIFY_SIZE (MAX_FRAME_HEADER_SIZE)

 typedef struct FLACHeaderMarker {
    int offset;       /**< byte offset from start of FLACParseContext->buffer */
@@ -171,7 +170,7 @@ static int find_headers_search_validate(FLACParseContext *fpc, int offset)
    uint8_t *header_buf;
    int size = 0;
    header_buf = flac_fifo_read_wrap(fpc, offset,
-                                     MAX_FRAME_VERIFY_SIZE + AV_INPUT_BUFFER_PADDING_SIZE,
+                                     MAX_FRAME_HEADER_SIZE,
                                     &fpc->wrap_buf,
                                     &fpc->wrap_buf_allocated_size);
    if (frame_header_is_valid(fpc->avctx, header_buf, &fi)) {
--- a/libavcodec/flacdec.c
+++ b/libavcodec/flacdec.c
@@ -262,7 +262,7 @@ static int decode_residuals(FLACContext *s, int32_t *decoded, int pred_order)
        } else {
            int real_limit = tmp ? (INT_MAX >> tmp) + 2 : INT_MAX;
            for (; i < samples; i++) {
-                int v = get_sr_golomb_flac(&gb, tmp, real_limit, 1);
+                int v = get_sr_golomb_flac(&gb, tmp, real_limit, 0);
                if (v == 0x80000000){
                    av_log(s->avctx, AV_LOG_ERROR, "invalid residual\n");
                    return AVERROR_INVALIDDATA;
--- a/libavcodec/flashsv2enc.c
+++ b/libavcodec/flashsv2enc.c
@@ -231,13 +231,6 @@ static av_cold int flashsv2_encode_init(AVCodecContext * avctx)
    s->key_frame     = av_mallocz(s->frame_size);
    s->frame_blocks  = av_mallocz(s->blocks_size);
    s->key_blocks    = av_mallocz(s->blocks_size);
-    if (!s->encbuffer || !s->keybuffer || !s->databuffer
-        || !s->current_frame || !s->key_frame || !s->key_blocks
-        || !s->frame_blocks) {
-        av_log(avctx, AV_LOG_ERROR, "Memory allocation failed.\n");
-        cleanup(s);
-        return AVERROR(ENOMEM);
-    }

    s->blockbuffer      = NULL;
    s->blockbuffer_size = 0;
@@ -252,6 +245,14 @@ static av_cold int flashsv2_encode_init(AVCodecContext * avctx)
    s->use_custom_palette =  0;
    s->palette_type       = -1;        // so that the palette will be generated in reconfigure_at_keyframe

+    if (!s->encbuffer || !s->keybuffer || !s->databuffer
+        || !s->current_frame || !s->key_frame || !s->key_blocks
+        || !s->frame_blocks) {
+        av_log(avctx, AV_LOG_ERROR, "Memory allocation failed.\n");
+        cleanup(s);
+        return -1;
+    }
+
    return 0;
 }

--- a/libavcodec/flashsvenc.c
+++ b/libavcodec/flashsvenc.c
@@ -59,11 +59,11 @@ typedef struct FlashSVContext {
    uint8_t        *previous_frame;
    int             image_width, image_height;
    int             block_width, block_height;
+    uint8_t        *tmpblock;
    uint8_t        *encbuffer;
    int             block_size;
    z_stream        zstream;
    int             last_key_frame;
-    uint8_t         tmpblock[3 * 256 * 256];
 } FlashSVContext;

 static int copy_region_enc(uint8_t *sptr, uint8_t *dptr, int dx, int dy,
@@ -96,6 +96,7 @@ static av_cold int flashsv_encode_end(AVCodecContext *avctx)

    av_freep(&s->encbuffer);
    av_freep(&s->previous_frame);
+    av_freep(&s->tmpblock);

    return 0;
 }
@@ -120,9 +121,10 @@ static av_cold int flashsv_encode_init(AVCodecContext *avctx)
    s->image_width  = avctx->width;
    s->image_height = avctx->height;

+    s->tmpblock  = av_mallocz(3 * 256 * 256);
    s->encbuffer = av_mallocz(s->image_width * s->image_height * 3);

-    if (!s->encbuffer) {
+    if (!s->tmpblock || !s->encbuffer) {
        av_log(avctx, AV_LOG_ERROR, "Memory allocation failed.\n");
        return AVERROR(ENOMEM);
    }
--- a/libavcodec/flicvideo.c
+++ b/libavcodec/flicvideo.c
@@ -735,8 +735,6 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                bytestream2_skip(&g2, chunk_size - 6);
            } else {

-                if (bytestream2_get_bytes_left(&g2) < 2 * s->avctx->width * s->avctx->height )
-                    return AVERROR_INVALIDDATA;
                for (y_ptr = 0; y_ptr < s->frame->linesize[0] * s->avctx->height;
                     y_ptr += s->frame->linesize[0]) {

--- a/libavcodec/flvenc.c
+++ b/libavcodec/flvenc.c
@@ -107,6 +107,7 @@ AVCodec ff_flv_encoder = {
    .init           = ff_mpv_encode_init,
    .encode2        = ff_mpv_encode_picture,
    .close          = ff_mpv_encode_end,
+    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
    .pix_fmts       = (const enum AVPixelFormat[]) { AV_PIX_FMT_YUV420P,
                                                     AV_PIX_FMT_NONE},
    .priv_class     = &flv_class,
--- a/libavcodec/frame_thread_encoder.c
+++ b/libavcodec/frame_thread_encoder.c
@@ -118,7 +118,7 @@ end:
 int ff_frame_thread_encoder_init(AVCodecContext *avctx, AVDictionary *options){
    int i=0;
    ThreadContext *c;
-    AVCodecContext *thread_avctx = NULL;
+

    if(   !(avctx->thread_type & FF_THREAD_FRAME)
       || !(avctx->codec->capabilities & AV_CODEC_CAP_FRAME_THREADS))
@@ -182,10 +182,8 @@ int ff_frame_thread_encoder_init(AVCodecContext *avctx, AVDictionary *options){
    c->parent_avctx = avctx;

    c->task_fifo = av_fifo_alloc_array(BUFFER_SIZE, sizeof(Task));
-    if (!c->task_fifo) {
-        av_freep(&avctx->internal->frame_thread_encoder);
-        return AVERROR(ENOMEM);
-    }
+    if(!c->task_fifo)
+        goto fail;

    pthread_mutex_init(&c->task_fifo_mutex, NULL);
    pthread_mutex_init(&c->finished_task_mutex, NULL);
@@ -198,17 +196,16 @@ int ff_frame_thread_encoder_init(AVCodecContext *avctx, AVDictionary *options){
        AVDictionary *tmp = NULL;
        int ret;
        void *tmpv;
-        thread_avctx = avcodec_alloc_context3(avctx->codec);
+        AVCodecContext *thread_avctx = avcodec_alloc_context3(avctx->codec);
        if(!thread_avctx)
            goto fail;
        tmpv = thread_avctx->priv_data;
        *thread_avctx = *avctx;
-        thread_avctx->priv_data = tmpv;
-        thread_avctx->internal = NULL;
-        thread_avctx->hw_frames_ctx = NULL;
        ret = av_opt_copy(thread_avctx, avctx);
        if (ret < 0)
            goto fail;
+        thread_avctx->priv_data = tmpv;
+        thread_avctx->internal = NULL;
        if (avctx->codec->priv_class) {
            int ret = av_opt_copy(thread_avctx->priv_data, avctx->priv_data);
            if (ret < 0)
@@ -237,8 +234,6 @@ int ff_frame_thread_encoder_init(AVCodecContext *avctx, AVDictionary *options){

    return 0;
 fail:
-    avcodec_close(thread_avctx);
-    av_freep(&thread_avctx);
    avctx->thread_count = i;
    av_log(avctx, AV_LOG_ERROR, "ff_frame_thread_encoder_init failed\n");
    ff_frame_thread_encoder_free(avctx);
--- a/libavcodec/frame_thread_encoder.h
+++ b/libavcodec/frame_thread_encoder.h
@@ -23,10 +23,6 @@

 #include "avcodec.h"

-/**
- * Initialize frame thread encoder.
- * @note hardware encoders are not supported
- */
 int ff_frame_thread_encoder_init(AVCodecContext *avctx, AVDictionary *options);
 void ff_frame_thread_encoder_free(AVCodecContext *avctx);
 int ff_thread_video_encode_frame(AVCodecContext *avctx, AVPacket *pkt, const AVFrame *frame, int *got_packet_ptr);
--- a/libavcodec/g722enc.c
+++ b/libavcodec/g722enc.c
@@ -59,11 +59,27 @@ static av_cold int g722_encode_close(AVCodecContext *avctx)
 static av_cold int g722_encode_init(AVCodecContext * avctx)
 {
    G722Context *c = avctx->priv_data;
+    int ret;

    c->band[0].scale_factor = 8;
    c->band[1].scale_factor = 2;
    c->prev_samples_pos = 22;

+    if (avctx->trellis) {
+        int frontier = 1 << avctx->trellis;
+        int max_paths = frontier * FREEZE_INTERVAL;
+        int i;
+        for (i = 0; i < 2; i++) {
+            c->paths[i] = av_mallocz_array(max_paths, sizeof(**c->paths));
+            c->node_buf[i] = av_mallocz_array(frontier, 2 * sizeof(**c->node_buf));
+            c->nodep_buf[i] = av_mallocz_array(frontier, 2 * sizeof(**c->nodep_buf));
+            if (!c->paths[i] || !c->node_buf[i] || !c->nodep_buf[i]) {
+                ret = AVERROR(ENOMEM);
+                goto error;
+            }
+        }
+    }
+
    if (avctx->frame_size) {
        /* validate frame size */
        if (avctx->frame_size & 1 || avctx->frame_size > MAX_FRAME_SIZE) {
@@ -97,23 +113,14 @@ static av_cold int g722_encode_init(AVCodecContext * avctx)
                   avctx->trellis);
            avctx->trellis = new_trellis;
        }
-        if (avctx->trellis) {
-            int frontier = 1 << avctx->trellis;
-            int max_paths = frontier * FREEZE_INTERVAL;
-
-            for (int i = 0; i < 2; i++) {
-                c->paths[i]     = av_calloc(max_paths, sizeof(**c->paths));
-                c->node_buf[i]  = av_calloc(frontier, 2 * sizeof(**c->node_buf));
-                c->nodep_buf[i] = av_calloc(frontier, 2 * sizeof(**c->nodep_buf));
-                if (!c->paths[i] || !c->node_buf[i] || !c->nodep_buf[i])
-                    return AVERROR(ENOMEM);
-            }
-        }
    }

    ff_g722dsp_init(&c->dsp);

    return 0;
+error:
+    g722_encode_close(avctx);
+    return ret;
 }

 static const int16_t low_quant[33] = {
@@ -380,5 +387,4 @@ AVCodec ff_adpcm_g722_encoder = {
    .capabilities    = AV_CODEC_CAP_SMALL_LAST_FRAME,
    .sample_fmts     = (const enum AVSampleFormat[]){ AV_SAMPLE_FMT_S16, AV_SAMPLE_FMT_NONE },
    .channel_layouts = (const uint64_t[]){ AV_CH_LAYOUT_MONO, 0 },
-    .caps_internal   = FF_CODEC_CAP_INIT_CLEANUP,
 };
--- a/libavcodec/g729_parser.c
+++ b/libavcodec/g729_parser.c
@@ -49,9 +49,6 @@ static int g729_parse(AVCodecParserContext *s1, AVCodecContext *avctx,
        s->block_size = (avctx->bit_rate < 8000) ? G729D_6K4_BLOCK_SIZE : G729_8K_BLOCK_SIZE;
        if (avctx->codec_id == AV_CODEC_ID_ACELP_KELVIN)
            s->block_size++;
-        // channels > 2 is invalid, we pass the packet on unchanged
-        if (avctx->channels > 2)
-            s->block_size = 0;
        s->block_size *= avctx->channels;
        s->duration   = avctx->frame_size;
    }
--- a/libavcodec/gif.c
+++ b/libavcodec/gif.c
@@ -497,5 +497,4 @@ AVCodec ff_gif_encoder = {
        AV_PIX_FMT_GRAY8, AV_PIX_FMT_PAL8, AV_PIX_FMT_NONE
    },
    .priv_class     = &gif_class,
-    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
 };
--- a/libavcodec/h261enc.c
+++ b/libavcodec/h261enc.c
@@ -394,6 +394,7 @@ AVCodec ff_h261_encoder = {
    .init           = ff_mpv_encode_init,
    .encode2        = ff_mpv_encode_picture,
    .close          = ff_mpv_encode_end,
+    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
    .pix_fmts       = (const enum AVPixelFormat[]) { AV_PIX_FMT_YUV420P,
                                                     AV_PIX_FMT_NONE },
    .priv_class     = &h261_class,
--- a/libavcodec/h264_metadata_bsf.c
+++ b/libavcodec/h264_metadata_bsf.c
@@ -528,7 +528,7 @@ static int h264_metadata_filter(AVBSFContext *bsf, AVPacket *pkt)
                if (err < 0) {
                    av_log(bsf, AV_LOG_ERROR, "Failed to attach extracted "
                           "displaymatrix side data to packet.\n");
-                    av_free(matrix);
+                    av_freep(matrix);
                    goto fail;
                }
            }
--- a/libavcodec/h264_slice.c
+++ b/libavcodec/h264_slice.c
@@ -304,8 +304,9 @@ int ff_h264_update_thread_context(AVCodecContext *dst,
    if (dst == src)
        return 0;

-    if (inited && !h1->ps.sps)
-        return AVERROR_INVALIDDATA;
+    // We can't fail if SPS isn't set at it breaks current skip_frame code
+    //if (!h1->ps.sps)
+    //    return AVERROR_INVALIDDATA;

    if (inited &&
        (h->width                 != h1->width                 ||
@@ -911,11 +912,6 @@ static int h264_slice_header_init(H264Context *h)
    const SPS *sps = h->ps.sps;
    int i, ret;

-    if (!sps) {
-        ret = AVERROR_INVALIDDATA;
-        goto fail;
-    }
-
    ff_set_sar(h->avctx, sps->sar);
    av_pix_fmt_get_chroma_sub_sample(h->avctx->pix_fmt,
                                     &h->chroma_x_shift, &h->chroma_y_shift);
@@ -1603,7 +1599,7 @@ static int h264_field_start(H264Context *h, const H264SliceContext *sl,
                              prev->f->format,
                              prev->f->width,
                              prev->f->height);
-                h->short_ref[0]->poc = prev->poc + 2U;
+                h->short_ref[0]->poc = prev->poc + 2;
            } else if (!h->frame_recovered && !h->avctx->hwaccel)
                ff_color_frame(h->short_ref[0]->f, c);
            h->short_ref[0]->frame_num = h->poc.prev_frame_num;
@@ -1823,8 +1819,6 @@ static int h264_slice_header_parse(const H264Context *h, H264SliceContext *sl,
    if (nal->type == H264_NAL_IDR_SLICE)
        get_ue_golomb_long(&sl->gb); /* idr_pic_id */

-    sl->poc_lsb = 0;
-    sl->delta_poc_bottom = 0;
    if (sps->poc_type == 0) {
        sl->poc_lsb = get_bits(&sl->gb, sps->log2_max_poc_lsb);

@@ -1832,7 +1826,6 @@ static int h264_slice_header_parse(const H264Context *h, H264SliceContext *sl,
            sl->delta_poc_bottom = get_se_golomb(&sl->gb);
    }

-    sl->delta_poc[0] = sl->delta_poc[1] = 0;
    if (sps->poc_type == 1 && !sps->delta_pic_order_always_zero_flag) {
        sl->delta_poc[0] = get_se_golomb(&sl->gb);

--- a/libavcodec/h264dec.c
+++ b/libavcodec/h264dec.c
@@ -939,7 +939,7 @@ static int finalize_frame(H264Context *h, AVFrame *dst, H264Picture *out, int *g
                                 out->qscale_table,
                                 out->motion_val,
                                 NULL,
-                                 out->mb_width, out->mb_height, out->mb_stride, 1);
+                                 h->mb_width, h->mb_height, h->mb_stride, 1);
        }
    }

--- a/libavcodec/h264idct_template.c
+++ b/libavcodec/h264idct_template.c
@@ -278,13 +278,13 @@ void FUNCC(ff_h264_chroma422_dc_dequant_idct)(int16_t *_block, int qmul){
    const int stride= 16*2;
    const int xStride= 16;
    int i;
-    unsigned temp[8];
+    int temp[8];
    static const uint8_t x_offset[2]={0, 16};
    dctcoef *block = (dctcoef*)_block;

    for(i=0; i<4; i++){
-        temp[2*i+0] = block[stride*i + xStride*0] + (unsigned)block[stride*i + xStride*1];
-        temp[2*i+1] = block[stride*i + xStride*0] - (unsigned)block[stride*i + xStride*1];
+        temp[2*i+0] = block[stride*i + xStride*0] + block[stride*i + xStride*1];
+        temp[2*i+1] = block[stride*i + xStride*0] - block[stride*i + xStride*1];
    }

    for(i=0; i<2; i++){
--- a/libavcodec/h265_metadata_bsf.c
+++ b/libavcodec/h265_metadata_bsf.c
@@ -415,7 +415,7 @@ static int h265_metadata_filter(AVBSFContext *bsf, AVPacket *pkt)
    }

    // If an AUD is present, it must be the first NAL unit.
-    if (au->nb_units && au->units[0].type == HEVC_NAL_AUD) {
+    if (au->units[0].type == HEVC_NAL_AUD) {
        if (ctx->aud == REMOVE)
            ff_cbs_delete_unit(ctx->cbc, au, 0);
    } else {
--- a/libavcodec/hap.h
+++ b/libavcodec/hap.h
@@ -52,7 +52,7 @@ enum HapSectionType {

 typedef struct HapChunk {
    enum HapCompressor compressor;
-    uint32_t compressed_offset;
+    int compressed_offset;
    size_t compressed_size;
    int uncompressed_offset;
    size_t uncompressed_size;
--- a/libavcodec/hapdec.c
+++ b/libavcodec/hapdec.c
@@ -105,8 +105,6 @@ static int hap_parse_decode_instructions(HapContext *ctx, int size)
        size_t running_size = 0;
        for (i = 0; i < ctx->chunk_count; i++) {
            ctx->chunks[i].compressed_offset = running_size;
-            if (ctx->chunks[i].compressed_size > UINT32_MAX - running_size)
-                return AVERROR_INVALIDDATA;
            running_size += ctx->chunks[i].compressed_size;
        }
    }
@@ -188,7 +186,7 @@ static int hap_parse_frame_header(AVCodecContext *avctx)
        HapChunk *chunk = &ctx->chunks[i];

        /* Check the compressed buffer is valid */
-        if (chunk->compressed_offset + (uint64_t)chunk->compressed_size > bytestream2_get_bytes_left(gbc))
+        if (chunk->compressed_offset + chunk->compressed_size > bytestream2_get_bytes_left(gbc))
            return AVERROR_INVALIDDATA;

        /* Chunks are unpacked sequentially, ctx->tex_size is the uncompressed
--- a/libavcodec/hcadec.c
+++ b/libavcodec/hcadec.c
@@ -157,10 +157,6 @@ static av_cold int decode_init(AVCodecContext *avctx)
    } else
        return AVERROR_INVALIDDATA;

-    if (c->total_band_count > FF_ARRAY_ELEMS(c->ch->imdct_in))
-        return AVERROR_INVALIDDATA;
-
-
    while (get_bits_left(gb) >= 32) {
        chunk = get_bits_long(gb, 32);
        if (chunk == MKBETAG('v', 'b', 'r', 0)) {
--- a/libavcodec/hevc_cabac.c
+++ b/libavcodec/hevc_cabac.c
@@ -998,7 +998,7 @@ static av_always_inline int coeff_abs_level_remaining_decode(HEVCContext *s, int
    } else {
        int prefix_minus3 = prefix - 3;

-        if (prefix == CABAC_MAX_BIN || prefix_minus3 + rc_rice_param > 16 + 6) {
+        if (prefix == CABAC_MAX_BIN || prefix_minus3 + rc_rice_param >= 31) {
            av_log(s->avctx, AV_LOG_ERROR, "CABAC_MAX_BIN : %d\n", prefix);
            return 0;
        }
--- a/libavcodec/hevc_mp4toannexb_bsf.c
+++ b/libavcodec/hevc_mp4toannexb_bsf.c
@@ -142,14 +142,10 @@ static int hevc_mp4toannexb_filter(AVBSFContext *ctx, AVPacket *out)
        int      nalu_type;
        int is_irap, add_extradata, extra_size, prev_size;

-        if (bytestream2_get_bytes_left(&gb) < s->length_size) {
-            ret = AVERROR_INVALIDDATA;
-            goto fail;
-        }
        for (i = 0; i < s->length_size; i++)
            nalu_size = (nalu_size << 8) | bytestream2_get_byte(&gb);

-        if (nalu_size < 2 || nalu_size > bytestream2_get_bytes_left(&gb)) {
+        if (nalu_size < 2) {
            ret = AVERROR_INVALIDDATA;
            goto fail;
        }
--- a/libavcodec/hevc_ps.c
+++ b/libavcodec/hevc_ps.c
@@ -816,11 +816,7 @@ static int scaling_list_data(GetBitContext *gb, AVCodecContext *avctx, ScalingLi
                next_coef = 8;
                coef_num  = FFMIN(64, 1 << (4 + (size_id << 1)));
                if (size_id > 1) {
-                    int scaling_list_coeff_minus8 = get_se_golomb(gb);
-                    if (scaling_list_coeff_minus8 < -7 ||
-                        scaling_list_coeff_minus8 > 247)
-                        return AVERROR_INVALIDDATA;
-                    scaling_list_dc_coef[size_id - 2][matrix_id] = scaling_list_coeff_minus8 + 8;
+                    scaling_list_dc_coef[size_id - 2][matrix_id] = get_se_golomb(gb) + 8;
                    next_coef = scaling_list_dc_coef[size_id - 2][matrix_id];
                    sl->sl_dc[size_id - 2][matrix_id] = next_coef;
                }
--- a/libavcodec/hevc_sei.c
+++ b/libavcodec/hevc_sei.c
@@ -343,8 +343,6 @@ static int decode_nal_sei_message(GetBitContext *gb, void *logctx, HEVCSEI *s,
        byte          = get_bits(gb, 8);
        payload_size += byte;
    }
-    if (get_bits_left(gb) < 8LL*payload_size)
-        return AVERROR_INVALIDDATA;
    if (nal_unit_type == HEVC_NAL_SEI_PREFIX) {
        return decode_nal_sei_prefix(gb, logctx, s, ps, payload_type, payload_size);
    } else { /* nal_unit_type == NAL_SEI_SUFFIX */
--- a/libavcodec/hevcdec.c
+++ b/libavcodec/hevcdec.c
@@ -785,11 +785,6 @@ static int hls_slice_header(HEVCContext *s)
        if (s->ps.pps->pic_slice_level_chroma_qp_offsets_present_flag) {
            sh->slice_cb_qp_offset = get_se_golomb(gb);
            sh->slice_cr_qp_offset = get_se_golomb(gb);
-            if (sh->slice_cb_qp_offset < -12 || sh->slice_cb_qp_offset > 12 ||
-                sh->slice_cr_qp_offset < -12 || sh->slice_cr_qp_offset > 12) {
-                av_log(s->avctx, AV_LOG_ERROR, "Invalid slice cx qp offset.\n");
-                return AVERROR_INVALIDDATA;
-            }
        } else {
            sh->slice_cb_qp_offset = 0;
            sh->slice_cr_qp_offset = 0;
--- a/libavcodec/hevcpred_template.c
+++ b/libavcodec/hevcpred_template.c
@@ -83,7 +83,6 @@ do {                                  \
    int y = y0 >> vshift;
    int x_tb = (x0 >> s->ps.sps->log2_min_tb_size) & s->ps.sps->tb_mask;
    int y_tb = (y0 >> s->ps.sps->log2_min_tb_size) & s->ps.sps->tb_mask;
-    int spin = c_idx && !size_in_tbs_v && ((2 * y0) & (1 << s->ps.sps->log2_min_tb_size));

    int cur_tb_addr = MIN_TB_ADDR_ZS(x_tb, y_tb);

@@ -104,11 +103,11 @@ do {                                  \
    pixel  *top           = top_array  + 1;
    pixel  *filtered_left = filtered_left_array + 1;
    pixel  *filtered_top  = filtered_top_array  + 1;
-    int cand_bottom_left = lc->na.cand_bottom_left && cur_tb_addr > MIN_TB_ADDR_ZS( x_tb - 1, (y_tb + size_in_tbs_v + spin) & s->ps.sps->tb_mask);
+    int cand_bottom_left = lc->na.cand_bottom_left && cur_tb_addr > MIN_TB_ADDR_ZS( x_tb - 1, (y_tb + size_in_tbs_v) & s->ps.sps->tb_mask);
    int cand_left        = lc->na.cand_left;
    int cand_up_left     = lc->na.cand_up_left;
    int cand_up          = lc->na.cand_up;
-    int cand_up_right    = lc->na.cand_up_right && !spin && cur_tb_addr > MIN_TB_ADDR_ZS((x_tb + size_in_tbs_h) & s->ps.sps->tb_mask, y_tb - 1);
+    int cand_up_right    = lc->na.cand_up_right    && cur_tb_addr > MIN_TB_ADDR_ZS((x_tb + size_in_tbs_h) & s->ps.sps->tb_mask, y_tb - 1);

    int bottom_left_size = (FFMIN(y0 + 2 * size_in_luma_v, s->ps.sps->height) -
                           (y0 + size_in_luma_v)) >> vshift;
--- a/libavcodec/iff.c
+++ b/libavcodec/iff.c
@@ -723,7 +723,7 @@ static void decode_deep_rle32(uint8_t *dst, const uint8_t *src, int src_size, in
        if (opcode >= 0) {
            int size = opcode + 1;
            for (i = 0; i < size; i++) {
-                int length = FFMIN(size - i, width - x);
+                int length = FFMIN(size - i, width);
                if (src_end - src < length * 4)
                    return;
                memcpy(dst + y*linesize + x * 4, src, length * 4);
@@ -1848,8 +1848,7 @@ static int decode_frame(AVCodecContext *avctx,
                    buf += s->planesize;
                }
            }
-            if (avctx->pix_fmt == AV_PIX_FMT_PAL8)
-                memcpy(frame->data[1], s->pal, 256 * 4);
+            memcpy(frame->data[1], s->pal, 256 * 4);
        } else if (s->ham) {
            int i, count = 1 << s->ham;

--- a/libavcodec/indeo5.c
+++ b/libavcodec/indeo5.c
@@ -30,7 +30,6 @@
 #define BITSTREAM_READER_LE
 #include "avcodec.h"
 #include "get_bits.h"
-#include "internal.h"
 #include "ivi.h"
 #include "ivi_dsp.h"
 #include "indeo5data.h"
@@ -693,5 +692,4 @@ AVCodec ff_indeo5_decoder = {
    .close          = ff_ivi_decode_close,
    .decode         = ff_ivi_decode_frame,
    .capabilities   = AV_CODEC_CAP_DR1,
-    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
 };
--- a/libavcodec/ivi.c
+++ b/libavcodec/ivi.c
@@ -442,10 +442,8 @@ av_cold int ff_ivi_init_tiles(IVIPlaneDesc *planes,

            av_freep(&band->tiles);
            band->tiles = av_mallocz_array(band->num_tiles, sizeof(IVITile));
-            if (!band->tiles) {
-                band->num_tiles = 0;
+            if (!band->tiles)
                return AVERROR(ENOMEM);
-            }

            /* use the first luma band as reference for motion vectors
             * and quant */
--- a/libavcodec/j2kenc.c
+++ b/libavcodec/j2kenc.c
@@ -410,7 +410,7 @@ static int init_tiles(Jpeg2000EncoderContext *s)
    s->numXtiles = ff_jpeg2000_ceildiv(s->width, s->tile_width);
    s->numYtiles = ff_jpeg2000_ceildiv(s->height, s->tile_height);

-    s->tile = av_calloc(s->numXtiles, s->numYtiles * sizeof(Jpeg2000Tile));
+    s->tile = av_malloc_array(s->numXtiles, s->numYtiles * sizeof(Jpeg2000Tile));
    if (!s->tile)
        return AVERROR(ENOMEM);
    for (tileno = 0, tiley = 0; tiley < s->numYtiles; tiley++)
@@ -972,16 +972,12 @@ static void cleanup(Jpeg2000EncoderContext *s)
    int tileno, compno;
    Jpeg2000CodingStyle *codsty = &s->codsty;

-    if (!s->tile)
-        return;
    for (tileno = 0; tileno < s->numXtiles * s->numYtiles; tileno++){
-        if (s->tile[tileno].comp) {
-            for (compno = 0; compno < s->ncomponents; compno++){
-                Jpeg2000Component *comp = s->tile[tileno].comp + compno;
-                ff_jpeg2000_cleanup(comp, codsty);
-            }
-            av_freep(&s->tile[tileno].comp);
+        for (compno = 0; compno < s->ncomponents; compno++){
+            Jpeg2000Component *comp = s->tile[tileno].comp + compno;
+            ff_jpeg2000_cleanup(comp, codsty);
        }
+        av_freep(&s->tile[tileno].comp);
    }
    av_freep(&s->tile);
 }
@@ -1262,5 +1258,4 @@ AVCodec ff_jpeg2000_encoder = {
        AV_PIX_FMT_NONE
    },
    .priv_class     = &j2k_class,
-    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
 };
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -612,19 +612,12 @@ static int get_rgn(Jpeg2000DecoderContext *s, int n)
    // Currently compno cannot be greater than 4.
    // However, future implementation should support compno up to 65536
    if (compno < s->ncomponents) {
-        int v;
-        if (s->curtileno == -1) {
-            v =  bytestream2_get_byte(&s->g);
-            if (v > 30)
-                return AVERROR_PATCHWELCOME;
-            s->roi_shift[compno] = v;
-        } else {
+        if (s->curtileno == -1)
+            s->roi_shift[compno] = bytestream2_get_byte(&s->g);
+        else {
            if (s->tile[s->curtileno].tp_idx != 0)
                return AVERROR_INVALIDDATA; // marker occurs only in first tile part of tile
-            v = bytestream2_get_byte(&s->g);
-            if (v > 30)
-                return AVERROR_PATCHWELCOME;
-            s->tile[s->curtileno].comp[compno].roi_shift = v;
+            s->tile[s->curtileno].comp[compno].roi_shift = bytestream2_get_byte(&s->g);
        }
        return 0;
    }
@@ -1676,8 +1669,8 @@ static int decode_cblk(Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *codsty,
    ff_mqc_initdec(&t1->mqc, cblk->data, 0, 1);

    while (passno--) {
-        if (bpno < 0 || bpno > 29) {
-            av_log(s->avctx, AV_LOG_ERROR, "bpno became invalid\n");
+        if (bpno < 0) {
+            av_log(s->avctx, AV_LOG_ERROR, "bpno became negative\n");
            return AVERROR_INVALIDDATA;
        }
        switch(pass_t) {
@@ -2207,12 +2200,8 @@ static int jp2_find_codestream(Jpeg2000DecoderContext *s)
                return 0;
            }
            atom_size = bytestream2_get_be32u(&s->g);
-            if (atom_size < 16 || (int64_t)bytestream2_tell(&s->g) + atom_size - 16 > INT_MAX)
-                return AVERROR_INVALIDDATA;
            atom_end  = bytestream2_tell(&s->g) + atom_size - 16;
        } else {
-            if (atom_size <  8 || (int64_t)bytestream2_tell(&s->g) + atom_size -  8 > INT_MAX)
-                return AVERROR_INVALIDDATA;
            atom_end  = bytestream2_tell(&s->g) + atom_size -  8;
        }

@@ -2226,8 +2215,6 @@ static int jp2_find_codestream(Jpeg2000DecoderContext *s)
                   atom_size >= 16) {
            uint32_t atom2_size, atom2, atom2_end;
            do {
-                if (bytestream2_get_bytes_left(&s->g) < 8)
-                    break;
                atom2_size = bytestream2_get_be32u(&s->g);
                atom2      = bytestream2_get_be32u(&s->g);
                atom2_end  = bytestream2_tell(&s->g) + atom2_size - 8;
--- a/libavcodec/jpegls.h
+++ b/libavcodec/jpegls.h
@@ -99,7 +99,7 @@ static inline void ff_jpegls_downscale_state(JLSState *state, int Q)
 static inline int ff_jpegls_update_state_regular(JLSState *state,
                                                 int Q, int err)
 {
-    if(FFABS(err) > 0xFFFF || FFABS(err) > INT_MAX - state->A[Q])
+    if(FFABS(err) > 0xFFFF)
        return -0x10000;
    state->A[Q] += FFABS(err);
    err         *= state->twonear;
--- a/libavcodec/jpeglsdec.c
+++ b/libavcodec/jpeglsdec.c
@@ -67,7 +67,7 @@ int ff_jpegls_decode_lse(MJpegDecodeContext *s)
        s->t3     = get_bits(&s->gb, 16);
        s->reset  = get_bits(&s->gb, 16);

-        if (s->avctx->debug & FF_DEBUG_PICT_INFO) {
+        if(s->avctx->debug & FF_DEBUG_PICT_INFO) {
            av_log(s->avctx, AV_LOG_DEBUG, "Coding parameters maxval:%d T1:%d T2:%d T3:%d reset:%d\n",
                   s->maxval, s->t1, s->t2, s->t3, s->reset);
        }
@@ -96,7 +96,7 @@ int ff_jpegls_decode_lse(MJpegDecodeContext *s)
        else
            maxtab = 65530/wt - 1;

-        if (s->avctx->debug & FF_DEBUG_PICT_INFO) {
+        if(s->avctx->debug & FF_DEBUG_PICT_INFO) {
            av_log(s->avctx, AV_LOG_DEBUG, "LSE palette %d tid:%d wt:%d maxtab:%d\n", id, tid, wt, maxtab);
        }
        if (maxtab >= 256) {
@@ -122,7 +122,7 @@ int ff_jpegls_decode_lse(MJpegDecodeContext *s)
            s->avctx->pix_fmt = AV_PIX_FMT_PAL8;
            for (i=s->palette_index; i<=maxtab; i++) {
                uint8_t k = i << shift;
-                pal[k] = wt < 4 ? 0xFF000000 : 0;
+                pal[k] = 0;
                for (j=0; j<wt; j++) {
                    pal[k] |= get_bits(&s->gb, 8) << (8*(wt-j-1));
                }
@@ -149,7 +149,7 @@ static inline int ls_get_code_regular(GetBitContext *gb, JLSState *state, int Q)
 {
    int k, ret;

-    for (k = 0; ((unsigned)state->N[Q] << k) < state->A[Q]; k++)
+    for (k = 0; (state->N[Q] << k) < state->A[Q]; k++)
        ;

 #ifdef JLS_BROKEN
@@ -186,7 +186,7 @@ static inline int ls_get_code_runterm(GetBitContext *gb, JLSState *state,
    if (RItype)
        temp += state->N[Q] >> 1;

-    for (k = 0; ((unsigned)state->N[Q] << k) < temp; k++)
+    for (k = 0; (state->N[Q] << k) < temp; k++)
        ;

 #ifdef JLS_BROKEN
@@ -195,8 +195,6 @@ static inline int ls_get_code_runterm(GetBitContext *gb, JLSState *state,
 #endif
    ret = get_ur_golomb_jpegls(gb, k, state->limit - limit_add - 1,
                               state->qbpp);
-    if (ret < 0)
-        return -0x10000;

    /* decode mapped error */
    map = 0;
@@ -211,7 +209,7 @@ static inline int ls_get_code_runterm(GetBitContext *gb, JLSState *state,
        ret = ret >> 1;
    }

-    if (FFABS(ret) > 0xFFFF)
+    if(FFABS(ret) > 0xFFFF)
        return -0x10000;
    /* update state */
    state->A[Q] += FFABS(ret) - RItype;
@@ -555,5 +553,5 @@ AVCodec ff_jpegls_decoder = {
    .close          = ff_mjpeg_decode_end,
    .decode         = ff_mjpeg_decode_frame,
    .capabilities   = AV_CODEC_CAP_DR1,
-    .caps_internal  = FF_CODEC_CAP_INIT_THREADSAFE | FF_CODEC_CAP_INIT_CLEANUP,
+    .caps_internal  = FF_CODEC_CAP_INIT_THREADSAFE,
 };
--- a/libavcodec/libdav1d.c
+++ b/libavcodec/libdav1d.c
@@ -226,10 +226,8 @@ static int libdav1d_receive_frame(AVCodecContext *c, AVFrame *frame)
    if (res < 0) {
        if (res == AVERROR(EINVAL))
            res = AVERROR_INVALIDDATA;
-        if (res != AVERROR(EAGAIN)) {
-            dav1d_data_unref(data);
+        if (res != AVERROR(EAGAIN))
            return res;
-        }
    }

    res = dav1d_get_picture(dav1d->c, p);
--- a/libavcodec/libzvbi-teletextdec.c
+++ b/libavcodec/libzvbi-teletextdec.c
@@ -797,7 +797,7 @@ static void teletext_flush(AVCodecContext *avctx)
 #define SD AV_OPT_FLAG_SUBTITLE_PARAM | AV_OPT_FLAG_DECODING_PARAM
 static const AVOption options[] = {
    {"txt_page",        "page numbers to decode, subtitle for subtitles, * for all", OFFSET(pgno),   AV_OPT_TYPE_STRING, {.str = "*"},      0, 0,        SD},
-    {"txt_default_region", "default G0 character set used for decoding",     OFFSET(default_region), AV_OPT_TYPE_INT,    {.i64 = -1},      -1, 87,       SD},
+    {"txt_default_region", "default G0 character set used for decoding",     OFFSET(default_region), AV_OPT_TYPE_INT,    {.i64 = -1},      -1, 80,       SD},
    {"txt_chop_top",    "discards the top teletext line",                    OFFSET(chop_top),       AV_OPT_TYPE_INT,    {.i64 = 1},        0, 1,        SD},
    {"txt_format",      "format of the subtitles (bitmap or text or ass)",   OFFSET(format_id),      AV_OPT_TYPE_INT,    {.i64 = 0},        0, 2,        SD,  "txt_format"},
    {"bitmap",          NULL,                                                0,                      AV_OPT_TYPE_CONST,  {.i64 = 0},        0, 0,        SD,  "txt_format"},
--- a/libavcodec/loco.c
+++ b/libavcodec/loco.c
@@ -82,7 +82,7 @@ static inline void loco_update_rice_param(RICEContext *r, int val)

 static inline int loco_get_rice(RICEContext *r)
 {
-    unsigned v;
+    int v;
    if (r->run > 0) { /* we have zero run */
        r->run--;
        loco_update_rice_param(r, 0);
@@ -131,7 +131,7 @@ static int loco_decode_plane(LOCOContext *l, uint8_t *data, int width, int heigh
                             int stride, const uint8_t *buf, int buf_size)
 {
    RICEContext rc;
-    unsigned val;
+    int val;
    int ret;
    int i, j;

--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .3.4
 .2.git