Bump minor versions after branching 4.3

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-06-08 22:49:04 +02:00
446 changed files with 2724 additions and 5369 deletions
--- a/4
+++ b/4
@@ -1,6 +1,6 @@
-See the Git history of the project (https://git.ffmpeg.org/ffmpeg) to
+See the Git history of the project (git://source.ffmpeg.org/ffmpeg) to
 get the names of people who have contributed to FFmpeg.

 To check the log, you can type the command "git log" in the FFmpeg
 source directory, or browse the online repository at
-https://git.ffmpeg.org/ffmpeg
+http://source.ffmpeg.org.
--- a/839
+++ b/839
@@ -1,845 +1,6 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.

-
-version 4.3.6:
- avcodec/escape124: Check that blocks are allocated before use
- avcodec/huffyuvdec: Fix undefined behavior with shift
- avcodec/j2kenc: Replace RGB24 special case by generic test
- avcodec/j2kenc: Fix funky bpno errors on decoding
- avcodec/j2kenc: remove misleading pred value
- avcodec/j2kenc: fix 5/3 DWT identifer
- avcodec/vp3: Check width to avoid assertion failure
- avcodec/g729postfilter: Limit shift in long term filter
- configure: update copyright year
- avcodec/tests/snowenc: Fix 2nd test
- avcodec/tests/snowenc: return a failure if DWT/IDWT mismatches
- avcodec/snowenc: Fix visual weight calculation
- avcodec/tests/snowenc: unbreak DWT tests
- avcodec/escape124: Fix some return codes
- avcodec/escape124: fix signdness of end of input check
- Use https for repository links
- avcodec/motionpixels: Mask pixels to valid values
- avcodec/xpmdec: Check size before allocation to avoid truncation
- avcodec/bink: Avoid undefined out of array end pointers in binkb_decode_plane()
- avcodec/bink: Fix off by 1 error in ref end
- avcodec/utils: Ensure linesize for SVQ3
- avcodec/utils: allocate a line more for VC1 and WMV3
- avcodec/videodsp_template: Adjust pointers to avoid undefined pointer things
- avcodec/pngdec: Check deloco index more exactly
- avcodec/ffv1dec: Check that num h/v slices is supported
- avformat/mov: Check samplesize and offset to avoid integer overflow
- avcodec/pictordec: Remove mid exit branch
- avcodec/eac3dec: avoid float noise in fixed mode addition to overflow
- avcodec/utils: use 32pixel alignment for bink
- avcodec/scpr3: Check bx
- avcodec/012v: Order operations for odd size handling
- avcodec/eatgq: : Check index increments in tgq_decode_block()
- avcodec/scpr: Test bx before use
- avformat/mxfdec: Use 64bit in remainder
- avcodec/sunrast: Fix maplength check
- avcodec/wavpack: Avoid undefined shift in get_tail()
- avcodec/wavpack: Check for end of input in wv_unpack_dsd_high()
- avformat/id3v2: Check taglen in read_uslt()
- avcodec/tiff: Ignore tile_count
- avcodec/ffv1dec: restructure slice coordinate reading a bit
- avcodec/mlpdec: Check max matrix instead of max channel in noise check
- swscale/input: Use more unsigned intermediates
- avcodec/alsdec: The minimal block is at least 7 bits
- avformat/replaygain: avoid undefined / negative abs
- swscale/output: Bias 16bps output calculations to improve non overflowing range
- avcodec/speedhq: Check buf_size to be big enough for DC
- avcodec/ffv1dec: Fail earlier if prior context is corrupted
- avfilter/vf_untile: swap the chroma shift values used for plane offsets
- avcodec/vp3: Add missing check for av_malloc
- avcodec/nvenc: fix vbv buffer size in cq mode
- avcodec/mjpegenc: take into account component count when writing the SOF header size
- swscale: aarch64: Fix yuv2rgb with negative strides
-
-version 4.3.5:
- avformat/vividas: Check packet size
- avcodec/dstdec: Check for overflow in build_filter()
- avformat/spdifdec: Use 64bit to compute bit rate
- avformat/rpl: Use 64bit for duration computation
- avformat/xwma: Use av_rescale() for duration computation
- avformat/sdsdec: Use av_rescale() to avoid intermediate overflow in duration calculation
- avformat/sbgdec: Check ts_int in genrate_intervals
- avformat/rmdec: check tag_size
- avformat/nutdec: Check fields
- avformat/flvdec: Use 64bit for sum_flv_tag_size
- avformat/jacosubdec: Fix overflow in get_shift()
- avformat/dxa: avoid bpc overflows
- avformat/cafdec: Check that nb_frasmes fits within 64bit
- avformat/asfdec_o: Limit packet offset
- avformat/ape: Check frames size
- avformat/icodec: Check nb_pal
- avformat/aiffdec: Use 64bit for block_duration use
- avformat/aiffdec: Check block_duration
- avformat/mxfdec: only probe max run in
- avformat/mxfdec: Check run_in is within 65536
- avcodec/mjpegdec: Check for unsupported bayer case
- avcodec/apedec: Fix integer overflow in filter_3800()
- avcodec/tta: Check 24bit scaling for overflow
- avcodec/tiff: Fix loop detection
- libavformat/hls: Free keys
- avcodec/fmvc: Move frame allocation to a later stage
- avfilter/vf_showinfo: remove backspaces
- avcodec/speedhq: Check width
- avcodec/bink: disallow odd positioned scaled blocks
- avformat/asfdec_o: limit recursion depth in asf_read_unknown()
- doc/git-howto.texi: Document commit signing
- libavcodec/8bps: Check that line lengths fit within the buffer
- avcodec/midivid: Perform lzss_uncompress() before ff_reget_buffer()
- libavformat/iff: Check for overflow in body_end calculation
- avformat/avidec: Prevent entity expansion attacks
- avcodec/h263dec: Sanity check against minimal I/P frame size
- avcodec/hevcdec: Check s->ref in the md5 path similar to hwaccel
- avformat/subviewerdec: Make read_ts() more flexible
- avcodec/mjpegdec: bayer and rct are incompatible
- MAINTAINERS: Add ED25519 key for signing my commits in the future
- avcodec/hevc_filter: copy_CTB() only within width&height
- avformat/flvdec: Check for EOF in index reading
- avformat/nutdec: Check get_packetheader() in mainheader
- avformat/asfdec_f: Use 64bit for packet start time
- tools/target_dec_fuzzer: Adjust threshold for MMVIDEO
- avcodec/lagarith: Check dst/src in zero run code
- avcodec/h264dec: Skip late SEI
- avcodec/sbrdsp_fixed: Fix integer overflows in sbr_qmf_deint_neg_c()
- avfilter/vf_signature: Fix integer overflow in filter_frame()
- avformat/rtsp: break on unknown protocols
- avcodec/hevcdsp_template: stay within tables in sao_band_filter()
- avcodec/tiff: Check pixel format types for dng
- avcodec/qpeldsp: copy less for the mc0x cases
- avcodec/ffv1dec: Limit golomb rice coded slices to width 8M
- avformat/iff: simplify duration calculation
- avcodec/wnv1: Check for width =1
- avcodec/ffv1dec_template: fix indention
- avformat/sctp: close socket on errors
- avcodec/aasc: Fix indention
- avcodec/qdrw: adjust max colors to array size
- avcodec/alacdsp: Make intermediates unsigned
- avformat/aiffdec: cleanup size handling for extreem cases
- avcodec/jpeglsdec: fix end check for xfrm
- avcodec/cdgraphics: limit scrolling to the line
- avformat/aiffdec: avoid integer overflow in get_meta()
- avformat/ape: more bits in size for less overflows
- avformat/bfi: Check offsets better
- avformat/asfdec_f: Check packet_frag_timestamp
- avcodec/texturedspenc: Fix indexing in color distribution determination
- avformat/act: Check ff_get_wav_header() for failure
- avcodec/libxavs2: Improve r redundancy in occured
- avformat/libzmq: Improve r redundancy in occured
- avfilter/vsrc_mandelbrot: Check for malloc failure
- avfilter/vf_frei0r: Copy to frame allocated according to frei0r requirements
- avfilter/video: Add ff_default_get_video_buffer2() to set specific alignment
- avformat/genh: Check sample rate
- avcodec/pngenc: remove monowhite from apng formats
- configure: bump year
- configure: extend SDL check to accept all 2.x versions
- lavf/tls_mbedtls: add support for mbedtls version 3
-
-version 4.3.4:
- fate: update reference files after the recent dash manifest muxer changes
- avformat/webmdashenc: fix on-demand profile string
- Update for FFmpeg 4.3.4
- avcodec/diracdec: avoid signed integer overflow in global mv
- avcodec/takdsp: Fix integer overflow in decorrelate_sf()
- avcodec/apedec: fix a integer overflow in long_filter_high_3800()
- avfilter/vf_subtitles: pass storage size to libass
- avformat/aqtitledec: Skip unrepresentable durations
- avformat/cafdec: Do not store empty keys in read_info_chunk()
- avformat/mxfdec: Do not clear array in mxf_read_strong_ref_array() before writing
- avformat/mxfdec: Check for avio_read() failure in mxf_read_strong_ref_array()
- avformat/mxfdec: Check count in mxf_read_strong_ref_array()
- avformat/hls: Check target_duration
- avcodec/pixlet: Avoid signed integer overflow in scaling in filterfn()
- avformat/matroskadec: Check pre_ns
- avcodec/sonic: Use unsigned for predictor_k to avoid undefined behavior
- avcodec/mjpegbdec: Set buf_size
- avformat/matroskadec: Use rounded down duration in get_cue_desc() check
- avcodec/g729_parser: Check channels
- avformat/avidec: Check height
- avformat/rmdec: Better duplicate tags check
- avformat/mov: Disallow empty sidx
- avformat/matroskadec: Check duration
- avformat/mov: Corner case encryption error cleanup in mov_read_senc()
- avcodec/jpeglsdec: Fix if( code style
- avcodec/jpeglsdec: Check get_ur_golomb_jpegls() for error
- avcodec/motion_est: fix indention of ff_get_best_fcode()
- avcodec/motion_est: Fix xy indexing on range violation in ff_get_best_fcode()
- avcodec/jpeglsdec: Increase range for N in ls_get_code_runterm() by using unsigned
- avformat/matroskadec: Check desc_bytes
- avformat/utils: Fix invalid NULL pointer operation in ff_parse_key_value()
- avformat/matroskadec: Fix infinite loop with bz decompression
- avformat/mov: Check size before subtraction
- avcodec/apedec: Fix integer overflows in predictor_update_3930()
- avcodec/apedec: fix integer overflow in 8bit samples
- avformat/flvdec: timestamps cannot use the full int64 range
- avcodec/vqavideo: reset accounting on error
- avcodec/alacdsp: fix integer overflow in decorrelate_stereo()
- avformat/4xm: Check for duplicate track ids
- avformat/4xm: Consider max_streams on reallocating tracks array
- avformat/mov: Check next offset in mov_read_dref()
- avformat/vivo: Favor setting fps from explicit fractions
- avformat/vivo: Do not use the general expression evaluator for parsing a floating point value
- avformat/mxfdec: Check for duplicate mxf_read_index_entry_array()
- avcodec/apedec: Change avg to uint32_t
- avformat/mov: Disallow duplicate smdm
- avformat/mov: Check for EOF in mov_read_glbl()
- avcodec/vp3: Check version in all cases when VP4 code is not built
- avformat/mov: Check channels for mov_parse_stsd_audio()
- avformat/avidec: Check read_odml_index() for failure
- avformat/aiffdec: Use av_rescale() for bitrate
- avformat/aiffdec: sanity check block_align
- avformat/aiffdec: Check sample_rate
- avcodec/flac_parser: Consider AV_INPUT_BUFFER_PADDING_SIZE
- avcodec/libdav1d: free the Dav1dData packet on dav1d_send_data() failure
- configure: Add missing libshine->mpegaudioheader dependency
-
-version 4.3.3:
- avcodec/ttadsp: Fix integer overflows in tta_filter_process_c()
- avutil/mathematics: Document av_rescale_rnd() behavior on non int64 results
- avformat/matroskadec: Reset state also on failure in matroska_reset_status()
- avformat/wavdec: Check smv_block_size
- avformat/rmdec: Check for multiple audio_stream_info
- avcodec/apedec: Use 64bit to avoid overflow
- avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830()
- oavformat/avidec: Check offset in odml
- avformat/mpegts: use actually read packet size in mpegts_resync special case
- avfilter/scale_npp: fix non-aligned output frame dimensions
- Update for 4.3.3
- swscale/alphablend: Fix slice handling
- avcodec/apedec: Fix integer overflow in filter_fast_3320()
- avcodec/mxpegdec: Check for AVDISCARD_ALL
- avcodec/flicvideo: Check remaining bytes in FLI*COPY
- avcodec/cbs_h265_syntax_template: Limit sps_num_palette_predictor_initializer_minus1 to 127
- avcodec/snowdec: Maintain avmv buffer
- avcodec/mpeg12dec: Do not put mpeg_f_code into an invalid state on error return
- avcodec/mpegvideo_enc: Limit bitrate tolerance to the representable
- avcodec/apedec: Fix integer overflow in intermediate
- avformat/mvdec: Do not set invalid sample rate
- avformat/sbgdec: Check for t0 overflow in expand_tseq()
- avformat/rmdec: Use 64bit for intermediate for DEINT_ID_INT4
- avformat/sbgdec: Check opt_duration and start for overflow
- avformat/mov: Check for duplicate clli
- avformat/jacosubdec: Check for min in t overflow in get_shift()
- avformat/mxfdec: check channel number in mxf_get_d10_aes3_packet()
- avcodec/utils: don't return negative values in av_get_audio_frame_duration()
- avcodec/jpeg2000dec: Check that atom header is within bytsetream
- avcodec/apedec: Fix 2 integer overflows in filter_3800()
- avcodec/xpmdec: Move allocations down after more error checks
- avformat/mov: Check dts for overflow in mov_read_trun()
- avformat/avidec: Use 64bit for frame number in odml index parsing
- avcodec/mjpegbdec: Skip SOS on AVDISCARD_ALL as does mjpeg
- avcodec/mjpegdec: Check for bits left in mjpeg_decode_scan_progressive_ac()
- avformat/adtsenc: return value check for init_get_bits in adts_decode_extradata
- avcodec/webp: Check available space in loop in decode_entropy_coded_image()
- avcodec/h264dec: use picture parameters in ff_print_debug_info2()
- avcodec/vc1dec: ff_print_debug_info() does not support WMV3 field_mode
- avcodec/frame_thread_encoder: Free AVCodecContext structure on error during init
- avcodec/faxcompr: Check for end of input in cmode == 1 in decode_group3_2d_line()
- avcodec/vc1dec: Disable error concealment for *IMAGE
- avcodec/sbrdsp_fixed: Fix negation overflow in sbr_neg_odd_64_c()
- avformat/wtvdec: Check for EOF before seeking back in parse_media_type()
- avformat/mpc8: Check first keyframe position for overflow
- avformat/wavdec: Use 64bit in new_pos computation
- avformat/sbgdec: Check for overflow in timestamp preparation
- avformat/dsicin: Check packet size for overflow
- avformat/dsfdec: Change order of operations in bitrate computation
- avformat/bfi: check nframes
- avformat/avidec: fix position overflow in avi_load_index()
- avformat/asfdec_f: Check sizeX against padding
- avformat/aiffdec: Check for size overflow in header parsing
- avcodec/aaccoder: Add minimal bias in search_for_ms()
- avformat/mov: Avoid undefined overflow in time_offset calculation
- avfilter/af_drmeter: Check that there is data
- avfilter/vf_fftdnoiz: Use lrintf() in export_row8()
- avfilter/vf_mestimate: Check b_count
- avformat/mov: do not ignore errors in mov_metadata_hmmt()
- avformat/mxfdec: Check size for shrinking
- avcodec/dnxhddec: check and propagate function return value
- swscale/slice: Fix wrong return on error
- avcodec/aacdec_template: Avoid some invalid values to be set by decode_audio_specific_config_gb()
- swscale/slice: Check slice for allocation failure
- avformat/matroskadec: Fix handling of huge default durations
- avcodec/lpc: check for zero err in normalization in compute_lpc_coefs()
- avformat/ftp: Check for av_strtok() failure
- tools/cws2fws: Check read() for failure
- avcodec/cpia: Fix missing src_size update
- avcodec/clearvideo: Check tile_size to be not too large
- avcodec/utils: Use 64bit for intermediate in AV_CODEC_ID_ADPCM_THP* duration calculation
- avformat/rmdec: Check old_format len for overflow
- avformat/realtextdec: Check the pts difference before using it for the duration computation
- avformat/qcp: Avoid negative nb_rates
- avformat/nutdec: Check tmp_size
- avformat/msf: Check that channels doesnt overflow during extradata construction
- avformat/mpc8: Check for position overflow in mpc8_handle_chunk()
- avformat/iff: Use 64bit in duration computation
- avformat/dxa: Check fps to be within the supported range more precissely
- avcodec/iff: Only write palette to plane 1 if its PAL8
- avformat/tta: Check for EOF in index reading loop
- Update missed irc links
- avformat/rpl: The associative law doesnt hold for signed integers in C
- avcodec/faxcompr: Check available bits in decode_uncompressed()
- avcodec/faxcompr: Check if bits are available before reading in cmode == 9 || cmode == 10
- avformat/utils: check dts/duration to be representable before using them
- avcodec/utils: do "calc from frame_bytes, channels, and block_align" in 64bit
- avcodec/ttadata: Add sentinel at the end of ff_tta_shift_1
- avformat/mov: Check for duplicate mdcv
- avfilter/vf_dctdnoiz: Check threads
- avfilter/vf_ciescope: Fix undefined behavior in rgb_to_xy() with black
- avformat/rpl: Check for EOF and zero framesize
- avcodec/vc2enc: Check for non negative slice bounds
- avformat/rpl: Use 64bit in bitrate computation and check it
- avcodec/svq1enc: Do not print debug RD value before it has been computed
- avcodec/aacpsy: Check bandwidth
- avcodec/aacenc: Do not divide by lambda_count if it is 0
- avcodec/aacenc: Use FLT_EPSILON for lambda minimum
- avformat/cinedec: Fix index_entries size check
- avfilter/vf_yadif: Fix handing of tiny images
- avfilter/vf_vmafmotion: Check dimensions
- avformat/movenc: Check pal_size before use
- avcodec/lpc: Avoid floating point division by 0
- avcodec/aacpsy: Avoid floating point division by 0 of norm_fac
- avcodec/aacenc: Avoid 0 lambda
- avcodec/exr: x/ymax cannot be INT_MAX
- avformat/avio: Check av_opt_copy() for failure
- avcodec/clearvideo: Check for 0 tile_shift
- avcodec/vc1: Check remaining bits in ff_vc1_parse_frame_header()
- avformat/mov: Ignore duplicate CoLL
- avformat/mov: Limit nb_chapter_tracks to input size
- avformat/utils: Use 64bit earlier in r_frame_rate check
- avcodec/alsdec: Fix decoding error with mono audio files
- avformat/mvdec: Check sample rate in parse_audio_var()
- avcodec/faxcompr: Check for end of bitstream in decode_group3_1d_line() and decode_group3_2d_line()
- avcodec/utils: treat PAL8 for jpegs similar to other colorspaces
- avcodec/jpeglsdec: Set alpha plane in PAL8 so image is not 100% transparent
- avformat/asfdec_o: Use ff_get_extradata()
- avformat/id3v2: Check end for overflow in id3v2_parse()
- avformat/wtvdec: Improve size overflow checks in parse_chunks()
- avcodec/faxcompr: Check remaining bits on error in decode_group3_1d_line()
- avcodec/utils: Check ima wav duration for overflow
- avcodec/rv10: Execute whole size check earlier for rv20
- avformat/cafdec: Check channels
- avcodec/dpx: Check bits_per_color earlier
- avformat/mvi: Check audio_data_size to be non negative
- avcodec/pnm_parser: Check image size addition for overflow
- avcodec/h265_metadata_bsf: Check nb_units before accessing the first in h265_metadata_update_fragment()
- avformat/rmdec: use larger intermediate type for audio_framesize * sub_packet_h check
- avcodec/h264_slice: Check input SPS in ff_h264_update_thread_context()
- avformat/mpc8: check for size overflow in mpc8_get_chunk_header()
- avformat/mov: Do not zero memory that is written too or unused
- avcodec/mpegvideo: Update chroma_?_shift in ff_mpv_common_frame_size_change()
- avformat/mov: Ignore multiple STSC / STCO
- avformat/utils: Extend overflow check in dts wrap in compute_pkt_fields()
- avfilter/vf_scale: Fix adding 0 to NULL (which is UB) in scale_slice()
- avutil/common: Add FF_PTR_ADD()
- avformat/wtvdec: Check size in SBE2_STREAM_DESC_EVENT / stream2_guid
- tools/target_dec_fuzzer: Adjust threshold for H264
- avformat/cafdec: Do not build an index if all packets are the same
- avformat/vividas: Use equals check with n in read_sb_block()
- avcodec/sonic: Use unsigned temporary in predictor_calc_error()
- avformat/jacosubdec: Use 64bit intermediate for start/end timestamp shift
- avformat/flvdec: Check array entry number
- avcodec/h264_slice: Check sps in h264_slice_header_init()
- avformat/movenc: Avoid loosing cluster array on failure
- avformat/avidec: Check for dv streams before using priv_data in parse ##dc/##wb
- avformat/mov: Check sample size for overflow in mov_parse_stsd_audio()
- avformat/sbgdec: Check for overflow in last loop in expand_timestamps()
- avcodec/ffwavesynth: Avoid signed integer overflow in phi_at()
- avcodec/mpeg4videoenc: Check extradata malloc()
- avcodec/speedhq: Width < 8 is not supported
- avformat/matroskadec: Check for EOF in resync loop
- avcodec/utils: Use more bits for intermediate for AV_CODEC_ID_ADPCM_MS
- avcodec/jpegls: Check A[Q] for overflow in ff_jpegls_update_state_regular()
- avformat/voc_packet: prevent remaining size from becoming negative in ff_voc_get_packet()
- avutil/timecode: Avoid fps overflow
- avformat/mvi: Check audio size for more overflows
- avcodec/flacdec: Avoid undefined shift in error case
- avcodec/ffv1dec: Check if trailer is available
- avcodec/4xm: Check pre_gb in decode_i_block()
- avformat/mvdec: Allocate extradata only once
- avcodec/dcadsp: Fix integer overflow in dmix_add_c()
- avformat/flvdec: Check double before cast in parse_keyframes_index()
- avformat/paf: Check for EOF before allocation in read_header()
- avcodec/aacdec_template: Avoid undefined negation in imdct_and_windowing_eld()
- avformat/lxfdec: Fix multiple integer overflows related to track_size
- avcodec/exr: skip bottom clearing loop when its outside the image
- avutil/parseutils: Check sign in av_parse_time()
- avformat/aiffdec: Check that SSND is at least 8 bytes
- avformat/dcstr: Check sample rate
- avcodec/alsdec: Check bitstream input in read_block()
- avformat/mov: Extend data_size check in mov_read_udta_string()
- avformat/aadec: Check for EOF while reading chapters
- avformat/voc_packet: Add a basic check on max_size
- avformat/microdvddec: use 64bit for durations
- avcodec/h264_slice: clear old slice POC values on parsing failure
- avfilter/overlay_cuda: check av_buffer_ref result
- avfilter/overlay_cuda: hold explicit reference to hw_device_ctx
- avformat/url: add ff_make_absolulte_url2 to be able to test windows path cases
- avformat/url: fix ff_make_absolute_url with Windows file paths
- Revert "avcodec: Add FF_CODEC_CAP_INIT_CLEANUP"
- fftools/ffplay: do not write out of rdft visualization texture
- avfilter/overlay_cuda: fix framesync with embedded PGS subtitle
- avcodec/mxpegdec: Fix memleaks upon init failure
- avcodec/mjpegdec: Fix memleak upon init failure
- avfilter/af_headphone: Fix stack buffer overflow
- avfilter/af_headphone: Don't overrun array
- avfilter/af_headphone: Fix segfault when using very short streams
- avfilter/af_headphone: Check for the existence of samples
- avfilter/af_headphone: Remove always true check
- avfilter/af_headphone: Don't use uninitialized buffer in log message
- avformat/segment: Fix error messages
- avformat/segment: Free SegmentListEntries in deinit, not write_trailer
- avformat/segment: Fix leak and invalid free of AVIOContext
- avformat/segment: Fix leak of string on error
- avformat/segment: Fix segfault when error happens and segment list is output
- avformat/segment: Fix segfault on allocation error, avoid allocation
- avformat/segment: Fix leak of duration/framenumber lists upon error
- avformat/segment: Don't overwrite AVCodecParameters after init
- avformat/dashdec: Reset pointer to NULL after freeing it
- libavformat/dashdec: Fix issue with dash on Windows
- avformat/dashdec: Fix memleak on allocation error, avoid allocation
- avformat/dashdec: Fix memleaks on error to add representation to dynarray
- avformat/dashdec: Fix leak of representation languages
- avformat/dashdec: Fix leak of string on error when parsing representation
- avformat/dashdec: Fix leak of representation on error
- avformat/dashdec: Remove unused index of representation
- avformat/dashdec: Fix memleaks upon read_header failure
- avformat/dashdec: Check allocation of AVProgram
- avformat/dashdec, hls: Update correct pointer to AVDictionary
- avformat/dashdec: Fix leak of AVDictionary on error
- avformat/dashdec: Free subtitle representations on exit
- avformat/dashdec: Free strings as soon as they aren't needed anymore
- avformat/dashdec: Don't overwrite and leak old initialization fragments
- avformat/dashdec: Don't leave representation in inconsistent state on error
- avformat/dashdec: Remove dead code
- avformat/spdifenc: Fix leak upon error
- avformat/wavenc: Fix leak and segfault on reallocation error
- avformat/mpegenc: Avoid adding invalid packet to queue
- avformat/mpegenc: Fix leak in case trailer is never written
- avformat/mpegenc: Ensure packet queue stays valid
- avformat/mxfenc: Never set codec_ul UID to NULL
- avcodec/frame_thread_encoder: Fix segfault on allocation error
- avformat/utils: Add av_assert1 to preclude NULL + len, len != 0
- avformat/utils: Fix undefined NULL + 0
- avcodec/g722enc: Validate parameters before using them
- avcodec/g722enc: Cleanup generically on init failure
- avcodec/opusdec: Return error upon error
- avcodec/wavpack: Fix leak on init failure
- avcodec/pthread_slice: Don't use static variable, fix race
- avcodec/a64multienc: Fix memleak upon init failure
- avformat/flacenc: Fix memleak when writing attached pictures fails
- avcodec/mpeg12enc: Always initialize MPEG-2 intra VLC table lengths
- avcodec/fft_template, fft_init_table: Make ff_fft_init() thread-safe
- avformat/asfdec_o: Don't segfault with lots of attached pics
- avcodec/mss4: Fix memleaks upon allocation error
- avformat/apngdec: Fix size/overflow checks
- avformat/apngdec: Return error for incomplete header
- avformat/jacosubdec: Fix unintended fallthrough
- avcodec/bitstream: Consistently treat symbol as VLC_TYPE
- avcodec/vp3: Check allocations of VLCs
- avcodec/vp3: Fix memleak upon init failure
- avcodec/movtextenc: Fix undefined left shifts outside the range of int
- avcodec/movtextenc: Fix memleak on (re)allocation error
- avcodec/movtextenc: Don't presume every style to have a font
- avcodec/movtextenc: Reset array counter after freeing array
- avcodec/movtextenc: Fix potential use of uninitialized value
- avcodec/movtextenc: fix writing to bytestream on BE arches
- avcodec/movtextdec: Fix leaks on (re)allocation failure
- avcodec/movtextdec: Simplify checking for invalid extradata
- avcodec/movtextdec: Fix leaks of strings upon reallocation failure
- avcodec/movtextdec: Reset counter of fonts when freeing them
- avcodec/sheervideo: Don't leave context in inconsistent state upon error
- avfilter/vf_minterpolate: Fix left shift of negative value
- avfilter/vf_minterpolate: Reject too small dimensions
- avformat/movenc: Don't forget to free fragment buffers
- avformat/movenc: Free old vos_data before overwriting it
- avformat/movenc: Fix segfault when remuxing rtp hint stream
- avcodec/dvenc: Fix undefined left shift of negative numbers
- avformat/movenc: Fix stack overflow when remuxing timecode tracks
- avcodec/utils: Also free encoder extradata on avcodec_open2() error
- avcodec/utils: Don't forget cleaning up when allocating priv_data fails
- avcodec/utils: Improve check for freeing codec private options
- swresample/audioconvert: Fix left shift of negative value
- avcodec/utils: Only call codec->close if init has been called
- avformat/movenc: Fix segfault upon allocation error
- avformat/swfdec: Reorder allocations/initializations
- avformat/swfdec: Fix memleaks on error
- avformat/dashdec: Avoid double free on error
- avformat/tedcaptionsdec: Fix leak of AVBPrint upon error
- avformat/swfenc: Fix memleak upon write_header error
- avformat/rmdec: Fix potential crash on allocation failure
- avformat/rmdec: Actually return value < 0 on read_header failure
- avformat/avidec: Fix memleak when error happens after creating DV stream
- avcodec/mpegaudiodec_template: Check return value of subdecoder
- avcodec/j2kenc: Fix leaks on init failure
- avcodec/flashsv2enc: Check allocations for success before usage
- avcodec/flashsvenc: Avoid allocation of buffer, fix memleak
- avcodec/ac3enc_template: Don't free uninitialized pointers on error
- avcodec/svq3: Fix segfault on allocation error, avoid allocations
- avcodec/sonic: Fix leaks upon allocation errors
- avcodec/qtrleenc: Fix memleak upon allocation failure
- avcodec/ffv1enc: Fix memleaks on init failure
- avcodec/ffv1: Fix segfaults on allocation error
- avcodec/mlpenc: Fix memleak upon init failure
- avcodec/indeo5: Fix memleaks upon allocation error
- avcodec/ivi: Fix segfault on allocation error
- avcodec/magicyuvenc: Fix memleak upon init failure
- avcodec/gif: Fix leaks upon allocation error
- avcodec/avrndec: Fix memleak on error
- avcodec/avrndec: Check allocation for success
- avcodec/atrac1: Check allocation of AVFloatDSPContext
- avfilter/vf_subtitles: Fix leaks on failure
- avfilter/vf_uspp: Fix potential leak of dict on error
- avfilter/lavfutils: Fix memleak when avformat_find_stream_info() fails
- avfilter/lavfutils: Don't use uninitialized pointers for freeing
- avcodec/binkaudio: Don't use static storage for context-dependent data
- avcodec/bink: Fix memleak upon init failure
- avcodec/wnv1: Use LE bitstream reader, avoid copying packet, fix memleak
- avcodec/truemotion2: Avoid duplicating array, fix memleak
- avfilter/af_headphone: Fix leak of channel layouts list on error
- avfilter/af_headphone: Fix segfault upon allocation failure
- avfilter/vf_signature: Fix leak of string upon error
- avfilter/vf_signature: Fix leak of inpads' names
- avfilter/af_aiir: Fix segfault and leak upon allocation failure
- avfilter/vf_premultiply: Fix leak of names of inpads
- avfilter/af_anequalizer: Fix memleak when inserting pad fails
- avfilter/af_amerge: Fix segfault upon allocation failure
- avfilter/af_aformat: Add uninit function
- avfilter/vf_hwdownload: Fix leak of formats list upon error
- avfilter/formats: Fix double frees and memleaks on error
- avfilter/af_channelmap: Fix double-free of AVFilterChannelLayouts on error
- avfilter/vf_alphamerge: Fix double-free of AVFilterFormats on error
- avfilter/vf_overlay: Fix double-free of AVFilterFormats on error
- avfilter/vf_remap: Fix double-free of AVFilterFormats on error
- avfilter/vf_showpalette: Fix double-free of AVFilterFormats on error
- avfilter/af_amix: Fix double-free of AVFilterChannelLayouts on error
- avfilter/af_amix: Don't needlessly reallocate table
- avfilter/vf_vpp_qsv: Fix leak of AVFilterFormats on error
- avfilter/vf_paletteuse: Fix leaks of AVFilterFormats on error
- avfilter/graphparser: Fix memleak when linking filters fails
- fftools/ffmpeg: Fix leak of AVFilterInOut in case of error
- avfilter/graphparser: Check allocations for success
- avfilter/graphparser: Don't set pointer to one beyond '\0' of string
- avfilter/graphparser: Fix leaks when parsing inputs fails
- avfilter/af_afir: Fix leak of AVFilterChannelLayout in case of error
- avformat/mlvdec: Only store dimensions after having validated them
- avformat/mlvdec: Don't leak open AVIOContexts on error
- avformat/mlvdec: Check for existence of AVIOContext before using it
- avformat/hls: Fix memleak when url is empty
- avfilter/formats: Fix heap-buffer overflow when merging channel layouts
- Revert "lavfi/avfiltergraph: add check before free the format"
- avfilter/formats: Leave lists' ownership unchanged upon merge failure
- avformat/mpegts: Don't leave context in inconsistent state upon error
- avformat/sierravmd: Don't return packets for non-existing stream
- avformat/vividas: Check allocation for success
- avformat/vividas: Check return value before storing it in smaller type
- avformat/webmdashenc: Avoid allocations, fix memleak
- avformat/webmdashenc: Fix segfault when no filename is given when live
- avformat/matroskadec: Avoid undefined pointer arithmetic
- avformat/mxfdec: Fix memleak upon repeating tags
- avformat/mxfdec: Fix memleak when parsing tag fails
- avformat/mxfdec: Fix memleak when adding element to array fails
-
-
-version 4.3.2:
- avcodec/hapdec: Change compressed_offset to unsigned 32bit
- avformat/rmdec: Check codec_length without overflow
- avformat/mov: Check element count in mov_metadata_hmmt()
- avcodec/vp8: Move end check into MB loop in vp78_decode_mv_mb_modes()
- avcodec/fits: Check gcount and pcount being non negative
- avformat/nutdec: Check timebase count against main header length
- avformat/electronicarts: Clear partial_packet on error
- avformat/r3d: Check samples before computing duration
- avcodec/pnm_parser: Check av_image_get_buffer_size() for failure
- avformat/wavdec: Consider AV_INPUT_BUFFER_PADDING_SIZE in set_spdif()
- avformat/rmdec: Check remaining space in debug av_log() loop
- avformat/flvdec: Treat high ts byte as unsigned
- avformat/samidec: Sanity check pts
- avcodec/jpeg2000dec: Check atom_size in jp2_find_codestream()
- avformat/avidec: Use 64bit in get_duration()
- avformat/mov: Check for duplicate st3d
- avformat/mvdec: Check for EOF in read_index()
- avcodec/jpeglsdec: Fix k=16 in ls_get_code_regular()
- avformat/id3v2: Check the return from avio_get_str()
- avcodec/hevc_sei: Check payload size in decode_nal_sei_message()
- libavutil/eval: Remove CONFIG_TRAPV special handling
- avformat/wtvdec: Check len in parse_chunks() to avoid overflow
- avformat/asfdec_f: Add an additional check for the extradata size
- avformat/3dostr: Check sample_rate
- avformat/4xm: Make audio_frame_count 64bit
- avformat/mov: Use av_mul_q() to avoid integer overflows
- avcodec/vp9dsp_template: Fix integer overflows in itxfm_wrapper
- avformat/rmdec: Reorder operations to avoid overflow
- avcodec/mxpegdec: fix SOF counting
- avcodec/rscc: Check inflated_buf size whan it is used
- avformat/mvdec: Sanity check SAMPLE_WIDTH
- avcodec/nvenc: fix timestamp offset ticks logic
- avformat/rmdec: Fix codecdata_length overflow check
- avcodec/simple_idct: Fix undefined integer overflow in idct4row()
- avformat/wavdec: Check block_align vs. channels before combining them
- avformat/tta: Use 64bit intermediate for index
- avformat/soxdec: Check channels to be positive
- avformat/smacker: Check for too small pts_inc
- avformat/sbgdec: Use av_sat_add64() in str_to_time()
- avcodec/cscd: Check output len in zlib as in lzo
- avcodec/vp3: Check input amount in theora_decode_header()
- avformat/wavdec: Check avio_get_str16le() for failure
- avformat/flvdec: Check for EOF in amf_skip_tag()
- avformat/aiffdec: Check size before subtraction in get_aiff_header()
- avformat/electronicarts: More chunk_size checks
- avcodec/cfhd: check peak.offset
- avformat/tedcaptionsdec: Check for overflow in parse_int()
- avformat/nuv: Check channels
- avcodec/siren: Increase noise category 5 and 6
- avformat/mpc8: Check size before implicitly converting to int
- avformat/nutdec: Fix integer overflow in count computation
- avformat/mvi: Use 64bit for testing dimensions
- avformat/utils: Check dts in update_initial_timestamps() more
- avformat/mpsubdec: Use av_sat_add/sub64() in fracval handling
- avformat/flvdec: Check for avio_read() failure in amf_get_string()
- avformat/flvdec: Check for nesting depth in amf_skip_tag()
- avformat/flvdec: Check for nesting depth in amf_parse_object()
- avformat/asfdec_o: Check for EOF in asf_read_marker()
- avformat/flvdec: Use av_sat_add64() for pts computation
- avformat/utils: Check dts - (1<<pts_wrap_bits) overflow
- avformat/bfi: Check chunk_header
- avformat/ads: Check size
- avformat/iff: Check block align also for ID_MAUD
- avcodec/utils: Check for integer overflow in get_audio_frame_duration() for ADPCM_DTK
- avformat/fitsdec: Better size checks
- avformat/mxfdec: Fix integer overflow in next position in mxf_read_local_tags()
- avformat/avidec: dv does not support palettes
- avformat/dhav: Break out of infinite dhav search loop
- libavformat/utils: consider avio_size() failure in ffio_limit()
- avformat/nistspheredec: Check bits_per_coded_sample and channels
- avformat/asfdec_o: Check size vs. offset in detect_unknown_subobject()
- avformat/utils: check for integer overflow in av_get_frame_filename2()
- avutil/timecode: Avoid undefined behavior with large framenum
- avformat/mov: Check a.size before computing next_root_atom
- avformat/sbgdec: Reduce the amount of floating point in str_to_time()
- avformat/mxfdec: Free all types for both Descriptors
- uavformat/rsd: check for EOF in extradata
- avcodec/wmaprodec: Check packet size
- avformat/dhav: Check position for overflow
- avcodec/rasc: Check frame before clearing
- avformat/vividas: Check number of audio channels
- avcodec/alsdec: Fix integer overflow with quant_cof
- avformat/mpegts: Fix argument type for av_log
- avformat/cafdec: clip sample rate
- avcodec/ffv1dec: Fix off by 1 error with quant tables
- avformat/mpegts: Increase pcr_incr width to 64bit
- avcodec/utils: Check bitrate for overflow in get_bit_rate()
- avformat/mov: Check if hoov is at the end
- avcodec/hevc_ps: check scaling_list_dc_coef
- avformat/iff: Check data_size
- avformat/matroskadec: Sanity check codec_id/track type
- avformat/rpl: Check the number of streams
- avformat/vividas: Check sample_rate
- avformat/vividas: Make len signed
- avcodec/h264idct_template: Fix integer overflow in ff_h264_chroma422_dc_dequant_idct()
- avformat/dsfdec: Check block_align more completely
- avformat/mpc8: Check remaining space in mpc8_parse_seektable()
- avformat/id3v2: Sanity check tlen before alloc and uncompress
- avformat/vqf: Check len for COMM chunks
- avformat/mov: Avoid overflow in end computation in mov_read_custom()
- avcodec/hevc_cabac: Limit value in coeff_abs_level_remaining_decode() tighter
- avformat/cafdec: Check the return code from av_add_index_entry()
- avformat/cafdec: Check for EOF in index read loop
- avformat/cafdec: Check that bytes_per_packet and frames_per_packet are non negative
- avformat/mpc8: correct integer overflow in mpc8_parse_seektable()
- avformat/mpc8: correct 32bit timestamp truncation
- avcodec/exr: Check ymin vs. h
- avformat/avs: Use 64bit for the avio_tell() output
- avformat/wavdec: More complete size check in find_guid()
- avcodec/mv30: Use unsigned in idct_1d()
- avformat/iff: Check size before skip
- avformat/rmdec: Check for EOF in index packet reading
- avcodec/vp3dsp: Use unsigned constant to avoid undefined integer overflow in ff_vp3dsp_set_bounding_values()
- avformat/icodec: Check for zero streams and stream creation failure
- avformat/icodec: Factor failure code out in read_header()
- avformat/bintext: Check width
- avformat/sbgdec: Check that end is not before start
- avformat/lvfdec: Check stream_index before use
- avformat/au: cleanup on EOF return in au_read_annotation()
- avformat/mpegts: Limit copied data to space
- avformat/bintext: Check width in idf_read_header()
- avformat/iff: check size against INT64_MAX
- avformat/vividas: improve extradata packing checks in track_header()
- avformat/paf: Check for EOF in read_table()
- avformat/gxf: Check pkt_len
- avformat/aiffdec: Check packet size
- avformat/concatdec: use av_strstart()
- avformat/wavdec: Refuse to read chunks bigger than the filesize in w64_read_header()
- avformat/rsd: Check size and start before computing duration
- avformat/vividas: better check of current_sb_entry
- avformat/iff: More completely check body_size
- avformat/vividas use avpriv_set_pts_info()
- avformat/xwma: Check for EOF in dpds_table read code
- avcodec/utils: Check sample rate before use for AV_CODEC_ID_BINKAUDIO_DCT in get_audio_frame_duration()
- avcodec/dirac_parser: do not offset AV_NOPTS_OFFSET
- avformat/rmdec: Make expected_len 64bit
- avformat/pcm: Check block_align
- avformat/lrcdec: Clip timestamps
- avutil/mathematics: Use av_sat_add64() for the last addition in av_add_stable()
- avformat/electronicarts: Check for EOF in each iteration of the loop in ea_read_packet()
- avformat/ifv: Check that total frames do not overflow
- avcodec/vp9dsp_template: Fix some overflows in iadst8_1d()
- avcodec/fits: Check bscale
- avformat/nistspheredec: Check bps
- avformat/jacosubdec: Use 64bit inside get_shift()
- avformat/genh: Check block_align
- avformat/mvi: Check count for overflow
- avcodec/magicyuv: Check slice size before reading flags and pred
- avformat/asfdec_f: Check for negative ext_len
- avformat/bethsoftvid: Check image dimensions before use
- avformat/genh: Check block_align for how it will be used in SDX2_DPCM
- avformat/au: Check for EOF in au_read_annotation()
- avformat/vividas: Check for zero v_size
- avformat/segafilm: Do not assume AV_CODEC_ID_NONE is 0
- avformat/segafilm: Check that there is a stream
- avformat/wtvdec: Check dir_length
- avformat/ffmetadec: finalize AVBPrint on errors
- avcodec/decode/ff_get_buffer: Check for overflow in FFALIGN()
- avcodec/exr: Check limits to avoid overflow in delta computation
- avformat/boadec: Check that channels and block_align are set
- avformat/asfdec_f: Check name_len for overflow
- avcodec/h264idct_template: Fix integer overflow in ff_h264_chroma422_dc_dequant_idct()
- avformat/sbgdec: Check for timestamp overflow in parse_time_sequence()
- avcodec/aacdec_fixed: Limit index in vector_pow43()
- avformat/kvag: Fix integer overflow in bitrate computation
- avcodec/h264_slice: fix undefined integer overflow with POC in error concealment
- avformat/rmdec: sanity check coded_framesize
- avformat/flvdec: Check for EOF in amf_parse_object()
- avcodec/mv30: Fix multiple integer overflows
- avcodec/smacker: Check remaining bits in SMK_BLK_FULL
- avcodec/cook: Check subpacket index against max
- avcodec/utils: Check for overflow with ATRAC* in get_audio_frame_duration()
- avcodec/hevcpred_template: Fix diagonal chroma availability in 4:2:2 edge case in intra_pred
- avformat/icodec: Change order of operations to avoid NULL dereference
- avcodec/exr: Fix overflow with many blocks
- avcodec/vp9dsp_template: Fix integer overflows in idct16_1d()
- avcodec/ansi: Check initial dimensions
- avcodec/hevcdec: Check slice_cb_qp_offset / slice_cr_qp_offset
- avcodec/sonic: Check for overread
- avformat/subviewerdec: fail on AV_NOPTS_VALUE
- avcodec/exr: Check line size for overflow
- avcodec/exr: Check xdelta, ydelta
- avcodec/celp_filters: Avoid invalid negation in ff_celp_lp_synthesis_filter()
- avcodec/takdsp: Fix negative shift in decorrelate_sf()
- avcodec/dxtory: Fix negative stride shift in dx2_decode_slice_420()
- avformat/asfdec_f: Change order or operations slightly
- avformat/dxa: Use av_rescale() for duration computation
- avcodec/vc1_block: Fix integer overflow in ac value
- avcodec/mv30: Fix several integer overflows in idct_1d()
- avformat/iff: Check data_size not overflowing int64
- avcodec/dxtory: Fix negative shift in dx2_decode_slice_410()
- avcodec/sonic: Check channels before deallocating
- avformat/vividas: Check for EOF in first loop in track_header()
- avformat/wvdec: Check rate for overflow
- avcodec/ansi: Check nb_args for overflow
- avformat/wc3movie: Cleanup on wc3_read_header() failure
- avformat/wc3movie: Move wc3_read_close() up
- avcodec/tiff: Fix default white level
- avcodec/diracdsp: Fix integer anomaly in dequant_subband_*
- avutil/fixed_dsp: Fix integer overflows in butterflies_fixed_c()
- avcodec/mv30: Check remaining mask in decode_inter()
- avcodec/wmalosslessdec: Check remaining space before padding and channel residue
- avformat/cdg: Fix integer overflow in duration computation
- avcodec/mpc: Fix multiple numerical overflows in ff_mpc_dequantize_and_synth()
- avcodec/agm: Fix off by 1 error in decode_inter_plane()
- avformat/electronicarts: Check if there are any streams
- avcodec/ffwavesynth: Fix integer overflow in wavesynth_synth_sample / WS_SINE
- avcodec/vp9dsp_template: Fix integer overflow in iadst8_1d()
- avformat/avidec: Fix io_fsize overflow
- avcodec/cfhd: Check transform type
- avcodec/tiff: Check jpeg context against jpeg frame parameters
- avcodec/tiff: Restrict tag order based on specification
- avcodec/tiff: Avoid abort with DNG RAW TIFF with YA8
- avcodec/tiff: Check the linearization table size
- avformat/siff: Reject audio packets without audio stream
- avformat/mpeg: Check avio_read() return value in get_pts()
- avcodec/tiff: Check bpp/bppcount for 0
- avcodec/snowdec: Sanity check hcoeff
- avformat/mov: Check comp_brand_size
- avformat/ape: Error out in case of EOF in the header
- avcodec/alac: Check decorr_shift to avoid invalid shift
- avcodec/tdsc: Fix tile checks
- opusdec: do not fail when LBRR frames are present
- configure: update copyright year
- avfilter/vf_framerate: fix infinite loop with 1-frame input
- avformat/url: Change () position in ff_make_absolute_url()
- avformat/mpegts: make sure mpegts_read_header always stops at the first pmt
- avformat/alp: fix handling of TUN files
- avformat/argo_asf: fix handling of v1.1 files
- swscale/x86/yuv2rgb: fix crashes when loading alpha from unaligned buffers
- lavf/url: fix relative url parsing when the query string or fragment has a colon
- avformat/libsrt: fix cleanups on failed libsrt_open() and libsrt_setup()
- avcodec/cuviddec: backport extradata fixes
- avcodec/cuviddec: handle arbitrarily sized extradata
- lavf/srt: fix build fail when used the libsrt 1.4.1
- avformat/libsrt: close listen fd in listener mode
- lavf/url: rewrite ff_make_absolute_url() using ff_url_decompose().
- lavf/url: add ff_url_decompose().
- avcodec/cbs_av1: fix setting FrameWidth in frame_size_with_refs()
- avcodec/cbs_av1: use a more appropiate AV1ReferenceFrameState pointer variable name
- avcodec/cbs_av1: fix handling reference frames on show_existing_frame frames
- avcodec/cbs_av1: infer frame_type in show_existing_frame frames earlier
- avcodec/cbs_av1: add OrderHint to CodedBitstreamAV1Context
- avcodec/cbs_av1: infer frame_type when parsing a show_existing_frame frame
- cbs_av1: Fix test for presence of buffer_removal_time element
- avcodec/cbs_av1: fix storage size for render_{width,height}_minus_1
- lavc: Lower MediaFoundation audio encoder priority.
- x86/yuv2rgb: fix crashes when storing data on unaligned buffers
- checkasm/vf_blend: use the correct depth parameters to initialize the blend modes
- x86/vf_blend: fix warnings about trailing empty parameters
- x86/h264_deblock: fix warning about trailing empty parameter
- avutil/x86inc: fix warnings when assembling with Nasm 2.15
-
-
-version 4.3.1:
- avcodec/tiff: Check input space in dng_decode_jpeg()
- avcodec/mjpeg_parser: Adjust size rejection threshold
- avcodec/cbs_jpeg: Fix uninitialized end index in cbs_jpeg_split_fragment()
- avformat/sdp: Fix potential write beyond end of buffer
- avformat/mm: Check for existence of audio stream
- avformat/mov: Fix unaligned read of uint32_t and endian-dependance in mov_read_default
- avcodec/apedec: Fix undefined integer overflow with 24bit
- avcodec/loco: Fix integer overflow with large values from loco_get_rice()
- avformat/smjpegdec: Check the existence of referred streams
- avcodec/tiff: Check frame parameters before blit for DNG
- avcodec/mjpegdec: Limit bayer to single plane outputting format
- avcodec/pnmdec: Fix misaligned reads
- avcodec/mv30: Fix integer overflows in idct2_1d()
- avcodec/hcadec: Check total_band_count against imdct_in size
- avcodec/scpr3: Fix out of array access with dectab
- avcodec/tiff: Do not overrun the array ends in dng_blit()
- avcodec/dstdec: Replace AC overread check by sample rate check
- dnn_backend_native: Add overflow check for length calculation.
- avcodec/h264_metadata_bsf: Fix invalid av_freep
- avcodec/cbs_h265: set default VUI parameters when vui_parameters_present_flag is false
- avcodec/av1_parser: initialize avctx->pix_fmt
- avcodec/av1_parser: add missing parsing for RGB pixel format signaling
- avcodec/av1_parser: set context values outside the OBU parsing loop
- avutil/avsscanf: Add () to avoid integer overflow in scanexp()
- avformat/utils: reorder duration computation to avoid overflow
- avcodec/pngdec: Check for fctl after idat
- avformat/hls: Pass a copy of the URL for probing
- avutil/common: Fix integer overflow in av_ceil_log2_c()
- avcodec/wmalosslessdec: fix overflow with pred in revert_cdlms
- avformat/mvdec: Fix integer overflow with billions of channels
- avformat/microdvddec: skip malformed lines without frame number.
- dnn_backend_native: check operand index
- dnn_backend_native.c: refine code for fail case
- avformat/mov: fix memleaks
- libavformat/mov: Fix memleaks when demuxing DV audio
- avcodec/cbs_av1: Fix writing uvlc numbers >= INT_MAX
- avformat/avc, mxfenc: Avoid allocation of H264 SPS structure, fix memleak
- avcodec/bitstream: Don't check for undefined behaviour after it happened
- avformat/aviobuf: Also return truncated buffer in avio_get_dyn_buf()
- avformat/aviobuf: Don't check for overflow after it happened
-
 version 4.3:
 - v360 filter
 - Intel QSV-accelerated MJPEG decoding
--- a/1
+++ b/1
@@ -610,7 +610,6 @@ Loren Merritt                 ABD9 08F4 C920 3F65 D8BE 35D7 1540 DAA7 060F 56DE
 Lou Logan (llogan)            7D68 DC73 CBEF EABB 671A B6CF 621C 2E28 82F8 DC3A
 Lynne                         FE50 139C 6805 72CA FD52 1F8D A2FE A5F0 3F03 4464
 Michael Niedermayer           9FF2 128B 147E F673 0BAD F133 611E C787 040B 0FAB
-                              DD1E C9E8 DE08 5C62 9B3E 1846 B18E 8928 B394 8D64
 Nicolas George                24CE 01CE 9ACC 5CEB 74D8 8D9D B063 D997 36E5 4C93
 Nikolay Aleksandrov           8978 1D8C FB71 588E 4B27 EAA8 C4F0 B5FC E011 13B1
 Panagiotis Issaris            6571 13A3 33D9 3726 F728 AA98 F643 B12E ECF3 E029
--- a/2
+++ b/2
@@ -1 +1 @@
-4.3.6
+4.2.git
--- a/15
+++ b/15
@@ -1,15 +0,0 @@
-
-              ┌────────────────────────────────────┐
-              │ RELEASE NOTES for FFmpeg 4.3 "4:3" │
-              └────────────────────────────────────┘
-
-   The FFmpeg Project proudly presents FFmpeg 4.3 "4:3", about 10
-   months after the release of FFmpeg 4.2.
-
-   A complete Changelog is available at the root of the project, and the
-   complete Git history on https://git.ffmpeg.org/gitweb/ffmpeg.git
-
-   We hope you will like this release as much as we enjoyed working on it, and
-   as usual, if you have any questions about it, or any FFmpeg related topic,
-   feel free to join us on the #ffmpeg IRC channel (on irc.libera.chat) or ask
-   on the mailing-lists.
--- a/8
+++ b/8
@@ -532,7 +532,7 @@ die(){

 If you think configure made a mistake, make sure you are using the latest
 version from Git.  If the latest version fails, report the problem to the
-ffmpeg-user@ffmpeg.org mailing list or IRC #ffmpeg on irc.libera.chat.
+ffmpeg-user@ffmpeg.org mailing list or IRC #ffmpeg on irc.freenode.net.
 EOF
    if disabled logging; then
        cat <<EOF
@@ -3236,7 +3236,7 @@ librav1e_encoder_deps="librav1e"
 librav1e_encoder_select="extract_extradata_bsf"
 librsvg_decoder_deps="librsvg"
 libshine_encoder_deps="libshine"
-libshine_encoder_select="audio_frame_queue mpegaudioheader"
+libshine_encoder_select="audio_frame_queue"
 libspeex_decoder_deps="libspeex"
 libspeex_encoder_deps="libspeex"
 libspeex_encoder_select="audio_frame_queue"
@@ -6493,7 +6493,7 @@ fi

 if enabled sdl2; then
    SDL2_CONFIG="${cross_prefix}sdl2-config"
-    test_pkg_config sdl2 "sdl2 >= 2.0.1 sdl2 < 3.0.0" SDL_events.h SDL_PollEvent
+    test_pkg_config sdl2 "sdl2 >= 2.0.1 sdl2 < 2.1.0" SDL_events.h SDL_PollEvent
    if disabled sdl2 && "${SDL2_CONFIG}" --version > /dev/null 2>&1; then
        sdl2_cflags=$("${SDL2_CONFIG}" --cflags)
        sdl2_extralibs=$("${SDL2_CONFIG}" --libs)
@@ -7513,7 +7513,7 @@ cat > $TMPH <<EOF
 #define FFMPEG_CONFIG_H
 #define FFMPEG_CONFIGURATION "$(c_escape $FFMPEG_CONFIGURATION)"
 #define FFMPEG_LICENSE "$(c_escape $license)"
-#define CONFIG_THIS_YEAR 2023
+#define CONFIG_THIS_YEAR 2020
 #define FFMPEG_DATADIR "$(eval c_escape $datadir)"
 #define AVCONV_DATADIR "$(eval c_escape $datadir)"
 #define CC_IDENT "$(c_escape ${cc_ident:-Unknown compiler})"
--- a/doc/Doxyfile
+++ b/doc/Doxyfile
@@ -38,7 +38,7 @@ PROJECT_NAME           = FFmpeg
 # could be handy for archiving the generated documentation or if some version
 # control system is used.

-PROJECT_NUMBER         = 4.3.6
+PROJECT_NUMBER         =

 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
--- a/doc/authors.texi
+++ b/doc/authors.texi
@@ -3,9 +3,9 @@
 The FFmpeg developers.

 For details about the authorship, see the Git history of the project
-(https://git.ffmpeg.org/ffmpeg), e.g. by typing the command
+(git://source.ffmpeg.org/ffmpeg), e.g. by typing the command
@command{git log} in the FFmpeg source directory, or browsing the
-online repository at @url{https://git.ffmpeg.org/ffmpeg}.
+online repository at @url{http://source.ffmpeg.org}.

 Maintainers for the specific components are listed in the file
@file{MAINTAINERS} in the source code tree.
--- a/doc/decoders.texi
+++ b/doc/decoders.texi
@@ -317,7 +317,7 @@ list are dropped. You may use the special @code{*} string to match all pages,
 or @code{subtitle} to match all subtitle pages.
 Default value is *.
@item txt_default_region
-Set default character set used for decoding, a value between 0 and 87 (see
+Set default G0 character set used for decoding, a value between 0 and 80 (see
 ETS 300 706, Section 15, Table 32). Default value is -1, which does not
 override the libzvbi default. This option is needed for some legacy level 1.0
 transmissions which cannot signal the proper charset.
--- a/doc/git-howto.texi
+++ b/doc/git-howto.texi
@@ -53,7 +53,7 @@ Most distribution and operating system provide a package for it.
@section Cloning the source tree

@example
-git clone https://git.ffmpeg.org/ffmpeg.git <target>
+git clone git://source.ffmpeg.org/ffmpeg <target>
@end example

 This will put the FFmpeg sources into the directory @var{<target>}.
@@ -187,18 +187,11 @@ to make sure you don't have untracked files or deletions.
 git add [-i|-p|-A] <filenames/dirnames>
@end example

-Make sure you have told Git your name, email address and GPG key
+Make sure you have told Git your name and email address

@example
 git config --global user.name "My Name"
 git config --global user.email my@@email.invalid
-git config --global user.signingkey ABCDEF0123245
-@end example
-
-Enable signing all commits or use -S
-
-@example
-git config --global commit.gpgsign true
@end example

 Use @option{--global} to set the global configuration for all your Git checkouts.
@@ -400,19 +393,6 @@ git checkout -b svn_23456 $SHA1
 where @var{$SHA1} is the commit hash from the @command{git log} output.


-@chapter gpg key generation
-
-If you have no gpg key yet, we recommend that you create a ed25519 based key as it
-is small, fast and secure. Especially it results in small signatures in git.
-
-@example
-gpg --default-new-key-algo "ed25519/cert,sign+cv25519/encr" --quick-generate-key "human@@server.com"
-@end example
-
-When generating a key, make sure the email specified matches the email used in git as some sites like
-github consider mismatches a reason to declare such commits unverified. After generating a key you
-can add it to the MAINTAINER file and upload it to a keyserver.
-
@chapter Pre-push checklist

 Once you have a set of commits that you feel are ready for pushing,
--- a/doc/writing_filters.txt
+++ b/doc/writing_filters.txt
@@ -418,4 +418,4 @@ done:

 When all of this is done, you can submit your patch to the ffmpeg-devel
 mailing-list for review.  If you need any help, feel free to come on our IRC
-channel, #ffmpeg-devel on irc.libera.chat.
+channel, #ffmpeg-devel on irc.freenode.net.
--- a/fftools/ffmpeg.c
+++ b/fftools/ffmpeg.c
@@ -528,7 +528,6 @@ static void ffmpeg_cleanup(int ret)
        for (j = 0; j < fg->nb_outputs; j++) {
            OutputFilter *ofilter = fg->outputs[j];

-            avfilter_inout_free(&ofilter->out_tmp);
            av_freep(&ofilter->name);
            av_freep(&ofilter->formats);
            av_freep(&ofilter->channel_layouts);
--- a/fftools/ffplay.c
+++ b/fftools/ffplay.c
@@ -1151,8 +1151,6 @@ static void video_audio_display(VideoState *s)
        if (realloc_texture(&s->vis_texture, SDL_PIXELFORMAT_ARGB8888, s->width, s->height, SDL_BLENDMODE_NONE, 1) < 0)
            return;

-        if (s->xpos >= s->width)
-            s->xpos = 0;
        nb_display_channels= FFMIN(nb_display_channels, 2);
        if (rdft_bits != s->rdft_bits) {
            av_rdft_end(s->rdft);
@@ -1202,6 +1200,8 @@ static void video_audio_display(VideoState *s)
        }
        if (!s->paused)
            s->xpos++;
+        if (s->xpos >= s->width)
+            s->xpos= s->xleft;
    }
 }

--- a/libavcodec/012v.c
+++ b/libavcodec/012v.c
@@ -131,8 +131,8 @@ static int zero12v_decode_frame(AVCodecContext *avctx, void *data,
            u = x/2 + (uint16_t *)(pic->data[1] + line * pic->linesize[1]);
            v = x/2 + (uint16_t *)(pic->data[2] + line * pic->linesize[2]);
            memcpy(y, y_temp, sizeof(*y) * (width - x));
-            memcpy(u, u_temp, sizeof(*u) * ((width - x + 1) / 2));
-            memcpy(v, v_temp, sizeof(*v) * ((width - x + 1) / 2));
+            memcpy(u, u_temp, sizeof(*u) * (width - x + 1) / 2);
+            memcpy(v, v_temp, sizeof(*v) * (width - x + 1) / 2);
        }

        line_end += stride;
--- a/libavcodec/4xm.c
+++ b/libavcodec/4xm.c
@@ -498,8 +498,8 @@ static int decode_i_block(FourXContext *f, int16_t *block)
 {
    int code, i, j, level, val;

-    if (get_bits_left(&f->pre_gb) < 2) {
-        av_log(f->avctx, AV_LOG_ERROR, "%d bits left before decode_i_block()\n", get_bits_left(&f->pre_gb));
+    if (get_bits_left(&f->gb) < 2){
+        av_log(f->avctx, AV_LOG_ERROR, "%d bits left before decode_i_block()\n", get_bits_left(&f->gb));
        return AVERROR_INVALIDDATA;
    }

--- a/libavcodec/8bps.c
+++ b/libavcodec/8bps.c
@@ -70,9 +70,6 @@ static int decode_frame(AVCodecContext *avctx, void *data,
    unsigned char *planemap = c->planemap;
    int ret;

-    if (buf_size < planes * height *2)
-        return AVERROR_INVALIDDATA;
-
    if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
        return ret;

--- a/libavcodec/a64multienc.c
+++ b/libavcodec/a64multienc.c
@@ -407,7 +407,6 @@ AVCodec ff_a64multi_encoder = {
    .close          = a64multi_close_encoder,
    .pix_fmts       = (const enum AVPixelFormat[]) {AV_PIX_FMT_GRAY8, AV_PIX_FMT_NONE},
    .capabilities   = AV_CODEC_CAP_DELAY,
-    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
 };
 #endif
 #if CONFIG_A64MULTI5_ENCODER
@@ -422,6 +421,5 @@ AVCodec ff_a64multi5_encoder = {
    .close          = a64multi_close_encoder,
    .pix_fmts       = (const enum AVPixelFormat[]) {AV_PIX_FMT_GRAY8, AV_PIX_FMT_NONE},
    .capabilities   = AV_CODEC_CAP_DELAY,
-    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
 };
 #endif
--- a/libavcodec/aaccoder.c
+++ b/libavcodec/aaccoder.c
@@ -843,25 +843,25 @@ static void search_for_ms(AACEncContext *s, ChannelElement *cpe)
                                                    sce0->ics.swb_sizes[g],
                                                    sce0->sf_idx[w*16+g],
                                                    sce0->band_type[w*16+g],
-                                                    lambda / (band0->threshold + FLT_MIN), INFINITY, &b1, NULL, 0);
+                                                    lambda / band0->threshold, INFINITY, &b1, NULL, 0);
                        dist1 += quantize_band_cost(s, &sce1->coeffs[start + (w+w2)*128],
                                                    R34,
                                                    sce1->ics.swb_sizes[g],
                                                    sce1->sf_idx[w*16+g],
                                                    sce1->band_type[w*16+g],
-                                                    lambda / (band1->threshold + FLT_MIN), INFINITY, &b2, NULL, 0);
+                                                    lambda / band1->threshold, INFINITY, &b2, NULL, 0);
                        dist2 += quantize_band_cost(s, M,
                                                    M34,
                                                    sce0->ics.swb_sizes[g],
                                                    mididx,
                                                    midcb,
-                                                    lambda / (minthr + FLT_MIN), INFINITY, &b3, NULL, 0);
+                                                    lambda / minthr, INFINITY, &b3, NULL, 0);
                        dist2 += quantize_band_cost(s, S,
                                                    S34,
                                                    sce1->ics.swb_sizes[g],
                                                    sididx,
                                                    sidcb,
-                                                    mslambda / (minthr * bmax + FLT_MIN), INFINITY, &b4, NULL, 0);
+                                                    mslambda / (minthr * bmax), INFINITY, &b4, NULL, 0);
                        B0 += b1+b2;
                        B1 += b3+b4;
                        dist1 -= b1+b2;
--- a/libavcodec/aacdec_fixed.c
+++ b/libavcodec/aacdec_fixed.c
@@ -155,9 +155,9 @@ static void vector_pow43(int *coefs, int len)
    for (i=0; i<len; i++) {
        coef = coefs[i];
        if (coef < 0)
-            coef = -(int)ff_cbrt_tab_fixed[(-coef) & 8191];
+            coef = -(int)ff_cbrt_tab_fixed[-coef];
        else
-            coef =  (int)ff_cbrt_tab_fixed[  coef  & 8191];
+            coef = (int)ff_cbrt_tab_fixed[coef];
        coefs[i] = coef;
    }
 }
--- a/libavcodec/aacdec_template.c
+++ b/libavcodec/aacdec_template.c
@@ -974,18 +974,14 @@ static int decode_audio_specific_config_gb(AACContext *ac,
 {
    int i, ret;
    GetBitContext gbc = *gb;
-    MPEG4AudioConfig m4ac_bak = *m4ac;

-    if ((i = ff_mpeg4audio_get_config_gb(m4ac, &gbc, sync_extension, avctx)) < 0) {
-        *m4ac = m4ac_bak;
+    if ((i = ff_mpeg4audio_get_config_gb(m4ac, &gbc, sync_extension, avctx)) < 0)
        return AVERROR_INVALIDDATA;
-    }

    if (m4ac->sampling_index > 12) {
        av_log(avctx, AV_LOG_ERROR,
               "invalid sampling rate index %d\n",
               m4ac->sampling_index);
-        *m4ac = m4ac_bak;
        return AVERROR_INVALIDDATA;
    }
    if (m4ac->object_type == AOT_ER_AAC_LD &&
@@ -993,7 +989,6 @@ static int decode_audio_specific_config_gb(AACContext *ac,
        av_log(avctx, AV_LOG_ERROR,
               "invalid low delay sampling rate index %d\n",
               m4ac->sampling_index);
-        *m4ac = m4ac_bak;
        return AVERROR_INVALIDDATA;
    }

@@ -2812,7 +2807,7 @@ static void imdct_and_windowing_ld(AACContext *ac, SingleChannelElement *sce)

 static void imdct_and_windowing_eld(AACContext *ac, SingleChannelElement *sce)
 {
-    UINTFLOAT *in   = sce->coeffs;
+    INTFLOAT *in    = sce->coeffs;
    INTFLOAT *out   = sce->ret;
    INTFLOAT *saved = sce->saved;
    INTFLOAT *buf  = ac->buf_mdct;
--- a/libavcodec/aacenc.c
+++ b/libavcodec/aacenc.c
@@ -28,7 +28,6 @@
 *              TODOs:
 * add sane pulse detection
 ***********************************/
-#include <float.h>

 #include "libavutil/libm.h"
 #include "libavutil/thread.h"
@@ -857,7 +856,7 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
                /* Not so fast though */
                ratio = sqrtf(ratio);
            }
-            s->lambda = av_clipf(s->lambda * ratio, FLT_EPSILON, 65536.f);
+            s->lambda = FFMIN(s->lambda * ratio, 65536.f);

            /* Keep iterating if we must reduce and lambda is in the sky */
            if (ratio > 0.9f && ratio < 1.1f) {
@@ -902,7 +901,7 @@ static av_cold int aac_encode_end(AVCodecContext *avctx)
 {
    AACEncContext *s = avctx->priv_data;

-    av_log(avctx, AV_LOG_INFO, "Qavg: %.3f\n", s->lambda_count ? s->lambda_sum / s->lambda_count : NAN);
+    av_log(avctx, AV_LOG_INFO, "Qavg: %.3f\n", s->lambda_sum / s->lambda_count);

    ff_mdct_end(&s->mdct1024);
    ff_mdct_end(&s->mdct128);
--- a/libavcodec/aacpsy.c
+++ b/libavcodec/aacpsy.c
@@ -308,9 +308,6 @@ static av_cold int psy_3gpp_init(FFPsyContext *ctx) {
    const int bandwidth    = ctx->cutoff ? ctx->cutoff : AAC_CUTOFF(ctx->avctx);
    const float num_bark   = calc_bark((float)bandwidth);

-    if (bandwidth <= 0)
-        return AVERROR(EINVAL);
-
    ctx->model_priv_data = av_mallocz(sizeof(AacPsyContext));
    if (!ctx->model_priv_data)
        return AVERROR(ENOMEM);
@@ -797,7 +794,7 @@ static void psy_3gpp_analyze_channel(FFPsyContext *ctx, int channel,

        if (pe < 1.15f * desired_pe) {
            /* 6.6.1.3.6 "Final threshold modification by linearization" */
-            norm_fac = norm_fac ? 1.0f / norm_fac : 0;
+            norm_fac = 1.0f / norm_fac;
            for (w = 0; w < wi->num_windows*16; w += 16) {
                for (g = 0; g < num_bands; g++) {
                    AacPsyBand *band = &pch->band[w+g];
--- a/libavcodec/aasc.c
+++ b/libavcodec/aasc.c
@@ -104,26 +104,26 @@ static int aasc_decode_frame(AVCodecContext *avctx,
        ff_msrle_decode(avctx, s->frame, 8, &s->gb);
        break;
    case MKTAG('A', 'A', 'S', 'C'):
-        switch (compr) {
-        case 0:
-            stride = (avctx->width * psize + psize) & ~psize;
-            if (buf_size < stride * avctx->height)
-                return AVERROR_INVALIDDATA;
-            for (i = avctx->height - 1; i >= 0; i--) {
-                memcpy(s->frame->data[0] + i * s->frame->linesize[0], buf, avctx->width * psize);
-                buf += stride;
-                buf_size -= stride;
-            }
-            break;
-        case 1:
-            bytestream2_init(&s->gb, buf, buf_size);
-            ff_msrle_decode(avctx, s->frame, 8, &s->gb);
-            break;
-        default:
-            av_log(avctx, AV_LOG_ERROR, "Unknown compression type %d\n", compr);
+    switch (compr) {
+    case 0:
+        stride = (avctx->width * psize + psize) & ~psize;
+        if (buf_size < stride * avctx->height)
            return AVERROR_INVALIDDATA;
+        for (i = avctx->height - 1; i >= 0; i--) {
+            memcpy(s->frame->data[0] + i * s->frame->linesize[0], buf, avctx->width * psize);
+            buf += stride;
+            buf_size -= stride;
        }
        break;
+    case 1:
+        bytestream2_init(&s->gb, buf, buf_size);
+        ff_msrle_decode(avctx, s->frame, 8, &s->gb);
+        break;
+    default:
+        av_log(avctx, AV_LOG_ERROR, "Unknown compression type %d\n", compr);
+        return AVERROR_INVALIDDATA;
+    }
+        break;
    default:
        av_log(avctx, AV_LOG_ERROR, "Unknown FourCC: %X\n", avctx->codec_tag);
        return -1;
--- a/libavcodec/ac3.h
+++ b/libavcodec/ac3.h
@@ -75,7 +75,6 @@
 #define AC3_DYNAMIC_RANGE1      0

 typedef int                     INTFLOAT;
-typedef unsigned int            UINTFLOAT;
 typedef int16_t                 SHORTFLOAT;

 #else /* USE_FIXED */
@@ -95,7 +94,6 @@ typedef int16_t                 SHORTFLOAT;
 #define AC3_DYNAMIC_RANGE1      1.0f

 typedef float                   INTFLOAT;
-typedef float                   UINTFLOAT;
 typedef float                   SHORTFLOAT;

 #endif /* USE_FIXED */
--- a/libavcodec/ac3enc_template.c
+++ b/libavcodec/ac3enc_template.c
@@ -43,7 +43,7 @@ int AC3_NAME(allocate_sample_buffers)(AC3EncodeContext *s)

    FF_ALLOC_OR_GOTO(s->avctx, s->windowed_samples, AC3_WINDOW_SIZE *
                     sizeof(*s->windowed_samples), alloc_fail);
-    FF_ALLOCZ_ARRAY_OR_GOTO(s->avctx, s->planar_samples, s->channels, sizeof(*s->planar_samples),
+    FF_ALLOC_ARRAY_OR_GOTO(s->avctx, s->planar_samples, s->channels, sizeof(*s->planar_samples),
                     alloc_fail);
    for (ch = 0; ch < s->channels; ch++) {
        FF_ALLOCZ_OR_GOTO(s->avctx, s->planar_samples[ch],
--- a/libavcodec/agm.c
+++ b/libavcodec/agm.c
@@ -423,8 +423,8 @@ static int decode_inter_plane(AGMContext *s, GetBitContext *gb, int size,
                int map = s->map[x];

                if (orig_mv_x >= -32) {
-                    if (y * 8 + mv_y < 0 || y * 8 + mv_y + 8 > h ||
-                        x * 8 + mv_x < 0 || x * 8 + mv_x + 8 > w)
+                    if (y * 8 + mv_y < 0 || y * 8 + mv_y + 8 >= h ||
+                        x * 8 + mv_x < 0 || x * 8 + mv_x + 8 >= w)
                        return AVERROR_INVALIDDATA;

                    copy_block8(frame->data[plane] + (s->blocks_h - 1 - y) * 8 * frame->linesize[plane] + x * 8,
--- a/libavcodec/alac.c
+++ b/libavcodec/alac.c
@@ -302,9 +302,6 @@ static int decode_element(AVCodecContext *avctx, AVFrame *frame, int ch_index,
        decorr_shift       = get_bits(&alac->gb, 8);
        decorr_left_weight = get_bits(&alac->gb, 8);

-        if (channels == 2 && decorr_left_weight && decorr_shift > 31)
-            return AVERROR_INVALIDDATA;
-
        for (ch = 0; ch < channels; ch++) {
            prediction_type[ch]   = get_bits(&alac->gb, 4);
            lpc_quant[ch]         = get_bits(&alac->gb, 4);
--- a/libavcodec/alacdsp.c
+++ b/libavcodec/alacdsp.c
@@ -29,12 +29,12 @@ static void decorrelate_stereo(int32_t *buffer[2], int nb_samples,
    int i;

    for (i = 0; i < nb_samples; i++) {
-        uint32_t a, b;
+        int32_t a, b;

        a = buffer[0][i];
        b = buffer[1][i];

-        a -= (int)(b * decorr_left_weight) >> decorr_shift;
+        a -= (b * decorr_left_weight) >> decorr_shift;
        b += a;

        buffer[0][i] = b;
--- a/libavcodec/allcodecs.c
+++ b/libavcodec/allcodecs.c
@@ -679,7 +679,9 @@ extern AVCodec ff_xsub_decoder;
 /* external libraries */
 extern AVCodec ff_aac_at_encoder;
 extern AVCodec ff_aac_at_decoder;
+extern AVCodec ff_aac_mf_encoder;
 extern AVCodec ff_ac3_at_decoder;
+extern AVCodec ff_ac3_mf_encoder;
 extern AVCodec ff_adpcm_ima_qt_at_decoder;
 extern AVCodec ff_alac_at_encoder;
 extern AVCodec ff_alac_at_decoder;
@@ -691,6 +693,7 @@ extern AVCodec ff_ilbc_at_decoder;
 extern AVCodec ff_mp1_at_decoder;
 extern AVCodec ff_mp2_at_decoder;
 extern AVCodec ff_mp3_at_decoder;
+extern AVCodec ff_mp3_mf_encoder;
 extern AVCodec ff_pcm_alaw_at_encoder;
 extern AVCodec ff_pcm_alaw_at_decoder;
 extern AVCodec ff_pcm_mulaw_at_encoder;
@@ -754,8 +757,6 @@ extern AVCodec ff_idf_decoder;

 /* external libraries, that shouldn't be used by default if one of the
 * above is available */
-extern AVCodec ff_aac_mf_encoder;
-extern AVCodec ff_ac3_mf_encoder;
 extern AVCodec ff_h263_v4l2m2m_encoder;
 extern AVCodec ff_libaom_av1_decoder;
 extern AVCodec ff_libopenh264_encoder;
@@ -788,7 +789,6 @@ extern AVCodec ff_mjpeg_cuvid_decoder;
 extern AVCodec ff_mjpeg_qsv_encoder;
 extern AVCodec ff_mjpeg_qsv_decoder;
 extern AVCodec ff_mjpeg_vaapi_encoder;
-extern AVCodec ff_mp3_mf_encoder;
 extern AVCodec ff_mpeg1_cuvid_decoder;
 extern AVCodec ff_mpeg2_cuvid_decoder;
 extern AVCodec ff_mpeg2_qsv_encoder;
--- a/libavcodec/alsdec.c
+++ b/libavcodec/alsdec.c
@@ -762,7 +762,7 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
            }

            for (k = 2; k < opt_order; k++)
-                quant_cof[k] = (quant_cof[k] * (1U << 14)) + (add_base << 13);
+                quant_cof[k] = (quant_cof[k] * (1 << 14)) + (add_base << 13);
        }
    }

@@ -1016,10 +1016,6 @@ static int read_block(ALSDecContext *ctx, ALSBlockData *bd)
    ALSSpecificConfig *sconf = &ctx->sconf;

    *bd->shift_lsbs = 0;
-
-    if (get_bits_left(gb) < 7)
-        return AVERROR_INVALIDDATA;
-
    // read block type flag and read the samples accordingly
    if (get_bits1(gb)) {
        ret = read_var_block_data(ctx, bd);
@@ -1632,7 +1628,7 @@ static int read_frame_data(ALSDecContext *ctx, unsigned int ra_frame)
    AVCodecContext *avctx    = ctx->avctx;
    GetBitContext *gb = &ctx->gb;
    unsigned int div_blocks[32];                ///< block sizes.
-    int c;
+    unsigned int c;
    unsigned int js_blocks[2];
    uint32_t bs_info = 0;
    int ret;
@@ -1810,17 +1806,14 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame_ptr,
    else
        ctx->cur_frame_length = sconf->frame_length;

-    ctx->highest_decoded_channel = -1;
+    ctx->highest_decoded_channel = 0;
    // decode the frame data
    if ((invalid_frame = read_frame_data(ctx, ra_frame)) < 0)
        av_log(ctx->avctx, AV_LOG_WARNING,
               "Reading frame data failed. Skipping RA unit.\n");

-    if (ctx->highest_decoded_channel == -1) {
-        av_log(ctx->avctx, AV_LOG_WARNING,
-               "No channel data decoded.\n");
+    if (ctx->highest_decoded_channel == 0)
        return AVERROR_INVALIDDATA;
-    }

    ctx->frame_id++;

--- a/libavcodec/ansi.c
+++ b/libavcodec/ansi.c
@@ -431,8 +431,7 @@ static int decode_frame(AVCodecContext *avctx,
                    s->args[s->nb_args] = FFMAX(s->args[s->nb_args], 0) * 10 + buf[0] - '0';
                break;
            case ';':
-                if (s->nb_args < MAX_NB_ARGS)
-                    s->nb_args++;
+                s->nb_args++;
                if (s->nb_args < MAX_NB_ARGS)
                    s->args[s->nb_args] = 0;
                break;
@@ -475,11 +474,6 @@ static av_cold int decode_close(AVCodecContext *avctx)
    return 0;
 }

-static const AVCodecDefault ansi_defaults[] = {
-    { "max_pixels", "640*480" },
-    { NULL },
-};
-
 AVCodec ff_ansi_decoder = {
    .name           = "ansi",
    .long_name      = NULL_IF_CONFIG_SMALL("ASCII/ANSI art"),
@@ -491,5 +485,4 @@ AVCodec ff_ansi_decoder = {
    .decode         = decode_frame,
    .capabilities   = AV_CODEC_CAP_DR1,
    .caps_internal  = FF_CODEC_CAP_INIT_THREADSAFE,
-    .defaults       = ansi_defaults,
 };
--- a/libavcodec/apedec.c
+++ b/libavcodec/apedec.c
@@ -102,7 +102,7 @@ typedef struct APEFilter {
    int16_t *historybuffer; ///< filter memory
    int16_t *delay;         ///< filtered values

-    uint32_t avg;
+    int avg;
 } APEFilter;

 typedef struct APERice {
@@ -852,7 +852,7 @@ static av_always_inline int filter_fast_3320(APEPredictor *p,
    }

    predictionA = p->buf[delayA] * 2U - p->buf[delayA - 1];
-    p->lastA[filter] = decoded + (unsigned)((int32_t)(predictionA  * p->coeffsA[filter][0]) >> 9);
+    p->lastA[filter] = decoded + ((int32_t)(predictionA  * p->coeffsA[filter][0]) >> 9);

    if ((decoded ^ predictionA) > 0)
        p->coeffsA[filter][0]++;
@@ -882,8 +882,8 @@ static av_always_inline int filter_3800(APEPredictor *p,
        return predictionA;
    }
    d2 =  p->buf[delayA];
-    d1 = (p->buf[delayA] - (unsigned)p->buf[delayA - 1]) * 2;
-    d0 =  p->buf[delayA] + ((p->buf[delayA - 2] - (unsigned)p->buf[delayA - 1]) * 8);
+    d1 = (p->buf[delayA] - p->buf[delayA - 1]) * 2U;
+    d0 =  p->buf[delayA] + ((p->buf[delayA - 2] - p->buf[delayA - 1]) * 8U);
    d3 =  p->buf[delayB] * 2U - p->buf[delayB - 1];
    d4 =  p->buf[delayB];

@@ -903,7 +903,7 @@ static av_always_inline int filter_3800(APEPredictor *p,
    p->coeffsB[filter][0] += (((d3 >> 29) & 4) - 2) * sign;
    p->coeffsB[filter][1] -= (((d4 >> 30) & 2) - 1) * sign;

-    p->filterB[filter] = p->lastA[filter] + (unsigned)(predictionB >> shift);
+    p->filterB[filter] = p->lastA[filter] + (predictionB >> shift);
    p->filterA[filter] = p->filterB[filter] + (unsigned)((int)(p->filterA[filter] * 31U) >> 5);

    return p->filterA[filter];
@@ -928,7 +928,7 @@ static void long_filter_high_3800(int32_t *buffer, int order, int shift, int len
            dotprod += delay[j] * (unsigned)coeffs[j];
            coeffs[j] += ((delay[j] >> 31) | 1) * sign;
        }
-        buffer[i] -= (unsigned)(dotprod >> shift);
+        buffer[i] -= dotprod >> shift;
        for (j = 0; j < order - 1; j++)
            delay[j] = delay[j + 1];
        delay[order - 1] = buffer[i];
@@ -952,7 +952,7 @@ static void long_filter_ehigh_3830(int32_t *buffer, int length)
        for (j = 7; j > 0; j--)
            delay[j] = delay[j - 1];
        delay[0] = buffer[i];
-        buffer[i] -= (unsigned)(dotprod >> 9);
+        buffer[i] -= dotprod >> 9;
    }
 }

@@ -1061,13 +1061,13 @@ static av_always_inline int predictor_update_3930(APEPredictor *p,
                                                  const int delayA)
 {
    int32_t predictionA, sign;
-    uint32_t d0, d1, d2, d3;
+    int32_t d0, d1, d2, d3;

    p->buf[delayA]     = p->lastA[filter];
    d0 = p->buf[delayA    ];
-    d1 = p->buf[delayA    ] - (unsigned)p->buf[delayA - 1];
-    d2 = p->buf[delayA - 1] - (unsigned)p->buf[delayA - 2];
-    d3 = p->buf[delayA - 2] - (unsigned)p->buf[delayA - 3];
+    d1 = p->buf[delayA    ] - p->buf[delayA - 1];
+    d2 = p->buf[delayA - 1] - p->buf[delayA - 2];
+    d3 = p->buf[delayA - 2] - p->buf[delayA - 3];

    predictionA = d0 * p->coeffsA[filter][0] +
                  d1 * p->coeffsA[filter][1] +
@@ -1078,10 +1078,10 @@ static av_always_inline int predictor_update_3930(APEPredictor *p,
    p->filterA[filter] = p->lastA[filter] + ((int)(p->filterA[filter] * 31U) >> 5);

    sign = APESIGN(decoded);
-    p->coeffsA[filter][0] += (((int32_t)d0 < 0) * 2 - 1) * sign;
-    p->coeffsA[filter][1] += (((int32_t)d1 < 0) * 2 - 1) * sign;
-    p->coeffsA[filter][2] += (((int32_t)d2 < 0) * 2 - 1) * sign;
-    p->coeffsA[filter][3] += (((int32_t)d3 < 0) * 2 - 1) * sign;
+    p->coeffsA[filter][0] += ((d0 < 0) * 2 - 1) * sign;
+    p->coeffsA[filter][1] += ((d1 < 0) * 2 - 1) * sign;
+    p->coeffsA[filter][2] += ((d2 < 0) * 2 - 1) * sign;
+    p->coeffsA[filter][3] += ((d3 < 0) * 2 - 1) * sign;

    return p->filterA[filter];
 }
@@ -1309,7 +1309,7 @@ static void do_apply_filter(APEContext *ctx, int version, APEFilter *f,
            absres = res < 0 ? -(unsigned)res : res;
            if (absres)
                *f->adaptcoeffs = APESIGN(res) *
-                                  (8 << ((absres > f->avg * 3LL) + (absres > (f->avg + f->avg / 3))));
+                                  (8 << ((absres > f->avg * 3) + (absres > f->avg * 4 / 3)));
                /* equivalent to the following code
                    if (absres <= f->avg * 4 / 3)
                        *f->adaptcoeffs = APESIGN(res) * 8;
@@ -1559,7 +1559,7 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data,
        for (ch = 0; ch < s->channels; ch++) {
            sample8 = (uint8_t *)frame->data[ch];
            for (i = 0; i < blockstodecode; i++)
-                *sample8++ = (s->decoded[ch][i] + 0x80U) & 0xff;
+                *sample8++ = (s->decoded[ch][i] + 0x80) & 0xff;
        }
        break;
    case 16:
@@ -1573,7 +1573,7 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data,
        for (ch = 0; ch < s->channels; ch++) {
            sample24 = (int32_t *)frame->data[ch];
            for (i = 0; i < blockstodecode; i++)
-                *sample24++ = s->decoded[ch][i] * 256U;
+                *sample24++ = s->decoded[ch][i] * 256;
        }
        break;
    }
--- a/libavcodec/atrac1.c
+++ b/libavcodec/atrac1.c
@@ -362,10 +362,6 @@ static av_cold int atrac1_decode_init(AVCodecContext *avctx)
    ff_atrac_generate_tables();

    q->fdsp = avpriv_float_dsp_alloc(avctx->flags & AV_CODEC_FLAG_BITEXACT);
-    if (!q->fdsp) {
-        atrac1_decode_end(avctx);
-        return AVERROR(ENOMEM);
-    }

    q->bands[0] = q->low;
    q->bands[1] = q->mid;
--- a/libavcodec/av1_parser.c
+++ b/libavcodec/av1_parser.c
@@ -45,10 +45,6 @@ static const enum AVPixelFormat pix_fmts_12bit[2][2] = {
    { AV_PIX_FMT_YUV422P12, AV_PIX_FMT_YUV420P12 },
 };

-static const enum AVPixelFormat pix_fmts_rgb[3] = {
-    AV_PIX_FMT_GBRP, AV_PIX_FMT_GBRP10, AV_PIX_FMT_GBRP12,
-};
-
 static int av1_parser_parse(AVCodecParserContext *ctx,
                            AVCodecContext *avctx,
                            const uint8_t **out_data, int *out_size,
@@ -57,8 +53,6 @@ static int av1_parser_parse(AVCodecParserContext *ctx,
    AV1ParseContext *s = ctx->priv_data;
    CodedBitstreamFragment *td = &s->temporal_unit;
    CodedBitstreamAV1Context *av1 = s->cbc->priv_data;
-    AV1RawSequenceHeader *seq;
-    AV1RawColorConfig *color;
    int ret;

    *out_data = data;
@@ -92,12 +86,11 @@ static int av1_parser_parse(AVCodecParserContext *ctx,
        goto end;
    }

-    seq = av1->sequence_header;
-    color = &seq->color_config;
-
    for (int i = 0; i < td->nb_units; i++) {
        CodedBitstreamUnit *unit = &td->units[i];
        AV1RawOBU *obu = unit->content;
+        AV1RawSequenceHeader *seq = av1->sequence_header;
+        AV1RawColorConfig *color = &seq->color_config;
        AV1RawFrameHeader *frame;
        int frame_type;

@@ -134,6 +127,9 @@ static int av1_parser_parse(AVCodecParserContext *ctx,
            ctx->key_frame = frame_type == AV1_FRAME_KEY;
        }

+        avctx->profile = seq->seq_profile;
+        avctx->level   = seq->seq_level_idx[0];
+
        switch (frame_type) {
        case AV1_FRAME_KEY:
        case AV1_FRAME_INTRA_ONLY:
@@ -147,44 +143,33 @@ static int av1_parser_parse(AVCodecParserContext *ctx,
            break;
        }
        ctx->picture_structure = AV_PICTURE_STRUCTURE_FRAME;
-    }

-    switch (av1->bit_depth) {
-    case 8:
-        ctx->format = color->mono_chrome ? AV_PIX_FMT_GRAY8
-                                         : pix_fmts_8bit [color->subsampling_x][color->subsampling_y];
-        break;
-    case 10:
-        ctx->format = color->mono_chrome ? AV_PIX_FMT_GRAY10
-                                         : pix_fmts_10bit[color->subsampling_x][color->subsampling_y];
-        break;
-    case 12:
-        ctx->format = color->mono_chrome ? AV_PIX_FMT_GRAY12
-                                         : pix_fmts_12bit[color->subsampling_x][color->subsampling_y];
-        break;
-    }
-    av_assert2(ctx->format != AV_PIX_FMT_NONE);
+        switch (av1->bit_depth) {
+        case 8:
+            ctx->format = color->mono_chrome ? AV_PIX_FMT_GRAY8
+                                             : pix_fmts_8bit [color->subsampling_x][color->subsampling_y];
+            break;
+        case 10:
+            ctx->format = color->mono_chrome ? AV_PIX_FMT_GRAY10
+                                             : pix_fmts_10bit[color->subsampling_x][color->subsampling_y];
+            break;
+        case 12:
+            ctx->format = color->mono_chrome ? AV_PIX_FMT_GRAY12
+                                             : pix_fmts_12bit[color->subsampling_x][color->subsampling_y];
+            break;
+        }
+        av_assert2(ctx->format != AV_PIX_FMT_NONE);

-    if (!color->subsampling_x && !color->subsampling_y &&
-        color->matrix_coefficients       == AVCOL_SPC_RGB &&
-        color->color_primaries           == AVCOL_PRI_BT709 &&
-        color->transfer_characteristics  == AVCOL_TRC_IEC61966_2_1)
-        ctx->format = pix_fmts_rgb[color->high_bitdepth + color->twelve_bit];
+        avctx->colorspace = (enum AVColorSpace) color->matrix_coefficients;
+        avctx->color_primaries = (enum AVColorPrimaries) color->color_primaries;
+        avctx->color_trc = (enum AVColorTransferCharacteristic) color->transfer_characteristics;
+        avctx->color_range = color->color_range ? AVCOL_RANGE_JPEG : AVCOL_RANGE_MPEG;

-    avctx->pix_fmt = ctx->format;
-
-    avctx->profile = seq->seq_profile;
-    avctx->level   = seq->seq_level_idx[0];
-
-    avctx->colorspace = (enum AVColorSpace) color->matrix_coefficients;
-    avctx->color_primaries = (enum AVColorPrimaries) color->color_primaries;
-    avctx->color_trc = (enum AVColorTransferCharacteristic) color->transfer_characteristics;
-    avctx->color_range = color->color_range ? AVCOL_RANGE_JPEG : AVCOL_RANGE_MPEG;
-
-    if (ctx->width != avctx->width || ctx->height != avctx->height) {
-        ret = ff_set_dimensions(avctx, ctx->width, ctx->height);
-        if (ret < 0)
-            goto end;
+        if (ctx->width != avctx->width || ctx->height != avctx->height) {
+            ret = ff_set_dimensions(avctx, ctx->width, ctx->height);
+            if (ret < 0)
+                goto end;
+        }
    }

    if (avctx->framerate.num)
--- a/libavcodec/avrndec.c
+++ b/libavcodec/avrndec.c
@@ -54,8 +54,6 @@ static av_cold int init(AVCodecContext *avctx)
        }

        a->mjpeg_avctx = avcodec_alloc_context3(codec);
-        if (!a->mjpeg_avctx)
-            return AVERROR(ENOMEM);

        av_dict_set(&thread_opt, "threads", "1", 0); // Is this needed ?
        a->mjpeg_avctx->refcounted_frames = 1;
@@ -171,5 +169,5 @@ AVCodec ff_avrn_decoder = {
    .close          = end,
    .decode         = decode_frame,
    .max_lowres     = 3,
-    .caps_internal  = FF_CODEC_CAP_INIT_THREADSAFE | FF_CODEC_CAP_INIT_CLEANUP,
+    .caps_internal  = FF_CODEC_CAP_INIT_THREADSAFE,
 };
--- a/libavcodec/bink.c
+++ b/libavcodec/bink.c
@@ -867,7 +867,7 @@ static int binkb_decode_plane(BinkContext *c, AVFrame *frame, GetBitContext *gb,

    binkb_init_bundles(c);
    ref_start = frame->data[plane_idx];
-    ref_end   = frame->data[plane_idx] + ((bh - 1) * frame->linesize[plane_idx] + bw - 1) * 8;
+    ref_end   = frame->data[plane_idx] + (bh * frame->linesize[plane_idx] + bw) * 8;

    for (i = 0; i < 64; i++)
        coordmap[i] = (i & 7) + (i >> 3) * stride;
@@ -923,7 +923,7 @@ static int binkb_decode_plane(BinkContext *c, AVFrame *frame, GetBitContext *gb,
                xoff = binkb_get_value(c, BINKB_SRC_X_OFF);
                yoff = binkb_get_value(c, BINKB_SRC_Y_OFF) + ybias;
                ref = dst + xoff + yoff * stride;
-                if (ref < ref_start || ref > ref_end) {
+                if (ref < ref_start || ref + 8*stride > ref_end) {
                    av_log(c->avctx, AV_LOG_WARNING, "Reference block is out of bounds\n");
                } else if (ref + 8*stride < dst || ref >= dst + 8*stride) {
                    c->hdsp.put_pixels_tab[1][0](dst, ref, stride, 8);
@@ -939,7 +939,7 @@ static int binkb_decode_plane(BinkContext *c, AVFrame *frame, GetBitContext *gb,
                xoff = binkb_get_value(c, BINKB_SRC_X_OFF);
                yoff = binkb_get_value(c, BINKB_SRC_Y_OFF) + ybias;
                ref = dst + xoff + yoff * stride;
-                if (ref < ref_start || ref > ref_end) {
+                if (ref < ref_start || ref + 8 * stride > ref_end) {
                    av_log(c->avctx, AV_LOG_WARNING, "Reference block is out of bounds\n");
                } else if (ref + 8*stride < dst || ref >= dst + 8*stride) {
                    c->hdsp.put_pixels_tab[1][0](dst, ref, stride, 8);
@@ -971,7 +971,7 @@ static int binkb_decode_plane(BinkContext *c, AVFrame *frame, GetBitContext *gb,
                xoff = binkb_get_value(c, BINKB_SRC_X_OFF);
                yoff = binkb_get_value(c, BINKB_SRC_Y_OFF) + ybias;
                ref = dst + xoff + yoff * stride;
-                if (ref < ref_start || ref > ref_end) {
+                if (ref < ref_start || ref + 8 * stride > ref_end) {
                    av_log(c->avctx, AV_LOG_WARNING, "Reference block is out of bounds\n");
                } else if (ref + 8*stride < dst || ref >= dst + 8*stride) {
                    c->hdsp.put_pixels_tab[1][0](dst, ref, stride, 8);
@@ -1084,7 +1084,7 @@ static int bink_decode_plane(BinkContext *c, AVFrame *frame, GetBitContext *gb,
        for (bx = 0; bx < bw; bx++, dst += 8, prev += 8) {
            blk = get_value(c, BINK_SRC_BLOCK_TYPES);
            // 16x16 block type on odd line means part of the already decoded block, so skip it
-            if (((by & 1) || (bx & 1)) && blk == SCALED_BLOCK) {
+            if ((by & 1) && blk == SCALED_BLOCK) {
                bx++;
                dst  += 8;
                prev += 8;
@@ -1381,8 +1381,10 @@ static av_cold int decode_init(AVCodecContext *avctx)
    ff_hpeldsp_init(&c->hdsp, avctx->flags);
    ff_binkdsp_init(&c->binkdsp);

-    if ((ret = init_bundles(c)) < 0)
+    if ((ret = init_bundles(c)) < 0) {
+        free_bundles(c);
        return ret;
+    }

    if (c->version == 'b') {
        if (!binkb_initialised) {
@@ -1422,5 +1424,4 @@ AVCodec ff_bink_decoder = {
    .decode         = decode_frame,
    .flush          = flush,
    .capabilities   = AV_CODEC_CAP_DR1,
-    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
 };
--- a/libavcodec/binkaudio.c
+++ b/libavcodec/binkaudio.c
@@ -40,6 +40,8 @@
 #include "rdft.h"
 #include "wma_freqs.h"

+static float quant_table[96];
+
 #define MAX_CHANNELS 2
 #define BINK_BLOCK_MAX_SIZE (MAX_CHANNELS << 11)

@@ -56,7 +58,6 @@ typedef struct BinkAudioContext {
    float root;
    DECLARE_ALIGNED(32, FFTSample, coeffs)[BINK_BLOCK_MAX_SIZE];
    float previous[MAX_CHANNELS][BINK_BLOCK_MAX_SIZE / 16];  ///< coeffs from previous audio block
-    float quant_table[96];
    AVPacket *pkt;
    union {
        RDFTContext rdft;
@@ -115,7 +116,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
        s->root = s->frame_len / (sqrt(s->frame_len) * 32768.0);
    for (i = 0; i < 96; i++) {
        /* constant is result of 0.066399999/log10(M_E) */
-        s->quant_table[i] = expf(i * 0.15289164787221953823f) * s->root;
+        quant_table[i] = expf(i * 0.15289164787221953823f) * s->root;
    }

    /* calculate number of bands */
@@ -196,7 +197,7 @@ static int decode_block(BinkAudioContext *s, float **out, int use_dct)
            return AVERROR_INVALIDDATA;
        for (i = 0; i < s->num_bands; i++) {
            int value = get_bits(gb, 8);
-            quant[i]  = s->quant_table[FFMIN(value, 95)];
+            quant[i]  = quant_table[FFMIN(value, 95)];
        }

        k = 0;
--- a/libavcodec/bitstream.c
+++ b/libavcodec/bitstream.c
@@ -129,7 +129,7 @@ static int alloc_table(VLC *vlc, int size, int use_static)

 typedef struct VLCcode {
    uint8_t bits;
-    VLC_TYPE symbol;
+    uint16_t symbol;
    /** codeword, with the first bit-to-be-read in the msb
     * (even if intended for a little-endian bitstream reader) */
    uint32_t code;
@@ -162,9 +162,9 @@ static int build_table(VLC *vlc, int table_nb_bits, int nb_codes,
    uint32_t code;
    volatile VLC_TYPE (* volatile table)[2]; // the double volatile is needed to prevent an internal compiler error in gcc 4.2

+    table_size = 1 << table_nb_bits;
    if (table_nb_bits > 30)
       return AVERROR(EINVAL);
-    table_size = 1 << table_nb_bits;
    table_index = alloc_table(vlc, table_size, flags & INIT_VLC_USE_NEW_STATIC);
    ff_dlog(NULL, "new table index=%d size=%d\n", table_index, table_size);
    if (table_index < 0)
--- a/libavcodec/cbs.c
+++ b/libavcodec/cbs.c
@@ -693,11 +693,11 @@ static int cbs_insert_unit(CodedBitstreamContext *ctx,
            memmove(units + position + 1, units + position,
                    (frag->nb_units - position) * sizeof(*units));
    } else {
-        units = av_malloc_array(frag->nb_units*2 + 1, sizeof(*units));
+        units = av_malloc_array(frag->nb_units + 1, sizeof(*units));
        if (!units)
            return AVERROR(ENOMEM);

-        frag->nb_units_allocated = 2*frag->nb_units_allocated + 1;
+        ++frag->nb_units_allocated;

        if (position > 0)
            memcpy(units, frag->units, position * sizeof(*units));
--- a/libavcodec/cbs_av1.c
+++ b/libavcodec/cbs_av1.c
@@ -125,9 +125,8 @@ static int cbs_av1_write_uvlc(CodedBitstreamContext *ctx, PutBitContext *pbc,
        put_bits(pbc, 1, 1);
    } else {
        zeroes = av_log2(value + 1);
-        v = value - (1U << zeroes) + 1;
-        put_bits(pbc, zeroes, 0);
-        put_bits(pbc, 1, 1);
+        v = value - (1 << zeroes) + 1;
+        put_bits(pbc, zeroes + 1, 1);
        put_bits(pbc, zeroes, v);
    }

@@ -712,11 +711,10 @@ static size_t cbs_av1_get_payload_bytes_left(GetBitContext *gbc)

 #define infer(name, value) do { \
        if (current->name != (value)) { \
-            av_log(ctx->log_ctx, AV_LOG_ERROR, \
+            av_log(ctx->log_ctx, AV_LOG_WARNING, "Warning: " \
                   "%s does not match inferred value: " \
                   "%"PRId64", but should be %"PRId64".\n", \
                   #name, (int64_t)current->name, (int64_t)(value)); \
-            return AVERROR_INVALIDDATA; \
        } \
    } while (0)

--- a/libavcodec/cbs_av1.h
+++ b/libavcodec/cbs_av1.h
@@ -158,8 +158,8 @@ typedef struct AV1RawFrameHeader {
    uint8_t  use_superres;
    uint8_t  coded_denom;
    uint8_t  render_and_frame_size_different;
-    uint16_t render_width_minus_1;
-    uint16_t render_height_minus_1;
+    uint8_t  render_width_minus_1;
+    uint8_t  render_height_minus_1;

    uint8_t found_ref[AV1_REFS_PER_FRAME];

@@ -429,7 +429,6 @@ typedef struct CodedBitstreamAV1Context {
    int operating_point_idc;

    int bit_depth;
-    int order_hint;
    int frame_width;
    int frame_height;
    int upscaled_width;
--- a/libavcodec/cbs_av1_syntax_template.c
+++ b/libavcodec/cbs_av1_syntax_template.c
@@ -366,7 +366,7 @@ static int FUNC(set_frame_refs)(CodedBitstreamContext *ctx, RWContext *rw,
    for (i = 0; i < AV1_NUM_REF_FRAMES; i++)
        shifted_order_hints[i] = cur_frame_hint +
                                 cbs_av1_get_relative_dist(seq, priv->ref[i].order_hint,
-                                                           priv->order_hint);
+                                                           current->order_hint);

    latest_order_hint = shifted_order_hints[current->last_frame_idx];
    earliest_order_hint = shifted_order_hints[current->golden_frame_idx];
@@ -541,7 +541,7 @@ static int FUNC(frame_size_with_refs)(CodedBitstreamContext *ctx, RWContext *rw,
            }

            priv->upscaled_width = ref->upscaled_width;
-            priv->frame_width    = priv->upscaled_width;
+            priv->frame_width    = ref->frame_width;
            priv->frame_height   = ref->frame_height;
            priv->render_width   = ref->render_width;
            priv->render_height  = ref->render_height;
@@ -993,7 +993,7 @@ static int FUNC(skip_mode_params)(CodedBitstreamContext *ctx, RWContext *rw,
        for (i = 0; i < AV1_REFS_PER_FRAME; i++) {
            ref_hint = priv->ref[current->ref_frame_idx[i]].order_hint;
            dist = cbs_av1_get_relative_dist(seq, ref_hint,
-                                             priv->order_hint);
+                                             current->order_hint);
            if (dist < 0) {
                if (forward_idx < 0 ||
                    cbs_av1_get_relative_dist(seq, ref_hint,
@@ -1261,10 +1261,10 @@ static int FUNC(uncompressed_header)(CodedBitstreamContext *ctx, RWContext *rw,
        flag(show_existing_frame);

        if (current->show_existing_frame) {
-            AV1ReferenceFrameState *ref;
+            AV1ReferenceFrameState *frame;

            fb(3, frame_to_show_map_idx);
-            ref = &priv->ref[current->frame_to_show_map_idx];
+            frame = &priv->ref[current->frame_to_show_map_idx];

            if (seq->decoder_model_info_present_flag &&
                !seq->timing_info.equal_picture_interval) {
@@ -1275,24 +1275,12 @@ static int FUNC(uncompressed_header)(CodedBitstreamContext *ctx, RWContext *rw,
            if (seq->frame_id_numbers_present_flag)
                fb(id_len, display_frame_id);

-            infer(frame_type, ref->frame_type);
-            if (current->frame_type == AV1_FRAME_KEY) {
+            if (frame->frame_type == AV1_FRAME_KEY)
                infer(refresh_frame_flags, all_frames);
-
-                // Section 7.21
-                infer(current_frame_id, ref->frame_id);
-                priv->upscaled_width  = ref->upscaled_width;
-                priv->frame_width     = ref->frame_width;
-                priv->frame_height    = ref->frame_height;
-                priv->render_width    = ref->render_width;
-                priv->render_height   = ref->render_height;
-                priv->bit_depth       = ref->bit_depth;
-                priv->order_hint      = ref->order_hint;
-            } else
+            else
                infer(refresh_frame_flags, 0);

-            // Section 7.20
-            goto update_refs;
+            return 0;
        }

        fb(2, frame_type);
@@ -1378,7 +1366,6 @@ static int FUNC(uncompressed_header)(CodedBitstreamContext *ctx, RWContext *rw,
        fb(order_hint_bits, order_hint);
    else
        infer(order_hint, 0);
-    priv->order_hint = current->order_hint;

    if (frame_is_intra || current->error_resilient_mode)
        infer(primary_ref_frame, AV1_PRIMARY_REF_NONE);
@@ -1394,7 +1381,7 @@ static int FUNC(uncompressed_header)(CodedBitstreamContext *ctx, RWContext *rw,
                    int in_temporal_layer = (op_pt_idc >>  priv->temporal_id    ) & 1;
                    int in_spatial_layer  = (op_pt_idc >> (priv->spatial_id + 8)) & 1;
                    if (seq->operating_point_idc[i] == 0 ||
-                        (in_temporal_layer && in_spatial_layer)) {
+                        in_temporal_layer || in_spatial_layer) {
                        fbs(seq->decoder_model_info.buffer_removal_time_length_minus_1 + 1,
                            buffer_removal_time[i], 1, i);
                    }
@@ -1554,16 +1541,6 @@ static int FUNC(uncompressed_header)(CodedBitstreamContext *ctx, RWContext *rw,

    CHECK(FUNC(film_grain_params)(ctx, rw, current));

-    av_log(ctx->log_ctx, AV_LOG_DEBUG, "Frame %d:  size %dx%d  "
-           "upscaled %d  render %dx%d  subsample %dx%d  "
-           "bitdepth %d  tiles %dx%d.\n", priv->order_hint,
-           priv->frame_width, priv->frame_height, priv->upscaled_width,
-           priv->render_width, priv->render_height,
-           seq->color_config.subsampling_x + 1,
-           seq->color_config.subsampling_y + 1, priv->bit_depth,
-           priv->tile_rows, priv->tile_cols);
-
-update_refs:
    for (i = 0; i < AV1_NUM_REF_FRAMES; i++) {
        if (current->refresh_frame_flags & (1 << i)) {
            priv->ref[i] = (AV1ReferenceFrameState) {
@@ -1578,11 +1555,20 @@ update_refs:
                .subsampling_x  = seq->color_config.subsampling_x,
                .subsampling_y  = seq->color_config.subsampling_y,
                .bit_depth      = priv->bit_depth,
-                .order_hint     = priv->order_hint,
+                .order_hint     = current->order_hint,
            };
        }
    }

+    av_log(ctx->log_ctx, AV_LOG_DEBUG, "Frame %d:  size %dx%d  "
+           "upscaled %d  render %dx%d  subsample %dx%d  "
+           "bitdepth %d  tiles %dx%d.\n", current->order_hint,
+           priv->frame_width, priv->frame_height, priv->upscaled_width,
+           priv->render_width, priv->render_height,
+           seq->color_config.subsampling_x + 1,
+           seq->color_config.subsampling_y + 1, priv->bit_depth,
+           priv->tile_rows, priv->tile_cols);
+
    return 0;
 }

--- a/libavcodec/cbs_h2645.c
+++ b/libavcodec/cbs_h2645.c
@@ -408,11 +408,10 @@ static int cbs_h2645_read_more_rbsp_data(GetBitContext *gbc)

 #define infer(name, value) do { \
        if (current->name != (value)) { \
-            av_log(ctx->log_ctx, AV_LOG_ERROR, \
+            av_log(ctx->log_ctx, AV_LOG_WARNING, "Warning: " \
                   "%s does not match inferred value: " \
                   "%"PRId64", but should be %"PRId64".\n", \
                   #name, (int64_t)current->name, (int64_t)(value)); \
-            return AVERROR_INVALIDDATA; \
        } \
    } while (0)

--- a/libavcodec/cbs_h265_syntax_template.c
+++ b/libavcodec/cbs_h265_syntax_template.c
@@ -728,7 +728,7 @@ static int FUNC(sps_scc_extension)(CodedBitstreamContext *ctx, RWContext *rw,

        flag(sps_palette_predictor_initializer_present_flag);
        if (current->sps_palette_predictor_initializer_present_flag) {
-            ue(sps_num_palette_predictor_initializer_minus1, 0, 127);
+            ue(sps_num_palette_predictor_initializer_minus1, 0, 128);
            for (comp = 0; comp < (current->chroma_format_idc ? 3 : 1); comp++) {
                int bit_depth = comp == 0 ? current->bit_depth_luma_minus8 + 8
                                          : current->bit_depth_chroma_minus8 + 8;
@@ -744,32 +744,6 @@ static int FUNC(sps_scc_extension)(CodedBitstreamContext *ctx, RWContext *rw,
    return 0;
 }

-static int FUNC(vui_parameters_default)(CodedBitstreamContext *ctx,
-                                        RWContext *rw, H265RawVUI *current,
-                                        H265RawSPS *sps)
-{
-    infer(aspect_ratio_idc, 0);
-
-    infer(video_format,             5);
-    infer(video_full_range_flag,    0);
-    infer(colour_primaries,         2);
-    infer(transfer_characteristics, 2);
-    infer(matrix_coefficients,      2);
-
-    infer(chroma_sample_loc_type_top_field,    0);
-    infer(chroma_sample_loc_type_bottom_field, 0);
-
-    infer(tiles_fixed_structure_flag,    0);
-    infer(motion_vectors_over_pic_boundaries_flag, 1);
-    infer(min_spatial_segmentation_idc,  0);
-    infer(max_bytes_per_pic_denom,       2);
-    infer(max_bits_per_min_cu_denom,     1);
-    infer(log2_max_mv_length_horizontal, 15);
-    infer(log2_max_mv_length_vertical,   15);
-
-    return 0;
-}
-
 static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw,
                     H265RawSPS *current)
 {
@@ -934,8 +908,6 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw,
    flag(vui_parameters_present_flag);
    if (current->vui_parameters_present_flag)
        CHECK(FUNC(vui_parameters)(ctx, rw, &current->vui, current));
-    else
-        CHECK(FUNC(vui_parameters_default)(ctx, rw, &current->vui, current));

    flag(sps_extension_present_flag);
    if (current->sps_extension_present_flag) {
--- a/libavcodec/cbs_jpeg.c
+++ b/libavcodec/cbs_jpeg.c
@@ -149,7 +149,6 @@ static int cbs_jpeg_split_fragment(CodedBitstreamContext *ctx,
            break;
        } else if (marker == JPEG_MARKER_SOS) {
            next_marker = -1;
-            end = start;
            for (i = start; i + 1 < frag->data_size; i++) {
                if (frag->data[i] != 0xff)
                    continue;
--- a/libavcodec/cdgraphics.c
+++ b/libavcodec/cdgraphics.c
@@ -239,7 +239,7 @@ static void cdg_scroll(CDGraphicsContext *cc, uint8_t *data,
    for (y = FFMAX(0, vinc); y < FFMIN(CDG_FULL_HEIGHT + vinc, CDG_FULL_HEIGHT); y++)
        memcpy(out + FFMAX(0, hinc) + stride * y,
               in + FFMAX(0, hinc) - hinc + (y - vinc) * stride,
-               FFABS(stride) - FFABS(hinc));
+               FFMIN(stride + hinc, stride));

    if (vinc > 0)
        cdg_fill_wrapper(0, 0, out,
--- a/libavcodec/celp_filters.c
+++ b/libavcodec/celp_filters.c
@@ -65,11 +65,11 @@ int ff_celp_lp_synthesis_filter(int16_t *out, const int16_t *filter_coeffs,
    int i,n;

    for (n = 0; n < buffer_length; n++) {
-        int sum = rounder, sum1;
+        int sum = -rounder, sum1;
        for (i = 1; i <= filter_length; i++)
-            sum -= (unsigned)(filter_coeffs[i-1] * out[n-i]);
+            sum += (unsigned)(filter_coeffs[i-1] * out[n-i]);

-        sum1 = ((sum >> 12) + in[n]) >> shift;
+        sum1 = ((-sum >> 12) + in[n]) >> shift;
        sum  = av_clip_int16(sum1);

        if (stop_on_overflow && sum != sum1)
--- a/libavcodec/cfhd.c
+++ b/libavcodec/cfhd.c
@@ -503,10 +503,6 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
                avpriv_report_missing_feature(avctx, "Transform type of %"PRIu16, data);
                ret = AVERROR_PATCHWELCOME;
                break;
-            } else if (data == 1) {
-                av_log(avctx, AV_LOG_ERROR, "unsupported transform type\n");
-                ret = AVERROR_PATCHWELCOME;
-                break;
            }
            av_log(avctx, AV_LOG_DEBUG, "Transform-type? %"PRIu16"\n", data);
        } else if (abstag >= 0x4000 && abstag <= 0x40ff) {
@@ -611,12 +607,6 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
            s->peak.level   = 0;
        } else if (tag == -74 && s->peak.offset) {
            s->peak.level = data;
-            if (s->peak.offset < 4 - bytestream2_tell(&s->peak.base) ||
-                s->peak.offset > 4 + bytestream2_get_bytes_left(&s->peak.base)
-            ) {
-                ret = AVERROR_INVALIDDATA;
-                goto end;
-            }
            bytestream2_seek(&s->peak.base, s->peak.offset - 4, SEEK_CUR);
        } else
            av_log(avctx, AV_LOG_DEBUG,  "Unknown tag %i data %x\n", tag, data);
--- a/libavcodec/clearvideo.c
+++ b/libavcodec/clearvideo.c
@@ -665,8 +665,8 @@ static av_cold int clv_decode_init(AVCodecContext *avctx)
    }

    c->tile_shift = av_log2(c->tile_size);
-    if (1U << c->tile_shift != c->tile_size || c->tile_shift < 1 || c->tile_shift > 30) {
-        av_log(avctx, AV_LOG_ERROR, "Tile size: %d, is not power of 2 > 1 and < 2^31\n", c->tile_size);
+    if (1U << c->tile_shift != c->tile_size) {
+        av_log(avctx, AV_LOG_ERROR, "Tile size: %d, is not power of 2.\n", c->tile_size);
        return AVERROR_INVALIDDATA;
    }

--- a/libavcodec/cook.c
+++ b/libavcodec/cook.c
@@ -1084,10 +1084,6 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)
    ff_audiodsp_init(&q->adsp);

    while (bytestream2_get_bytes_left(&gb)) {
-        if (s >= FFMIN(MAX_SUBPACKETS, avctx->block_align)) {
-            avpriv_request_sample(avctx, "subpackets > %d", FFMIN(MAX_SUBPACKETS, avctx->block_align));
-            return AVERROR_PATCHWELCOME;
-        }
        /* 8 for mono, 16 for stereo, ? for multichannel
           Swap to right endianness so we don't need to care later on. */
        q->subpacket[s].cookversion      = bytestream2_get_be32(&gb);
@@ -1219,6 +1215,10 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)

        q->num_subpackets++;
        s++;
+        if (s > FFMIN(MAX_SUBPACKETS, avctx->block_align)) {
+            avpriv_request_sample(avctx, "subpackets > %d", FFMIN(MAX_SUBPACKETS, avctx->block_align));
+            return AVERROR_PATCHWELCOME;
+        }
    }

    /* Try to catch some obviously faulty streams, otherwise it might be exploitable */
--- a/libavcodec/cpia.c
+++ b/libavcodec/cpia.c
@@ -111,7 +111,6 @@ static int cpia_decode_frame(AVCodecContext *avctx,
        // Read line length, two byte little endian
        linelength = AV_RL16(src);
        src += 2;
-        src_size -= 2;

        if (src_size < linelength) {
            frame->decode_error_flags = FF_DECODE_ERROR_INVALID_BITSTREAM;
--- a/libavcodec/cscd.c
+++ b/libavcodec/cscd.c
@@ -93,7 +93,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
    case 1: { // zlib compression
 #if CONFIG_ZLIB
        unsigned long dlen = c->decomp_size;
-        if (uncompress(c->decomp_buf, &dlen, &buf[2], buf_size - 2) != Z_OK || dlen != c->decomp_size) {
+        if (uncompress(c->decomp_buf, &dlen, &buf[2], buf_size - 2) != Z_OK) {
            av_log(avctx, AV_LOG_ERROR, "error during zlib decompression\n");
            return AVERROR_INVALIDDATA;
        }
--- a/libavcodec/cuviddec.c
+++ b/libavcodec/cuviddec.c
@@ -88,7 +88,7 @@ typedef struct CuvidContext
    CUVIDDECODECAPS caps8, caps10, caps12;

    CUVIDPARSERPARAMS cuparseinfo;
-    CUVIDEOFORMATEX *cuparse_ext;
+    CUVIDEOFORMATEX cuparse_ext;

    CudaFunctions *cudl;
    CuvidFunctions *cvdl;
@@ -684,7 +684,6 @@ static av_cold int cuvid_decode_end(AVCodecContext *avctx)
    av_buffer_unref(&ctx->hwdevice);

    av_freep(&ctx->key_frame);
-    av_freep(&ctx->cuparse_ext);

    cuvid_free_functions(&ctx->cvdl);

@@ -794,8 +793,6 @@ static av_cold int cuvid_decode_init(AVCodecContext *avctx)
    CUVIDSOURCEDATAPACKET seq_pkt;
    CUcontext cuda_ctx = NULL;
    CUcontext dummy;
-    uint8_t *extradata;
-    int extradata_size;
    int ret = 0;

    enum AVPixelFormat pix_fmts[3] = { AV_PIX_FMT_CUDA,
@@ -892,8 +889,11 @@ static av_cold int cuvid_decode_init(AVCodecContext *avctx)
    ctx->cudl = device_hwctx->internal->cuda_dl;

    memset(&ctx->cuparseinfo, 0, sizeof(ctx->cuparseinfo));
+    memset(&ctx->cuparse_ext, 0, sizeof(ctx->cuparse_ext));
    memset(&seq_pkt, 0, sizeof(seq_pkt));

+    ctx->cuparseinfo.pExtVideoInfo = &ctx->cuparse_ext;
+
    switch (avctx->codec->id) {
 #if CONFIG_H264_CUVID_DECODER
    case AV_CODEC_ID_H264:
@@ -947,26 +947,17 @@ static av_cold int cuvid_decode_init(AVCodecContext *avctx)

    if (avctx->codec->bsfs) {
        const AVCodecParameters *par = avctx->internal->bsf->par_out;
-        extradata = par->extradata;
-        extradata_size = par->extradata_size;
-    } else {
-        extradata = avctx->extradata;
-        extradata_size = avctx->extradata_size;
+        ctx->cuparse_ext.format.seqhdr_data_length = par->extradata_size;
+        memcpy(ctx->cuparse_ext.raw_seqhdr_data,
+               par->extradata,
+               FFMIN(sizeof(ctx->cuparse_ext.raw_seqhdr_data), par->extradata_size));
+    } else if (avctx->extradata_size > 0) {
+        ctx->cuparse_ext.format.seqhdr_data_length = avctx->extradata_size;
+        memcpy(ctx->cuparse_ext.raw_seqhdr_data,
+               avctx->extradata,
+               FFMIN(sizeof(ctx->cuparse_ext.raw_seqhdr_data), avctx->extradata_size));
    }

-    ctx->cuparse_ext = av_mallocz(sizeof(*ctx->cuparse_ext)
-            + FFMAX(extradata_size - (int)sizeof(ctx->cuparse_ext->raw_seqhdr_data), 0));
-    if (!ctx->cuparse_ext) {
-        ret = AVERROR(ENOMEM);
-        goto error;
-    }
-
-    if (extradata_size > 0)
-        memcpy(ctx->cuparse_ext->raw_seqhdr_data, extradata, extradata_size);
-    ctx->cuparse_ext->format.seqhdr_data_length = extradata_size;
-
-    ctx->cuparseinfo.pExtVideoInfo = ctx->cuparse_ext;
-
    ctx->key_frame = av_mallocz(ctx->nb_surfaces * sizeof(int));
    if (!ctx->key_frame) {
        ret = AVERROR(ENOMEM);
@@ -995,8 +986,8 @@ static av_cold int cuvid_decode_init(AVCodecContext *avctx)
    if (ret < 0)
        goto error;

-    seq_pkt.payload = ctx->cuparse_ext->raw_seqhdr_data;
-    seq_pkt.payload_size = ctx->cuparse_ext->format.seqhdr_data_length;
+    seq_pkt.payload = ctx->cuparse_ext.raw_seqhdr_data;
+    seq_pkt.payload_size = ctx->cuparse_ext.format.seqhdr_data_length;

    if (seq_pkt.payload && seq_pkt.payload_size) {
        ret = CHECK_CU(ctx->cvdl->cuvidParseVideoData(ctx->cuparser, &seq_pkt));
@@ -1055,8 +1046,8 @@ static void cuvid_flush(AVCodecContext *avctx)
    if (ret < 0)
        goto error;

-    seq_pkt.payload = ctx->cuparse_ext->raw_seqhdr_data;
-    seq_pkt.payload_size = ctx->cuparse_ext->format.seqhdr_data_length;
+    seq_pkt.payload = ctx->cuparse_ext.raw_seqhdr_data;
+    seq_pkt.payload_size = ctx->cuparse_ext.format.seqhdr_data_length;

    if (seq_pkt.payload && seq_pkt.payload_size) {
        ret = CHECK_CU(ctx->cvdl->cuvidParseVideoData(ctx->cuparser, &seq_pkt));
--- a/libavcodec/dcadsp.c
+++ b/libavcodec/dcadsp.c
@@ -328,7 +328,7 @@ static void dmix_add_c(int32_t *dst, const int32_t *src, int coeff, ptrdiff_t le
    int i;

    for (i = 0; i < len; i++)
-        dst[i] += (unsigned)mul15(src[i], coeff);
+        dst[i] += mul15(src[i], coeff);
 }

 static void dmix_scale_c(int32_t *dst, int scale, ptrdiff_t len)
--- a/libavcodec/decode.c
+++ b/libavcodec/decode.c
@@ -1858,8 +1858,7 @@ int ff_get_buffer(AVCodecContext *avctx, AVFrame *frame, int flags)
    int ret;

    if (avctx->codec_type == AVMEDIA_TYPE_VIDEO) {
-        if ((unsigned)avctx->width > INT_MAX - STRIDE_ALIGN ||
-            (ret = av_image_check_size2(FFALIGN(avctx->width, STRIDE_ALIGN), avctx->height, avctx->max_pixels, AV_PIX_FMT_NONE, 0, avctx)) < 0 || avctx->pix_fmt<0) {
+        if ((ret = av_image_check_size2(FFALIGN(avctx->width, STRIDE_ALIGN), avctx->height, avctx->max_pixels, AV_PIX_FMT_NONE, 0, avctx)) < 0 || avctx->pix_fmt<0) {
            av_log(avctx, AV_LOG_ERROR, "video_get_buffer: image parameters invalid\n");
            ret = AVERROR(EINVAL);
            goto fail;
--- a/libavcodec/dirac_parser.c
+++ b/libavcodec/dirac_parser.c
@@ -215,7 +215,7 @@ static int dirac_combine_frame(AVCodecParserContext *s, AVCodecContext *avctx,
            int64_t pts = AV_RB32(cur_pu + 13);
            if (s->last_pts == 0 && s->last_dts == 0)
                s->dts = pts - 1;
-            else if (s->last_dts != AV_NOPTS_VALUE)
+            else
                s->dts = s->last_dts + 1;
            s->pts = pts;
            if (!avctx->has_b_frames && (cur_pu[4] & 0x03))
--- a/libavcodec/diracdec.c
+++ b/libavcodec/diracdec.c
@@ -1431,8 +1431,8 @@ static void global_mv(DiracContext *s, DiracBlock *block, int x, int y, int ref)
    int *c      = s->globalmc[ref].perspective;

    int64_t m   = (1<<ep) - (c[0]*(int64_t)x + c[1]*(int64_t)y);
-    int64_t mx  = m * (uint64_t)((A[0][0] * (int64_t)x + A[0][1]*(int64_t)y) + (1LL<<ez) * b[0]);
-    int64_t my  = m * (uint64_t)((A[1][0] * (int64_t)x + A[1][1]*(int64_t)y) + (1LL<<ez) * b[1]);
+    int64_t mx  = m * (int64_t)((A[0][0] * (int64_t)x + A[0][1]*(int64_t)y) + (1LL<<ez) * b[0]);
+    int64_t my  = m * (int64_t)((A[1][0] * (int64_t)x + A[1][1]*(int64_t)y) + (1LL<<ez) * b[1]);

    block->u.mv[ref][0] = (mx + (1<<(ez+ep))) >> (ez+ep);
    block->u.mv[ref][1] = (my + (1<<(ez+ep))) >> (ez+ep);
--- a/libavcodec/diracdsp.c
+++ b/libavcodec/diracdsp.c
@@ -198,9 +198,9 @@ static void dequant_subband_ ## PX ## _c(uint8_t *src, uint8_t *dst, ptrdiff_t s
        PX c, sign, *src_r = (PX *)src, *dst_r = (PX *)dst;                                \
        for (i = 0; i < tot_h; i++) {                                                      \
            c = *src_r++;                                                                  \
-            if     (c < 0) c = -((-(unsigned)c*qf + qs) >> 2);                             \
-            else if(c > 0) c =  (( (unsigned)c*qf + qs) >> 2);                             \
-            *dst_r++ = c;                                                                  \
+            sign = FFSIGN(c)*(!!c);                                                        \
+            c = (FFABS(c)*(unsigned)qf + qs) >> 2;                                                   \
+            *dst_r++ = c*sign;                                                             \
        }                                                                                  \
        src += tot_h << (sizeof(PX) >> 1);                                                 \
        dst += stride;                                                                     \
--- a/libavcodec/dnxhddec.c
+++ b/libavcodec/dnxhddec.c
@@ -110,7 +110,6 @@ static av_cold int dnxhd_decode_init(AVCodecContext *avctx)

 static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth)
 {
-    int ret;
    if (cid != ctx->cid) {
        int index;

@@ -130,26 +129,19 @@ static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth)
        ff_free_vlc(&ctx->dc_vlc);
        ff_free_vlc(&ctx->run_vlc);

-        if ((ret = init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,
+        init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,
                 ctx->cid_table->ac_bits, 1, 1,
-                 ctx->cid_table->ac_codes, 2, 2, 0)) < 0)
-            goto out;
-        if ((ret = init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12,
+                 ctx->cid_table->ac_codes, 2, 2, 0);
+        init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12,
                 ctx->cid_table->dc_bits, 1, 1,
-                 ctx->cid_table->dc_codes, 1, 1, 0)) < 0)
-            goto out;
-        if ((ret = init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,
+                 ctx->cid_table->dc_codes, 1, 1, 0);
+        init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,
                 ctx->cid_table->run_bits, 1, 1,
-                 ctx->cid_table->run_codes, 2, 2, 0)) < 0)
-            goto out;
+                 ctx->cid_table->run_codes, 2, 2, 0);

        ctx->cid = cid;
    }
-    ret = 0;
-out:
-    if (ret < 0)
-        av_log(ctx->avctx, AV_LOG_ERROR, "init_vlc failed\n");
-    return ret;
+    return 0;
 }

 static int dnxhd_get_profile(int cid)
--- a/libavcodec/dpx.c
+++ b/libavcodec/dpx.c
@@ -206,9 +206,6 @@ static int decode_frame(AVCodecContext *avctx,
        return AVERROR_PATCHWELCOME;
    }

-    if (bits_per_color > 32)
-        return AVERROR_INVALIDDATA;
-
    buf += 820;
    avctx->sample_aspect_ratio.num = read32(&buf, endian);
    avctx->sample_aspect_ratio.den = read32(&buf, endian);
--- a/libavcodec/dstdec.c
+++ b/libavcodec/dstdec.c
@@ -56,6 +56,7 @@ static const int8_t probs_code_pred_coeff[3][3] = {
 typedef struct ArithCoder {
    unsigned int a;
    unsigned int c;
+    int overread;
 } ArithCoder;

 typedef struct Table {
@@ -85,12 +86,6 @@ static av_cold int decode_init(AVCodecContext *avctx)
        return AVERROR_PATCHWELCOME;
    }

-    // the sample rate is only allowed to be 64,128,256 * 44100 by ISO/IEC 14496-3:2005(E)
-    // We are a bit more tolerant here, but this check is needed to bound the size and duration
-    if (avctx->sample_rate > 512 * 44100)
-        return AVERROR_INVALIDDATA;
-
-
    if (DST_SAMPLES_PER_FRAME(avctx->sample_rate) & 7) {
        return AVERROR_PATCHWELCOME;
    }
@@ -186,6 +181,7 @@ static void ac_init(ArithCoder *ac, GetBitContext *gb)
 {
    ac->a = 4095;
    ac->c = get_bits(gb, 12);
+    ac->overread = 0;
 }

 static av_always_inline void ac_get(ArithCoder *ac, GetBitContext *gb, int p, int *e)
@@ -205,6 +201,8 @@ static av_always_inline void ac_get(ArithCoder *ac, GetBitContext *gb, int p, in
    if (ac->a < 2048) {
        int n = 11 - av_log2(ac->a);
        ac->a <<= n;
+        if (get_bits_left(gb) < n)
+            ac->overread ++;
        ac->c = (ac->c << n) | get_bits(gb, n);
    }
 }
@@ -214,7 +212,7 @@ static uint8_t prob_dst_x_bit(int c)
    return (ff_reverse[c & 127] >> 1) + 1;
 }

-static int build_filter(int16_t table[DST_MAX_ELEMENTS][16][256], const Table *fsets)
+static void build_filter(int16_t table[DST_MAX_ELEMENTS][16][256], const Table *fsets)
 {
    int i, j, k, l;

@@ -225,17 +223,14 @@ static int build_filter(int16_t table[DST_MAX_ELEMENTS][16][256], const Table *f
            int total = av_clip(length - j * 8, 0, 8);

            for (k = 0; k < 256; k++) {
-                int64_t v = 0;
+                int v = 0;

                for (l = 0; l < total; l++)
                    v += (((k >> l) & 1) * 2 - 1) * fsets->coeff[i][j * 8 + l];
-                if ((int16_t)v != v)
-                    return AVERROR_INVALIDDATA;
                table[i][j][k] = v;
            }
        }
    }
-    return 0;
 }

 static int decode_frame(AVCodecContext *avctx, void *data,
@@ -331,9 +326,7 @@ static int decode_frame(AVCodecContext *avctx, void *data,
        return AVERROR_INVALIDDATA;
    ac_init(ac, gb);

-    ret = build_filter(s->filter, &s->fsets);
-    if (ret < 0)
-        return ret;
+    build_filter(s->filter, &s->fsets);

    memset(s->status, 0xAA, sizeof(s->status));
    memset(dsd, 0, frame->nb_samples * 4 * channels);
@@ -362,6 +355,9 @@ static int decode_frame(AVCodecContext *avctx, void *data,
                prob = 128;
            }

+            if (ac->overread > 16)
+                return AVERROR_INVALIDDATA;
+
            ac_get(ac, gb, prob, &residual);
            v = ((predict >> 15) ^ residual) & 1;
            dsd[((i >> 3) * channels + ch) << 2] |= v << (7 - (i & 0x7 ));
--- a/libavcodec/dvenc.c
+++ b/libavcodec/dvenc.c
@@ -215,8 +215,8 @@ static av_always_inline int dv_guess_dct_mode(DVVideoContext *s, uint8_t *data,
    if (s->avctx->flags & AV_CODEC_FLAG_INTERLACED_DCT) {
        int ps = s->ildct_cmp(NULL, data, NULL, linesize, 8) - 400;
        if (ps > 0) {
-            int is = s->ildct_cmp(NULL, data,            NULL, linesize * 2, 4) +
-                     s->ildct_cmp(NULL, data + linesize, NULL, linesize * 2, 4);
+            int is = s->ildct_cmp(NULL, data,            NULL, linesize << 1, 4) +
+                     s->ildct_cmp(NULL, data + linesize, NULL, linesize << 1, 4);
            return ps > is;
        }
    }
@@ -511,7 +511,7 @@ static av_always_inline int dv_init_enc_block(EncBlockInfo* bi, uint8_t *data, i

    if (data) {
        if (DV_PROFILE_IS_HD(s->sys)) {
-            s->get_pixels(blk, data, linesize * (1 << bi->dct_mode));
+            s->get_pixels(blk, data, linesize << bi->dct_mode);
            s->fdct[0](blk);
        } else {
            bi->dct_mode = dv_guess_dct_mode(s, data, linesize);
@@ -860,7 +860,7 @@ static int dv_encode_video_segment(AVCodecContext *avctx, void *arg)

        qnos[mb_index] = DV_PROFILE_IS_HD(s->sys) ? 1 : 15;

-        y_ptr    = s->frame->data[0] + (mb_y * s->frame->linesize[0] + mb_x) * 8;
+        y_ptr    = s->frame->data[0] + ((mb_y * s->frame->linesize[0] + mb_x) << 3);
        linesize = s->frame->linesize[0];

        if (s->sys->height == 1080 && mb_y < 134)
@@ -874,12 +874,12 @@ static int dv_encode_video_segment(AVCodecContext *avctx, void *arg)
        if ((s->sys->pix_fmt == AV_PIX_FMT_YUV420P)                      ||
            (s->sys->pix_fmt == AV_PIX_FMT_YUV411P && mb_x >= (704 / 8)) ||
            (s->sys->height >= 720 && mb_y != 134)) {
-            y_stride = s->frame->linesize[0] * (1 << (3*!enc_blk->dct_mode));
+            y_stride = s->frame->linesize[0] << (3*!enc_blk->dct_mode);
        } else {
            y_stride = 16;
        }
        y_ptr    = s->frame->data[0] +
-                   (mb_y * s->frame->linesize[0] + mb_x) * 8;
+                   ((mb_y * s->frame->linesize[0] + mb_x) << 3);
        linesize = s->frame->linesize[0];

        if (s->sys->video_stype == 4) { /* SD 422 */
@@ -898,17 +898,17 @@ static int dv_encode_video_segment(AVCodecContext *avctx, void *arg)
        enc_blk += 4;

        /* initializing chrominance blocks */
-        c_offset = ((mb_y >>  (s->sys->pix_fmt == AV_PIX_FMT_YUV420P)) * s->frame->linesize[1] +
-                    (mb_x >> ((s->sys->pix_fmt == AV_PIX_FMT_YUV411P) ? 2 : 1))) * 8;
+        c_offset = (((mb_y >>  (s->sys->pix_fmt == AV_PIX_FMT_YUV420P)) * s->frame->linesize[1] +
+                     (mb_x >> ((s->sys->pix_fmt == AV_PIX_FMT_YUV411P) ? 2 : 1))) << 3);
        for (j = 2; j; j--) {
            uint8_t *c_ptr = s->frame->data[j] + c_offset;
            linesize = s->frame->linesize[j];
-            y_stride = (mb_y == 134) ? 8 : (s->frame->linesize[j] * (1 << (3*!enc_blk->dct_mode)));
+            y_stride = (mb_y == 134) ? 8 : (s->frame->linesize[j] << (3*!enc_blk->dct_mode));
            if (s->sys->pix_fmt == AV_PIX_FMT_YUV411P && mb_x >= (704 / 8)) {
                uint8_t *d;
                uint8_t *b = scratch;
                for (i = 0; i < 8; i++) {
-                    d      = c_ptr + linesize * 8;
+                    d      = c_ptr + (linesize << 3);
                    b[0]   = c_ptr[0];
                    b[1]   = c_ptr[1];
                    b[2]   = c_ptr[2];
--- a/libavcodec/dxtory.c
+++ b/libavcodec/dxtory.c
@@ -456,7 +456,7 @@ static int dx2_decode_slice_410(GetBitContext *gb, AVFrame *frame,
            V[x >> 2] = decode_sym(gb, lru[2]) ^ 0x80;
        }

-        Y += ystride * 4;
+        Y += ystride << 2;
        U += ustride;
        V += vstride;
    }
@@ -501,7 +501,7 @@ static int dx2_decode_slice_420(GetBitContext *gb, AVFrame *frame,
            V[x >> 1] = decode_sym(gb, lru[2]) ^ 0x80;
        }

-        Y += ystride * 2;
+        Y += ystride << 1;
        U += ustride;
        V += vstride;
    }
--- a/libavcodec/eac3dec.c
+++ b/libavcodec/eac3dec.c
@@ -139,11 +139,9 @@ static void ff_eac3_apply_spectral_extension(AC3DecodeContext *s)
            // spx_noise_blend and spx_signal_blend are both FP.23
            nscale *= 1.0 / (1<<23);
            sscale *= 1.0 / (1<<23);
-            if (nscale < -1.0)
-                nscale = -1.0;
 #endif
            for (i = 0; i < s->spx_band_sizes[bnd]; i++) {
-                UINTFLOAT noise = (INTFLOAT)(nscale * (int32_t)av_lfg_get(&s->dith_state));
+                float noise  = nscale * (int32_t)av_lfg_get(&s->dith_state);
                s->transform_coeffs[ch][bin]   *= sscale;
                s->transform_coeffs[ch][bin++] += noise;
            }
--- a/libavcodec/eatgq.c
+++ b/libavcodec/eatgq.c
@@ -58,7 +58,7 @@ static av_cold int tgq_decode_init(AVCodecContext *avctx)
    return 0;
 }

-static int tgq_decode_block(TgqContext *s, int16_t block[64], GetBitContext *gb)
+static void tgq_decode_block(TgqContext *s, int16_t block[64], GetBitContext *gb)
 {
    uint8_t *perm = s->scantable.permutated;
    int i, j, value;
@@ -66,8 +66,6 @@ static int tgq_decode_block(TgqContext *s, int16_t block[64], GetBitContext *gb)
    for (i = 1; i < 64;) {
        switch (show_bits(gb, 3)) {
        case 4:
-            if (i >= 63)
-                return AVERROR_INVALIDDATA;
            block[perm[i++]] = 0;
        case 0:
            block[perm[i++]] = 0;
@@ -77,8 +75,6 @@ static int tgq_decode_block(TgqContext *s, int16_t block[64], GetBitContext *gb)
        case 1:
            skip_bits(gb, 2);
            value = get_bits(gb, 6);
-            if (value > 64 - i)
-                return AVERROR_INVALIDDATA;
            for (j = 0; j < value; j++)
                block[perm[i++]] = 0;
            break;
@@ -106,7 +102,6 @@ static int tgq_decode_block(TgqContext *s, int16_t block[64], GetBitContext *gb)
        }
    }
    block[0] += 128 << 4;
-    return 0;
 }

 static void tgq_idct_put_mb(TgqContext *s, int16_t (*block)[64], AVFrame *frame,
@@ -166,11 +161,8 @@ static int tgq_decode_mb(TgqContext *s, AVFrame *frame, int mb_y, int mb_x)
        if (ret < 0)
            return ret;

-        for (i = 0; i < 6; i++) {
-            int ret = tgq_decode_block(s, s->block[i], &gb);
-            if (ret < 0)
-                return ret;
-        }
+        for (i = 0; i < 6; i++)
+            tgq_decode_block(s, s->block[i], &gb);
        tgq_idct_put_mb(s, s->block, frame, mb_x, mb_y);
        bytestream2_skip(&s->gb, mode);
    } else {
--- a/libavcodec/escape124.c
+++ b/libavcodec/escape124.c
@@ -88,6 +88,11 @@ static CodeBook unpack_codebook(GetBitContext* gb, unsigned depth,
    unsigned i, j;
    CodeBook cb = { 0 };

+    if (size >= INT_MAX / 34 || get_bits_left(gb) < size * 34)
+        return cb;
+
+    if (size >= INT_MAX / sizeof(MacroBlock))
+        return cb;
    cb.blocks = av_malloc(size ? size * sizeof(MacroBlock) : 1);
    if (!cb.blocks)
        return cb;
@@ -157,7 +162,7 @@ static MacroBlock decode_macroblock(Escape124Context* s, GetBitContext* gb,

    // This condition can occur with invalid bitstreams and
    // *codebook_index == 2
-    if (block_index >= s->codebooks[*codebook_index].size || !s->codebooks[*codebook_index].blocks)
+    if (block_index >= s->codebooks[*codebook_index].size)
        return (MacroBlock) { { 0 } };

    return s->codebooks[*codebook_index].blocks[block_index];
@@ -221,7 +226,7 @@ static int escape124_decode_frame(AVCodecContext *avctx,
    // represent a lower bound of the space needed for skipped superblocks. Non
    // skipped SBs need more space.
    if (get_bits_left(&gb) < 64 + s->num_superblocks * 23LL / 4320)
-        return AVERROR_INVALIDDATA;
+        return -1;

    frame_flags = get_bits_long(&gb, 32);
    frame_size  = get_bits_long(&gb, 32);
@@ -272,14 +277,9 @@ static int escape124_decode_frame(AVCodecContext *avctx,
            }

            av_freep(&s->codebooks[i].blocks);
-            if (cb_size >= INT_MAX / 34 || get_bits_left(&gb) < (int)cb_size * 34)
-                return AVERROR_INVALIDDATA;
-
-            if (cb_size >= INT_MAX / sizeof(MacroBlock))
-                return AVERROR_INVALIDDATA;
            s->codebooks[i] = unpack_codebook(&gb, cb_depth, cb_size);
            if (!s->codebooks[i].blocks)
-                return AVERROR(ENOMEM);
+                return -1;
        }
    }

--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -1051,9 +1051,6 @@ static int decode_block(AVCodecContext *avctx, void *tdata,
        if ((col + td->xsize) != s->xdelta)/* not the last tile of the line */
            axmax = 0; /* doesn't add pixel at the right of the datawindow */

-        if (td->xsize * (uint64_t)s->current_channel_offset > INT_MAX)
-            return AVERROR_INVALIDDATA;
-
        td->channel_line_size = td->xsize * s->current_channel_offset;/* uncompress size of one line */
        uncompressed_size = td->channel_line_size * (uint64_t)td->ysize;/* uncompress size of the block */
    } else {
@@ -1073,9 +1070,6 @@ static int decode_block(AVCodecContext *avctx, void *tdata,
        td->ysize          = FFMIN(s->scan_lines_per_block, s->ymax - line + 1); /* s->ydelta - line ?? */
        td->xsize          = s->xdelta;

-        if (td->xsize * (uint64_t)s->current_channel_offset > INT_MAX)
-            return AVERROR_INVALIDDATA;
-
        td->channel_line_size = td->xsize * s->current_channel_offset;/* uncompress size of one line */
        uncompressed_size = td->channel_line_size * (uint64_t)td->ysize;/* uncompress size of the block */

@@ -1499,28 +1493,15 @@ static int decode_header(EXRContext *s, AVFrame *frame)
            continue;
        } else if ((var_size = check_header_variable(s, "dataWindow", "box2i",
                                                     31)) >= 0) {
-            int xmin, ymin, xmax, ymax;
            if (!var_size) {
                ret = AVERROR_INVALIDDATA;
                goto fail;
            }

-            xmin   = bytestream2_get_le32(&s->gb);
-            ymin   = bytestream2_get_le32(&s->gb);
-            xmax   = bytestream2_get_le32(&s->gb);
-            ymax   = bytestream2_get_le32(&s->gb);
-
-            if (xmin > xmax || ymin > ymax ||
-                ymax == INT_MAX || xmax == INT_MAX ||
-                (unsigned)xmax - xmin >= INT_MAX ||
-                (unsigned)ymax - ymin >= INT_MAX) {
-                ret = AVERROR_INVALIDDATA;
-                goto fail;
-            }
-            s->xmin = xmin;
-            s->xmax = xmax;
-            s->ymin = ymin;
-            s->ymax = ymax;
+            s->xmin   = bytestream2_get_le32(&s->gb);
+            s->ymin   = bytestream2_get_le32(&s->gb);
+            s->xmax   = bytestream2_get_le32(&s->gb);
+            s->ymax   = bytestream2_get_le32(&s->gb);
            s->xdelta = (s->xmax - s->xmin) + 1;
            s->ydelta = (s->ymax - s->ymin) + 1;

@@ -1753,9 +1734,7 @@ static int decode_frame(AVCodecContext *avctx, void *data,
        s->ymin > s->ymax                  ||
        s->xdelta != s->xmax - s->xmin + 1 ||
        s->xmax >= s->w                    ||
-        s->ymax >= s->h                    ||
-        s->ydelta == 0xFFFFFFFF || s->xdelta == 0xFFFFFFFF
-    ) {
+        s->ymax >= s->h) {
        av_log(avctx, AV_LOG_ERROR, "Wrong or missing size information.\n");
        return AVERROR_INVALIDDATA;
    }
@@ -1786,7 +1765,7 @@ static int decode_frame(AVCodecContext *avctx, void *data,
    if ((ret = ff_thread_get_buffer(avctx, &frame, 0)) < 0)
        return ret;

-    if (bytestream2_get_bytes_left(&s->gb)/8 < nb_blocks)
+    if (bytestream2_get_bytes_left(&s->gb) < nb_blocks * 8)
        return AVERROR_INVALIDDATA;

    // check offset table and recreate it if need
@@ -1815,7 +1794,7 @@ static int decode_frame(AVCodecContext *avctx, void *data,
    // Zero out the start if ymin is not 0
    for (i = 0; i < planes; i++) {
        ptr = picture->data[i];
-        for (y = 0; y < FFMIN(s->ymin, s->h); y++) {
+        for (y = 0; y < s->ymin; y++) {
            memset(ptr, 0, out_line_size);
            ptr += picture->linesize[i];
        }
@@ -1826,14 +1805,13 @@ static int decode_frame(AVCodecContext *avctx, void *data,
    avctx->execute2(avctx, decode_block, s->thread_data, NULL, nb_blocks);

    // Zero out the end if ymax+1 is not h
-    if ((s->ymax+1) < avctx->height)
-        for (i = 0; i < planes; i++) {
-            ptr = picture->data[i] + ((s->ymax+1) * picture->linesize[i]);
-            for (y = s->ymax + 1; y < avctx->height; y++) {
-                memset(ptr, 0, out_line_size);
-                ptr += picture->linesize[i];
-            }
+    for (i = 0; i < planes; i++) {
+        ptr = picture->data[i] + ((s->ymax+1) * picture->linesize[i]);
+        for (y = s->ymax + 1; y < avctx->height; y++) {
+            memset(ptr, 0, out_line_size);
+            ptr += picture->linesize[i];
        }
+    }

    picture->pict_type = AV_PICTURE_TYPE_I;
    *got_frame = 1;
--- a/libavcodec/faxcompr.c
+++ b/libavcodec/faxcompr.c
@@ -141,8 +141,6 @@ static int decode_uncompressed(AVCodecContext *avctx, GetBitContext *gb,
                return AVERROR_INVALIDDATA;
            }
            cwi = 10 - av_log2(cwi);
-            if (get_bits_left(gb) < cwi + 1)
-                return AVERROR_INVALIDDATA;
            skip_bits(gb, cwi + 1);
            if (cwi > 5) {
                newmode = get_bits1(gb);
@@ -208,8 +206,6 @@ static int decode_group3_1d_line(AVCodecContext *avctx, GetBitContext *gb,
    unsigned int run = 0;
    unsigned int t;
    for (;;) {
-        if (get_bits_left(gb) <= 0)
-            return AVERROR_INVALIDDATA;
        t    = get_vlc2(gb, ccitt_vlc[mode].table, 9, 2);
        run += t;
        if (t < 64) {
@@ -228,7 +224,7 @@ static int decode_group3_1d_line(AVCodecContext *avctx, GetBitContext *gb,
            run       = 0;
            mode      = !mode;
        } else if ((int)t == -1) {
-            if (get_bits_left(gb) > 12 && show_bits(gb, 12) == 15) {
+            if (show_bits(gb, 12) == 15) {
                int ret;
                skip_bits(gb, 12);
                ret = decode_uncompressed(avctx, gb, &pix_left, &runs, runend, &mode);
@@ -255,10 +251,7 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
    unsigned int offs = 0, run = 0;

    while (offs < width) {
-        int cmode;
-        if (get_bits_left(gb) <= 0)
-            return AVERROR_INVALIDDATA;
-        cmode = get_vlc2(gb, ccitt_group3_2d_vlc.table, 9, 1);
+        int cmode = get_vlc2(gb, ccitt_group3_2d_vlc.table, 9, 1);
        if (cmode == -1) {
            av_log(avctx, AV_LOG_ERROR, "Incorrect mode VLC\n");
            return AVERROR_INVALIDDATA;
@@ -280,8 +273,6 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
            for (k = 0; k < 2; k++) {
                run = 0;
                for (;;) {
-                    if (get_bits_left(gb) <= 0)
-                        return AVERROR_INVALIDDATA;
                    t = get_vlc2(gb, ccitt_vlc[mode].table, 9, 2);
                    if (t == -1) {
                        av_log(avctx, AV_LOG_ERROR, "Incorrect code\n");
@@ -305,10 +296,7 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
                mode = !mode;
            }
        } else if (cmode == 9 || cmode == 10) {
-            int xxx;
-            if (get_bits_left(gb) < 3)
-                return AVERROR_INVALIDDATA;
-            xxx = get_bits(gb, 3);
+            int xxx = get_bits(gb, 3);
            if (cmode == 9 && xxx == 7) {
                int ret;
                int pix_left = width - offs;
--- a/libavcodec/fft_init_table.c
+++ b/libavcodec/fft_init_table.c
@@ -51,8 +51,6 @@
 * @file
 * definitions and initialization of LUT table for FFT
 */
-#include "libavutil/thread.h"
-
 #include "libavcodec/fft_table.h"

 const int32_t ff_w_tab_sr[MAX_FFT_SIZE/(4*16)] = {
@@ -316,29 +314,15 @@ const int32_t ff_w_tab_sr[MAX_FFT_SIZE/(4*16)] = {

 uint16_t ff_fft_offsets_lut[21845];

-static void fft_lut_init(uint16_t *table, int off, int size, int *index)
+void ff_fft_lut_init(uint16_t *table, int off, int size, int *index)
 {
    if (size < 16) {
        table[*index] = off >> 2;
        (*index)++;
    }
    else {
-        fft_lut_init(table, off,                   size >> 1, index);
-        fft_lut_init(table, off +     (size >> 1), size >> 2, index);
-        fft_lut_init(table, off + 3 * (size >> 2), size >> 2, index);
+        ff_fft_lut_init(table, off, size>>1, index);
+        ff_fft_lut_init(table, off+(size>>1), size>>2, index);
+        ff_fft_lut_init(table, off+3*(size>>2), size>>2, index);
    }
 }
-
-static void fft_lut_init_start(void)
-{
-    int n = 0;
-
-    fft_lut_init(ff_fft_offsets_lut, 0, 1 << 17, &n);
-}
-
-void ff_fft_lut_init(void)
-{
-    static AVOnce init_once = AV_ONCE_INIT;
-
-    ff_thread_once(&init_once, fft_lut_init_start);
-}
--- a/libavcodec/fft_table.h
+++ b/libavcodec/fft_table.h
@@ -61,6 +61,6 @@

 extern const int32_t ff_w_tab_sr[];
 extern uint16_t ff_fft_offsets_lut[];
-void ff_fft_lut_init(void);
+void ff_fft_lut_init(uint16_t *table, int off, int size, int *index);

 #endif /* AVCODEC_FFT_TABLE_H */
--- a/libavcodec/fft_template.c
+++ b/libavcodec/fft_template.c
@@ -35,6 +35,13 @@

 #if FFT_FIXED_32
 #include "fft_table.h"
+
+static void av_cold fft_lut_init(void)
+{
+    int n = 0;
+    ff_fft_lut_init(ff_fft_offsets_lut, 0, 1 << 17, &n);
+}
+
 #else /* FFT_FIXED_32 */

 /* cos(2*pi*x/n) for 0<=x<=n/4, followed by its reverse */
@@ -229,7 +236,10 @@ av_cold int ff_fft_init(FFTContext *s, int nbits, int inverse)
 #endif

 #if FFT_FIXED_32
-    ff_fft_lut_init();
+    {
+        static AVOnce control = AV_ONCE_INIT;
+        ff_thread_once(&control, fft_lut_init);
+    }
 #else /* FFT_FIXED_32 */
 #if FFT_FLOAT
    if (ARCH_AARCH64) ff_fft_init_aarch64(s);
--- a/libavcodec/ffv1.c
+++ b/libavcodec/ffv1.c
@@ -115,11 +115,12 @@ av_cold int ff_ffv1_init_slices_state(FFV1Context *f)

 av_cold int ff_ffv1_init_slice_contexts(FFV1Context *f)
 {
-    int i, max_slice_count = f->num_h_slices * f->num_v_slices;
+    int i;

-    av_assert0(max_slice_count > 0);
+    f->max_slice_count = f->num_h_slices * f->num_v_slices;
+    av_assert0(f->max_slice_count > 0);

-    for (i = 0; i < max_slice_count; i++) {
+    for (i = 0; i < f->max_slice_count; i++) {
        int sx          = i % f->num_h_slices;
        int sy          = i / f->num_h_slices;
        int sxs         = f->avctx->width  *  sx      / f->num_h_slices;
@@ -151,7 +152,6 @@ av_cold int ff_ffv1_init_slice_contexts(FFV1Context *f)
            goto memfail;
        }
    }
-    f->max_slice_count = max_slice_count;
    return 0;

 memfail:
--- a/libavcodec/ffv1dec.c
+++ b/libavcodec/ffv1dec.c
@@ -166,34 +166,24 @@ static int decode_slice_header(FFV1Context *f, FFV1Context *fs)
    RangeCoder *c = &fs->c;
    uint8_t state[CONTEXT_SIZE];
    unsigned ps, i, context_count;
-    int sx, sy, sw, sh;
-
    memset(state, 128, sizeof(state));
-    sx = get_symbol(c, state, 0);
-    sy = get_symbol(c, state, 0);
-    sw = get_symbol(c, state, 0) + 1U;
-    sh = get_symbol(c, state, 0) + 1U;

    av_assert0(f->version > 2);

+    fs->slice_x      =  get_symbol(c, state, 0)      * f->width ;
+    fs->slice_y      =  get_symbol(c, state, 0)      * f->height;
+    fs->slice_width  = (get_symbol(c, state, 0) + 1) * f->width  + fs->slice_x;
+    fs->slice_height = (get_symbol(c, state, 0) + 1) * f->height + fs->slice_y;

-    if (sx < 0 || sy < 0 || sw <= 0 || sh <= 0)
-        return AVERROR_INVALIDDATA;
-    if (sx > f->num_h_slices - sw || sy > f->num_v_slices - sh)
-        return AVERROR_INVALIDDATA;
-
-    fs->slice_x      =  sx       * (int64_t)f->width  / f->num_h_slices;
-    fs->slice_y      =  sy       * (int64_t)f->height / f->num_v_slices;
-    fs->slice_width  = (sx + sw) * (int64_t)f->width  / f->num_h_slices - fs->slice_x;
-    fs->slice_height = (sy + sh) * (int64_t)f->height / f->num_v_slices - fs->slice_y;
-
-    av_assert0((unsigned)fs->slice_width  <= f->width &&
-                (unsigned)fs->slice_height <= f->height);
-    av_assert0 (   (unsigned)fs->slice_x + (uint64_t)fs->slice_width  <= f->width
-                && (unsigned)fs->slice_y + (uint64_t)fs->slice_height <= f->height);
-
-    if (fs->ac == AC_GOLOMB_RICE && fs->slice_width >= (1<<23))
-        return AVERROR_INVALIDDATA;
+    fs->slice_x /= f->num_h_slices;
+    fs->slice_y /= f->num_v_slices;
+    fs->slice_width  = fs->slice_width /f->num_h_slices - fs->slice_x;
+    fs->slice_height = fs->slice_height/f->num_v_slices - fs->slice_y;
+    if ((unsigned)fs->slice_width > f->width || (unsigned)fs->slice_height > f->height)
+        return -1;
+    if (    (unsigned)fs->slice_x + (uint64_t)fs->slice_width  > f->width
+         || (unsigned)fs->slice_y + (uint64_t)fs->slice_height > f->height)
+        return -1;

    for (i = 0; i < f->plane_count; i++) {
        PlaneContext * const p = &fs->plane[i];
@@ -308,11 +298,8 @@ static int decode_slice(AVCodecContext *c, void *arg)
    }
    if ((ret = ff_ffv1_init_slice_state(f, fs)) < 0)
        return ret;
-    if (f->cur->key_frame || fs->slice_reset_contexts) {
+    if (f->cur->key_frame || fs->slice_reset_contexts)
        ff_ffv1_clear_slice_state(f, fs);
-    } else if (fs->slice_damaged) {
-        return AVERROR_INVALIDDATA;
-    }

    width  = fs->slice_width;
    height = fs->slice_height;
@@ -475,11 +462,6 @@ static int read_extra_header(FFV1Context *f)
        return AVERROR_INVALIDDATA;
    }

-    if (f->num_h_slices > MAX_SLICES / f->num_v_slices) {
-        av_log(f->avctx, AV_LOG_ERROR, "slice count unsupported\n");
-        return AVERROR_PATCHWELCOME;
-    }
-
    f->quant_table_count = get_symbol(c, state, 0);
    if (f->quant_table_count > (unsigned)MAX_QUANT_TABLES || !f->quant_table_count) {
        av_log(f->avctx, AV_LOG_ERROR, "quant table count %d is invalid\n", f->quant_table_count);
@@ -782,25 +764,21 @@ static int read_header(FFV1Context *f)
        fs->slice_damaged = 0;

        if (f->version == 2) {
-            int sx = get_symbol(c, state, 0);
-            int sy = get_symbol(c, state, 0);
-            int sw = get_symbol(c, state, 0) + 1U;
-            int sh = get_symbol(c, state, 0) + 1U;
+            fs->slice_x      =  get_symbol(c, state, 0)      * f->width ;
+            fs->slice_y      =  get_symbol(c, state, 0)      * f->height;
+            fs->slice_width  = (get_symbol(c, state, 0) + 1) * f->width  + fs->slice_x;
+            fs->slice_height = (get_symbol(c, state, 0) + 1) * f->height + fs->slice_y;

-            if (sx < 0 || sy < 0 || sw <= 0 || sh <= 0)
+            fs->slice_x     /= f->num_h_slices;
+            fs->slice_y     /= f->num_v_slices;
+            fs->slice_width  = fs->slice_width  / f->num_h_slices - fs->slice_x;
+            fs->slice_height = fs->slice_height / f->num_v_slices - fs->slice_y;
+            if ((unsigned)fs->slice_width  > f->width ||
+                (unsigned)fs->slice_height > f->height)
                return AVERROR_INVALIDDATA;
-            if (sx > f->num_h_slices - sw || sy > f->num_v_slices - sh)
+            if (   (unsigned)fs->slice_x + (uint64_t)fs->slice_width  > f->width
+                || (unsigned)fs->slice_y + (uint64_t)fs->slice_height > f->height)
                return AVERROR_INVALIDDATA;
-
-            fs->slice_x      =  sx       * (int64_t)f->width  / f->num_h_slices;
-            fs->slice_y      =  sy       * (int64_t)f->height / f->num_v_slices;
-            fs->slice_width  = (sx + sw) * (int64_t)f->width  / f->num_h_slices - fs->slice_x;
-            fs->slice_height = (sy + sh) * (int64_t)f->height / f->num_v_slices - fs->slice_y;
-
-            av_assert0((unsigned)fs->slice_width  <= f->width &&
-                       (unsigned)fs->slice_height <= f->height);
-            av_assert0 (   (unsigned)fs->slice_x + (uint64_t)fs->slice_width  <= f->width
-                        && (unsigned)fs->slice_y + (uint64_t)fs->slice_height <= f->height);
        }

        for (i = 0; i < f->plane_count; i++) {
@@ -808,7 +786,7 @@ static int read_header(FFV1Context *f)

            if (f->version == 2) {
                int idx = get_symbol(c, state, 0);
-                if (idx >= (unsigned)f->quant_table_count) {
+                if (idx > (unsigned)f->quant_table_count) {
                    av_log(f->avctx, AV_LOG_ERROR,
                           "quant_table_index out of range\n");
                    return AVERROR_INVALIDDATA;
@@ -910,10 +888,8 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac
        int trailer = 3 + 5*!!f->ec;
        int v;

-        if (i || f->version > 2) {
-            if (trailer > buf_p - buf) v = INT_MAX;
-            else                       v = AV_RB24(buf_p-trailer) + trailer;
-        } else                         v = buf_p - c->bytestream_start;
+        if (i || f->version > 2) v = AV_RB24(buf_p-trailer) + trailer;
+        else                     v = buf_p - c->bytestream_start;
        if (buf_p - c->bytestream_start < v) {
            av_log(avctx, AV_LOG_ERROR, "Slice pointer chain broken\n");
            ff_thread_report_progress(&f->picture, INT_MAX, 0);
--- a/libavcodec/ffv1dec_template.c
+++ b/libavcodec/ffv1dec_template.c
@@ -93,11 +93,11 @@ static av_always_inline int RENAME(decode_line)(FFV1Context *s, int w,
                        run_count--;
                    }
                } else {
-                    while (run_count > 1 && w-x > 1) {
-                        sample[1][x] = RENAME(predict)(sample[1] + x, sample[0] + x);
-                        x++;
-                        run_count--;
-                    }
+                while (run_count > 1 && w-x > 1) {
+                    sample[1][x] = RENAME(predict)(sample[1] + x, sample[0] + x);
+                    x++;
+                    run_count--;
+                }
                }
                run_count--;
                if (run_count < 0) {
--- a/libavcodec/ffv1enc.c
+++ b/libavcodec/ffv1enc.c
@@ -1354,5 +1354,4 @@ AVCodec ff_ffv1_encoder = {
    .defaults       = ffv1_defaults,
 #endif
    .priv_class     = &ffv1_class,
-    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
 };
--- a/libavcodec/ffwavesynth.c
+++ b/libavcodec/ffwavesynth.c
@@ -188,7 +188,7 @@ static uint64_t frac64(uint64_t a, uint64_t b)

 static uint64_t phi_at(struct ws_interval *in, int64_t ts)
 {
-    uint64_t dt = ts - (uint64_t)in->ts_start;
+    uint64_t dt = ts - in->ts_start;
    uint64_t dt2 = dt & 1 ? /* dt * (dt - 1) / 2 without overflow */
                   dt * ((dt - 1) >> 1) : (dt >> 1) * (dt - 1);
    return in->phi0 + dt * in->dphi0 + dt2 * in->ddphi;
@@ -373,7 +373,7 @@ static void wavesynth_synth_sample(struct wavesynth_context *ws, int64_t ts,
        in->amp  += in->damp;
        switch (in->type) {
            case WS_SINE:
-                val = amp * (unsigned)ws->sin[in->phi >> (64 - SIN_BITS)];
+                val = amp * ws->sin[in->phi >> (64 - SIN_BITS)];
                in->phi  += in->dphi;
                in->dphi += in->ddphi;
                break;
@@ -444,7 +444,7 @@ static int wavesynth_decode(AVCodecContext *avc, void *rframe, int *rgot_frame,
    if (r < 0)
        return r;
    pcm = (int16_t *)frame->data[0];
-    for (s = 0; s < duration; s++, ts+=(uint64_t)1) {
+    for (s = 0; s < duration; s++, ts++) {
        memset(channels, 0, avc->channels * sizeof(*channels));
        if (ts >= ws->next_ts)
            wavesynth_enter_intervals(ws, ts);
@@ -452,7 +452,7 @@ static int wavesynth_decode(AVCodecContext *avc, void *rframe, int *rgot_frame,
        for (c = 0; c < avc->channels; c++)
            *(pcm++) = channels[c] >> 16;
    }
-    ws->cur_ts += (uint64_t)duration;
+    ws->cur_ts += duration;
    *rgot_frame = 1;
    return packet->size;
 }
--- a/libavcodec/fits.c
+++ b/libavcodec/fits.c
@@ -187,8 +187,6 @@ int avpriv_fits_header_parse_line(void *avcl, FITSHeader *header, const uint8_t
            header->blank = t;
            header->blank_found = 1;
        } else if (!strcmp(keyword, "BSCALE") && sscanf(value, "%lf", &d) == 1) {
-            if (d <= 0)
-                return AVERROR_INVALIDDATA;
            header->bscale = d;
        } else if (!strcmp(keyword, "BZERO") && sscanf(value, "%lf", &d) == 1) {
            header->bzero = d;
@@ -205,12 +203,8 @@ int avpriv_fits_header_parse_line(void *avcl, FITSHeader *header, const uint8_t
        } else if (!strcmp(keyword, "GROUPS") && sscanf(value, "%c", &c) == 1) {
            header->groups = (c == 'T');
        } else if (!strcmp(keyword, "GCOUNT") && sscanf(value, "%"SCNd64"", &t) == 1) {
-            if (t < 0 || t > INT_MAX)
-                return AVERROR_INVALIDDATA;
            header->gcount = t;
        } else if (!strcmp(keyword, "PCOUNT") && sscanf(value, "%"SCNd64"", &t) == 1) {
-            if (t < 0 || t > INT_MAX)
-                return AVERROR_INVALIDDATA;
            header->pcount = t;
        }
        dict_set_if_not_null(metadata, keyword, value);
--- a/libavcodec/flac_parser.c
+++ b/libavcodec/flac_parser.c
@@ -55,7 +55,6 @@

 /** largest possible size of flac header */
 #define MAX_FRAME_HEADER_SIZE 16
-#define MAX_FRAME_VERIFY_SIZE (MAX_FRAME_HEADER_SIZE)

 typedef struct FLACHeaderMarker {
    int offset;       /**< byte offset from start of FLACParseContext->buffer */
@@ -171,7 +170,7 @@ static int find_headers_search_validate(FLACParseContext *fpc, int offset)
    uint8_t *header_buf;
    int size = 0;
    header_buf = flac_fifo_read_wrap(fpc, offset,
-                                     MAX_FRAME_VERIFY_SIZE + AV_INPUT_BUFFER_PADDING_SIZE,
+                                     MAX_FRAME_HEADER_SIZE,
                                     &fpc->wrap_buf,
                                     &fpc->wrap_buf_allocated_size);
    if (frame_header_is_valid(fpc->avctx, header_buf, &fi)) {
--- a/libavcodec/flacdec.c
+++ b/libavcodec/flacdec.c
@@ -262,7 +262,7 @@ static int decode_residuals(FLACContext *s, int32_t *decoded, int pred_order)
        } else {
            int real_limit = tmp ? (INT_MAX >> tmp) + 2 : INT_MAX;
            for (; i < samples; i++) {
-                int v = get_sr_golomb_flac(&gb, tmp, real_limit, 1);
+                int v = get_sr_golomb_flac(&gb, tmp, real_limit, 0);
                if (v == 0x80000000){
                    av_log(s->avctx, AV_LOG_ERROR, "invalid residual\n");
                    return AVERROR_INVALIDDATA;
--- a/libavcodec/flashsv2enc.c
+++ b/libavcodec/flashsv2enc.c
@@ -231,13 +231,6 @@ static av_cold int flashsv2_encode_init(AVCodecContext * avctx)
    s->key_frame     = av_mallocz(s->frame_size);
    s->frame_blocks  = av_mallocz(s->blocks_size);
    s->key_blocks    = av_mallocz(s->blocks_size);
-    if (!s->encbuffer || !s->keybuffer || !s->databuffer
-        || !s->current_frame || !s->key_frame || !s->key_blocks
-        || !s->frame_blocks) {
-        av_log(avctx, AV_LOG_ERROR, "Memory allocation failed.\n");
-        cleanup(s);
-        return AVERROR(ENOMEM);
-    }

    s->blockbuffer      = NULL;
    s->blockbuffer_size = 0;
@@ -252,6 +245,14 @@ static av_cold int flashsv2_encode_init(AVCodecContext * avctx)
    s->use_custom_palette =  0;
    s->palette_type       = -1;        // so that the palette will be generated in reconfigure_at_keyframe

+    if (!s->encbuffer || !s->keybuffer || !s->databuffer
+        || !s->current_frame || !s->key_frame || !s->key_blocks
+        || !s->frame_blocks) {
+        av_log(avctx, AV_LOG_ERROR, "Memory allocation failed.\n");
+        cleanup(s);
+        return -1;
+    }
+
    return 0;
 }

--- a/libavcodec/flashsvenc.c
+++ b/libavcodec/flashsvenc.c
@@ -59,11 +59,11 @@ typedef struct FlashSVContext {
    uint8_t        *previous_frame;
    int             image_width, image_height;
    int             block_width, block_height;
+    uint8_t        *tmpblock;
    uint8_t        *encbuffer;
    int             block_size;
    z_stream        zstream;
    int             last_key_frame;
-    uint8_t         tmpblock[3 * 256 * 256];
 } FlashSVContext;

 static int copy_region_enc(uint8_t *sptr, uint8_t *dptr, int dx, int dy,
@@ -96,6 +96,7 @@ static av_cold int flashsv_encode_end(AVCodecContext *avctx)

    av_freep(&s->encbuffer);
    av_freep(&s->previous_frame);
+    av_freep(&s->tmpblock);

    return 0;
 }
@@ -120,9 +121,10 @@ static av_cold int flashsv_encode_init(AVCodecContext *avctx)
    s->image_width  = avctx->width;
    s->image_height = avctx->height;

+    s->tmpblock  = av_mallocz(3 * 256 * 256);
    s->encbuffer = av_mallocz(s->image_width * s->image_height * 3);

-    if (!s->encbuffer) {
+    if (!s->tmpblock || !s->encbuffer) {
        av_log(avctx, AV_LOG_ERROR, "Memory allocation failed.\n");
        return AVERROR(ENOMEM);
    }
--- a/libavcodec/flicvideo.c
+++ b/libavcodec/flicvideo.c
@@ -735,8 +735,6 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                bytestream2_skip(&g2, chunk_size - 6);
            } else {

-                if (bytestream2_get_bytes_left(&g2) < 2 * s->avctx->width * s->avctx->height )
-                    return AVERROR_INVALIDDATA;
                for (y_ptr = 0; y_ptr < s->frame->linesize[0] * s->avctx->height;
                     y_ptr += s->frame->linesize[0]) {

--- a/libavcodec/flvenc.c
+++ b/libavcodec/flvenc.c
@@ -107,6 +107,7 @@ AVCodec ff_flv_encoder = {
    .init           = ff_mpv_encode_init,
    .encode2        = ff_mpv_encode_picture,
    .close          = ff_mpv_encode_end,
+    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
    .pix_fmts       = (const enum AVPixelFormat[]) { AV_PIX_FMT_YUV420P,
                                                     AV_PIX_FMT_NONE},
    .priv_class     = &flv_class,
--- a/libavcodec/fmvc.c
+++ b/libavcodec/fmvc.c
@@ -401,17 +401,20 @@ static int decode_frame(AVCodecContext *avctx, void *data,
    PutByteContext *pb = &s->pb;
    AVFrame *frame = data;
    int ret, y, x;
-    int key_frame;

    if (avpkt->size < 8)
        return AVERROR_INVALIDDATA;

+    if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
+        return ret;
+
    bytestream2_init(gb, avpkt->data, avpkt->size);
    bytestream2_skip(gb, 2);

-    key_frame = !!bytestream2_get_le16(gb);
+    frame->key_frame = !!bytestream2_get_le16(gb);
+    frame->pict_type = frame->key_frame ? AV_PICTURE_TYPE_I : AV_PICTURE_TYPE_P;

-    if (key_frame) {
+    if (frame->key_frame) {
        const uint8_t *src;
        unsigned type, size;
        uint8_t *dst;
@@ -431,12 +434,6 @@ static int decode_frame(AVCodecContext *avctx, void *data,
            return AVERROR_PATCHWELCOME;
        }

-        if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
-            return ret;
-
-        frame->key_frame = 1;
-        frame->pict_type = AV_PICTURE_TYPE_I;
-
        src = s->buffer;
        dst = frame->data[0] + (avctx->height - 1) * frame->linesize[0];
        for (y = 0; y < avctx->height; y++) {
@@ -515,12 +512,6 @@ static int decode_frame(AVCodecContext *avctx, void *data,
            dst = &rect[block_h * s->stride];
        }

-        if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
-            return ret;
-
-        frame->key_frame = 0;
-        frame->pict_type = AV_PICTURE_TYPE_P;
-
        ssrc = s->buffer;
        ddst = frame->data[0] + (avctx->height - 1) * frame->linesize[0];
        for (y = 0; y < avctx->height; y++) {
--- a/libavcodec/frame_thread_encoder.c
+++ b/libavcodec/frame_thread_encoder.c
@@ -118,7 +118,7 @@ end:
 int ff_frame_thread_encoder_init(AVCodecContext *avctx, AVDictionary *options){
    int i=0;
    ThreadContext *c;
-    AVCodecContext *thread_avctx = NULL;
+

    if(   !(avctx->thread_type & FF_THREAD_FRAME)
       || !(avctx->codec->capabilities & AV_CODEC_CAP_FRAME_THREADS))
@@ -182,10 +182,8 @@ int ff_frame_thread_encoder_init(AVCodecContext *avctx, AVDictionary *options){
    c->parent_avctx = avctx;

    c->task_fifo = av_fifo_alloc_array(BUFFER_SIZE, sizeof(Task));
-    if (!c->task_fifo) {
-        av_freep(&avctx->internal->frame_thread_encoder);
-        return AVERROR(ENOMEM);
-    }
+    if(!c->task_fifo)
+        goto fail;

    pthread_mutex_init(&c->task_fifo_mutex, NULL);
    pthread_mutex_init(&c->finished_task_mutex, NULL);
@@ -198,17 +196,16 @@ int ff_frame_thread_encoder_init(AVCodecContext *avctx, AVDictionary *options){
        AVDictionary *tmp = NULL;
        int ret;
        void *tmpv;
-        thread_avctx = avcodec_alloc_context3(avctx->codec);
+        AVCodecContext *thread_avctx = avcodec_alloc_context3(avctx->codec);
        if(!thread_avctx)
            goto fail;
        tmpv = thread_avctx->priv_data;
        *thread_avctx = *avctx;
-        thread_avctx->priv_data = tmpv;
-        thread_avctx->internal = NULL;
-        thread_avctx->hw_frames_ctx = NULL;
        ret = av_opt_copy(thread_avctx, avctx);
        if (ret < 0)
            goto fail;
+        thread_avctx->priv_data = tmpv;
+        thread_avctx->internal = NULL;
        if (avctx->codec->priv_class) {
            int ret = av_opt_copy(thread_avctx->priv_data, avctx->priv_data);
            if (ret < 0)
@@ -237,8 +234,6 @@ int ff_frame_thread_encoder_init(AVCodecContext *avctx, AVDictionary *options){

    return 0;
 fail:
-    avcodec_close(thread_avctx);
-    av_freep(&thread_avctx);
    avctx->thread_count = i;
    av_log(avctx, AV_LOG_ERROR, "ff_frame_thread_encoder_init failed\n");
    ff_frame_thread_encoder_free(avctx);
--- a/libavcodec/frame_thread_encoder.h
+++ b/libavcodec/frame_thread_encoder.h
@@ -23,10 +23,6 @@

 #include "avcodec.h"

-/**
- * Initialize frame thread encoder.
- * @note hardware encoders are not supported
- */
 int ff_frame_thread_encoder_init(AVCodecContext *avctx, AVDictionary *options);
 void ff_frame_thread_encoder_free(AVCodecContext *avctx);
 int ff_thread_video_encode_frame(AVCodecContext *avctx, AVPacket *pkt, const AVFrame *frame, int *got_packet_ptr);
--- a/libavcodec/g722enc.c
+++ b/libavcodec/g722enc.c
@@ -59,11 +59,27 @@ static av_cold int g722_encode_close(AVCodecContext *avctx)
 static av_cold int g722_encode_init(AVCodecContext * avctx)
 {
    G722Context *c = avctx->priv_data;
+    int ret;

    c->band[0].scale_factor = 8;
    c->band[1].scale_factor = 2;
    c->prev_samples_pos = 22;

+    if (avctx->trellis) {
+        int frontier = 1 << avctx->trellis;
+        int max_paths = frontier * FREEZE_INTERVAL;
+        int i;
+        for (i = 0; i < 2; i++) {
+            c->paths[i] = av_mallocz_array(max_paths, sizeof(**c->paths));
+            c->node_buf[i] = av_mallocz_array(frontier, 2 * sizeof(**c->node_buf));
+            c->nodep_buf[i] = av_mallocz_array(frontier, 2 * sizeof(**c->nodep_buf));
+            if (!c->paths[i] || !c->node_buf[i] || !c->nodep_buf[i]) {
+                ret = AVERROR(ENOMEM);
+                goto error;
+            }
+        }
+    }
+
    if (avctx->frame_size) {
        /* validate frame size */
        if (avctx->frame_size & 1 || avctx->frame_size > MAX_FRAME_SIZE) {
@@ -97,23 +113,14 @@ static av_cold int g722_encode_init(AVCodecContext * avctx)
                   avctx->trellis);
            avctx->trellis = new_trellis;
        }
-        if (avctx->trellis) {
-            int frontier = 1 << avctx->trellis;
-            int max_paths = frontier * FREEZE_INTERVAL;
-
-            for (int i = 0; i < 2; i++) {
-                c->paths[i]     = av_calloc(max_paths, sizeof(**c->paths));
-                c->node_buf[i]  = av_calloc(frontier, 2 * sizeof(**c->node_buf));
-                c->nodep_buf[i] = av_calloc(frontier, 2 * sizeof(**c->nodep_buf));
-                if (!c->paths[i] || !c->node_buf[i] || !c->nodep_buf[i])
-                    return AVERROR(ENOMEM);
-            }
-        }
    }

    ff_g722dsp_init(&c->dsp);

    return 0;
+error:
+    g722_encode_close(avctx);
+    return ret;
 }

 static const int16_t low_quant[33] = {
@@ -380,5 +387,4 @@ AVCodec ff_adpcm_g722_encoder = {
    .capabilities    = AV_CODEC_CAP_SMALL_LAST_FRAME,
    .sample_fmts     = (const enum AVSampleFormat[]){ AV_SAMPLE_FMT_S16, AV_SAMPLE_FMT_NONE },
    .channel_layouts = (const uint64_t[]){ AV_CH_LAYOUT_MONO, 0 },
-    .caps_internal   = FF_CODEC_CAP_INIT_CLEANUP,
 };
--- a/libavcodec/g729_parser.c
+++ b/libavcodec/g729_parser.c
@@ -49,9 +49,6 @@ static int g729_parse(AVCodecParserContext *s1, AVCodecContext *avctx,
        s->block_size = (avctx->bit_rate < 8000) ? G729D_6K4_BLOCK_SIZE : G729_8K_BLOCK_SIZE;
        if (avctx->codec_id == AV_CODEC_ID_ACELP_KELVIN)
            s->block_size++;
-        // channels > 2 is invalid, we pass the packet on unchanged
-        if (avctx->channels > 2)
-            s->block_size = 0;
        s->block_size *= avctx->channels;
        s->duration   = avctx->frame_size;
    }
--- a/libavcodec/g729postfilter.c
+++ b/libavcodec/g729postfilter.c
@@ -350,7 +350,7 @@ static int16_t long_term_filter(AudioDSPContext *adsp, int pitch_delay_int,
        if (tmp > 0)
            L_temp0 >>= tmp;
        else
-            L_temp1 >>= FFMIN(-tmp, 31);
+            L_temp1 >>= -tmp;

        /* Check if longer filter increases the values of R'(k). */
        if (L_temp1 > L_temp0) {
--- a/libavcodec/gif.c
+++ b/libavcodec/gif.c
@@ -497,5 +497,4 @@ AVCodec ff_gif_encoder = {
        AV_PIX_FMT_GRAY8, AV_PIX_FMT_PAL8, AV_PIX_FMT_NONE
    },
    .priv_class     = &gif_class,
-    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
 };
--- a/libavcodec/h261enc.c
+++ b/libavcodec/h261enc.c
@@ -394,6 +394,7 @@ AVCodec ff_h261_encoder = {
    .init           = ff_mpv_encode_init,
    .encode2        = ff_mpv_encode_picture,
    .close          = ff_mpv_encode_end,
+    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
    .pix_fmts       = (const enum AVPixelFormat[]) { AV_PIX_FMT_YUV420P,
                                                     AV_PIX_FMT_NONE },
    .priv_class     = &h261_class,
--- a/libavcodec/h263dec.c
+++ b/libavcodec/h263dec.c
@@ -544,8 +544,6 @@ retry:
    avctx->has_b_frames = !s->low_delay;

    if (CONFIG_MPEG4_DECODER && avctx->codec_id == AV_CODEC_ID_MPEG4) {
-        if (s->pict_type != AV_PICTURE_TYPE_B && s->mb_num/2 > get_bits_left(&s->gb))
-            return AVERROR_INVALIDDATA;
        if (ff_mpeg4_workaround_bugs(avctx) == 1)
            goto retry;
        if (s->studio_profile != (s->idsp.idct == NULL))
--- a/libavcodec/h264_metadata_bsf.c
+++ b/libavcodec/h264_metadata_bsf.c
@@ -528,7 +528,7 @@ static int h264_metadata_filter(AVBSFContext *bsf, AVPacket *pkt)
                if (err < 0) {
                    av_log(bsf, AV_LOG_ERROR, "Failed to attach extracted "
                           "displaymatrix side data to packet.\n");
-                    av_free(matrix);
+                    av_freep(matrix);
                    goto fail;
                }
            }
--- a/libavcodec/h264_slice.c
+++ b/libavcodec/h264_slice.c
@@ -304,8 +304,9 @@ int ff_h264_update_thread_context(AVCodecContext *dst,
    if (dst == src)
        return 0;

-    if (inited && !h1->ps.sps)
-        return AVERROR_INVALIDDATA;
+    // We can't fail if SPS isn't set at it breaks current skip_frame code
+    //if (!h1->ps.sps)
+    //    return AVERROR_INVALIDDATA;

    if (inited &&
        (h->width                 != h1->width                 ||
@@ -911,11 +912,6 @@ static int h264_slice_header_init(H264Context *h)
    const SPS *sps = h->ps.sps;
    int i, ret;

-    if (!sps) {
-        ret = AVERROR_INVALIDDATA;
-        goto fail;
-    }
-
    ff_set_sar(h->avctx, sps->sar);
    av_pix_fmt_get_chroma_sub_sample(h->avctx->pix_fmt,
                                     &h->chroma_x_shift, &h->chroma_y_shift);
@@ -1603,7 +1599,7 @@ static int h264_field_start(H264Context *h, const H264SliceContext *sl,
                              prev->f->format,
                              prev->f->width,
                              prev->f->height);
-                h->short_ref[0]->poc = prev->poc + 2U;
+                h->short_ref[0]->poc = prev->poc + 2;
            } else if (!h->frame_recovered && !h->avctx->hwaccel)
                ff_color_frame(h->short_ref[0]->f, c);
            h->short_ref[0]->frame_num = h->poc.prev_frame_num;
@@ -1823,8 +1819,6 @@ static int h264_slice_header_parse(const H264Context *h, H264SliceContext *sl,
    if (nal->type == H264_NAL_IDR_SLICE)
        get_ue_golomb_long(&sl->gb); /* idr_pic_id */

-    sl->poc_lsb = 0;
-    sl->delta_poc_bottom = 0;
    if (sps->poc_type == 0) {
        sl->poc_lsb = get_bits(&sl->gb, sps->log2_max_poc_lsb);

@@ -1832,7 +1826,6 @@ static int h264_slice_header_parse(const H264Context *h, H264SliceContext *sl,
            sl->delta_poc_bottom = get_se_golomb(&sl->gb);
    }

-    sl->delta_poc[0] = sl->delta_poc[1] = 0;
    if (sps->poc_type == 1 && !sps->delta_pic_order_always_zero_flag) {
        sl->delta_poc[0] = get_se_golomb(&sl->gb);

--- a/libavcodec/h264dec.c
+++ b/libavcodec/h264dec.c
@@ -679,10 +679,6 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size)
            avpriv_request_sample(avctx, "data partitioning");
            break;
        case H264_NAL_SEI:
-            if (h->setup_finished) {
-                avpriv_request_sample(avctx, "Late SEI");
-                break;
-            }
            ret = ff_h264_sei_decode(&h->sei, &nal->gb, &h->ps, avctx);
            h->has_recovery_point = h->has_recovery_point || h->sei.recovery_point.recovery_frame_cnt != -1;
            if (avctx->debug & FF_DEBUG_GREEN_MD)
@@ -943,7 +939,7 @@ static int finalize_frame(H264Context *h, AVFrame *dst, H264Picture *out, int *g
                                 out->qscale_table,
                                 out->motion_val,
                                 NULL,
-                                 out->mb_width, out->mb_height, out->mb_stride, 1);
+                                 h->mb_width, h->mb_height, h->mb_stride, 1);
        }
    }

--- a/libavcodec/h264idct_template.c
+++ b/libavcodec/h264idct_template.c
@@ -278,13 +278,13 @@ void FUNCC(ff_h264_chroma422_dc_dequant_idct)(int16_t *_block, int qmul){
    const int stride= 16*2;
    const int xStride= 16;
    int i;
-    unsigned temp[8];
+    int temp[8];
    static const uint8_t x_offset[2]={0, 16};
    dctcoef *block = (dctcoef*)_block;

    for(i=0; i<4; i++){
-        temp[2*i+0] = block[stride*i + xStride*0] + (unsigned)block[stride*i + xStride*1];
-        temp[2*i+1] = block[stride*i + xStride*0] - (unsigned)block[stride*i + xStride*1];
+        temp[2*i+0] = block[stride*i + xStride*0] + block[stride*i + xStride*1];
+        temp[2*i+1] = block[stride*i + xStride*0] - block[stride*i + xStride*1];
    }

    for(i=0; i<2; i++){
--- a/libavcodec/h265_metadata_bsf.c
+++ b/libavcodec/h265_metadata_bsf.c
@@ -415,7 +415,7 @@ static int h265_metadata_filter(AVBSFContext *bsf, AVPacket *pkt)
    }

    // If an AUD is present, it must be the first NAL unit.
-    if (au->nb_units && au->units[0].type == HEVC_NAL_AUD) {
+    if (au->units[0].type == HEVC_NAL_AUD) {
        if (ctx->aud == REMOVE)
            ff_cbs_delete_unit(ctx->cbc, au, 0);
    } else {
--- a/libavcodec/hap.h
+++ b/libavcodec/hap.h
@@ -52,7 +52,7 @@ enum HapSectionType {

 typedef struct HapChunk {
    enum HapCompressor compressor;
-    uint32_t compressed_offset;
+    int compressed_offset;
    size_t compressed_size;
    int uncompressed_offset;
    size_t uncompressed_size;
--- a/libavcodec/hapdec.c
+++ b/libavcodec/hapdec.c
@@ -105,8 +105,6 @@ static int hap_parse_decode_instructions(HapContext *ctx, int size)
        size_t running_size = 0;
        for (i = 0; i < ctx->chunk_count; i++) {
            ctx->chunks[i].compressed_offset = running_size;
-            if (ctx->chunks[i].compressed_size > UINT32_MAX - running_size)
-                return AVERROR_INVALIDDATA;
            running_size += ctx->chunks[i].compressed_size;
        }
    }
@@ -188,7 +186,7 @@ static int hap_parse_frame_header(AVCodecContext *avctx)
        HapChunk *chunk = &ctx->chunks[i];

        /* Check the compressed buffer is valid */
-        if (chunk->compressed_offset + (uint64_t)chunk->compressed_size > bytestream2_get_bytes_left(gbc))
+        if (chunk->compressed_offset + chunk->compressed_size > bytestream2_get_bytes_left(gbc))
            return AVERROR_INVALIDDATA;

        /* Chunks are unpacked sequentially, ctx->tex_size is the uncompressed
--- a/libavcodec/hcadec.c
+++ b/libavcodec/hcadec.c
@@ -157,10 +157,6 @@ static av_cold int decode_init(AVCodecContext *avctx)
    } else
        return AVERROR_INVALIDDATA;

-    if (c->total_band_count > FF_ARRAY_ELEMS(c->ch->imdct_in))
-        return AVERROR_INVALIDDATA;
-
-
    while (get_bits_left(gb) >= 32) {
        chunk = get_bits_long(gb, 32);
        if (chunk == MKBETAG('v', 'b', 'r', 0)) {
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .3.6
 .2.git