RELEASE_NOTES: Based on the version from 5.1

Name suggested by 7 people on ML

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Changelog

@@ -17,7 +17,7 @@ version 7.0:
 - qrencode filter and qrencodesrc source
 - quirc filter
 - lavu/eval: introduce randomi() function in expressions
-- VVC decoder
+- VVC decoder (experimental)
 - fsync filter
 - Raw Captions with Time (RCWT) closed caption muxer
 - ffmpeg CLI -bsf option may now be used for input as well as output
@@ -38,6 +38,15 @@ version 7.0:
 - ffplay with hwaccel decoding support (depends on vulkan renderer via libplacebo)
 - dnn filter libtorch backend
 - Android content URIs protocol
+- AOMedia Film Grain Synthesis 1 (AFGS1)
+- RISC-V optimizations for AAC, FLAC, JPEG-2000, LPC, RV4.0, SVQ, VC1, VP8, and more
+- Loongarch optimizations for HEVC decoding
+- Important AArch64 optimizations for HEVC
+- IAMF support inside MP4/ISOBMFF
+- Support for HEIF/AVIF still images and tiled still images
+- Dolby Vision profile 10 support in AV1
+- Support for Ambient Viewing Environment metadata in MP4/ISOBMFF
+- HDR10 metadata passthrough when encoding with libx264, libx265, and libsvtav1
 
 
 version 6.1:

RELEASE

@@ -1 +1 @@
-5.1.git
+7.0

RELEASE_NOTES

@@ -0,0 +1,15 @@
+
+            ┌─────────────────────────────────────────┐
+            │ RELEASE NOTES for FFmpeg 7.0 "Dijkstra" │
+            └─────────────────────────────────────────┘
+
+   The FFmpeg Project proudly presents FFmpeg 7.0 "Dijkstra", about 6
+   months after the release of FFmpeg 6.1.
+
+   A complete Changelog is available at the root of the project, and the
+   complete Git history on https://git.ffmpeg.org/gitweb/ffmpeg.git
+
+   We hope you will like this release as much as we enjoyed working on it, and
+   as usual, if you have any questions about it, or any FFmpeg related topic,
+   feel free to join us on the #ffmpeg IRC channel (on irc.libera.chat) or ask
+   on the mailing-lists.

configure

@@ -2851,6 +2851,7 @@ h264_sei_select="atsc_a53 golomb"
 hevcparse_select="golomb"
 hevc_sei_select="atsc_a53 golomb"
 frame_thread_encoder_deps="encoders threads"
+iamfdec_select="iso_media mpeg4audio"
 inflate_wrapper_deps="zlib"
 intrax8_select="blockdsp wmv2dsp"
 iso_media_select="mpeg4audio"
@@ -2894,7 +2895,7 @@ asv1_encoder_select="aandcttables bswapdsp fdctdsp pixblockdsp"
 asv2_decoder_select="blockdsp bswapdsp idctdsp"
 asv2_encoder_select="aandcttables bswapdsp fdctdsp pixblockdsp"
 atrac1_decoder_select="sinewin"
-av1_decoder_select="cbs_av1 atsc_a53"
+av1_decoder_select="atsc_a53 cbs_av1 dovi_rpu"
 bink_decoder_select="blockdsp hpeldsp"
 binkaudio_dct_decoder_select="wma_freqs"
 binkaudio_rdft_decoder_select="wma_freqs"
@@ -3483,7 +3484,7 @@ libcelt_decoder_deps="libcelt"
 libcodec2_decoder_deps="libcodec2"
 libcodec2_encoder_deps="libcodec2"
 libdav1d_decoder_deps="libdav1d"
-libdav1d_decoder_select="atsc_a53"
+libdav1d_decoder_select="atsc_a53 dovi_rpu"
 libdavs2_decoder_deps="libdavs2"
 libdavs2_decoder_select="avs2_parser"
 libfdk_aac_decoder_deps="libfdk_aac"

doc/Doxyfile

@@ -38,7 +38,7 @@ PROJECT_NAME           = FFmpeg
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         =
+PROJECT_NUMBER         = 7.0
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a

doc/developer.texi

@@ -390,6 +390,10 @@ If you apply a patch, send an
 answer to ffmpeg-devel (or wherever you got the patch from) saying that
 you applied the patch.
 
+@subheading Credit any researchers
+If a commit/patch fixes an issues found by some researcher, always credit the
+researcher in the commit message for finding/reporting the issue.
+
 @subheading Always wait long enough before pushing changes
 Do NOT commit to code actively maintained by others without permission.
 Send a patch to ffmpeg-devel. If no one answers within a reasonable

fftools/ffmpeg_sched.c

@@ -260,6 +260,12 @@ typedef struct SchFilterGraph {
     int                 task_exited;
 } SchFilterGraph;
 
+enum SchedulerState {
+    SCH_STATE_UNINIT,
+    SCH_STATE_STARTED,
+    SCH_STATE_STOPPED,
+};
+
 struct Scheduler {
     const AVClass      *class;
 
@@ -292,7 +298,7 @@ struct Scheduler {
     char               *sdp_filename;
     int                 sdp_auto;
 
-    int                 transcode_started;
+    enum SchedulerState state;
     atomic_int          terminate;
     atomic_int          task_failed;
 
@@ -399,22 +405,6 @@ static int queue_alloc(ThreadQueue **ptq, unsigned nb_streams, unsigned queue_si
 
 static void *task_wrapper(void *arg);
 
-static int task_stop(SchTask *task)
-{
-    int ret;
-    void *thread_ret;
-
-    if (!task->thread_running)
-        return 0;
-
-    ret = pthread_join(task->thread, &thread_ret);
-    av_assert0(ret == 0);
-
-    task->thread_running = 0;
-
-    return (intptr_t)thread_ret;
-}
-
 static int task_start(SchTask *task)
 {
     int ret;
@@ -468,59 +458,6 @@ static int64_t trailing_dts(const Scheduler *sch, int count_finished)
     return min_dts == INT64_MAX ? AV_NOPTS_VALUE : min_dts;
 }
 
-int sch_stop(Scheduler *sch, int64_t *finish_ts)
-{
-    int ret = 0, err;
-
-    atomic_store(&sch->terminate, 1);
-
-    for (unsigned type = 0; type < 2; type++)
-        for (unsigned i = 0; i < (type ? sch->nb_demux : sch->nb_filters); i++) {
-            SchWaiter *w = type ? &sch->demux[i].waiter : &sch->filters[i].waiter;
-            waiter_set(w, 1);
-        }
-
-    for (unsigned i = 0; i < sch->nb_demux; i++) {
-        SchDemux *d = &sch->demux[i];
-
-        err = task_stop(&d->task);
-        ret = err_merge(ret, err);
-    }
-
-    for (unsigned i = 0; i < sch->nb_dec; i++) {
-        SchDec *dec = &sch->dec[i];
-
-        err = task_stop(&dec->task);
-        ret = err_merge(ret, err);
-    }
-
-    for (unsigned i = 0; i < sch->nb_filters; i++) {
-        SchFilterGraph *fg = &sch->filters[i];
-
-        err = task_stop(&fg->task);
-        ret = err_merge(ret, err);
-    }
-
-    for (unsigned i = 0; i < sch->nb_enc; i++) {
-        SchEnc *enc = &sch->enc[i];
-
-        err = task_stop(&enc->task);
-        ret = err_merge(ret, err);
-    }
-
-    for (unsigned i = 0; i < sch->nb_mux; i++) {
-        SchMux *mux = &sch->mux[i];
-
-        err = task_stop(&mux->task);
-        ret = err_merge(ret, err);
-    }
-
-    if (finish_ts)
-        *finish_ts = trailing_dts(sch, 1);
-
-    return ret;
-}
-
 void sch_free(Scheduler **psch)
 {
     Scheduler *sch = *psch;
@@ -1213,7 +1150,8 @@ int sch_mux_stream_ready(Scheduler *sch, unsigned mux_idx, unsigned stream_idx)
 
     // this may be called during initialization - do not start
     // threads before sch_start() is called
-    if (++mux->nb_streams_ready == mux->nb_streams && sch->transcode_started)
+    if (++mux->nb_streams_ready == mux->nb_streams &&
+        sch->state >= SCH_STATE_STARTED)
         ret = mux_init(sch, mux);
 
     pthread_mutex_unlock(&sch->mux_ready_lock);
@@ -1583,7 +1521,8 @@ int sch_start(Scheduler *sch)
     if (ret < 0)
         return ret;
 
-    sch->transcode_started = 1;
+    av_assert0(sch->state == SCH_STATE_UNINIT);
+    sch->state = SCH_STATE_STARTED;
 
     for (unsigned i = 0; i < sch->nb_mux; i++) {
         SchMux *mux = &sch->mux[i];
@@ -1591,7 +1530,7 @@ int sch_start(Scheduler *sch)
         if (mux->nb_streams_ready == mux->nb_streams) {
             ret = mux_init(sch, mux);
             if (ret < 0)
-                return ret;
+                goto fail;
         }
     }
 
@@ -1600,7 +1539,7 @@ int sch_start(Scheduler *sch)
 
         ret = task_start(&enc->task);
         if (ret < 0)
-            return ret;
+            goto fail;
     }
 
     for (unsigned i = 0; i < sch->nb_filters; i++) {
@@ -1608,7 +1547,7 @@ int sch_start(Scheduler *sch)
 
         ret = task_start(&fg->task);
         if (ret < 0)
-            return ret;
+            goto fail;
     }
 
     for (unsigned i = 0; i < sch->nb_dec; i++) {
@@ -1616,7 +1555,7 @@ int sch_start(Scheduler *sch)
 
         ret = task_start(&dec->task);
         if (ret < 0)
-            return ret;
+            goto fail;
     }
 
     for (unsigned i = 0; i < sch->nb_demux; i++) {
@@ -1627,7 +1566,7 @@ int sch_start(Scheduler *sch)
 
         ret = task_start(&d->task);
         if (ret < 0)
-            return ret;
+            goto fail;
     }
 
     pthread_mutex_lock(&sch->schedule_lock);
@@ -1635,6 +1574,9 @@ int sch_start(Scheduler *sch)
     pthread_mutex_unlock(&sch->schedule_lock);
 
     return 0;
+fail:
+    sch_stop(sch, NULL);
+    return ret;
 }
 
 int sch_wait(Scheduler *sch, uint64_t timeout_us, int64_t *transcode_ts)
@@ -2483,6 +2425,18 @@ int sch_filter_command(Scheduler *sch, unsigned fg_idx, AVFrame *frame)
     return send_to_filter(sch, fg, fg->nb_inputs, frame);
 }
 
+static int task_cleanup(Scheduler *sch, SchedulerNode node)
+{
+    switch (node.type) {
+    case SCH_NODE_TYPE_DEMUX:       return demux_done (sch, node.idx);
+    case SCH_NODE_TYPE_MUX:         return mux_done   (sch, node.idx);
+    case SCH_NODE_TYPE_DEC:         return dec_done   (sch, node.idx);
+    case SCH_NODE_TYPE_ENC:         return enc_done   (sch, node.idx);
+    case SCH_NODE_TYPE_FILTER_IN:   return filter_done(sch, node.idx);
+    default: av_assert0(0);
+    }
+}
+
 static void *task_wrapper(void *arg)
 {
     SchTask  *task = arg;
@@ -2495,15 +2449,7 @@ static void *task_wrapper(void *arg)
         av_log(task->func_arg, AV_LOG_ERROR,
                "Task finished with error code: %d (%s)\n", ret, av_err2str(ret));
 
-    switch (task->node.type) {
-    case SCH_NODE_TYPE_DEMUX:       err = demux_done (sch, task->node.idx); break;
-    case SCH_NODE_TYPE_MUX:         err = mux_done   (sch, task->node.idx); break;
-    case SCH_NODE_TYPE_DEC:         err = dec_done   (sch, task->node.idx); break;
-    case SCH_NODE_TYPE_ENC:         err = enc_done   (sch, task->node.idx); break;
-    case SCH_NODE_TYPE_FILTER_IN:   err = filter_done(sch, task->node.idx); break;
-    default: av_assert0(0);
-    }
-
+    err = task_cleanup(sch, task->node);
     ret = err_merge(ret, err);
 
     // EOF is considered normal termination
@@ -2518,3 +2464,77 @@ static void *task_wrapper(void *arg)
 
     return (void*)(intptr_t)ret;
 }
+
+static int task_stop(Scheduler *sch, SchTask *task)
+{
+    int ret;
+    void *thread_ret;
+
+    if (!task->thread_running)
+        return task_cleanup(sch, task->node);
+
+    ret = pthread_join(task->thread, &thread_ret);
+    av_assert0(ret == 0);
+
+    task->thread_running = 0;
+
+    return (intptr_t)thread_ret;
+}
+
+int sch_stop(Scheduler *sch, int64_t *finish_ts)
+{
+    int ret = 0, err;
+
+    if (sch->state != SCH_STATE_STARTED)
+        return 0;
+
+    atomic_store(&sch->terminate, 1);
+
+    for (unsigned type = 0; type < 2; type++)
+        for (unsigned i = 0; i < (type ? sch->nb_demux : sch->nb_filters); i++) {
+            SchWaiter *w = type ? &sch->demux[i].waiter : &sch->filters[i].waiter;
+            waiter_set(w, 1);
+        }
+
+    for (unsigned i = 0; i < sch->nb_demux; i++) {
+        SchDemux *d = &sch->demux[i];
+
+        err = task_stop(sch, &d->task);
+        ret = err_merge(ret, err);
+    }
+
+    for (unsigned i = 0; i < sch->nb_dec; i++) {
+        SchDec *dec = &sch->dec[i];
+
+        err = task_stop(sch, &dec->task);
+        ret = err_merge(ret, err);
+    }
+
+    for (unsigned i = 0; i < sch->nb_filters; i++) {
+        SchFilterGraph *fg = &sch->filters[i];
+
+        err = task_stop(sch, &fg->task);
+        ret = err_merge(ret, err);
+    }
+
+    for (unsigned i = 0; i < sch->nb_enc; i++) {
+        SchEnc *enc = &sch->enc[i];
+
+        err = task_stop(sch, &enc->task);
+        ret = err_merge(ret, err);
+    }
+
+    for (unsigned i = 0; i < sch->nb_mux; i++) {
+        SchMux *mux = &sch->mux[i];
+
+        err = task_stop(sch, &mux->task);
+        ret = err_merge(ret, err);
+    }
+
+    if (finish_ts)
+        *finish_ts = trailing_dts(sch, 1);
+
+    sch->state = SCH_STATE_STOPPED;
+
+    return ret;
+}

libavcodec/Makefile

@@ -1068,6 +1068,7 @@ STLIBOBJS-$(CONFIG_ISO_MEDIA)          += mpegaudiotabs.o
 STLIBOBJS-$(CONFIG_FLV_MUXER)          += mpeg4audio_sample_rates.o
 STLIBOBJS-$(CONFIG_HLS_DEMUXER)        += ac3_channel_layout_tab.o
 STLIBOBJS-$(CONFIG_IMAGE_JPEGXL_PIPE_DEMUXER) += jpegxl_parse.o
+STLIBOBJS-$(CONFIG_JNI)                += ffjni.o
 STLIBOBJS-$(CONFIG_JPEGXL_ANIM_DEMUXER)       += jpegxl_parse.o
 STLIBOBJS-$(CONFIG_MATROSKA_DEMUXER)   += mpeg4audio_sample_rates.o
 STLIBOBJS-$(CONFIG_MOV_DEMUXER)        += ac3_channel_layout_tab.o

libavcodec/apedec.c

@@ -1286,7 +1286,7 @@ static void predictor_decode_stereo_3950(APEContext *ctx, int count)
                 int32_t left  = a1 - (unsigned)(a0 / 2);
                 int32_t right = left + (unsigned)a0;
 
-                if (FFMAX(FFABS(left), FFABS(right)) > (1<<23)) {
+                if (FFMIN(FFNABS(left), FFNABS(right)) < -(1<<23)) {
                     ctx->interim_mode = !interim_mode;
                     av_log(ctx->avctx, AV_LOG_VERBOSE, "Interim mode: %d\n", ctx->interim_mode);
                     break;

libavcodec/bitstream_template.h

@@ -536,7 +536,8 @@ static inline int BS_FUNC(read_vlc)(BSCTX *bc, const VLCElem *table,
 static inline int BS_FUNC(read_vlc_multi)(BSCTX *bc, uint8_t dst[8],
                                           const VLC_MULTI_ELEM *const Jtable,
                                           const VLCElem *const table,
-                                          const int bits, const int max_depth)
+                                          const int bits, const int max_depth,
+                                          const int symbols_size)
 {
     unsigned idx = BS_FUNC(peek)(bc, bits);
     int ret, nb_bits, code, n = Jtable[idx].len;
@@ -554,7 +555,10 @@ static inline int BS_FUNC(read_vlc_multi)(BSCTX *bc, uint8_t dst[8],
                 code = BS_FUNC(priv_set_idx)(bc, code, &n, &nb_bits, table);
             }
         }
-        AV_WN16(dst, code);
+        if (symbols_size == 1)
+            *dst = code;
+        else
+            AV_WN16(dst, code);
         ret = n > 0;
     }
     BS_FUNC(priv_skip_remaining)(bc, n);

libavcodec/bsf/h264_mp4toannexb.c

@@ -208,6 +208,49 @@ static int h264_mp4toannexb_save_ps(uint8_t **dst, int *dst_size,
     return 0;
 }
 
+static int h264_mp4toannexb_filter_ps(H264BSFContext *s,
+                                      const uint8_t *buf,
+                                      const uint8_t *buf_end)
+{
+    int sps_count = 0;
+    int pps_count = 0;
+    uint8_t unit_type;
+
+    do {
+        uint32_t nal_size = 0;
+
+        /* possible overread ok due to padding */
+        for (int i = 0; i < s->length_size; i++)
+            nal_size = (nal_size << 8) | buf[i];
+
+        buf += s->length_size;
+
+        /* This check requires the cast as the right side might
+         * otherwise be promoted to an unsigned value. */
+        if ((int64_t)nal_size > buf_end - buf)
+            return AVERROR_INVALIDDATA;
+
+        if (!nal_size)
+            continue;
+
+        unit_type = *buf & 0x1f;
+
+        if (unit_type == H264_NAL_SPS) {
+            h264_mp4toannexb_save_ps(&s->sps, &s->sps_size, &s->sps_buf_size, buf,
+                                   nal_size, !sps_count);
+            sps_count++;
+        } else if (unit_type == H264_NAL_PPS) {
+            h264_mp4toannexb_save_ps(&s->pps, &s->pps_size, &s->pps_buf_size, buf,
+                                   nal_size, !pps_count);
+            pps_count++;
+        }
+
+        buf += nal_size;
+    } while (buf < buf_end);
+
+    return 0;
+}
+
 static int h264_mp4toannexb_init(AVBSFContext *ctx)
 {
     int extra_size = ctx->par_in->extradata_size;
@@ -263,14 +306,14 @@ static int h264_mp4toannexb_filter(AVBSFContext *ctx, AVPacket *opkt)
     }
 
     buf_end  = in->data + in->size;
+    ret = h264_mp4toannexb_filter_ps(s, in->data, buf_end);
+    if (ret < 0)
+        goto fail;
 
 #define LOG_ONCE(...) \
     if (j) \
         av_log(__VA_ARGS__)
     for (int j = 0; j < 2; j++) {
-        int sps_count = 0;
-        int pps_count = 0;
-
         buf      = in->data;
         new_idr  = s->new_idr;
         sps_seen = s->idr_sps_seen;
@@ -301,18 +344,8 @@ static int h264_mp4toannexb_filter(AVBSFContext *ctx, AVPacket *opkt)
 
             if (unit_type == H264_NAL_SPS) {
                 sps_seen = new_idr = 1;
-                if (!j) {
-                    h264_mp4toannexb_save_ps(&s->sps, &s->sps_size, &s->sps_buf_size,
-                                             buf, nal_size, !sps_count);
-                    sps_count++;
-                }
             } else if (unit_type == H264_NAL_PPS) {
                 pps_seen = new_idr = 1;
-                if (!j) {
-                    h264_mp4toannexb_save_ps(&s->pps, &s->pps_size, &s->pps_buf_size,
-                                             buf, nal_size, !pps_count);
-                    pps_count++;
-                }
                 /* if SPS has not been seen yet, prepend the AVCC one to PPS */
                 if (!sps_seen) {
                     if (!s->sps_size) {

libavcodec/exr.c

@@ -334,7 +334,10 @@ static int huf_unpack_enc_table(GetByteContext *gb,
         return ret;
 
     for (; im <= iM; im++) {
-        uint64_t l = freq[im] = get_bits(&gbit, 6);
+        int l;
+        if (get_bits_left(&gbit) < 6)
+            return AVERROR_INVALIDDATA;
+        l = freq[im] = get_bits(&gbit, 6);
 
         if (l == LONG_ZEROCODE_RUN) {
             int zerun = get_bits(&gbit, 8) + SHORTEST_LONG_RUN;

libavcodec/get_bits.h

@@ -667,7 +667,8 @@ static av_always_inline int get_vlc2(GetBitContext *s, const VLCElem *table,
 static inline int get_vlc_multi(GetBitContext *s, uint8_t *dst,
                                 const VLC_MULTI_ELEM *const Jtable,
                                 const VLCElem *const table,
-                                const int bits, const int max_depth)
+                                const int bits, const int max_depth,
+                                const int symbols_size)
 {
     dst[0] = get_vlc2(s, table, bits, max_depth);
     return 1;

libavcodec/hevc_ps.c

@@ -449,6 +449,15 @@ static void uninit_vps(FFRefStructOpaque opaque, void *obj)
     av_freep(&vps->hdr);
 }
 
+static int compare_vps(const HEVCVPS *vps1, const HEVCVPS *vps2)
+{
+    if (!memcmp(vps1, vps2, offsetof(HEVCVPS, hdr)))
+        return !vps1->vps_num_hrd_parameters ||
+               !memcmp(vps1->hdr, vps2->hdr, vps1->vps_num_hrd_parameters * sizeof(*vps1->hdr));
+
+    return 0;
+}
+
 int ff_hevc_decode_nal_vps(GetBitContext *gb, AVCodecContext *avctx,
                            HEVCParamSets *ps)
 {
@@ -545,9 +554,11 @@ int ff_hevc_decode_nal_vps(GetBitContext *gb, AVCodecContext *avctx,
             goto err;
         }
 
-        vps->hdr = av_calloc(vps->vps_num_hrd_parameters, sizeof(*vps->hdr));
-        if (!vps->hdr)
-            goto err;
+        if (vps->vps_num_hrd_parameters) {
+            vps->hdr = av_calloc(vps->vps_num_hrd_parameters, sizeof(*vps->hdr));
+            if (!vps->hdr)
+                goto err;
+        }
 
         for (i = 0; i < vps->vps_num_hrd_parameters; i++) {
             int common_inf_present = 1;
@@ -569,7 +580,7 @@ int ff_hevc_decode_nal_vps(GetBitContext *gb, AVCodecContext *avctx,
     }
 
     if (ps->vps_list[vps_id] &&
-        !memcmp(ps->vps_list[vps_id], vps, sizeof(*vps))) {
+        compare_vps(ps->vps_list[vps_id], vps)) {
         ff_refstruct_unref(&vps);
     } else {
         remove_vps(ps, vps_id);

libavcodec/hevc_ps.h

@@ -153,7 +153,6 @@ typedef struct PTL {
 
 typedef struct HEVCVPS {
     unsigned int vps_id;
-    HEVCHdrParams *hdr;
 
     uint8_t vps_temporal_id_nesting_flag;
     int vps_max_layers;
@@ -175,6 +174,9 @@ typedef struct HEVCVPS {
 
     uint8_t data[4096];
     int data_size;
+    /* Put this at the end of the structure to make it easier to calculate the
+     * size before this pointer, which is used for memcmp */
+    HEVCHdrParams *hdr;
 } HEVCVPS;
 
 typedef struct ScalingList {

libavcodec/jpeg2000dec.c

@@ -1885,7 +1885,7 @@ static inline void roi_scale_cblk(Jpeg2000Cblk *cblk,
     }
 }
 
-static inline void tile_codeblocks(const Jpeg2000DecoderContext *s, Jpeg2000Tile *tile)
+static inline int tile_codeblocks(const Jpeg2000DecoderContext *s, Jpeg2000Tile *tile)
 {
     Jpeg2000T1Context t1;
 
@@ -1910,6 +1910,8 @@ static inline void tile_codeblocks(const Jpeg2000DecoderContext *s, Jpeg2000Tile
                 int nb_precincts, precno;
                 Jpeg2000Band *band = rlevel->band + bandno;
                 int cblkno = 0, bandpos;
+                /* See Rec. ITU-T T.800, Equation E-2 */
+                int magp = quantsty->expn[subbandno] + quantsty->nguardbits - 1;
 
                 bandpos = bandno + (reslevelno > 0);
 
@@ -1917,6 +1919,11 @@ static inline void tile_codeblocks(const Jpeg2000DecoderContext *s, Jpeg2000Tile
                     band->coord[1][0] == band->coord[1][1])
                     continue;
 
+                if ((codsty->cblk_style & JPEG2000_CTSY_HTJ2K_F) && magp >= 31) {
+                    avpriv_request_sample(s->avctx, "JPEG2000_CTSY_HTJ2K_F and magp >= 31");
+                    return AVERROR_PATCHWELCOME;
+                }
+
                 nb_precincts = rlevel->num_precincts_x * rlevel->num_precincts_y;
                 /* Loop on precincts */
                 for (precno = 0; precno < nb_precincts; precno++) {
@@ -1927,8 +1934,6 @@ static inline void tile_codeblocks(const Jpeg2000DecoderContext *s, Jpeg2000Tile
                          cblkno < prec->nb_codeblocks_width * prec->nb_codeblocks_height;
                          cblkno++) {
                         int x, y, ret;
-                        /* See Rec. ITU-T T.800, Equation E-2 */
-                        int magp = quantsty->expn[subbandno] + quantsty->nguardbits - 1;
 
                         Jpeg2000Cblk *cblk = prec->cblk + cblkno;
 
@@ -1968,6 +1973,7 @@ static inline void tile_codeblocks(const Jpeg2000DecoderContext *s, Jpeg2000Tile
             ff_dwt_decode(&comp->dwt, codsty->transform == FF_DWT97 ? (void*)comp->f_data : (void*)comp->i_data);
 
     } /*end comp */
+    return 0;
 }
 
 #define WRITE_FRAME(D, PIXEL)                                                                     \
@@ -2044,7 +2050,9 @@ static int jpeg2000_decode_tile(AVCodecContext *avctx, void *td,
     AVFrame *picture = td;
     Jpeg2000Tile *tile = s->tile + jobnr;
 
-    tile_codeblocks(s, tile);
+    int ret = tile_codeblocks(s, tile);
+    if (ret < 0)
+        return ret;
 
     /* inverse MCT transformation */
     if (tile->codsty[0].mct)

libavcodec/jpeg2000htdec.c

@@ -1198,6 +1198,9 @@ ff_jpeg2000_decode_htj2k(const Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c
     av_assert0(width * height <= 4096);
     av_assert0(width * height > 0);
 
+    if (roi_shift)
+        avpriv_report_missing_feature(s->avctx, "ROI shift");
+
     memset(t1->data, 0, t1->stride * height * sizeof(*t1->data));
     memset(t1->flags, 0, t1->stride * (height + 2) * sizeof(*t1->flags));
 

libavcodec/magicyuv.c

@@ -124,7 +124,7 @@ static void magicyuv_median_pred16(uint16_t *dst, const uint16_t *src1,
     x = 0; \
     for (; CACHED_BITSTREAM_READER && x < width-c && get_bits_left(&gb) > 0;) {\
         ret = get_vlc_multi(&gb, (uint8_t *)dst + x * b, multi, \
-                            vlc, vlc_bits, 3); \
+                            vlc, vlc_bits, 3, b); \
         if (ret <= 0) \
             return AVERROR_INVALIDDATA; \
         x += ret; \

libavcodec/nvdec.c

@@ -664,6 +664,8 @@ int ff_nvdec_simple_end_frame(AVCodecContext *avctx)
     NVDECContext *ctx = avctx->internal->hwaccel_priv_data;
     int ret = ff_nvdec_end_frame(avctx);
     ctx->bitstream = NULL;
+    ctx->bitstream_len = 0;
+    ctx->nb_slices = 0;
     return ret;
 }
 

libavcodec/nvenc.c

@@ -1255,6 +1255,11 @@ static av_cold int nvenc_setup_h264_config(AVCodecContext *avctx)
 
     h264->level = ctx->level;
 
+#ifdef NVENC_HAVE_NEW_BIT_DEPTH_API
+    h264->inputBitDepth = h264->outputBitDepth =
+        IS_10BIT(ctx->data_pix_fmt) ? NV_ENC_BIT_DEPTH_10 : NV_ENC_BIT_DEPTH_8;
+#endif
+
     if (ctx->coder >= 0)
         h264->entropyCodingMode = ctx->coder;
 
@@ -1370,7 +1375,12 @@ static av_cold int nvenc_setup_hevc_config(AVCodecContext *avctx)
 
     hevc->chromaFormatIDC = IS_YUV444(ctx->data_pix_fmt) ? 3 : 1;
 
+#ifdef NVENC_HAVE_NEW_BIT_DEPTH_API
+    hevc->inputBitDepth = hevc->outputBitDepth =
+        IS_10BIT(ctx->data_pix_fmt) ? NV_ENC_BIT_DEPTH_10 : NV_ENC_BIT_DEPTH_8;
+#else
     hevc->pixelBitDepthMinus8 = IS_10BIT(ctx->data_pix_fmt) ? 2 : 0;
+#endif
 
     hevc->level = ctx->level;
 
@@ -1455,8 +1465,13 @@ static av_cold int nvenc_setup_av1_config(AVCodecContext *avctx)
 
     av1->chromaFormatIDC = IS_YUV444(ctx->data_pix_fmt) ? 3 : 1;
 
+#ifdef NVENC_HAVE_NEW_BIT_DEPTH_API
+    av1->inputBitDepth = IS_10BIT(ctx->data_pix_fmt) ? NV_ENC_BIT_DEPTH_10 : NV_ENC_BIT_DEPTH_8;
+    av1->outputBitDepth = (IS_10BIT(ctx->data_pix_fmt) || ctx->highbitdepth) ? NV_ENC_BIT_DEPTH_10 : NV_ENC_BIT_DEPTH_8;
+#else
     av1->inputPixelBitDepthMinus8 = IS_10BIT(ctx->data_pix_fmt) ? 2 : 0;
     av1->pixelBitDepthMinus8 = (IS_10BIT(ctx->data_pix_fmt) || ctx->highbitdepth) ? 2 : 0;
+#endif
 
     if (ctx->b_ref_mode >= 0)
         av1->useBFramesAsRef = ctx->b_ref_mode;
@@ -1689,15 +1704,15 @@ static NV_ENC_BUFFER_FORMAT nvenc_map_buffer_format(enum AVPixelFormat pix_fmt)
 {
     switch (pix_fmt) {
     case AV_PIX_FMT_YUV420P:
-        return NV_ENC_BUFFER_FORMAT_YV12_PL;
+        return NV_ENC_BUFFER_FORMAT_YV12;
     case AV_PIX_FMT_NV12:
-        return NV_ENC_BUFFER_FORMAT_NV12_PL;
+        return NV_ENC_BUFFER_FORMAT_NV12;
     case AV_PIX_FMT_P010:
     case AV_PIX_FMT_P016:
         return NV_ENC_BUFFER_FORMAT_YUV420_10BIT;
     case AV_PIX_FMT_GBRP:
     case AV_PIX_FMT_YUV444P:
-        return NV_ENC_BUFFER_FORMAT_YUV444_PL;
+        return NV_ENC_BUFFER_FORMAT_YUV444;
     case AV_PIX_FMT_GBRP16:
     case AV_PIX_FMT_YUV444P16:
         return NV_ENC_BUFFER_FORMAT_YUV444_10BIT;

libavcodec/nvenc.h

@@ -83,6 +83,11 @@ typedef void ID3D11Device;
 #define NVENC_NO_DEPRECATED_RC
 #endif
 
+// SDK 12.2 compile time feature checks
+#if NVENCAPI_CHECK_VERSION(12, 2)
+#define NVENC_HAVE_NEW_BIT_DEPTH_API
+#endif
+
 typedef struct NvencSurface
 {
     NV_ENC_INPUT_PTR input_surface;

libavcodec/utvideodec.c

@@ -120,7 +120,7 @@ static int build_huff(UtvideoContext *c, const uint8_t *src, VLC *vlc,
     i = 0; \
     for (; CACHED_BITSTREAM_READER && i < width-end && get_bits_left(&gb) > 0;) {\
         ret = get_vlc_multi(&gb, (uint8_t *)buf + i * b, multi.table, \
-                            vlc.table, VLC_BITS, 3); \
+                            vlc.table, VLC_BITS, 3, b); \
         if (ret > 0) \
             i += ret; \
         if (ret <= 0) \

libavcodec/vaapi_encode.c

@@ -1805,9 +1805,17 @@ static av_cold int vaapi_encode_init_rate_control(AVCodecContext *avctx)
         int i, first = 1, res;
 
         supported_va_rc_modes = rc_attr.value;
-        if (ctx->blbrc && !(supported_va_rc_modes & VA_RC_MB)) {
+        if (ctx->blbrc) {
+#if VA_CHECK_VERSION(0, 39, 2)
+            if (!(supported_va_rc_modes & VA_RC_MB)) {
+                ctx->blbrc = 0;
+                av_log(avctx, AV_LOG_WARNING, "Driver does not support BLBRC.\n");
+            }
+#else
             ctx->blbrc = 0;
-            av_log(avctx, AV_LOG_WARNING, "Driver does not support BLBRC.\n");
+            av_log(avctx, AV_LOG_WARNING, "Please consider to update to VAAPI 0.39.2 "
+                   "or above, which can support BLBRC.\n");
+#endif
         }
 
         for (i = 0; i < FF_ARRAY_ELEMS(vaapi_encode_rc_modes); i++) {
@@ -1961,7 +1969,10 @@ rc_mode_found:
         if (ctx->explicit_qp) {
             rc_quality = ctx->explicit_qp;
         } else if (avctx->global_quality > 0) {
-            rc_quality = avctx->global_quality;
+            if (avctx->flags & AV_CODEC_FLAG_QSCALE)
+                rc_quality = avctx->global_quality / FF_QP2LAMBDA;
+            else
+                rc_quality = avctx->global_quality;
         } else {
             rc_quality = ctx->codec->default_quality;
             av_log(avctx, AV_LOG_WARNING, "No quality level set; "
@@ -2032,7 +2043,11 @@ rc_mode_found:
         ctx->config_attributes[ctx->nb_config_attributes++] =
             (VAConfigAttrib) {
             .type  = VAConfigAttribRateControl,
+#if VA_CHECK_VERSION(0, 39, 2)
             .value = ctx->blbrc ? ctx->va_rc_mode | VA_RC_MB : ctx->va_rc_mode,
+#else
+            .value = ctx->va_rc_mode,
+#endif
         };
     }
 
@@ -2061,10 +2076,12 @@ rc_mode_found:
 #if VA_CHECK_VERSION(1, 1, 0)
             .ICQ_quality_factor = av_clip(rc_quality, 1, 51),
             .max_qp             = (avctx->qmax > 0 ? avctx->qmax : 0),
-            .rc_flags.bits.mb_rate_control = ctx->blbrc ? 1 : 2,
 #endif
 #if VA_CHECK_VERSION(1, 3, 0)
             .quality_factor     = rc_quality,
+#endif
+#if VA_CHECK_VERSION(0, 39, 2)
+            .rc_flags.bits.mb_rate_control = ctx->blbrc ? 1 : 2,
 #endif
         };
         vaapi_encode_add_global_param(avctx,

libavcodec/vlc.c

@@ -499,7 +499,10 @@ static int vlc_multi_gen(VLC_MULTI_ELEM *table, const VLC *single,
     for (int j = 0; j < 1<<numbits; j++) {
         table[j].len = single->table[j].len;
         table[j].num = single->table[j].len > 0 ? 1 : 0;
-        AV_WN16(table[j].val, single->table[j].sym);
+        if (is16bit)
+            AV_WN16(table[j].val, single->table[j].sym);
+        else
+            table[j].val[0] = single->table[j].sym;
     }
 
     add_level(table, is16bit, nb_codes, numbits, buf,

libavcodec/vvc/vvc_refs.c

@@ -454,7 +454,8 @@ int ff_vvc_slice_rpl(VVCContext *s, VVCFrameContext *fc, SliceContext *sc)
                 if (ret < 0)
                     return ret;
             } else {
-                avpriv_request_sample(fc->log_ctx, "Inter layer ref");
+                // OPI_B_3.bit and VPS_A_3.bit should cover this
+                avpriv_report_missing_feature(fc->log_ctx, "Inter layer ref");
                 ret = AVERROR_PATCHWELCOME;
                 return ret;
             }

libavcodec/vvc/vvcdec.c

@@ -939,6 +939,9 @@ static int vvc_decode_frame(AVCodecContext *avctx, AVFrame *output,
     if (ret < 0)
         return ret;
 
+    if (!fc->ft)
+        return avpkt->size;
+
     ret = submit_frame(s, fc, output, got_output);
     if (ret < 0)
         return ret;

libavcodec/wavarc.c

@@ -648,7 +648,7 @@ static int decode_5elp(AVCodecContext *avctx,
                 for (int o = 0; o < order; o++)
                     sum += s->filter[ch][o] * (unsigned)samples[n + 70 - o - 1];
 
-                samples[n + 70] += ac_out[n] + (sum >> 4);
+                samples[n + 70] += ac_out[n] + (unsigned)(sum >> 4);
             }
 
             for (int n = 0; n < 70; n++)

libavfilter/avfiltergraph.c

@@ -794,6 +794,10 @@ static int reduce_formats_on_filter(AVFilterContext *filter)
                    nb_formats, ff_add_format);
     REDUCE_FORMATS(int,      AVFilterFormats,        samplerates,     formats,
                    nb_formats, ff_add_format);
+    REDUCE_FORMATS(int,      AVFilterFormats,        color_spaces,    formats,
+                   nb_formats, ff_add_format);
+    REDUCE_FORMATS(int,      AVFilterFormats,        color_ranges,    formats,
+                   nb_formats, ff_add_format);
 
     /* reduce channel layouts */
     for (i = 0; i < filter->nb_inputs; i++) {
@@ -906,82 +910,6 @@ static void swap_samplerates(AVFilterGraph *graph)
         swap_samplerates_on_filter(graph->filters[i]);
 }
 
-static void swap_color_spaces_on_filter(AVFilterContext *filter)
-{
-    AVFilterLink *link = NULL;
-    enum AVColorSpace csp;
-    int i;
-
-    for (i = 0; i < filter->nb_inputs; i++) {
-        link = filter->inputs[i];
-        if (link->type == AVMEDIA_TYPE_VIDEO &&
-            link->outcfg.color_spaces->nb_formats == 1)
-            break;
-    }
-    if (i == filter->nb_inputs)
-        return;
-
-    csp = link->outcfg.color_spaces->formats[0];
-
-    for (i = 0; i < filter->nb_outputs; i++) {
-        AVFilterLink *outlink = filter->outputs[i];
-        if (outlink->type != AVMEDIA_TYPE_VIDEO)
-            continue;
-        /* there is no meaningful 'score' between different yuv matrices,
-         * so just prioritize an exact match if it exists */
-        for (int j = 0; j < outlink->incfg.color_spaces->nb_formats; j++) {
-            if (csp == outlink->incfg.color_spaces->formats[j]) {
-                FFSWAP(int, outlink->incfg.color_spaces->formats[0],
-                       outlink->incfg.color_spaces->formats[j]);
-                break;
-            }
-        }
-    }
-}
-
-static void swap_color_spaces(AVFilterGraph *graph)
-{
-    for (int i = 0; i < graph->nb_filters; i++)
-        swap_color_spaces_on_filter(graph->filters[i]);
-}
-
-static void swap_color_ranges_on_filter(AVFilterContext *filter)
-{
-    AVFilterLink *link = NULL;
-    enum AVColorRange range;
-    int i;
-
-    for (i = 0; i < filter->nb_inputs; i++) {
-        link = filter->inputs[i];
-        if (link->type == AVMEDIA_TYPE_VIDEO &&
-            link->outcfg.color_ranges->nb_formats == 1)
-            break;
-    }
-    if (i == filter->nb_inputs)
-        return;
-
-    range = link->outcfg.color_ranges->formats[0];
-
-    for (i = 0; i < filter->nb_outputs; i++) {
-        AVFilterLink *outlink = filter->outputs[i];
-        if (outlink->type != AVMEDIA_TYPE_VIDEO)
-            continue;
-        for (int j = 0; j < outlink->incfg.color_ranges->nb_formats; j++) {
-            if (range == outlink->incfg.color_ranges->formats[j]) {
-                FFSWAP(int, outlink->incfg.color_ranges->formats[0],
-                       outlink->incfg.color_ranges->formats[j]);
-                break;
-            }
-        }
-    }
-}
-
-static void swap_color_ranges(AVFilterGraph *graph)
-{
-    for (int i = 0; i < graph->nb_filters; i++)
-        swap_color_ranges_on_filter(graph->filters[i]);
-}
-
 #define CH_CENTER_PAIR (AV_CH_FRONT_LEFT_OF_CENTER | AV_CH_FRONT_RIGHT_OF_CENTER)
 #define CH_FRONT_PAIR  (AV_CH_FRONT_LEFT           | AV_CH_FRONT_RIGHT)
 #define CH_STEREO_PAIR (AV_CH_STEREO_LEFT          | AV_CH_STEREO_RIGHT)
@@ -1258,10 +1186,6 @@ static int graph_config_formats(AVFilterGraph *graph, void *log_ctx)
     if ((ret = reduce_formats(graph)) < 0)
         return ret;
 
-    /* for video filters, ensure that the best colorspace metadata is selected */
-    swap_color_spaces(graph);
-    swap_color_ranges(graph);
-
     /* for audio filters, ensure the best format, sample rate and channel layout
      * is selected */
     swap_sample_fmts(graph);

libavfilter/buffersrc.c

@@ -507,7 +507,7 @@ static int config_props(AVFilterLink *link)
         }
         break;
     case AVMEDIA_TYPE_AUDIO:
-        if (!c->ch_layout.nb_channels) {
+        if (!c->ch_layout.nb_channels || c->ch_layout.order == AV_CHANNEL_ORDER_UNSPEC) {
             int ret = av_channel_layout_copy(&c->ch_layout, &link->ch_layout);
             if (ret < 0)
                 return ret;

libavfilter/setpts.c

@@ -150,6 +150,13 @@ static int config_input(AVFilterLink *inlink)
     return 0;
 }
 
+static int config_output_video(AVFilterLink *outlink)
+{
+    outlink->frame_rate = (AVRational){ 1, 0 };
+
+    return 0;
+}
+
 #define BUF_SIZE 64
 
 static inline char *double2int64str(char *buf, double v)
@@ -198,6 +205,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *frame)
 
     d = eval_pts(setpts, inlink, frame, frame->pts);
     frame->pts = D2TS(d);
+    frame->duration = 0;
 
     av_log(inlink->dst, AV_LOG_TRACE,
             "N:%"PRId64" PTS:%s T:%f",
@@ -322,6 +330,14 @@ static const AVFilterPad avfilter_vf_setpts_inputs[] = {
     },
 };
 
+static const AVFilterPad outputs_video[] = {
+    {
+        .name         = "default",
+        .type         = AVMEDIA_TYPE_VIDEO,
+        .config_props = config_output_video,
+    },
+};
+
 const AVFilter ff_vf_setpts = {
     .name            = "setpts",
     .description     = NULL_IF_CONFIG_SMALL("Set PTS for the output video frame."),
@@ -335,7 +351,7 @@ const AVFilter ff_vf_setpts = {
     .priv_class = &setpts_class,
 
     FILTER_INPUTS(avfilter_vf_setpts_inputs),
-    FILTER_OUTPUTS(ff_video_default_filterpad),
+    FILTER_OUTPUTS(outputs_video),
 };
 #endif /* CONFIG_SETPTS_FILTER */
 

libavfilter/vf_signature.c

@@ -379,6 +379,9 @@ static int xml_export(AVFilterContext *ctx, StreamContext *sc, const char* filen
     FILE* f;
     unsigned int pot3[5] = { 3*3*3*3, 3*3*3, 3*3, 3, 1 };
 
+    if (!sc->coarseend->last)
+        return AVERROR(EINVAL); // No frames ?
+
     f = avpriv_fopen_utf8(filename, "w");
     if (!f) {
         int err = AVERROR(EINVAL);

libavformat/Makefile

@@ -728,6 +728,7 @@ SHLIBOBJS-$(CONFIG_ISO_MEDIA)            += mpegaudiotabs.o
 SHLIBOBJS-$(CONFIG_FLV_MUXER)            += mpeg4audio_sample_rates.o
 SHLIBOBJS-$(CONFIG_HLS_DEMUXER)          += ac3_channel_layout_tab.o
 SHLIBOBJS-$(CONFIG_IMAGE_JPEGXL_PIPE_DEMUXER)    += jpegxl_parse.o
+SHLIBOBJS-$(CONFIG_JNI)                  += ffjni.o
 SHLIBOBJS-$(CONFIG_JPEGXL_ANIM_DEMUXER)  += jpegxl_parse.o
 SHLIBOBJS-$(CONFIG_MATROSKA_DEMUXER)     += mpeg4audio_sample_rates.o
 SHLIBOBJS-$(CONFIG_MOV_DEMUXER)          += ac3_channel_layout_tab.o

libavformat/aiffdec.c

@@ -106,6 +106,8 @@ static int get_aiff_header(AVFormatContext *s, int64_t size,
         size++;
     par->codec_type = AVMEDIA_TYPE_AUDIO;
     channels = avio_rb16(pb);
+    if (par->ch_layout.nb_channels && par->ch_layout.nb_channels != channels)
+        return AVERROR_INVALIDDATA;
     par->ch_layout.nb_channels = channels;
     num_frames = avio_rb32(pb);
     par->bits_per_coded_sample = avio_rb16(pb);

libavformat/ffjni.c

@@ -0,0 +1,23 @@
+/*
+ * JNI utility functions - included stub
+ *
+ * Copyright (c) 2024 Leo Izen <leo.izen@gmail.com>
+ *
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include "libavcodec/ffjni.c"

libavformat/file.c

@@ -527,8 +527,8 @@ const URLProtocol ff_fd_protocol = {
 
 #if CONFIG_ANDROID_CONTENT_PROTOCOL
 #include <jni.h>
+#include "libavcodec/ffjni.h"
 #include "libavcodec/jni.h"
-#include "libavcodec/ffjni.c"
 
 typedef struct JFields {
     jclass uri_class;

libavformat/iamf_parse.c

@@ -933,6 +933,10 @@ static int mix_presentation_obu(void *s, IAMFContext *c, AVIOContext *pb, int le
             if (submix_layout->layout_type == 2) {
                 int sound_system;
                 sound_system = (byte >> 2) & 0xF;
+                if (sound_system >= FF_ARRAY_ELEMS(ff_iamf_sound_system_map)) {
+                    ret = AVERROR_INVALIDDATA;
+                    goto fail;
+                }
                 av_channel_layout_copy(&submix_layout->sound_system, &ff_iamf_sound_system_map[sound_system].layout);
             }
 

libavformat/iamf_reader.c

@@ -283,9 +283,9 @@ int ff_iamf_read_packet(AVFormatContext *s, IAMFDemuxContext *c,
 
         len = ff_iamf_parse_obu_header(header, size, &obu_size, &start_pos, &type,
                                        &skip_samples, &discard_padding);
-        if (len < 0 || obu_size > max_size) {
+        if (len < 0 || obu_size > max_size || len > INT_MAX - read) {
             av_log(s, AV_LOG_ERROR, "Failed to read obu\n");
-            return len;
+            return len < 0 ? len : AVERROR_INVALIDDATA;
         }
         avio_seek(pb, -(size - start_pos), SEEK_CUR);
 

libavformat/isom.c

@@ -359,6 +359,7 @@ int ff_mp4_read_dec_config_descr(AVFormatContext *fc, AVStream *st, AVIOContext
                                                 st->codecpar->extradata_size, 1, fc);
             if (ret < 0)
                 return ret;
+            av_channel_layout_uninit(&st->codecpar->ch_layout);
             st->codecpar->ch_layout.order = AV_CHANNEL_ORDER_UNSPEC;
             st->codecpar->ch_layout.nb_channels = cfg.channels;
             if (cfg.object_type == 29 && cfg.sampling_index < 3) // old mp3on4

libavformat/mov.c

@@ -83,7 +83,6 @@ typedef struct MOVParseTableEntry {
 
 static int mov_read_default(MOVContext *c, AVIOContext *pb, MOVAtom atom);
 static int mov_read_mfra(MOVContext *c, AVIOContext *f);
-static void mov_free_stream_context(AVFormatContext *s, AVStream *st);
 static int64_t add_ctts_entry(MOVCtts** ctts_data, unsigned int* ctts_count, unsigned int* allocated_size,
                               int count, int duration);
 
@@ -4860,25 +4859,6 @@ static int mov_read_trak(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     MOVStreamContext *sc;
     int ret;
 
-    if (c->found_iinf) {
-        // * For animated heif, if the iinf box showed up before the moov
-        //   box, we need to clear all the streams read in the former.
-        for (int i = c->nb_heif_item - 1; i >= 0; i--) {
-            HEIFItem *item = &c->heif_item[i];
-
-            av_freep(&item->name);
-
-            if (!item->st)
-                continue;
-
-            mov_free_stream_context(c->fc, item->st);
-            ff_remove_stream(c->fc, item->st);
-        }
-        av_freep(&c->heif_item);
-        c->nb_heif_item = 0;
-        c->found_iinf = c->found_iloc = 0;
-    }
-
     st = avformat_new_stream(c->fc, NULL);
     if (!st) return AVERROR(ENOMEM);
     st->id = -1;
@@ -5057,12 +5037,13 @@ static int mov_read_keys(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     for (i = 1; i <= count; ++i) {
         uint32_t key_size = avio_rb32(pb);
         uint32_t type = avio_rl32(pb);
-        if (key_size < 8) {
+        if (key_size < 8 || key_size > atom.size) {
             av_log(c->fc, AV_LOG_ERROR,
                    "The key# %"PRIu32" in meta has invalid size:"
                    "%"PRIu32"\n", i, key_size);
             return AVERROR_INVALIDDATA;
         }
+        atom.size -= key_size;
         key_size -= 8;
         if (type != MKTAG('m','d','t','a')) {
             avio_skip(pb, key_size);
@@ -6140,8 +6121,10 @@ static int mov_read_smdm(MOVContext *c, AVIOContext *pb, MOVAtom atom)
         av_log(c->fc, AV_LOG_WARNING, "Unsupported Mastering Display Metadata box version %d\n", version);
         return 0;
     }
-    if (sc->mastering)
-        return AVERROR_INVALIDDATA;
+    if (sc->mastering) {
+        av_log(c->fc, AV_LOG_WARNING, "Ignoring duplicate Mastering Display Metadata\n");
+        return 0;
+    }
 
     avio_skip(pb, 3); /* flags */
 
@@ -6178,11 +6161,16 @@ static int mov_read_mdcv(MOVContext *c, AVIOContext *pb, MOVAtom atom)
 
     sc = c->fc->streams[c->fc->nb_streams - 1]->priv_data;
 
-    if (atom.size < 24 || sc->mastering) {
+    if (atom.size < 24) {
         av_log(c->fc, AV_LOG_ERROR, "Invalid Mastering Display Color Volume box\n");
         return AVERROR_INVALIDDATA;
     }
 
+    if (sc->mastering) {
+        av_log(c->fc, AV_LOG_WARNING, "Ignoring duplicate Mastering Display Color Volume\n");
+        return 0;
+    }
+
     sc->mastering = av_mastering_display_metadata_alloc();
     if (!sc->mastering)
         return AVERROR(ENOMEM);
@@ -8058,9 +8046,8 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     int64_t base_offset, extent_offset, extent_length;
     uint8_t value;
 
-    if (c->found_moov) {
-        // * For animated heif, we don't care about the iloc box as all the
-        //   necessary information can be found in the moov box.
+    if (c->found_iloc) {
+        av_log(c->fc, AV_LOG_INFO, "Duplicate iloc box found\n");
         return 0;
     }
 
@@ -8191,11 +8178,6 @@ static int mov_read_iinf(MOVContext *c, AVIOContext *pb, MOVAtom atom)
         av_log(c->fc, AV_LOG_WARNING, "Duplicate iinf box found\n");
         return 0;
     }
-    if (c->found_moov) {
-        // * For animated heif, we don't care about the iinf box as all the
-        //   necessary information can be found in the moov box.
-        return 0;
-    }
 
     version = avio_r8(pb);
     avio_rb24(pb);  // flags.
@@ -8349,12 +8331,6 @@ static int mov_read_ispe(MOVContext *c, AVIOContext *pb, MOVAtom atom)
 {
     uint32_t width, height;
 
-    if (c->found_moov) {
-        // * For animated heif, we don't care about the ispe box as all the
-        //   necessary information can be found in the moov box.
-        return 0;
-    }
-
     avio_r8(pb);  /* version */
     avio_rb24(pb);  /* flags */
     width  = avio_rb32(pb);
@@ -8389,12 +8365,6 @@ static int mov_read_iprp(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     int version, flags;
     int ret;
 
-    if (c->found_moov) {
-        // * For animated heif, we don't care about the iprp box as all the
-        //   necessary information can be found in the moov box.
-        return 0;
-    }
-
     a.size = avio_rb32(pb);
     a.type = avio_rl32(pb);
 
@@ -8478,6 +8448,7 @@ static int mov_read_iprp(MOVContext *c, AVIOContext *pb, MOVAtom atom)
 
     ret = 0;
 fail:
+    c->cur_item_id = -1;
     for (int i = 0; i < nb_atoms; i++)
         av_free(atoms[i].data);
     av_free(atoms);
@@ -8849,7 +8820,7 @@ static void mov_read_chapters(AVFormatContext *s)
 
         if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO) {
             st->disposition |= AV_DISPOSITION_ATTACHED_PIC | AV_DISPOSITION_TIMED_THUMBNAILS;
-            if (sti->nb_index_entries) {
+            if (!st->attached_pic.data && sti->nb_index_entries) {
                 // Retrieve the first frame, if possible
                 AVIndexEntry *sample = &sti->index_entries[0];
                 if (avio_seek(sc->pb, sample->pos, SEEK_SET) != sample->pos) {
@@ -9426,8 +9397,9 @@ static int mov_parse_tiles(AVFormatContext *s)
 
         for (int j = 0; j < grid->nb_tiles; j++) {
             int tile_id = grid->tile_id_list[j];
+            int k;
 
-            for (int k = 0; k < mov->nb_heif_item; k++) {
+            for (k = 0; k < mov->nb_heif_item; k++) {
                 HEIFItem *item = &mov->heif_item[k];
                 AVStream *st = item->st;
 
@@ -9453,6 +9425,13 @@ static int mov_parse_tiles(AVFormatContext *s)
                 break;
             }
 
+            if (k == grid->nb_tiles) {
+                av_log(s, AV_LOG_WARNING, "HEIF item id %d referenced by grid id %d doesn't "
+                                          "exist\n",
+                       tile_id, grid->item->item_id);
+                ff_remove_stream_group(s, stg);
+                loop = 0;
+            }
             if (!loop)
                 break;
         }
@@ -9501,6 +9480,7 @@ static int mov_read_header(AVFormatContext *s)
     mov->trak_index = -1;
     mov->thmb_item_id = -1;
     mov->primary_item_id = -1;
+    mov->cur_item_id = -1;
     /* .mov and .mp4 aren't streamable anyway (only progressive download if moov is before mdat) */
     if (pb->seekable & AVIO_SEEKABLE_NORMAL)
         atom.size = avio_size(pb);

libavformat/movenc.c

@@ -6195,6 +6195,12 @@ int ff_mov_write_packet(AVFormatContext *s, AVPacket *pkt)
     if (ret < 0)
         return ret;
 
+    if (pkt->pts != AV_NOPTS_VALUE &&
+        (uint64_t)pkt->dts - pkt->pts != (int32_t)((uint64_t)pkt->dts - pkt->pts)) {
+        av_log(s, AV_LOG_WARNING, "pts/dts pair unsupported\n");
+        return AVERROR_PATCHWELCOME;
+    }
+
     if (mov->flags & FF_MOV_FLAG_FRAGMENT || mov->mode == MODE_AVIF) {
         int ret;
         if (mov->moov_written || mov->flags & FF_MOV_FLAG_EMPTY_MOOV) {

libavformat/mpegts.c

@@ -2605,7 +2605,8 @@ static void pat_cb(MpegTSFilter *filter, const uint8_t *section, int section_len
                     FFSWAP(struct Program, ts->prg[nb_prg], ts->prg[prg_idx]);
                 if (prg_idx >= nb_prg)
                     nb_prg++;
-            }
+            } else
+                nb_prg = 0;
         }
     }
     ts->nb_prg = nb_prg;

libavformat/mxfdec.c

@@ -250,7 +250,7 @@ typedef struct MXFFFV1SubDescriptor {
 
 typedef struct MXFIndexTableSegment {
     MXFMetadataSet meta;
-    int edit_unit_byte_count;
+    unsigned edit_unit_byte_count;
     int index_sid;
     int body_sid;
     AVRational index_edit_rate;
@@ -1263,6 +1263,9 @@ static int mxf_read_index_table_segment(void *arg, AVIOContext *pb, int tag, int
     case 0x3F0B:
         segment->index_edit_rate.num = avio_rb32(pb);
         segment->index_edit_rate.den = avio_rb32(pb);
+        if (segment->index_edit_rate.num <= 0 ||
+            segment->index_edit_rate.den <= 0)
+            return AVERROR_INVALIDDATA;
         av_log(NULL, AV_LOG_TRACE, "IndexEditRate %d/%d\n", segment->index_edit_rate.num,
                 segment->index_edit_rate.den);
         break;
@@ -1891,9 +1894,13 @@ static int mxf_edit_unit_absolute_offset(MXFContext *mxf, MXFIndexTable *index_t
         if (edit_unit < s->index_start_position + s->index_duration) {
             int64_t index = edit_unit - s->index_start_position;
 
-            if (s->edit_unit_byte_count)
+            if (s->edit_unit_byte_count) {
+                if (index > INT64_MAX / s->edit_unit_byte_count ||
+                    s->edit_unit_byte_count * index > INT64_MAX - offset_temp)
+                    return AVERROR_INVALIDDATA;
+
                 offset_temp += s->edit_unit_byte_count * index;
-            else {
+            } else {
                 if (s->nb_index_entries == 2 * s->index_duration + 1)
                     index *= 2;     /* Avid index */
 

libavformat/pcm.c

@@ -41,7 +41,7 @@ int ff_pcm_default_packet_size(AVCodecParameters *par)
     /* Don't trust the codecpar bitrate if we can calculate it ourselves */
     if (bits_per_sample > 0 && par->sample_rate > 0 && par->ch_layout.nb_channels > 0)
         if ((int64_t)par->sample_rate * par->ch_layout.nb_channels < INT64_MAX / bits_per_sample)
-            bitrate = bits_per_sample * par->sample_rate * par->ch_layout.nb_channels;
+            bitrate = bits_per_sample * (int64_t)par->sample_rate * par->ch_layout.nb_channels;
 
     if (bitrate > 0) {
         nb_samples = av_clip64(bitrate / 8 / PCM_DEMUX_TARGET_FPS / par->block_align, 1, max_samples);

libavutil/frame.c

@@ -711,16 +711,14 @@ AVBufferRef *av_frame_get_plane_buffer(const AVFrame *frame, int plane)
     return NULL;
 }
 
-static AVFrameSideData *add_side_data_from_buf(AVFrameSideData ***sd,
-                                               int *nb_sd,
-                                               enum AVFrameSideDataType type,
-                                               AVBufferRef *buf)
+static AVFrameSideData *add_side_data_from_buf_ext(AVFrameSideData ***sd,
+                                                   int *nb_sd,
+                                                   enum AVFrameSideDataType type,
+                                                   AVBufferRef *buf, uint8_t *data,
+                                                   size_t size)
 {
     AVFrameSideData *ret, **tmp;
 
-    if (!buf)
-        return NULL;
-
     // *nb_sd + 1 needs to fit into an int and a size_t.
     if ((unsigned)*nb_sd >= FFMIN(INT_MAX, SIZE_MAX))
         return NULL;
@@ -735,8 +733,8 @@ static AVFrameSideData *add_side_data_from_buf(AVFrameSideData ***sd,
         return NULL;
 
     ret->buf = buf;
-    ret->data = ret->buf->data;
-    ret->size = buf->size;
+    ret->data = data;
+    ret->size = size;
     ret->type = type;
 
     (*sd)[(*nb_sd)++] = ret;
@@ -744,6 +742,17 @@ static AVFrameSideData *add_side_data_from_buf(AVFrameSideData ***sd,
     return ret;
 }
 
+static AVFrameSideData *add_side_data_from_buf(AVFrameSideData ***sd,
+                                               int *nb_sd,
+                                               enum AVFrameSideDataType type,
+                                               AVBufferRef *buf)
+{
+    if (!buf)
+        return NULL;
+
+    return add_side_data_from_buf_ext(sd, nb_sd, type, buf, buf->data, buf->size);
+}
+
 AVFrameSideData *av_frame_new_side_data_from_buf(AVFrame *frame,
                                                  enum AVFrameSideDataType type,
                                                  AVBufferRef *buf)
@@ -799,7 +808,8 @@ int av_frame_side_data_clone(AVFrameSideData ***sd, int *nb_sd,
     if (flags & AV_FRAME_SIDE_DATA_FLAG_UNIQUE)
         remove_side_data(sd, nb_sd, src->type);
 
-    sd_dst = add_side_data_from_buf(sd, nb_sd, src->type, buf);
+    sd_dst = add_side_data_from_buf_ext(sd, nb_sd, src->type, buf,
+                                        src->data, src->size);
     if (!sd_dst) {
         av_buffer_unref(&buf);
         return AVERROR(ENOMEM);

libswscale/utils.c

@@ -564,7 +564,7 @@ static av_cold int initFilter(int16_t **outFilter, int32_t **filterPos,
                 filter[i * filterSize + j] = coeff;
                 xx++;
             }
-            xDstInSrc += 2 * xInc;
+            xDstInSrc += 2LL * xInc;
         }
     }
 

tests/fate/enc_external.mak

@@ -12,10 +12,5 @@ FATE_ENC_EXTERNAL-$(call ENCDEC, LIBX264 HEVC, MOV, LIBX264_HDR10 HEVC_DEMUXER H
 fate-libx264-hdr10: CMD = enc_external $(TARGET_SAMPLES)/hevc/hdr10_plus_h265_sample.hevc \
     mp4 "-c:v libx264" "-show_frames -show_entries frame=side_data_list -of flat"
 
-# test for x265 MDCV and CLL passthrough during encoding
-FATE_ENC_EXTERNAL-$(call ENCDEC, LIBX265 HEVC, MOV, HEVC_DEMUXER) += fate-libx265-hdr10
-fate-libx265-hdr10: CMD = enc_external $(TARGET_SAMPLES)/hevc/hdr10_plus_h265_sample.hevc \
-    mp4 "-c:v libx265" "-show_frames -show_entries frame=side_data_list -of flat"
-
 FATE_SAMPLES_FFMPEG_FFPROBE += $(FATE_ENC_EXTERNAL-yes)
 fate-enc-external: $(FATE_ENC_EXTERNAL-yes)

tests/fate/vvc.mak

@@ -9,7 +9,6 @@ VVC_SAMPLES_10BIT =       \
     BUMP_A_2              \
     DCI_A_3               \
     HRD_A_3               \
-    OPI_B_3               \
     PHSH_B_1              \
     POC_A_1               \
     PPS_B_1               \
@@ -21,7 +20,6 @@ VVC_SAMPLES_10BIT =       \
     STILL_B_1             \
     SUBPIC_A_3            \
     TILE_A_2              \
-    VPS_A_3               \
     WP_A_3                \
     WPP_A_3               \
     WRAP_A_4              \
@@ -31,6 +29,8 @@ VVC_SAMPLES_444_10BIT =   \
 
 # not tested:
 # BOUNDARY_A_3 (too big)
+# OPI_B_3 (Inter layer ref support needed)
+# VPS_A_3 (Inter layer ref support needed)
 
 FATE_VVC_VARS := 8BIT 10BIT 444_10BIT
 $(foreach VAR,$(FATE_VVC_VARS), $(eval VVC_TESTS_$(VAR) := $(addprefix fate-vvc-conformance-, $(VVC_SAMPLES_$(VAR)))))

tests/ref/fate/filter-setpts

@@ -1,42 +1,55 @@
-#tb 0: 1/25
+#tb 0: 1/1000
 #media_type 0: video
 #codec_id 0: rawvideo
 #dimensions 0: 352x288
 #sar 0: 0/1
-0,          0,          0,        1,   152064, 0x05b789ef
-0,          1,          1,        1,   152064, 0x4bb46551
-0,          2,          2,        1,   152064, 0x9dddf64a
-0,          3,          3,        1,   152064, 0x2a8380b0
-0,          4,          4,        1,   152064, 0x4de3b652
-0,          5,          5,        1,   152064, 0xedb5a8e6
-0,          6,          6,        1,   152064, 0x5ab58bac
-0,          7,          7,        1,   152064, 0x1f1b8026
-0,          8,          8,        1,   152064, 0x91373915
-0,          9,          9,        1,   152064, 0x30f5fcd5
-0,         10,         10,        1,   152064, 0xc711ad61
-0,         11,         11,        1,   152064, 0x52a48ddd
-0,         12,         12,        1,   152064, 0xa91c0f05
-0,         13,         13,        1,   152064, 0x8e364e18
-0,         14,         14,        1,   152064, 0xf25f6acc
-0,         15,         15,        1,   152064, 0xf34ddbff
-0,         16,         16,        1,   152064, 0x9dc72412
-0,         17,         17,        1,   152064, 0x445d1d59
-0,         18,         18,        1,   152064, 0x2f2768ef
-0,         19,         19,        1,   152064, 0x95579936
-0,         20,         20,        1,   152064, 0x43d796b5
-0,         21,         21,        1,   152064, 0x76d2a455
-0,         22,         22,        1,   152064, 0x6dc3650e
-0,         23,         23,        1,   152064, 0x0f9d6aca
-0,         24,         24,        1,   152064, 0xd766fc8d
-0,         25,         25,        1,   152064, 0xe22f7a30
-0,         26,         26,        1,   152064, 0xfa8d94fb
-0,         27,         27,        1,   152064, 0x4c9737ab
-0,         28,         28,        1,   152064, 0xa50d01f8
-0,         29,         29,        1,   152064, 0x88734edd
-0,         30,         30,        1,   152064, 0xd2735925
-0,         31,         31,        1,   152064, 0x20cebfa9
-0,         32,         32,        1,   152064, 0x575c20ec
-0,         33,         33,        1,   152064, 0x61b47e73
-0,         34,         34,        1,   152064, 0x09ef53ff
-0,         35,         35,        1,   152064, 0x6e88c5c2
-0,         36,         36,        1,   152064, 0x4bbad8ea
+0,          0,          0,        0,   152064, 0x05b789ef
+0,         28,         28,        0,   152064, 0x4bb46551
+0,         57,         57,        0,   152064, 0x9dddf64a
+0,         86,         86,        0,   152064, 0x2a8380b0
+0,        115,        115,        0,   152064, 0x4de3b652
+0,        144,        144,        0,   152064, 0xedb5a8e6
+0,        172,        172,        0,   152064, 0xe20f7c23
+0,        201,        201,        0,   152064, 0x5ab58bac
+0,        229,        229,        0,   152064, 0x1f1b8026
+0,        258,        258,        0,   152064, 0x91373915
+0,        286,        286,        0,   152064, 0x02344760
+0,        314,        314,        0,   152064, 0x30f5fcd5
+0,        343,        343,        0,   152064, 0xc711ad61
+0,        371,        371,        0,   152064, 0x24eca223
+0,        399,        399,        0,   152064, 0x52a48ddd
+0,        427,        427,        0,   152064, 0xa91c0f05
+0,        456,        456,        0,   152064, 0x8e364e18
+0,        484,        484,        0,   152064, 0xb15d38c8
+0,        512,        512,        0,   152064, 0xf25f6acc
+0,        541,        541,        0,   152064, 0xf34ddbff
+0,        570,        570,        0,   152064, 0xfc7bf570
+0,        598,        598,        0,   152064, 0x9dc72412
+0,        627,        627,        0,   152064, 0x445d1d59
+0,        656,        656,        0,   152064, 0x2f2768ef
+0,        685,        685,        0,   152064, 0xce09f9d6
+0,        714,        714,        0,   152064, 0x95579936
+0,        743,        743,        0,   152064, 0x43d796b5
+0,        772,        772,        0,   152064, 0xd780d887
+0,        800,        800,        0,   152064, 0x76d2a455
+0,        829,        829,        0,   152064, 0x6dc3650e
+0,        858,        858,        0,   152064, 0x0f9d6aca
+0,        887,        887,        0,   152064, 0xe295c51e
+0,        915,        915,        0,   152064, 0xd766fc8d
+0,        944,        944,        0,   152064, 0xe22f7a30
+0,        972,        972,        0,   152064, 0x7fea4378
+0,       1000,       1000,        0,   152064, 0xfa8d94fb
+0,       1029,       1029,        0,   152064, 0x4c9737ab
+0,       1057,       1057,        0,   152064, 0xa50d01f8
+0,       1085,       1085,        0,   152064, 0x0b07594c
+0,       1113,       1113,        0,   152064, 0x88734edd
+0,       1142,       1142,        0,   152064, 0xd2735925
+0,       1170,       1170,        0,   152064, 0xd4e49e08
+0,       1198,       1198,        0,   152064, 0x20cebfa9
+0,       1227,       1227,        0,   152064, 0x575c20ec
+0,       1255,       1255,        0,   152064, 0xfd500471
+0,       1284,       1284,        0,   152064, 0x61b47e73
+0,       1313,       1313,        0,   152064, 0x09ef53ff
+0,       1341,       1341,        0,   152064, 0x6e88c5c2
+0,       1370,       1370,        0,   152064, 0xbb87b483
+0,       1399,       1399,        0,   152064, 0x4bbad8ea

tests/ref/fate/libx265-hdr10

@@ -1,16 +0,0 @@
-frames.frame.0.side_data_list.side_data.0.side_data_type="H.26[45] User Data Unregistered SEI message"
-frames.frame.0.side_data_list.side_data.1.side_data_type="H.26[45] User Data Unregistered SEI message"
-frames.frame.0.side_data_list.side_data.2.side_data_type="Mastering display metadata"
-frames.frame.0.side_data_list.side_data.2.red_x="13250/50000"
-frames.frame.0.side_data_list.side_data.2.red_y="34500/50000"
-frames.frame.0.side_data_list.side_data.2.green_x="7500/50000"
-frames.frame.0.side_data_list.side_data.2.green_y="3000/50000"
-frames.frame.0.side_data_list.side_data.2.blue_x="34000/50000"
-frames.frame.0.side_data_list.side_data.2.blue_y="16000/50000"
-frames.frame.0.side_data_list.side_data.2.white_point_x="15635/50000"
-frames.frame.0.side_data_list.side_data.2.white_point_y="16450/50000"
-frames.frame.0.side_data_list.side_data.2.min_luminance="50/10000"
-frames.frame.0.side_data_list.side_data.2.max_luminance="10000000/10000"
-frames.frame.0.side_data_list.side_data.3.side_data_type="Content light level metadata"
-frames.frame.0.side_data_list.side_data.3.max_content=1000
-frames.frame.0.side_data_list.side_data.3.max_average=200

tests/ref/fate/vvc-conformance-OPI_B_3

@@ -1,6 +0,0 @@
-#tb 0: 1/25
-#media_type 0: video
-#codec_id 0: rawvideo
-#dimensions 0: 416x240
-#sar 0: 0/1
-0,          0,          0,        1,   299520, 0xdf1640db

tests/ref/fate/vvc-conformance-VPS_A_3

@@ -1,6 +0,0 @@
-#tb 0: 1/25
-#media_type 0: video
-#codec_id 0: rawvideo
-#dimensions 0: 208x120
-#sar 0: 0/1
-0,          0,          0,        1,    74880, 0x1b401a6d