Changelog: include last 3 fixes

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

.forgejo/CODEOWNERS

@@ -53,7 +53,6 @@ libavutil/.*d3d12va.* @jianhuaw
 libavutil/eval.* @michaelni
 libavutil/iamf.* @jamrial
 libavutil/integer.* @michaelni
-libavutil/kiss99.* @michaelni
 libavutil/lfg.* @michaelni
 libavutil/lls.* @michaelni
 libavutil/md5.* @michaelni

Changelog

@@ -1,8 +1,84 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.
 
-version <next>:
 
+version 8.0.1:
+ avutil/common: cast GET_BYTE/GET_16BIT returned value
+ avfilter/vf_drawtext: fix call GET_UTF8 with invalid argument
+ avfilter/vf_drawtext: fix incorrect text length
+ Update for 8.0.1
+ avfilter/vf_drawtext: Account for bbox text seperator
+ avcodec/mediacodecdec_common: Check that the input to mediacodec_wrap_sw_audio_buffer() contains channel * sample_size
+ avcodec/rv60dec: Clear blk_info
+ avformat/whip: Fix rtp_ctx->streams access
+ avcodec/utvideodec: Set B for the width= 1 case in restore_median_planar_il()
+ avcodec/osq: Fix 32bit sample overflow
+ avformat/rtpdec_rfc4175: Only change PayloadContext on success
+ avformat/rtpdec_rfc4175: Check dimensions
+ avformat/rtpdec_rfc4175: Fix memleak of sampling
+ avformat/http: Fix off by 1 error
+ avcodec/exr: spelling
+ avcodec/rv60dec: add upper bound check for qp
+ avcodec/exr: use tile dimensions in pxr24 UINT case
+ avcodec/exr: Simple check for available channels
+ avformat/sctp: Check size in sctp_write()
+ avformat/rtmpproto: consider command line argument lengths
+ avformat/rtmpproto_ Check tcurl and flashver length
+ avcodec/g723_1enc: Make min_err 64bit
+ avcodec/vlc: Clear val8/16 in vlc_multi_gen() by av_mallocz()
+ avformat/rtpenc_h264_hevc: Check space for nal_length_size in ff_rtp_send_h264_hevc()
+ avcodec/ffv1enc: Consider variation in slice sizes
+ libavcodec/cbs_apv_syntax_template: limit tile to 2gb
+ swscale/output: Fix unsigned cast position in  yuv2*
+ swscale/output: Fix integer overflow in yuv2ya16_X_c_template()
+ avcodec/exr: Check that DWA has 3 channels
+ avcodec/exr: check ac_size
+ avcodec/exr: Round dc_w/h up
+ avcodec/mjpegdec: Explain buf_size/width/height check
+ configure: strip non numeric trailer from gcc version
+ avformat/dhav: Fix off by length of read element error
+ avformat/aviobuf: Keep checksum_ptr consistent in avio_seek()
+ doc/examples/vaapi_encode: fix invalid check on fwrite
+ avcodec/librsvgdec: fix compilation with librsvg 2.50.3
+ avcodec/mfenc: fix memory leak with D3D11 input surfaces
+ swscale/graph: fix double-free when legacy pass fails initializing
+ libavformat/udp: Fix call to recvfrom(2)
+ avfilter/f_ebur128: Fix incorrect ebur128 peak calculation.
+ avformat/udp: fix warning about unused varible
+ avdevice/lavfi: stop setting deprecated buffersink options
+ configure: unbreak glslang build
+ swscale/range_convert: fix truncation bias in range conversion
+ lavc/aarch64: Fix addp overflow in ff_pred16x16_plane_neon_10
+ avcodec/mlpdec: don't depend on context channel layout when setting substream masks
+ avformat/demux: pass new extradata to the parser
+ avfilter/af_whisper: fix srt index
+ avfilter/af_whisper: fix int64 printf format
+ avfilter/af_whisper: fix srt file format
+ avfilter/whisper: correct option formatting
+ avfilter/af_whisper: fix broken output for multibyte character
+ avformat/rtsp: fix leading space in RTSP reason
+ avformat/rtsp: do not log invalid values
+ avformat/http: Handle IPv6 Zone ID in hostname
+ avformat/dump: fix log level passed to av_log when printing stream group side data
+ avcodec/hevc/sei: don't attempt to use stale values in HEVCSEITDRDI
+ avcodec/hevc/sei: prevent storing a potentially bogus num_ref_displays value in HEVCSEITDRDI
+ avcodec/hevc/refs: don't unconditionally discard non-IRAP frames if no IRAP frame was seen before
+ libavutil/arm: Rename the HWCAP defines
+ libavutil/arm: Make use of elf_aux_info() on FreeBSD/OpenBSD
+ fftools/ffmpeg: fix gracefully shutdown
+ avcodec/decode: sync initial_pict_type and intra_only_flag with thread worker's avctx
+ avcodec/x86/pngdsp: add missing emms at the end of add_png_paeth_prediction
+ avcodec/videotoolboxenc: ensure bitrate is set in low_delay mode
+ avcodec/videotoolboxenc: allow low latency RC with HEVC
+ avcodec/videotoolboxenc: support global_quality without qscale
+ avcodec/videotoolboxenc: fix the loss of precision when calculating quality
+ fftools/ffmpeg_demux: ensure the display_rotation option is honored
+ avcodec/mjpegdec: use ff_frame_new_side_data() to export display matrix
+ avutil/tests/aes_ctr: extend the test to cover payloads smaller than a block
+ avutil/aes_ctr: reintroduce the block offset state
+ avfilter/vf_lcevc: support LCEVCdec version 4
+ avcodec/lcevcdec: support LCEVCdec version 4
+ movenc: ensure chapters track extradata is not null and populated
 
 version 8.0:
 - Whisper filter

RELEASE

@@ -1 +1 @@
-7.1.git
+8.0.1

RELEASE_NOTES

@@ -0,0 +1,15 @@
+
+            ┌────────────────────────────────────────┐
+            │ RELEASE NOTES for FFmpeg 8.0 "Huffman" │
+            └────────────────────────────────────────┘
+
+   The FFmpeg Project proudly presents FFmpeg 8.0 "Huffman", about 11
+   months after the release of FFmpeg 7.1.
+
+   A complete Changelog is available at the root of the project, and the
+   complete Git history on https://git.ffmpeg.org/gitweb/ffmpeg.git
+
+   We hope you will like this release as much as we enjoyed working on it, and
+   as usual, if you have any questions about it, or any FFmpeg related topic,
+   feel free to join us on the #ffmpeg IRC channel (on irc.libera.chat) or ask
+   on the mailing-lists.

configure

@@ -5174,7 +5174,7 @@ probe_cc(){
         # but we can force it back to gnu mode and get the version from there.
         _ident=$($_cc -flavor gnu --version 2>/dev/null)
         _ld_o='-out:$@'
-        _flags_filter=msvc_flags
+        _flags_filter=msvc_flags_link
         _ld_lib='lib%.a'
         _ld_path='-libpath:'
     elif VSLANG=1033 $_cc -nologo- 2>&1 | grep -q ^Microsoft || { $_cc -v 2>&1 | grep -q clang && $_cc -? > /dev/null 2>&1; }; then
@@ -7049,12 +7049,16 @@ enabled libfontconfig     && require_pkg_config libfontconfig fontconfig "fontco
 enabled libfreetype       && require_pkg_config libfreetype freetype2 "ft2build.h FT_FREETYPE_H" FT_Init_FreeType
 enabled libfribidi        && require_pkg_config libfribidi fribidi fribidi.h fribidi_version_info
 enabled libharfbuzz       && require_pkg_config libharfbuzz harfbuzz hb.h hb_buffer_create
-enabled libglslang && { check_lib spirv_compiler glslang/Include/glslang_c_interface.h glslang_initialize_process \
+if enabled libglslang; then
+    spvremap="-lSPVRemapper"
+    require_headers "glslang/build_info.h" && { test_cpp_condition glslang/build_info.h "GLSLANG_VERSION_MAJOR >= 16" && spvremap="" ; }
+    check_lib spirv_compiler glslang/Include/glslang_c_interface.h glslang_initialize_process \
                             -lglslang -lMachineIndependent -lGenericCodeGen \
-                            -lSPVRemapper -lSPIRV -lSPIRV-Tools-opt -lSPIRV-Tools -lpthread -lstdc++ -lm ||
+                            ${spvremap} -lSPIRV -lSPIRV-Tools-opt -lSPIRV-Tools -lpthread -lstdc++ -lm ||
                         require spirv_compiler glslang/Include/glslang_c_interface.h glslang_initialize_process \
                             -lglslang -lMachineIndependent -lOSDependent -lHLSL -lOGLCompiler -lGenericCodeGen \
-                            -lSPVRemapper -lSPIRV -lSPIRV-Tools-opt -lSPIRV-Tools -lpthread -lstdc++ -lm ; }
+                            ${spvremap} -lSPIRV -lSPIRV-Tools-opt -lSPIRV-Tools -lpthread -lstdc++ -lm ;
+fi
 enabled libgme            && { check_pkg_config libgme libgme gme/gme.h gme_new_emu ||
                                require libgme gme/gme.h gme_new_emu -lgme -lstdc++; }
 enabled libgsm            && { for gsm_hdr in "gsm.h" "gsm/gsm.h"; do
@@ -7754,7 +7758,7 @@ if enabled icc; then
     fi
 elif enabled gcc; then
     gcc_version=$($cc -dumpversion)
-    major_version=${gcc_version%%.*}
+    major_version=${gcc_version%%[!0-9]*}
     if [ $major_version -lt 13 ]; then
         # Disable tree-vectorize for GCC <13 - it has historically been buggy.
         check_optflags -fno-tree-vectorize

doc/Doxyfile

@@ -38,7 +38,7 @@ PROJECT_NAME           = FFmpeg
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         =
+PROJECT_NUMBER         = 8.0.1
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a

doc/community.texi

@@ -123,7 +123,7 @@ Internally, the TC should take decisions with a majority, or using ranked-choice
 
 Each TC member must vote on such decision according to what is, in their view, best for the project.
 
-If a TC member feels they are affected by a conflict of interest with regards to the case, they should announce it and recurse themselves from the TC
+If a TC member feels they are affected by a conflict of interest with regards to the case, they should announce it and recuse themselves from the TC
 discussion and vote.
 
 A conflict of interest is presumed to occur when a TC member has a personal interest (e.g. financial) in a specific outcome of the case.

doc/examples/vaapi_encode.c

@@ -88,7 +88,7 @@ static int encode_write(AVCodecContext *avctx, AVFrame *frame, FILE *fout)
         enc_pkt->stream_index = 0;
         ret = fwrite(enc_pkt->data, enc_pkt->size, 1, fout);
         av_packet_unref(enc_pkt);
-        if (ret != enc_pkt->size) {
+        if (!ret) {
             ret = AVERROR(errno);
             break;
         }

fftools/ffmpeg.c

@@ -806,8 +806,6 @@ static int check_keyboard_interaction(int64_t cur_time)
 {
     int i, key;
     static int64_t last_time;
-    if (received_nb_signals)
-        return AVERROR_EXIT;
     /* read_key() returns 0 on EOF */
     if (cur_time - last_time >= 100000) {
         key =  read_key();
@@ -891,6 +889,9 @@ static int transcode(Scheduler *sch)
     while (!sch_wait(sch, stats_period, &transcode_ts)) {
         int64_t cur_time= av_gettime_relative();
 
+        if (received_nb_signals)
+            break;
+
         /* if 'q' pressed, exits */
         if (stdin_interaction)
             if (check_keyboard_interaction(cur_time) < 0)

fftools/ffmpeg_demux.c

@@ -67,6 +67,7 @@ typedef struct DemuxStream {
     int                      reinit_filters;
     int                      autorotate;
     int                      apply_cropping;
+    int                      force_display_matrix;
     int                      drop_changed;
 
 
@@ -1183,6 +1184,7 @@ static int add_display_matrix_to_stream(const OptionsContext *o,
                                         AVFormatContext *ctx, InputStream *ist)
 {
     AVStream *st = ist->st;
+    DemuxStream *ds = ds_from_ist(ist);
     AVPacketSideData *sd;
     double rotation = DBL_MAX;
     int hflip = -1, vflip = -1;
@@ -1217,6 +1219,8 @@ static int add_display_matrix_to_stream(const OptionsContext *o,
                            hflip_set ? hflip : 0,
                            vflip_set ? vflip : 0);
 
+    ds->force_display_matrix = 1;
+
     return 0;
 }
 
@@ -1455,6 +1459,15 @@ static int ist_add(const OptionsContext *o, Demuxer *d, AVStream *st, AVDictiona
     av_dict_set_int(&ds->decoder_opts, "apply_cropping",
                     ds->apply_cropping && ds->apply_cropping != CROP_CONTAINER, 0);
 
+    if (ds->force_display_matrix) {
+        char buf[32];
+        if (av_dict_get(ds->decoder_opts, "side_data_prefer_packet", NULL, 0))
+            buf[0] = ',';
+        else
+            buf[0] = '\0';
+        av_strlcat(buf, "displaymatrix", sizeof(buf));
+        av_dict_set(&ds->decoder_opts, "side_data_prefer_packet", buf, AV_DICT_APPEND);
+    }
     /* Attached pics are sparse, therefore we would not want to delay their decoding
      * till EOF. */
     if (ist->st->disposition & AV_DISPOSITION_ATTACHED_PIC)

fftools/ffmpeg_mux_init.c

@@ -1593,7 +1593,7 @@ static int map_auto_video(Muxer *mux, const OptionsContext *o)
 {
     AVFormatContext *oc = mux->fc;
     InputStream *best_ist = NULL;
-    int best_score = 0;
+    int64_t best_score = 0;
     int qcr;
 
     /* video: highest resolution */
@@ -1604,16 +1604,16 @@ static int map_auto_video(Muxer *mux, const OptionsContext *o)
     for (int j = 0; j < nb_input_files; j++) {
         InputFile *ifile = input_files[j];
         InputStream *file_best_ist = NULL;
-        int file_best_score = 0;
+        int64_t file_best_score = 0;
         for (int i = 0; i < ifile->nb_streams; i++) {
             InputStream *ist = ifile->streams[i];
-            int score;
+            int64_t score;
 
             if (ist->user_set_discard == AVDISCARD_ALL ||
                 ist->st->codecpar->codec_type != AVMEDIA_TYPE_VIDEO)
                 continue;
 
-            score = ist->st->codecpar->width * ist->st->codecpar->height
+            score = ist->st->codecpar->width * (int64_t)ist->st->codecpar->height
                        + 100000000 * !!(ist->st->event_flags & AVSTREAM_EVENT_FLAG_NEW_PACKETS)
                        + 5000000*!!(ist->st->disposition & AV_DISPOSITION_DEFAULT);
             if((qcr!=MKTAG('A', 'P', 'I', 'C')) && (ist->st->disposition & AV_DISPOSITION_ATTACHED_PIC))

libavcodec/Makefile

@@ -637,7 +637,7 @@ OBJS-$(CONFIG_PRORES_DECODER)          += proresdec.o proresdsp.o proresdata.o
 OBJS-$(CONFIG_PRORES_ENCODER)          += proresenc_anatoliy.o proresdata.o
 OBJS-$(CONFIG_PRORES_AW_ENCODER)       += proresenc_anatoliy.o proresdata.o
 OBJS-$(CONFIG_PRORES_KS_ENCODER)       += proresenc_kostya.o proresdata.o
-OBJS-$(CONFIG_PRORES_RAW_DECODER)      += prores_raw.o
+OBJS-$(CONFIG_PRORES_RAW_DECODER)      += prores_raw.o proresdsp.o proresdata.o
 OBJS-$(CONFIG_PRORES_VIDEOTOOLBOX_ENCODER) += videotoolboxenc.o
 OBJS-$(CONFIG_PROSUMER_DECODER)        += prosumer.o
 OBJS-$(CONFIG_PSD_DECODER)             += psd.o

libavcodec/aac/aacdec.c

@@ -62,6 +62,7 @@
 #include "libavutil/opt.h"
 #include "libavutil/tx.h"
 #include "libavutil/version.h"
+#include "libavutil/refstruct.h"
 
 /*
  * supported tools
@@ -421,6 +422,26 @@ static uint64_t sniff_channel_order(uint8_t (*layout_map)[3], int tags)
     return layout;
 }
 
+static void copy_oc(OutputConfiguration *dst, OutputConfiguration *src)
+{
+    int i;
+
+    for (i = 0; i < src->usac.nb_elems; i++) {
+        AACUsacElemConfig *src_e = &src->usac.elems[i];
+        AACUsacElemConfig *dst_e = &dst->usac.elems[i];
+        /* dst_e->ext.pl_buf is guaranteed to be set to src_e->ext.pl_buf
+         * upon this function's return */
+        av_refstruct_replace(&dst_e->ext.pl_buf, src_e->ext.pl_buf);
+    }
+
+    /* Unref all additional buffers to close leaks */
+    for (; i < dst->usac.nb_elems; i++)
+        av_refstruct_unref(&dst->usac.elems[i].ext.pl_buf);
+
+    /* Set all other properties */
+    *dst = *src;
+}
+
 /**
  * Save current output configuration if and only if it has been locked.
  */
@@ -429,7 +450,7 @@ static int push_output_configuration(AACDecContext *ac)
     int pushed = 0;
 
     if (ac->oc[1].status == OC_LOCKED || ac->oc[0].status == OC_NONE) {
-        ac->oc[0] = ac->oc[1];
+        copy_oc(&ac->oc[0], &ac->oc[1]);
         pushed = 1;
     }
     ac->oc[1].status = OC_NONE;
@@ -443,7 +464,8 @@ static int push_output_configuration(AACDecContext *ac)
 static void pop_output_configuration(AACDecContext *ac)
 {
     if (ac->oc[1].status != OC_LOCKED && ac->oc[0].status != OC_NONE) {
-        ac->oc[1] = ac->oc[0];
+        copy_oc(&ac->oc[1], &ac->oc[0]);
+
         ac->avctx->ch_layout = ac->oc[1].ch_layout;
         ff_aac_output_configure(ac, ac->oc[1].layout_map, ac->oc[1].layout_map_tags,
                                 ac->oc[1].status, 0);
@@ -466,6 +488,9 @@ int ff_aac_output_configure(AACDecContext *ac,
     uint8_t id_map[TYPE_END][MAX_ELEM_ID] = {{ 0 }};
     uint8_t type_counts[TYPE_END] = { 0 };
 
+    if (get_new_frame && !ac->frame)
+        return AVERROR_INVALIDDATA;
+
     if (ac->oc[1].layout_map != layout_map) {
         memcpy(ac->oc[1].layout_map, layout_map, tags * sizeof(layout_map[0]));
         ac->oc[1].layout_map_tags = tags;
@@ -1107,7 +1132,7 @@ static av_cold int decode_close(AVCodecContext *avctx)
         AACUSACConfig *usac = &oc->usac;
         for (int j = 0; j < usac->nb_elems; j++) {
             AACUsacElemConfig *ec = &usac->elems[j];
-            av_freep(&ec->ext.pl_data);
+            av_refstruct_unref(&ec->ext.pl_buf);
         }
 
         av_channel_layout_uninit(&ac->oc[i].ch_layout);

libavcodec/aac/aacdec.h

@@ -344,7 +344,7 @@ typedef struct AACUsacElemConfig {
         uint8_t payload_frag;
         uint32_t default_len;
         uint32_t pl_data_offset;
-        uint8_t *pl_data;
+        uint8_t *pl_buf;
     } ext;
 } AACUsacElemConfig;
 
@@ -353,7 +353,7 @@ typedef struct AACUSACConfig {
     uint16_t core_frame_len;
     uint16_t stream_identifier;
 
-    AACUsacElemConfig elems[64];
+    AACUsacElemConfig elems[MAX_ELEM_ID];
     int nb_elems;
 
     struct {

libavcodec/aac/aacdec_usac.c

@@ -24,12 +24,13 @@
 #include "aacdec_ac.h"
 
 #include "libavcodec/aacsbr.h"
-
 #include "libavcodec/aactab.h"
-#include "libavutil/mem.h"
 #include "libavcodec/mpeg4audio.h"
 #include "libavcodec/unary.h"
 
+#include "libavutil/mem.h"
+#include "libavutil/refstruct.h"
+
 /* Number of scalefactor bands per complex prediction band, equal to 2. */
 #define SFB_PER_PRED_BAND 2
 
@@ -1574,7 +1575,6 @@ static int parse_audio_preroll(AACDecContext *ac, GetBitContext *gb)
 static int parse_ext_ele(AACDecContext *ac, AACUsacElemConfig *e,
                          GetBitContext *gb)
 {
-    uint8_t *tmp;
     uint8_t pl_frag_start = 1;
     uint8_t pl_frag_end = 1;
     uint32_t len;
@@ -1601,18 +1601,26 @@ static int parse_ext_ele(AACDecContext *ac, AACUsacElemConfig *e,
     if (pl_frag_start)
         e->ext.pl_data_offset = 0;
 
-    /* If an extension starts and ends this packet, we can directly use it */
+    /* If an extension starts and ends this packet, we can directly use it below.
+     * Otherwise, we have to copy it to a buffer and accumulate it. */
     if (!(pl_frag_start && pl_frag_end)) {
-        tmp = av_realloc(e->ext.pl_data, e->ext.pl_data_offset + len);
-        if (!tmp) {
-            av_free(e->ext.pl_data);
+        /* Reallocate the data */
+        uint8_t *tmp_buf = av_refstruct_alloc_ext(e->ext.pl_data_offset + len,
+                                                  AV_REFSTRUCT_FLAG_NO_ZEROING,
+                                                  NULL, NULL);
+        if (!tmp_buf)
             return AVERROR(ENOMEM);
-        }
-        e->ext.pl_data = tmp;
+
+        /* Copy the data over only if we had saved data to begin with */
+        if (e->ext.pl_buf)
+            memcpy(tmp_buf, e->ext.pl_buf, e->ext.pl_data_offset);
+
+        av_refstruct_unref(&e->ext.pl_buf);
+        e->ext.pl_buf = tmp_buf;
 
         /* Readout data to a buffer */
         for (int i = 0; i < len; i++)
-            e->ext.pl_data[e->ext.pl_data_offset + i] = get_bits(gb, 8);
+            e->ext.pl_buf[e->ext.pl_data_offset + i] = get_bits(gb, 8);
     }
 
     e->ext.pl_data_offset += len;
@@ -1624,7 +1632,7 @@ static int parse_ext_ele(AACDecContext *ac, AACUsacElemConfig *e,
         GetBitContext *gb2 = gb;
         GetBitContext gbc;
         if (!(pl_frag_start && pl_frag_end)) {
-            ret = init_get_bits8(&gbc, e->ext.pl_data, pl_len);
+            ret = init_get_bits8(&gbc, e->ext.pl_buf, pl_len);
             if (ret < 0)
                 return ret;
 
@@ -1642,7 +1650,7 @@ static int parse_ext_ele(AACDecContext *ac, AACUsacElemConfig *e,
             /* This should never happen */
             av_assert0(0);
         }
-        av_freep(&e->ext.pl_data);
+        av_refstruct_unref(&e->ext.pl_buf);
         if (ret < 0)
             return ret;
 

libavcodec/aarch64/h264pred_neon.S

@@ -489,10 +489,10 @@ function ff_pred16x16_plane_neon_10, export=1
         mul             v2.8h,  v2.8h,  v0.8h
         mul             v3.8h,  v3.8h,  v0.8h
         addp            v2.8h,  v2.8h,  v3.8h
-        addp            v2.8h,  v2.8h,  v2.8h
-        addp            v2.4h,  v2.4h,  v2.4h
-        sshll           v3.4s,  v2.4h,  #2
-        saddw           v2.4s,  v3.4s,  v2.4h
+        saddlp          v2.4s,  v2.8h
+        addp            v2.4s,  v2.4s,  v2.4s
+        shl             v3.4s,  v2.4s,  #2
+        add             v2.4s,  v3.4s,  v2.4s
         rshrn           v4.4h,  v2.4s,  #6
         trn2            v5.4h,  v4.4h,  v4.4h
         add             v2.4h,  v4.4h,  v5.4h
@@ -506,14 +506,13 @@ function ff_pred16x16_plane_neon_10, export=1
         sxtl            v6.4s,  v5.4h          // c
 
         mov             v0.h[0],  wzr
-        mul             v0.8h,  v0.8h,  v4.h[0]
         dup             v16.4s, v2.s[0]
         dup             v17.4s, v2.s[0]
         dup             v2.8h,  v4.h[0]        // b
         dup             v3.4s,  v6.s[0]        // c
         sshll           v2.4s,  v2.4h,  #3     // b * 8
-        saddw           v16.4s, v16.4s, v0.4h
-        saddw2          v17.4s, v17.4s, v0.8h
+        smlal           v16.4s, v0.4h, v4.h[0]
+        smlal2          v17.4s, v0.8h, v4.h[0]
         sub             v3.4s,  v3.4s,  v2.4s
 
         mov             w3,      #16

libavcodec/apv_decode.c

@@ -35,6 +35,16 @@
 #include "thread.h"
 
 
+typedef struct APVDerivedTileInfo {
+    uint8_t  tile_cols;
+    uint8_t  tile_rows;
+    uint16_t num_tiles;
+    // The spec uses an extra element on the end of these arrays
+    // not corresponding to any tile.
+    uint16_t col_starts[APV_MAX_TILE_COLS + 1];
+    uint16_t row_starts[APV_MAX_TILE_ROWS + 1];
+} APVDerivedTileInfo;
+
 typedef struct APVDecodeContext {
     CodedBitstreamContext *cbc;
     APVDSPContext dsp;
@@ -52,9 +62,9 @@ typedef struct APVDecodeContext {
 static const enum AVPixelFormat apv_format_table[5][5] = {
     { AV_PIX_FMT_GRAY8,    AV_PIX_FMT_GRAY10,     AV_PIX_FMT_GRAY12,     AV_PIX_FMT_GRAY14, AV_PIX_FMT_GRAY16 },
     { 0 }, // 4:2:0 is not valid.
-    { AV_PIX_FMT_YUV422P,  AV_PIX_FMT_YUV422P10,  AV_PIX_FMT_YUV422P12,  AV_PIX_FMT_GRAY14, AV_PIX_FMT_YUV422P16 },
-    { AV_PIX_FMT_YUV444P,  AV_PIX_FMT_YUV444P10,  AV_PIX_FMT_YUV444P12,  AV_PIX_FMT_GRAY14, AV_PIX_FMT_YUV444P16 },
-    { AV_PIX_FMT_YUVA444P, AV_PIX_FMT_YUVA444P10, AV_PIX_FMT_YUVA444P12, AV_PIX_FMT_GRAY14, AV_PIX_FMT_YUVA444P16 },
+    { AV_PIX_FMT_YUV422P,  AV_PIX_FMT_YUV422P10,  AV_PIX_FMT_YUV422P12,  AV_PIX_FMT_YUV422P14, AV_PIX_FMT_YUV422P16 },
+    { AV_PIX_FMT_YUV444P,  AV_PIX_FMT_YUV444P10,  AV_PIX_FMT_YUV444P12,  AV_PIX_FMT_YUV444P14, AV_PIX_FMT_YUV444P16 },
+    { AV_PIX_FMT_YUVA444P, AV_PIX_FMT_YUVA444P10, AV_PIX_FMT_YUVA444P12, 0                   ,AV_PIX_FMT_YUVA444P16 },
 };
 
 static APVVLCLUT decode_lut;
@@ -75,6 +85,11 @@ static int apv_decode_check_format(AVCodecContext *avctx,
     avctx->pix_fmt =
         apv_format_table[header->frame_info.chroma_format_idc][bit_depth - 4 >> 2];
 
+    if (!avctx->pix_fmt) {
+        avpriv_request_sample(avctx, "YUVA444P14");
+        return AVERROR_PATCHWELCOME;
+    }
+
     err = ff_set_dimensions(avctx,
                             FFALIGN(header->frame_info.frame_width,  16),
                             FFALIGN(header->frame_info.frame_height, 16));
@@ -179,7 +194,7 @@ static int apv_decode_tile_component(AVCodecContext *avctx, void *data,
     APVRawFrame                      *input = data;
     APVDecodeContext                   *apv = avctx->priv_data;
     const CodedBitstreamAPVContext *apv_cbc = apv->cbc->priv_data;
-    const APVDerivedTileInfo     *tile_info = &apv_cbc->tile_info;
+    const APVDerivedTileInfo     *tile_info = &apv->tile_info;
 
     int tile_index = job / apv_cbc->num_comp;
     int comp_index = job % apv_cbc->num_comp;
@@ -292,12 +307,38 @@ fail:
     return err;
 }
 
+static void apv_derive_tile_info(APVDerivedTileInfo *ti,
+                                 const APVRawFrameHeader *fh)
+{
+    int frame_width_in_mbs  = (fh->frame_info.frame_width  + (APV_MB_WIDTH  - 1)) >> 4;
+    int frame_height_in_mbs = (fh->frame_info.frame_height + (APV_MB_HEIGHT - 1)) >> 4;
+    int start_mb, i;
+
+    start_mb = 0;
+    for (i = 0; start_mb < frame_width_in_mbs; i++) {
+        ti->col_starts[i] = start_mb * APV_MB_WIDTH;
+        start_mb += fh->tile_info.tile_width_in_mbs;
+    }
+    ti->col_starts[i] = frame_width_in_mbs * APV_MB_WIDTH;
+    ti->tile_cols = i;
+
+    start_mb = 0;
+    for (i = 0; start_mb < frame_height_in_mbs; i++) {
+        ti->row_starts[i] = start_mb * APV_MB_HEIGHT;
+        start_mb += fh->tile_info.tile_height_in_mbs;
+    }
+    ti->row_starts[i] = frame_height_in_mbs * APV_MB_HEIGHT;
+    ti->tile_rows = i;
+
+    ti->num_tiles = ti->tile_cols * ti->tile_rows;
+}
+
 static int apv_decode(AVCodecContext *avctx, AVFrame *output,
                       APVRawFrame *input)
 {
     APVDecodeContext                   *apv = avctx->priv_data;
-    const CodedBitstreamAPVContext *apv_cbc = apv->cbc->priv_data;
-    const APVDerivedTileInfo     *tile_info = &apv_cbc->tile_info;
+    const AVPixFmtDescriptor          *desc = NULL;
+    APVDerivedTileInfo           *tile_info = &apv->tile_info;
     int err, job_count;
 
     err = apv_decode_check_format(avctx, &input->frame_header);
@@ -306,6 +347,9 @@ static int apv_decode(AVCodecContext *avctx, AVFrame *output,
         return err;
     }
 
+    desc = av_pix_fmt_desc_get(avctx->pix_fmt);
+    av_assert0(desc);
+
     err = ff_thread_get_buffer(avctx, output, 0);
     if (err < 0)
         return err;
@@ -313,9 +357,11 @@ static int apv_decode(AVCodecContext *avctx, AVFrame *output,
     apv->output_frame = output;
     atomic_store_explicit(&apv->tile_errors, 0, memory_order_relaxed);
 
+    apv_derive_tile_info(tile_info, &input->frame_header);
+
     // Each component within a tile is independent of every other,
     // so we can decode all in parallel.
-    job_count = tile_info->num_tiles * apv_cbc->num_comp;
+    job_count = tile_info->num_tiles * desc->nb_components;
 
     avctx->execute2(avctx, apv_decode_tile_component,
                     input, NULL, job_count);

libavcodec/bsf/eia608_to_smpte436m.c

@@ -236,7 +236,7 @@ static int ff_eia608_to_smpte436m_filter(AVBSFContext *ctx, AVPacket *out)
     if (ret < 0)
         goto fail;
 
-    return 0;
+    ret = 0;
 
 fail:
     if (ret < 0)

libavcodec/bsf/smpte436m_to_eia608.c

@@ -68,6 +68,8 @@ static int ff_smpte436m_to_eia608_filter(AVBSFContext *ctx, AVPacket *out)
         // verified it won't fail by running it above
         av_smpte_291m_anc_8bit_extract_cta_708(&anc, out->data, ctx);
 
+        av_packet_free(&in);
+
         return 0;
     }
     if (ret != AVERROR_EOF)

libavcodec/cbs_apv.c

@@ -37,33 +37,18 @@ static int cbs_apv_get_num_comp(const APVRawFrameHeader *fh)
     }
 }
 
-static void cbs_apv_derive_tile_info(APVDerivedTileInfo *ti,
+static void cbs_apv_derive_tile_info(CodedBitstreamContext *ctx,
                                      const APVRawFrameHeader *fh)
 {
+    CodedBitstreamAPVContext *priv = ctx->priv_data;
     int frame_width_in_mbs   = (fh->frame_info.frame_width  + 15) / 16;
     int frame_height_in_mbs  = (fh->frame_info.frame_height + 15) / 16;
-    int start_mb, i;
+    int tile_cols = (frame_width_in_mbs  + fh->tile_info.tile_width_in_mbs - 1)  / fh->tile_info.tile_width_in_mbs;
+    int tile_rows = (frame_height_in_mbs + fh->tile_info.tile_height_in_mbs - 1) / fh->tile_info.tile_height_in_mbs;
 
-    start_mb = 0;
-    for (i = 0; start_mb < frame_width_in_mbs; i++) {
-        ti->col_starts[i] = start_mb * APV_MB_WIDTH;
-        start_mb += fh->tile_info.tile_width_in_mbs;
-    }
-    av_assert0(i <= APV_MAX_TILE_COLS);
-    ti->col_starts[i] = frame_width_in_mbs * APV_MB_WIDTH;
-    ti->tile_cols = i;
+    av_assert0(tile_cols <= APV_MAX_TILE_COLS && tile_rows <= APV_MAX_TILE_ROWS);
 
-    start_mb = 0;
-    for (i = 0; start_mb < frame_height_in_mbs; i++) {
-        av_assert0(i < APV_MAX_TILE_ROWS);
-        ti->row_starts[i] = start_mb * APV_MB_HEIGHT;
-        start_mb += fh->tile_info.tile_height_in_mbs;
-    }
-    av_assert0(i <= APV_MAX_TILE_ROWS);
-    ti->row_starts[i] = frame_height_in_mbs * APV_MB_HEIGHT;
-    ti->tile_rows = i;
-
-    ti->num_tiles = ti->tile_cols * ti->tile_rows;
+    priv->num_tiles = tile_cols * tile_rows;
 }
 
 

libavcodec/cbs_apv.h

@@ -187,21 +187,11 @@ typedef struct APVRawMetadata {
 } APVRawMetadata;
 
 
-typedef struct APVDerivedTileInfo {
-    uint8_t  tile_cols;
-    uint8_t  tile_rows;
-    uint16_t num_tiles;
-    // The spec uses an extra element on the end of these arrays
-    // not corresponding to any tile.
-    uint16_t col_starts[APV_MAX_TILE_COLS + 1];
-    uint16_t row_starts[APV_MAX_TILE_ROWS + 1];
-} APVDerivedTileInfo;
-
 typedef struct CodedBitstreamAPVContext {
     int bit_depth;
     int num_comp;
 
-    APVDerivedTileInfo tile_info;
+    uint16_t num_tiles;
 } CodedBitstreamAPVContext;
 
 #endif /* AVCODEC_CBS_APV_H */

libavcodec/cbs_apv_syntax_template.c

@@ -128,10 +128,10 @@ static int FUNC(tile_info)(CodedBitstreamContext *ctx, RWContext *rw,
 
     ub(1, tile_size_present_in_fh_flag);
 
-    cbs_apv_derive_tile_info(&priv->tile_info, fh);
+    cbs_apv_derive_tile_info(ctx, fh);
 
     if (current->tile_size_present_in_fh_flag) {
-        for (int t = 0; t < priv->tile_info.num_tiles; t++) {
+        for (int t = 0; t < priv->num_tiles; t++) {
             us(32, tile_size_in_fh[t], 10, MAX_UINT_BITS(32), 1, t);
         }
     }
@@ -262,8 +262,8 @@ static int FUNC(frame)(CodedBitstreamContext *ctx, RWContext *rw,
 
     CHECK(FUNC(frame_header)(ctx, rw, &current->frame_header));
 
-    for (int t = 0; t < priv->tile_info.num_tiles; t++) {
-        us(32, tile_size[t], 10, MAX_UINT_BITS(32), 1, t);
+    for (int t = 0; t < priv->num_tiles; t++) {
+        us(32, tile_size[t], 10, MAX_INT_BITS(32), 1, t);
 
         CHECK(FUNC(tile)(ctx, rw, &current->tile[t],
                          t, current->tile_size[t]));

libavcodec/cbs_vp9_syntax_template.c

@@ -152,7 +152,6 @@ static int FUNC(interpolation_filter)(CodedBitstreamContext *ctx, RWContext *rw,
 static int FUNC(loop_filter_params)(CodedBitstreamContext *ctx, RWContext *rw,
                                     VP9RawFrameHeader *current)
 {
-    CodedBitstreamVP9Context *vp9 = ctx->priv_data;
     int err, i;
 
     f(6, loop_filter_level);
@@ -160,8 +159,6 @@ static int FUNC(loop_filter_params)(CodedBitstreamContext *ctx, RWContext *rw,
 
     f(1, loop_filter_delta_enabled);
     if (current->loop_filter_delta_enabled) {
-        memcpy(current->loop_filter_ref_deltas, vp9->loop_filter_ref_deltas, sizeof(vp9->loop_filter_ref_deltas));
-        memcpy(current->loop_filter_mode_deltas, vp9->loop_filter_mode_deltas, sizeof(vp9->loop_filter_mode_deltas));
         f(1, loop_filter_delta_update);
         if (current->loop_filter_delta_update) {
             for (i = 0; i < VP9_MAX_REF_FRAMES; i++) {
@@ -174,9 +171,9 @@ static int FUNC(loop_filter_params)(CodedBitstreamContext *ctx, RWContext *rw,
                 if (current->update_mode_delta[i])
                     ss(6, loop_filter_mode_deltas[i], 1, i);
             }
-            memcpy(vp9->loop_filter_ref_deltas, current->loop_filter_ref_deltas, sizeof(vp9->loop_filter_ref_deltas));
-            memcpy(vp9->loop_filter_mode_deltas, current->loop_filter_mode_deltas, sizeof(vp9->loop_filter_mode_deltas));
         }
+    } else {
+        infer(loop_filter_delta_update, 0);
     }
 
     return 0;
@@ -201,18 +198,11 @@ static int FUNC(segmentation_params)(CodedBitstreamContext *ctx, RWContext *rw,
 {
     static const uint8_t segmentation_feature_bits[VP9_SEG_LVL_MAX]   = { 8, 6, 2, 0 };
     static const uint8_t segmentation_feature_signed[VP9_SEG_LVL_MAX] = { 1, 1, 0, 0 };
-
-    CodedBitstreamVP9Context *vp9 = ctx->priv_data;
     int err, i, j;
 
     f(1, segmentation_enabled);
 
     if (current->segmentation_enabled) {
-        memcpy(current->segmentation_tree_probs, vp9->segmentation_tree_probs, sizeof(vp9->segmentation_tree_probs));
-        memcpy(current->segmentation_pred_prob, vp9->segmentation_pred_prob, sizeof(vp9->segmentation_pred_prob));
-        memcpy(current->feature_enabled, vp9->feature_enabled, sizeof(vp9->feature_enabled));
-        memcpy(current->feature_value, vp9->feature_value, sizeof(vp9->feature_value));
-        memcpy(current->feature_sign, vp9->feature_sign, sizeof(vp9->feature_sign));
         f(1, segmentation_update_map);
         if (current->segmentation_update_map) {
             for (i = 0; i < 7; i++)
@@ -224,8 +214,6 @@ static int FUNC(segmentation_params)(CodedBitstreamContext *ctx, RWContext *rw,
                 else
                     infer(segmentation_pred_prob[i], 255);
             }
-            memcpy(vp9->segmentation_tree_probs, current->segmentation_tree_probs, sizeof(vp9->segmentation_tree_probs));
-            memcpy(vp9->segmentation_pred_prob, current->segmentation_pred_prob, sizeof(vp9->segmentation_pred_prob));
         }
 
         f(1, segmentation_update_data);
@@ -248,10 +236,9 @@ static int FUNC(segmentation_params)(CodedBitstreamContext *ctx, RWContext *rw,
                     }
                 }
             }
-            memcpy(vp9->feature_enabled, current->feature_enabled, sizeof(vp9->feature_enabled));
-            memcpy(vp9->feature_value, current->feature_value, sizeof(vp9->feature_value));
-            memcpy(vp9->feature_sign, current->feature_sign, sizeof(vp9->feature_sign));
         }
+    } else {
+        infer(segmentation_update_data, 0);
     }
 
     return 0;
@@ -368,18 +355,6 @@ static int FUNC(uncompressed_header)(CodedBitstreamContext *ctx, RWContext *rw,
 
     f(2, frame_context_idx);
 
-    if (current->frame_type == VP9_KEY_FRAME || current->error_resilient_mode || current->intra_only) {
-        infer(update_ref_delta[0], 1);
-        infer(update_ref_delta[1], 0);
-        infer(update_ref_delta[2], -1);
-        infer(update_ref_delta[3], -1);
-        infer(loop_filter_mode_deltas[0], 0);
-        infer(loop_filter_mode_deltas[1], 0);
-        memset(vp9->feature_enabled, 0, sizeof(current->feature_enabled));
-        memset(vp9->feature_value, 0, sizeof(current->feature_value));
-        memset(vp9->feature_sign, 0, sizeof(current->feature_sign));
-    }
-
     CHECK(FUNC(loop_filter_params)(ctx, rw, current));
     CHECK(FUNC(quantization_params)(ctx, rw, current));
     CHECK(FUNC(segmentation_params)(ctx, rw, current));
@@ -399,6 +374,60 @@ static int FUNC(uncompressed_header)(CodedBitstreamContext *ctx, RWContext *rw,
         }
     }
 
+    // Update top-level loop filter and segmentation state with changes
+    // from this frame.
+    if (current->frame_type == VP9_KEY_FRAME ||
+        current->intra_only                  ||
+        current->error_resilient_mode) {
+        // setup_past_independence() - fill with the initial values.
+
+        vp9->loop_filter_ref_deltas[VP9_INTRA_FRAME]  = 1;
+        vp9->loop_filter_ref_deltas[VP9_LAST_FRAME]   = 0;
+        vp9->loop_filter_ref_deltas[VP9_GOLDEN_FRAME] = -1;
+        vp9->loop_filter_ref_deltas[VP9_ALTREF_FRAME] = -1;
+
+        vp9->loop_filter_mode_deltas[0] = 0;
+        vp9->loop_filter_mode_deltas[1] = 0;
+
+        memset(vp9->feature_enabled, 0, sizeof(vp9->feature_enabled));
+        memset(vp9->feature_value,   0, sizeof(vp9->feature_value));
+        memset(vp9->feature_sign,    0, sizeof(vp9->feature_sign));
+
+    } else {
+        // Modify previous state based on updates in this frame.
+
+        if (current->loop_filter_delta_update) {
+            for (i = 0; i < 4; i++) {
+                if (current->update_ref_delta[i])
+                    vp9->loop_filter_ref_deltas[i] =
+                        current->loop_filter_ref_deltas[i];
+            }
+            for (i = 0; i < 2; i++) {
+                if (current->update_mode_delta[i])
+                    vp9->loop_filter_mode_deltas[i] =
+                        current->loop_filter_mode_deltas[i];
+            }
+        }
+
+        if (current->segmentation_update_data) {
+            memcpy(vp9->feature_enabled, current->feature_enabled,
+                   sizeof(vp9->feature_enabled));
+            memcpy(vp9->feature_value,   current->feature_value,
+                   sizeof(vp9->feature_value));
+            memcpy(vp9->feature_sign,    current->feature_sign,
+                   sizeof(vp9->feature_sign));
+
+            if (current->segmentation_update_map) {
+                memcpy(vp9->segmentation_tree_probs,
+                       current->segmentation_tree_probs,
+                       sizeof(vp9->segmentation_tree_probs));
+                memcpy(vp9->segmentation_pred_prob,
+                       current->segmentation_pred_prob,
+                       sizeof(vp9->segmentation_pred_prob));
+            }
+        }
+    }
+
     av_log(ctx->log_ctx, AV_LOG_DEBUG, "Frame:  size %dx%d  "
            "subsample %dx%d  bit_depth %d  tiles %dx%d.\n",
            vp9->frame_width, vp9->frame_height,

libavcodec/d3d12va_encode.c

@@ -973,8 +973,7 @@ rc_mode_found:
         case RC_MODE_CQP:
             // cqp ConfigParams will be updated in ctx->codec->configure.
             break;
-
-        case RC_MODE_CBR:
+        case RC_MODE_CBR: {
             D3D12_VIDEO_ENCODER_RATE_CONTROL_CBR *cbr_ctl;
 
             ctx->rc.ConfigParams.DataSize = sizeof(D3D12_VIDEO_ENCODER_RATE_CONTROL_CBR);
@@ -995,8 +994,8 @@ rc_mode_found:
 
             ctx->rc.ConfigParams.pConfiguration_CBR = cbr_ctl;
             break;
-
-        case RC_MODE_VBR:
+        }
+        case RC_MODE_VBR: {
             D3D12_VIDEO_ENCODER_RATE_CONTROL_VBR *vbr_ctl;
 
             ctx->rc.ConfigParams.DataSize = sizeof(D3D12_VIDEO_ENCODER_RATE_CONTROL_VBR);
@@ -1018,8 +1017,8 @@ rc_mode_found:
 
             ctx->rc.ConfigParams.pConfiguration_VBR = vbr_ctl;
             break;
-
-        case RC_MODE_QVBR:
+        }
+        case RC_MODE_QVBR: {
             D3D12_VIDEO_ENCODER_RATE_CONTROL_QVBR *qvbr_ctl;
 
             ctx->rc.ConfigParams.DataSize = sizeof(D3D12_VIDEO_ENCODER_RATE_CONTROL_QVBR);
@@ -1039,7 +1038,7 @@ rc_mode_found:
 
             ctx->rc.ConfigParams.pConfiguration_QVBR = qvbr_ctl;
             break;
-
+        }
         default:
             break;
     }

libavcodec/decode.c

@@ -2235,6 +2235,8 @@ void ff_decode_internal_sync(AVCodecContext *dst, const AVCodecContext *src)
     const DecodeContext *src_dc = decode_ctx(src->internal);
     DecodeContext *dst_dc = decode_ctx(dst->internal);
 
+    dst_dc->initial_pict_type = src_dc->initial_pict_type;
+    dst_dc->intra_only_flag   = src_dc->intra_only_flag;
     av_refstruct_replace(&dst_dc->lcevc, src_dc->lcevc);
 }
 

libavcodec/dxv.c

@@ -38,12 +38,15 @@ typedef struct DXVContext {
     GetByteContext gbc;
 
     uint8_t *tex_data;   // Compressed texture
+    unsigned tex_data_size;
     uint8_t *ctex_data;  // Compressed chroma texture
+    unsigned ctex_data_size;
 
-    int64_t tex_size;    // Texture size
+    size_t tex_size;     // Texture size
     int64_t ctex_size;   // Chroma texture size
 
     uint8_t *op_data[4]; // Opcodes
+    unsigned op_data_size[4];
     int64_t op_size[4];  // Opcodes size
 } DXVContext;
 
@@ -274,7 +277,9 @@ static int dxv_decompress_opcodes(GetByteContext *gb, void *dstp, size_t op_size
 
     if ((flag & 3) == 0) {
         bytestream2_skip(gb, 1);
-        bytestream2_get_buffer(gb, dstp, op_size);
+        int read_size = bytestream2_get_buffer(gb, dstp, op_size);
+        if (read_size != op_size)
+            return AVERROR_INVALIDDATA;
     } else if ((flag & 3) == 1) {
         bytestream2_skip(gb, 1);
         memset(dstp, bytestream2_get_byte(gb), op_size);
@@ -823,7 +828,7 @@ static int dxv_decompress_dxt5(AVCodecContext *avctx)
 static int dxv_decompress_lzf(AVCodecContext *avctx)
 {
     DXVContext *ctx = avctx->priv_data;
-    return ff_lzf_uncompress(&ctx->gbc, &ctx->tex_data, &ctx->tex_size);
+    return ff_lzf_uncompress(&ctx->gbc, &ctx->tex_data, &ctx->tex_size, &ctx->tex_data_size);
 }
 
 static int dxv_decompress_raw(AVCodecContext *avctx)
@@ -935,6 +940,8 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame *frame,
         }
         break;
     }
+    if (avctx->coded_height / 2 / TEXTURE_BLOCK_H < 1)
+        return AVERROR_INVALIDDATA;
 
     texdsp_ctx.slice_count  = av_clip(avctx->thread_count, 1,
                                       avctx->coded_height / TEXTURE_BLOCK_H);
@@ -969,9 +976,14 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame *frame,
     ctx->tex_size = avctx->coded_width  / (texdsp_ctx.raw_ratio / (avctx->pix_fmt == AV_PIX_FMT_RGBA ? 4 : 1)) *
                     avctx->coded_height / TEXTURE_BLOCK_H *
                     texdsp_ctx.tex_ratio;
-    ret = av_reallocp(&ctx->tex_data, ctx->tex_size + AV_INPUT_BUFFER_PADDING_SIZE);
-    if (ret < 0)
-        return ret;
+    unsigned old_size = ctx->tex_data_size;
+    void *ptr = av_fast_realloc(ctx->tex_data, &ctx->tex_data_size, ctx->tex_size + AV_INPUT_BUFFER_PADDING_SIZE);
+    if (!ptr)
+        return AVERROR(ENOMEM);
+    ctx->tex_data = ptr;
+
+    if (ctx->tex_data_size > old_size)
+        memset(ctx->tex_data + old_size, 0, ctx->tex_data_size - old_size);
 
     if (avctx->pix_fmt != AV_PIX_FMT_RGBA) {
         int i;
@@ -985,13 +997,20 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame *frame,
         ctx->op_size[2] = avctx->coded_width * avctx->coded_height / 32;
         ctx->op_size[3] = avctx->coded_width * avctx->coded_height / 16;
 
-        ret = av_reallocp(&ctx->ctex_data, ctx->ctex_size + AV_INPUT_BUFFER_PADDING_SIZE);
-        if (ret < 0)
-            return ret;
+        old_size = ctx->ctex_data_size;
+        ptr = av_fast_realloc(ctx->ctex_data, &ctx->ctex_data_size, ctx->ctex_size + AV_INPUT_BUFFER_PADDING_SIZE);
+        if (!ptr)
+            return AVERROR(ENOMEM);
+        ctx->ctex_data = ptr;
+        if (old_size < ctx->ctex_data_size)
+            memset(ctx->ctex_data + old_size, 0, ctx->ctex_data_size - old_size);
+
         for (i = 0; i < 4; i++) {
-            ret = av_reallocp(&ctx->op_data[i], ctx->op_size[i]);
-            if (ret < 0)
-                return ret;
+            old_size = ctx->op_data_size[i];
+            ptr = av_fast_realloc(ctx->op_data[i], &ctx->op_data_size[i], ctx->op_size[i]);
+            if (!ptr)
+                return AVERROR(ENOMEM);
+            ctx->op_data[i] = ptr;
         }
     }
 
@@ -1078,11 +1097,16 @@ static av_cold int dxv_close(AVCodecContext *avctx)
     DXVContext *ctx = avctx->priv_data;
 
     av_freep(&ctx->tex_data);
+    ctx->tex_data_size = 0;
+
     av_freep(&ctx->ctex_data);
+    ctx->ctex_data_size = 0;
+
     av_freep(&ctx->op_data[0]);
     av_freep(&ctx->op_data[1]);
     av_freep(&ctx->op_data[2]);
     av_freep(&ctx->op_data[3]);
+    memset(ctx->op_data_size, 0, sizeof(ctx->op_data_size));
 
     return 0;
 }

libavcodec/exr.c

@@ -175,6 +175,9 @@ typedef struct EXRContext {
 
     int is_luma;/* 1 if there is an Y plane */
 
+#define M(chr) (1<<chr - 'A')
+    int has_channel; ///< combination of flags representing the channel codes A-Z
+
     GetByteContext gb;
     const uint8_t *buf;
     int buf_size;
@@ -745,12 +748,12 @@ static int pxr24_uncompress(const EXRContext *s, const uint8_t *src,
                 break;
             case EXR_UINT:
                 ptr[0] = in;
-                ptr[1] = ptr[0] + s->xdelta;
-                ptr[2] = ptr[1] + s->xdelta;
-                ptr[3] = ptr[2] + s->xdelta;
-                in     = ptr[3] + s->xdelta;
+                ptr[1] = ptr[0] + td->xsize;
+                ptr[2] = ptr[1] + td->xsize;
+                ptr[3] = ptr[2] + td->xsize;
+                in     = ptr[3] + td->xsize;
 
-                for (j = 0; j < s->xdelta; ++j) {
+                for (j = 0; j < td->xsize; ++j) {
                     uint32_t diff = ((uint32_t)*(ptr[0]++) << 24) |
                     (*(ptr[1]++) << 16) |
                     (*(ptr[2]++) << 8 ) |
@@ -992,8 +995,8 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse
     int64_t version, lo_usize, lo_size;
     int64_t ac_size, dc_size, rle_usize, rle_csize, rle_raw_size;
     int64_t ac_count, dc_count, ac_compression;
-    const int dc_w = td->xsize >> 3;
-    const int dc_h = td->ysize >> 3;
+    const int dc_w = (td->xsize + 7) >> 3;
+    const int dc_h = (td->ysize + 7) >> 3;
     GetByteContext gb, agb;
     int skip, ret;
     int have_rle = 0;
@@ -1005,6 +1008,11 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse
     if (version != 2)
         return AVERROR_INVALIDDATA;
 
+    if (s->nb_channels < 3) {
+        avpriv_request_sample(s->avctx, "Gray DWA");
+        return AVERROR_PATCHWELCOME;
+    }
+
     lo_usize = AV_RL64(src + 8);
     lo_size = AV_RL64(src + 16);
     ac_size = AV_RL64(src + 24);
@@ -1021,11 +1029,20 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse
     )
         return AVERROR_INVALIDDATA;
 
+    if (ac_size <= 0) {
+        avpriv_request_sample(s->avctx, "Zero ac_size");
+        return AVERROR_INVALIDDATA;
+    }
+
     if ((uint64_t)rle_raw_size > INT_MAX) {
         avpriv_request_sample(s->avctx, "Too big rle_raw_size");
         return AVERROR_INVALIDDATA;
     }
 
+    if (td->xsize % 8 || td->ysize % 8) {
+        avpriv_request_sample(s->avctx, "odd dimensions DWA");
+    }
+
     bytestream2_init(&gb, src + 88, compressed_size - 88);
     skip = bytestream2_get_le16(&gb);
     if (skip < 2)
@@ -1608,6 +1625,7 @@ static int decode_header(EXRContext *s, AVFrame *frame)
     s->is_tile            = 0;
     s->is_multipart       = 0;
     s->is_luma            = 0;
+    s->has_channel        = 0;
     s->current_part       = 0;
 
     if (bytestream2_get_bytes_left(gb) < 10) {
@@ -1711,23 +1729,26 @@ static int decode_header(EXRContext *s, AVFrame *frame)
                 }
 
                 if (layer_match) { /* only search channel if the layer match is valid */
+                    if (strlen(ch_gb.buffer) == 1) {
+                        int ch_chr = av_toupper(*ch_gb.buffer);
+                        if (ch_chr >= 'A' && ch_chr <= 'Z')
+                            s->has_channel |= M(ch_chr);
+                        av_log(s->avctx, AV_LOG_DEBUG, "%c\n", ch_chr);
+                    }
+
                     if (!av_strcasecmp(ch_gb.buffer, "R") ||
                         !av_strcasecmp(ch_gb.buffer, "X") ||
                         !av_strcasecmp(ch_gb.buffer, "U")) {
                         channel_index = 0;
-                        s->is_luma = 0;
                     } else if (!av_strcasecmp(ch_gb.buffer, "G") ||
                                !av_strcasecmp(ch_gb.buffer, "V")) {
                         channel_index = 1;
-                        s->is_luma = 0;
                     } else if (!av_strcasecmp(ch_gb.buffer, "Y")) {
                         channel_index = 1;
-                        s->is_luma = 1;
                     } else if (!av_strcasecmp(ch_gb.buffer, "B") ||
                                !av_strcasecmp(ch_gb.buffer, "Z") ||
                                !av_strcasecmp(ch_gb.buffer, "W")) {
                         channel_index = 2;
-                        s->is_luma = 0;
                     } else if (!av_strcasecmp(ch_gb.buffer, "A")) {
                         channel_index = 3;
                     } else {
@@ -1803,6 +1824,20 @@ static int decode_header(EXRContext *s, AVFrame *frame)
                     s->current_channel_offset += 4;
                 }
             }
+            if        (!((M('R') + M('G') + M('B')) & ~s->has_channel)) {
+                s->is_luma = 0;
+            } else if (!((M('X') + M('Y') + M('Z')) & ~s->has_channel)) {
+                s->is_luma = 0;
+            } else if (!((M('Y') + M('U') + M('V')) & ~s->has_channel)) {
+                s->is_luma = 0;
+            } else if (!((M('Y')                  ) & ~s->has_channel) &&
+                       !((M('R') + M('G') + M('B') + M('U') + M('V') + M('X') + M('Z')) &  s->has_channel)) {
+                s->is_luma = 1;
+            } else {
+                avpriv_request_sample(s->avctx, "Uncommon channel combination");
+                ret = AVERROR(AVERROR_PATCHWELCOME);
+                goto fail;
+            }
 
             /* Check if all channels are set with an offset or if the channels
              * are causing an overflow  */
@@ -2086,6 +2121,17 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *picture,
     if ((ret = decode_header(s, picture)) < 0)
         return ret;
 
+    if (s->compression == EXR_DWAA ||
+        s->compression == EXR_DWAB) {
+        for (int i = 0; i<s->nb_channels; i++) {
+            EXRChannel *channel = &s->channels[i];
+            if (channel->pixel_type != s->pixel_type) {
+                avpriv_request_sample(s->avctx, "mixed pixel type DWA");
+                return AVERROR_PATCHWELCOME;
+            }
+        }
+    }
+
     switch (s->pixel_type) {
     case EXR_HALF:
         if (s->channel_offsets[3] >= 0) {

libavcodec/ffv1enc.c

@@ -1684,9 +1684,11 @@ size_t ff_ffv1_encode_buffer_size(AVCodecContext *avctx)
 {
     FFV1Context *f = avctx->priv_data;
 
-    size_t maxsize = avctx->width*avctx->height * (1 + f->transparency);
+    int w = avctx->width  + f->num_h_slices;
+    int h = avctx->height + f->num_v_slices;
+    size_t maxsize = w*h * (1 + f->transparency);
     if (f->chroma_planes)
-        maxsize += AV_CEIL_RSHIFT(avctx->width, f->chroma_h_shift) * AV_CEIL_RSHIFT(f->height, f->chroma_v_shift) * 2;
+        maxsize += AV_CEIL_RSHIFT(w, f->chroma_h_shift) * AV_CEIL_RSHIFT(h, f->chroma_v_shift) * 2;
     maxsize += f->slice_count * 800; //for slice header
     if (f->version > 3) {
         maxsize *= f->bits_per_raw_sample + 1;

libavcodec/g723_1.h

@@ -108,7 +108,7 @@ typedef struct HFParam {
  * Optimized fixed codebook excitation parameters
  */
 typedef struct FCBParam {
-    int min_err;
+    int64_t min_err;
     int amp_index;
     int grid_index;
     int dirac_train;

libavcodec/g723_1enc.c

@@ -1013,7 +1013,7 @@ static void fcb_search(G723_1_ChannelContext *p, int16_t *impulse_resp,
     int pulse_cnt = pulses[index];
     int i;
 
-    optim.min_err = 1 << 30;
+    optim.min_err = 1LL << 31;
     get_fcb_param(&optim, impulse_resp, buf, pulse_cnt, SUBFRAME_LEN);
 
     if (p->pitch_lag[index >> 1] < SUBFRAME_LEN - 2) {

libavcodec/g726.c

@@ -455,6 +455,8 @@ static av_cold int g726_decode_init(AVCodecContext *avctx)
     g726_reset(c);
 
     avctx->sample_fmt = AV_SAMPLE_FMT_S16;
+    if (!avctx->sample_rate)
+        avctx->sample_rate = 8000;
 
     return 0;
 }

libavcodec/hevc/hevcdec.c

@@ -4106,7 +4106,7 @@ static int hevc_sei_to_context(AVCodecContext *avctx, HEVCSEI *sei)
 {
     int ret;
 
-    if (sei->tdrdi.num_ref_displays) {
+    if (sei->tdrdi.present) {
         AVBufferRef *buf;
         size_t size;
         AV3DReferenceDisplaysInfo *tdrdi = av_tdrdi_alloc(sei->tdrdi.num_ref_displays, &size);

libavcodec/hevc/refs.c

@@ -235,6 +235,7 @@ int ff_hevc_set_new_ref(HEVCContext *s, HEVCLayerContext *l, int poc)
                             s->layers[0].cur_frame - s->layers[0].DPB : -1;
 
     no_output = !IS_IRAP(s) && (s->poc < s->recovery_poc) &&
+                HEVC_IS_RECOVERING(s) &&
                 !(s->avctx->flags & AV_CODEC_FLAG_OUTPUT_CORRUPT) &&
                 !(s->avctx->flags2 & AV_CODEC_FLAG2_SHOW_ALL);
     if (s->sh.pic_output_flag && !no_output)

libavcodec/hevc/sei.c

@@ -167,6 +167,8 @@ static int decode_nal_sei_timecode(HEVCSEITimeCode *s, GetBitContext *gb)
 
 static int decode_nal_sei_3d_reference_displays_info(HEVCSEITDRDI *s, GetBitContext *gb)
 {
+    unsigned num_ref_displays;
+
     s->prec_ref_display_width = get_ue_golomb(gb);
     if (s->prec_ref_display_width > 31)
         return AVERROR_INVALIDDATA;
@@ -176,10 +178,10 @@ static int decode_nal_sei_3d_reference_displays_info(HEVCSEITDRDI *s, GetBitCont
         if (s->prec_ref_viewing_dist > 31)
             return AVERROR_INVALIDDATA;
     }
-    s->num_ref_displays = get_ue_golomb(gb);
-    if (s->num_ref_displays > 31)
+    num_ref_displays = get_ue_golomb(gb);
+    if (num_ref_displays > 31)
         return AVERROR_INVALIDDATA;
-    s->num_ref_displays += 1;
+    s->num_ref_displays = num_ref_displays + 1;
 
     for (int i = 0; i < s->num_ref_displays; i++) {
         int length;
@@ -215,6 +217,8 @@ static int decode_nal_sei_3d_reference_displays_info(HEVCSEITDRDI *s, GetBitCont
     }
     s->three_dimensional_reference_displays_extension_flag = get_bits1(gb);
 
+    s->present = 1;
+
     return 0;
 }
 

libavcodec/hevc/sei.h

@@ -93,6 +93,7 @@ typedef struct HEVCSEITDRDI {
     uint8_t additional_shift_present_flag[32];
     int16_t num_sample_shift[32];
     uint8_t three_dimensional_reference_displays_extension_flag;
+    int present;
 } HEVCSEITDRDI;
 
 typedef struct HEVCSEIRecoveryPoint {
@@ -126,6 +127,7 @@ int ff_hevc_decode_nal_sei(GetBitContext *gb, void *logctx, HEVCSEI *s,
  */
 static inline void ff_hevc_reset_sei(HEVCSEI *sei)
 {
+    sei->tdrdi.present = 0;
     ff_h2645_sei_reset(&sei->common);
 }
 

libavcodec/ilbcdec.c

@@ -675,6 +675,7 @@ static void get_codebook(int16_t * cbvec,   /* (o) Constructed codebook vector *
         /* get vector */
         memcpy(cbvec, mem + lMem - k, cbveclen * 2);
     } else if (index < base_size) {
+        memset(cbvec, 0, cbveclen * 2);
 
         /* Calculate lag */
 
@@ -701,6 +702,7 @@ static void get_codebook(int16_t * cbvec,   /* (o) Constructed codebook vector *
 
             filter_mafq12(&mem[memIndTest + 4], cbvec, kCbFiltersRev, CB_FILTERLEN, cbveclen);
         } else {
+            memset(cbvec, 0, cbveclen * 2);
             /* interpolated vectors */
             /* Stuff zeros outside memory buffer  */
             memIndTest = lMem - cbveclen - CB_FILTERLEN;

libavcodec/lcevcdec.c

@@ -141,7 +141,11 @@ static int lcevc_send_frame(void *logctx, FFLCEVCFrame *frame_ctx, const AVFrame
     if (!sd)
         return 1;
 
+#ifdef LCEVC_DEC_VERSION_MAJOR
+    res = LCEVC_SendDecoderEnhancementData(lcevc->decoder, in->pts, sd->data, sd->size);
+#else
     res = LCEVC_SendDecoderEnhancementData(lcevc->decoder, in->pts, 0, sd->data, sd->size);
+#endif
     if (res != LCEVC_Success)
         return AVERROR_EXTERNAL;
 
@@ -149,7 +153,11 @@ static int lcevc_send_frame(void *logctx, FFLCEVCFrame *frame_ctx, const AVFrame
     if (ret < 0)
         return ret;
 
+#ifdef LCEVC_DEC_VERSION_MAJOR
+    res = LCEVC_SendDecoderBase(lcevc->decoder, in->pts, picture, -1, NULL);
+#else
     res = LCEVC_SendDecoderBase(lcevc->decoder, in->pts, 0, picture, -1, NULL);
+#endif
     if (res != LCEVC_Success)
         return AVERROR_EXTERNAL;
 

libavcodec/librsvgdec.c

@@ -90,8 +90,6 @@ static int librsvg_decode_frame(AVCodecContext *avctx, AVFrame *frame,
         goto end;
 
     avctx->pix_fmt = AV_PIX_FMT_RGB32;
-    viewport.width = dimensions.width;
-    viewport.height = dimensions.height;
 
     ret = ff_get_buffer(avctx, frame, 0);
     if (ret < 0)
@@ -116,6 +114,8 @@ static int librsvg_decode_frame(AVCodecContext *avctx, AVFrame *frame,
     cairo_restore(crender);
 
 #if LIBRSVG_MAJOR_VERSION > 2 || LIBRSVG_MAJOR_VERSION == 2 && LIBRSVG_MINOR_VERSION >= 52
+    viewport.width = dimensions.width;
+    viewport.height = dimensions.height;
     gret = rsvg_handle_render_document(handle, crender, &viewport, &error);
 #else
     cairo_scale(crender, dimensions.width / (double)unscaled_dimensions.width,

libavcodec/libvorbisdec.c

@@ -114,6 +114,12 @@ static av_cold int oggvorbis_decode_init(AVCodecContext *avccontext)
         }
     }
 
+    if (context->vi.rate <= 0 || context->vi.rate > INT_MAX) {
+        av_log(avccontext, AV_LOG_ERROR, "vorbis rate is invalid\n");
+        ret = AVERROR_INVALIDDATA;
+        goto error;
+    }
+
     av_channel_layout_uninit(&avccontext->ch_layout);
     avccontext->ch_layout.order       = AV_CHANNEL_ORDER_UNSPEC;
     avccontext->ch_layout.nb_channels = context->vi.channels;

libavcodec/lzf.c

@@ -37,7 +37,22 @@
 #define LZF_LITERAL_MAX (1 << 5)
 #define LZF_LONG_BACKREF 7 + 2
 
-int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size)
+
+static inline int lzf_realloc(uint8_t **buf, size_t *size, int addition, unsigned *allocated_size)
+{
+    void *ptr = av_fast_realloc(*buf, allocated_size, *size + addition);
+
+    if (!ptr) {
+        av_freep(buf); //probably not needed
+        return AVERROR(ENOMEM);
+    }
+    *buf = ptr;
+    *size += addition;
+
+    return 0;
+}
+
+int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, size_t *size, unsigned *allocated_size)
 {
     int ret     = 0;
     uint8_t *p  = *buf;
@@ -49,8 +64,7 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size)
         if (s < LZF_LITERAL_MAX) {
             s++;
             if (s > *size - len) {
-                *size += s + *size /2;
-                ret = av_reallocp(buf, *size);
+                ret = lzf_realloc(buf, size, s, allocated_size);
                 if (ret < 0)
                     return ret;
                 p = *buf + len;
@@ -75,8 +89,7 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size)
                 return AVERROR_INVALIDDATA;
 
             if (l > *size - len) {
-                *size += l + *size / 2;
-                ret = av_reallocp(buf, *size);
+                ret = lzf_realloc(buf, size, l, allocated_size);
                 if (ret < 0)
                     return ret;
                 p = *buf + len;

libavcodec/lzf.h

@@ -24,6 +24,6 @@
 
 #include "bytestream.h"
 
-int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size);
+int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, size_t *size, unsigned *allocated_size);
 
 #endif /* AVCODEC_LZF_H */

libavcodec/mediacodecdec_common.c

@@ -385,6 +385,12 @@ static int mediacodec_wrap_sw_audio_buffer(AVCodecContext *avctx,
         goto done;
     }
 
+    if (info->size % (sample_size * avctx->ch_layout.nb_channels)) {
+        av_log(avctx, AV_LOG_ERROR, "input is not a multiple of channels * sample_size\n");
+        ret = AVERROR(EINVAL);
+        goto done;
+    }
+
     frame->format = avctx->sample_fmt;
     frame->sample_rate = avctx->sample_rate;
     frame->nb_samples = info->size / (sample_size * avctx->ch_layout.nb_channels);

libavcodec/mfenc.c

@@ -1356,6 +1356,9 @@ static int mf_close(AVCodecContext *avctx)
     if (c->async_events)
         IMFMediaEventGenerator_Release(c->async_events);
 
+    if (c->dxgiManager)
+        IMFDXGIDeviceManager_Release(c->dxgiManager);
+
 #if !HAVE_UWP
     if (c->library)
         ff_free_mf(&c->functions, &c->mft);

libavcodec/mjpegdec.c

@@ -343,6 +343,8 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
     av_log(s->avctx, AV_LOG_DEBUG, "sof0: picture: %dx%d\n", width, height);
     if (av_image_check_size(width, height, 0, s->avctx) < 0)
         return AVERROR_INVALIDDATA;
+
+    // A valid frame requires at least 1 bit for DC + 1 bit for AC for each 8x8 block.
     if (s->buf_size && (width + 7) / 8 * ((height + 7) / 8) > s->buf_size * 4LL)
         return AVERROR_INVALIDDATA;
 
@@ -2875,15 +2877,15 @@ the_end:
             AVFrameSideData *sd = NULL;
 
             if (orientation >= 2 && orientation <= 8) {
-                int32_t *matrix;
-
-                sd = av_frame_new_side_data(frame, AV_FRAME_DATA_DISPLAYMATRIX, sizeof(int32_t) * 9);
-                if (!sd) {
+                ret = ff_frame_new_side_data(avctx, frame, AV_FRAME_DATA_DISPLAYMATRIX, sizeof(int32_t) * 9, &sd);
+                if (ret < 0) {
                     av_log(avctx, AV_LOG_ERROR, "Could not allocate frame side data\n");
-                    return AVERROR(ENOMEM);
+                    return ret;
                 }
+            }
 
-                matrix = (int32_t *)sd->data;
+            if (sd) {
+                int32_t *matrix = (int32_t *)sd->data;
 
                 switch (orientation) {
                 case 2:

libavcodec/mlpdec.c

@@ -318,8 +318,10 @@ static av_cold int mlp_decode_init(AVCodecContext *avctx)
             av_channel_layout_uninit(&avctx->ch_layout);
             avctx->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_5POINT1;
         }
-        else
+        else {
           av_log(avctx, AV_LOG_WARNING, "Invalid downmix layout\n");
+            av_channel_layout_uninit(&m->downmix_layout);
+        }
     }
 
     ff_thread_once(&init_static_once, init_static);
@@ -452,26 +454,22 @@ static int read_major_sync(MLPDecodeContext *m, GetBitContext *gb)
         }
         m->substream[1].mask = mh.channel_layout_thd_stream1;
         if (mh.channels_thd_stream1 == 2 &&
-            mh.channels_thd_stream2 == 2 &&
-            m->avctx->ch_layout.nb_channels == 2)
+            mh.channels_thd_stream2 == 2)
             m->substream[0].mask = AV_CH_LAYOUT_STEREO;
         if ((substr = (mh.num_substreams > 1)))
             m->substream[0].mask = AV_CH_LAYOUT_STEREO;
         if (mh.num_substreams == 1 &&
             mh.channels_thd_stream1 == 1 &&
-            mh.channels_thd_stream2 == 1 &&
-            m->avctx->ch_layout.nb_channels == 1)
+            mh.channels_thd_stream2 == 1)
             m->substream[0].mask = AV_CH_LAYOUT_MONO;
         if (mh.num_substreams > 2)
             if (mh.channel_layout_thd_stream2)
                 m->substream[2].mask = mh.channel_layout_thd_stream2;
             else
                 m->substream[2].mask = mh.channel_layout_thd_stream1;
-        if (m->avctx->ch_layout.nb_channels > 2)
-            if (mh.num_substreams > 2)
-                m->substream[1].mask = mh.channel_layout_thd_stream1;
-            else
-                m->substream[mh.num_substreams > 1].mask = mh.channel_layout_thd_stream2;
+        if (mh.num_substreams == 2 && (!m->downmix_layout.nb_channels ||
+                                        m->downmix_layout.nb_channels > 2))
+            m->substream[1].mask = mh.channel_layout_thd_stream2;
     }
 
     m->needs_reordering = mh.channel_arrangement >= 18 && mh.channel_arrangement <= 20;

libavcodec/notchlc.c

@@ -40,7 +40,8 @@ typedef struct NotchLCContext {
     unsigned uncompressed_size;
 
     uint8_t *lzf_buffer;
-    int64_t lzf_size;
+    size_t lzf_size;
+    unsigned lzf_alloc_size;
 
     unsigned texture_size_x;
     unsigned texture_size_y;
@@ -490,7 +491,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *p,
         return AVERROR_PATCHWELCOME;
 
     if (s->format == 0) {
-        ret = ff_lzf_uncompress(gb, &s->lzf_buffer, &s->lzf_size);
+        ret = ff_lzf_uncompress(gb, &s->lzf_buffer, &s->lzf_size, &s->lzf_alloc_size);
         if (ret < 0)
             return ret;
 

libavcodec/osq.c

@@ -390,7 +390,7 @@ static int osq_decode_block(AVCodecContext *avctx, AVFrame *frame)
             int32_t *src = s->decode_buffer[ch] + OFFSET;
 
             for (int n = 0; n < nb_samples; n++)
-                dst[n] = av_clip_uint8(src[n] + 0x80);
+                dst[n] = av_clip_uint8(src[n] + 0x80ll);
         }
         break;
     case AV_SAMPLE_FMT_S16P:

libavcodec/prores_raw.c

@@ -367,9 +367,6 @@ static int decode_frame(AVCodecContext *avctx,
     if ((w & 1) || (h & 1))
         return AVERROR_INVALIDDATA;
 
-    avctx->coded_width  = FFALIGN(w, 16);
-    avctx->coded_height = FFALIGN(h, 16);
-
     if (w != avctx->width || h != avctx->height) {
         av_log(avctx, AV_LOG_WARNING, "picture resolution change: %ix%i -> %ix%i\n",
                avctx->width, avctx->height, w, h);
@@ -377,6 +374,9 @@ static int decode_frame(AVCodecContext *avctx,
             return ret;
     }
 
+    avctx->coded_width  = FFALIGN(w, 16);
+    avctx->coded_height = FFALIGN(h, 16);
+
     enum AVPixelFormat pix_fmt = AV_PIX_FMT_BAYER_RGGB16;
     if (pix_fmt != s->pix_fmt) {
         s->pix_fmt = pix_fmt;

libavcodec/pthread_frame.c

@@ -115,10 +115,6 @@ typedef struct PerThreadContext {
     int hwaccel_threadsafe;
 
     atomic_int debug_threads;       ///< Set if the FF_DEBUG_THREADS option is set.
-
-    /// The following two fields have the same semantics as the DecodeContext field
-    int intra_only_flag;
-    enum AVPictureType initial_pict_type;
 } PerThreadContext;
 
 /**
@@ -820,13 +816,6 @@ static av_cold int init_thread(PerThreadContext *p, int *threads_to_free,
     AVCodecContext *copy;
     int err;
 
-    p->initial_pict_type = AV_PICTURE_TYPE_NONE;
-    if (avctx->codec_descriptor->props & AV_CODEC_PROP_INTRA_ONLY) {
-        p->intra_only_flag = AV_FRAME_FLAG_KEY;
-        if (avctx->codec_type == AVMEDIA_TYPE_VIDEO)
-            p->initial_pict_type = AV_PICTURE_TYPE_I;
-    }
-
     atomic_init(&p->state, STATE_INPUT_READY);
 
     copy = av_memdup(avctx, sizeof(*avctx));

libavcodec/rv60dec.c

@@ -308,6 +308,9 @@ static int update_dimensions_clear_info(RV60Context *s, int width, int height)
     if ((ret = av_reallocp_array(&s->blk_info, s->blk_stride * (s->cu_height << 4), sizeof(s->blk_info[0]))) < 0)
         return ret;
 
+    memset(s->pu_info, 0, s->pu_stride * (s->cu_height << 3) * sizeof(s->pu_info[0]));
+    memset(s->blk_info, 0, s->blk_stride * (s->cu_height << 4) * sizeof(s->blk_info[0]));
+
     for (int j = 0; j < s->cu_height << 4; j++)
         for (int i = 0; i < s->cu_width << 4; i++)
             s->blk_info[j*s->blk_stride + i].mv.mvref = MVREF_NONE;
@@ -2261,7 +2264,7 @@ static int decode_slice(AVCodecContext *avctx, void *tdata, int cu_y, int thread
             ff_thread_progress_await(&s->progress[cu_y - 1], cu_x + 2);
 
         qp = s->qp + read_qp_offset(&gb, s->qp_off_type);
-        if (qp < 0) {
+        if (qp < 0 || qp >= 64) {
             ret = AVERROR_INVALIDDATA;
             break;
         }

libavcodec/sanm.c

@@ -277,6 +277,7 @@ typedef struct SANMVideoContext {
     uint16_t *fbuf, *frm0, *frm1, *frm2;
     uint8_t *stored_frame;
     uint32_t fbuf_size, frm0_size, frm1_size, frm2_size;
+    uint32_t stor_size;
     uint32_t stored_frame_size;
 
     uint8_t *rle_buf;
@@ -471,9 +472,11 @@ static av_cold int init_buffers(SANMVideoContext *ctx)
     av_fast_padded_mallocz(&ctx->frm0, &ctx->frm0_size, ctx->buf_size);
     av_fast_padded_mallocz(&ctx->frm1, &ctx->frm1_size, ctx->buf_size);
     av_fast_padded_mallocz(&ctx->frm2, &ctx->frm2_size, ctx->buf_size);
-    if (!ctx->version)
+    if (!ctx->version) {
         av_fast_padded_mallocz(&ctx->stored_frame,
                               &ctx->stored_frame_size, ctx->buf_size);
+        ctx->stor_size = 0;
+    }
 
     if (!ctx->frm0 || !ctx->frm1 || !ctx->frm2 ||
         (!ctx->stored_frame && !ctx->version)) {
@@ -1427,8 +1430,18 @@ static void c48_4to8(uint8_t *dst, const uint8_t *src, const uint16_t w)
     }
 }
 
-static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db,
-                         const uint16_t w)
+static int check_mv(int x, int y, const uint16_t w, int h, int blocksize, int mvofs) {
+    if (mvofs < -x + -y*w)
+        return AVERROR_INVALIDDATA;
+
+    if (mvofs > w-x-blocksize + w*(h-y-blocksize))
+        return AVERROR_INVALIDDATA;
+
+    return 0;
+}
+
+static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db, int x, int y,
+                         const uint16_t w, int h)
 {
     uint8_t opc, sb[16];
     int i, j, k, l;
@@ -1453,6 +1466,8 @@ static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db,
         if (bytestream2_get_bytes_left(&ctx->gb) < 2)
             return 1;
         mvofs =  bytestream2_get_le16(&ctx->gb);
+        if (check_mv(x, y, w, h, 8, mvofs))
+            return 1;
         for (i = 0; i < 8; i++) {
             ofs = w * i;
             for (k = 0; k < 8; k++)
@@ -1480,6 +1495,8 @@ static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db,
             for (k = 0; k < 8; k += 4) {
                 opc =  bytestream2_get_byteu(&ctx->gb);
                 mvofs = c37_mv[opc * 2] + (c37_mv[opc * 2 + 1] * w);
+                if (check_mv(x+k, y+i, w, h, 4, mvofs))
+                    return 1;
                 for (j = 0; j < 4; j++) {
                     ofs = (w * (j + i)) + k;
                     for (l = 0; l < 4; l++)
@@ -1494,6 +1511,8 @@ static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db,
         for (i = 0; i < 8; i += 4) {
             for (k = 0; k < 8; k += 4) {
                 mvofs = bytestream2_get_le16(&ctx->gb);
+                if (check_mv(x+k, y+i, w, h, 4, mvofs))
+                    return 1;
                 for (j = 0; j < 4; j++) {
                     ofs = (w * (j + i)) + k;
                     for (l = 0; l < 4; l++)
@@ -1516,6 +1535,8 @@ static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db,
                 ofs = (w * i) + j;
                 opc = bytestream2_get_byteu(&ctx->gb);
                 mvofs = c37_mv[opc * 2] + (c37_mv[opc * 2 + 1] * w);
+                if (check_mv(x+j, y+i, w, h, 2, mvofs))
+                    return 1;
                 for (l = 0; l < 2; l++) {
                     *(dst + ofs + l + 0) = *(db + ofs + l + 0 + mvofs);
                     *(dst + ofs + l + w) = *(db + ofs + l + w + mvofs);
@@ -1530,6 +1551,8 @@ static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db,
             for (j = 0; j < 8; j += 2) {
                 ofs = w * i + j;
                 mvofs = bytestream2_get_le16(&ctx->gb);
+                if (check_mv(x+j, y+i, w, h, 2, mvofs))
+                    return 1;
                 for (l = 0; l < 2; l++) {
                     *(dst + ofs + l + 0) = *(db + ofs + l + 0 + mvofs);
                     *(dst + ofs + l + w) = *(db + ofs + l + w + mvofs);
@@ -1548,6 +1571,8 @@ static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db,
         break;
     default:    // copy 8x8 block from prev, c37_mv from source
         mvofs = c37_mv[opc * 2] + (c37_mv[opc * 2 + 1] * w);
+        if (check_mv(x, y, w, h, 8, mvofs))
+            return 1;
         for (i = 0; i < 8; i++) {
             ofs = i * w;
             for (l = 0; l < 8; l++)
@@ -1613,7 +1638,7 @@ static int old_codec48(SANMVideoContext *ctx, int width, int height)
         if (seq == ctx->prev_seq + 1) {
             for (j = 0; j < height; j += 8) {
                 for (i = 0; i < width; i += 8) {
-                    if (codec48_block(ctx, dst + i, prev + i, width))
+                    if (codec48_block(ctx, dst + i, prev + i, i, j, width, height))
                         return AVERROR_INVALIDDATA;
                 }
                 dst += width * 8;
@@ -1638,7 +1663,8 @@ static int old_codec48(SANMVideoContext *ctx, int width, int height)
     return 0;
 }
 
-static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
+static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb,
+                             int xoff, int yoff)
 {
     uint16_t w, h, parm2;
     uint8_t codec, param;
@@ -1647,14 +1673,14 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
 
     codec = bytestream2_get_byteu(gb);
     param = bytestream2_get_byteu(gb);
-    left  = bytestream2_get_le16u(gb);
-    top   = bytestream2_get_le16u(gb);
+    left  = bytestream2_get_le16u(gb) + xoff;
+    top   = bytestream2_get_le16u(gb) + yoff;
     w     = bytestream2_get_le16u(gb);
     h     = bytestream2_get_le16u(gb);
     bytestream2_skip(gb, 2);
     parm2 = bytestream2_get_le16u(gb);
 
-    if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600 || left + w <= 0 || top + h <= 0) {
+    if (w < 1 || h < 1 || w > 640 || h > 480 || left > 640 || top > 480 || left + w <= 0 || top + h <= 0) {
         av_log(ctx->avctx, AV_LOG_WARNING,
                "ignoring invalid fobj dimensions: c%d %d %d @ %d %d\n",
                codec, w, h, left, top);
@@ -1678,7 +1704,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
             if (w > xres || h > yres)
                 return AVERROR_INVALIDDATA;
             ctx->have_dimensions = 1;
-        } else if (codec == 37 || codec == 47 || codec == 48) {
+        } else if (fsc) {
             /* these codecs work on full frames, trust their dimensions */
             xres = w;
             yres = h;
@@ -1694,7 +1720,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
                 xres = w;
                 yres = h;
                 ctx->have_dimensions = 1;
-            } else if (((xres == 424) && (yres == 260)) ||  /* RA1 */
+            } else if (((xres == 424) && (yres == 260)) ||  /* RA2 */
                        ((xres == 320) && (yres == 200)) ||  /* ft/dig/... */
                        ((xres == 640) && (yres == 480))) {  /* ol/comi/mots... */
                 ctx->have_dimensions = 1;
@@ -1728,6 +1754,10 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
         }
     }
 
+    /* users of codecs>=37 are subversion 2, enforce that for STOR/FTCH */
+    if (fsc)
+        ctx->subversion = 2;
+
     /* clear the main buffer on the first fob */
     if (ctx->first_fob) {
         ctx->first_fob = 0;
@@ -1735,6 +1765,11 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
             memset(ctx->fbuf, 0, ctx->frm0_size);
     }
 
+    if (w + FFMAX(left, 0) > ctx->avctx->width || h + FFMAX(top, 0) > ctx->avctx->height) {
+        avpriv_request_sample(ctx->avctx, "overly large frame\n");
+        return AVERROR_PATCHWELCOME;
+    }
+
     switch (codec) {
     case 1:
     case 3:
@@ -1792,41 +1827,31 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
 
 static int process_ftch(SANMVideoContext *ctx, int size)
 {
-    uint8_t *sf = ctx->stored_frame;
-    int xoff, yoff, left, top, ret;
+    int xoff, yoff, ret;
     GetByteContext gb;
-    uint32_t sz;
 
     /* FTCH defines additional x/y offsets */
-    if (size != 12) {
-        if (bytestream2_get_bytes_left(&ctx->gb) < 6)
-            return AVERROR_INVALIDDATA;
+    if (size == 6) {
         bytestream2_skip(&ctx->gb, 2);
         xoff = bytestream2_get_le16u(&ctx->gb);
         yoff = bytestream2_get_le16u(&ctx->gb);
-    } else {
-        if (bytestream2_get_bytes_left(&ctx->gb) < 12)
-            return AVERROR_INVALIDDATA;
+    } else if (size == 12) {
+        av_assert0(bytestream2_get_bytes_left(&ctx->gb) >= 12);
         bytestream2_skip(&ctx->gb, 4);
         xoff = bytestream2_get_be32u(&ctx->gb);
         yoff = bytestream2_get_be32u(&ctx->gb);
-    }
-
-    sz = *(uint32_t *)(sf + 0);
-    if ((sz > 0) && (sz <= ctx->stored_frame_size - 4)) {
-        /* add the FTCH offsets to the left/top values of the stored FOBJ */
-        left = av_le2ne16(*(int16_t *)(sf + 4 + 2));
-        top  = av_le2ne16(*(int16_t *)(sf + 4 + 4));
-        *(int16_t *)(sf + 4 + 2) = av_le2ne16(left + xoff);
-        *(int16_t *)(sf + 4 + 4) = av_le2ne16(top  + yoff);
+    } else
+        return 1;
 
+    if (ctx->stor_size > 0) {
         /* decode the stored FOBJ */
-        bytestream2_init(&gb, sf + 4, sz);
-        ret = process_frame_obj(ctx, &gb);
-
-        /* now restore the original left/top values again */
-        *(int16_t *)(sf + 4 + 2) = av_le2ne16(left);
-        *(int16_t *)(sf + 4 + 4) = av_le2ne16(top);
+        uint8_t *bitstream = av_malloc(ctx->stor_size + AV_INPUT_BUFFER_PADDING_SIZE);
+        if (!bitstream)
+            return AVERROR(ENOMEM);
+        memcpy(bitstream, ctx->stored_frame, ctx->stor_size);
+        bytestream2_init(&gb, bitstream, ctx->stor_size);
+        ret = process_frame_obj(ctx, &gb, xoff, yoff);
+        av_free(bitstream);
     } else {
         /* this happens a lot in RA1: The individual files are meant to
          * be played in sequence, with some referencing objects STORed
@@ -2319,8 +2344,9 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
             case MKBETAG('F', 'O', 'B', 'J'):
                 if (size < 16)
                     return AVERROR_INVALIDDATA;
-                if (ret = process_frame_obj(ctx, &ctx->gb))
+                if (ret = process_frame_obj(ctx, &ctx->gb, 0, 0)) {
                     return ret;
+                }
                 have_img = 1;
 
                 /* STOR: for ANIMv0/1 store the whole FOBJ datablock, as it
@@ -2331,12 +2357,12 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
                 if (to_store) {
                     to_store = 0;
                     if (ctx->subversion < 2) {
-                        if (size + 4 <= ctx->stored_frame_size) {
+                        if (size <= ctx->stored_frame_size) {
                             int pos2 = bytestream2_tell(&ctx->gb);
                             bytestream2_seek(&ctx->gb, pos, SEEK_SET);
-                            *(uint32_t *)(ctx->stored_frame) = size;
-                            bytestream2_get_bufferu(&ctx->gb, ctx->stored_frame + 4, size);
+                            bytestream2_get_bufferu(&ctx->gb, ctx->stored_frame, size);
                             bytestream2_seek(&ctx->gb, pos2, SEEK_SET);
+                            ctx->stor_size = size;
                         } else {
                             av_log(avctx, AV_LOG_ERROR, "FOBJ too large for STOR\n");
                             ret = AVERROR(ENOMEM);

libavcodec/scpr3.c

@@ -1167,7 +1167,7 @@ static int decompress_p3(AVCodecContext *avctx,
                 }
             } else {
                 int run, bx = x * 16 + sx1, by = y * 16 + sy1;
-                uint32_t clr, ptype = 0, r, g, b;
+                uint32_t clr = 0, ptype = 0, r, g, b;
 
                 if (bx >= avctx->width)
                     return AVERROR_INVALIDDATA;

libavcodec/utvideodec.c

@@ -457,7 +457,7 @@ static void restore_median_planar_il(UtvideoContext *c, uint8_t *src, ptrdiff_t
         // second line - first element has top prediction, the rest uses median
         C        = bsrc[-stride2];
         bsrc[0] += C;
-        A        = bsrc[0];
+        A = B    = bsrc[0];
         for (i = 1; i < FFMIN(width, 16); i++) { /* scalar loop (DSP need align 16) */
             B        = bsrc[i - stride2];
             bsrc[i] += mid_pred(A, B, (uint8_t)(A + B - C));
@@ -585,7 +585,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
     int buf_size = avpkt->size;
     UtvideoContext *c = avctx->priv_data;
     int i, j;
-    const uint8_t *plane_start[5];
+    const uint8_t *plane_start[5] = {NULL};
     int plane_size, max_slice_size = 0, slice_start, slice_end, slice_size;
     int ret;
     GetByteContext gb;

libavcodec/videotoolboxenc.c

@@ -1185,9 +1185,7 @@ static int vtenc_create_encoder(AVCodecContext   *avctx,
     VTEncContext *vtctx = avctx->priv_data;
     SInt32       bit_rate = avctx->bit_rate;
     SInt32       max_rate = avctx->rc_max_rate;
-    Float32      quality = avctx->global_quality / FF_QP2LAMBDA;
     CFNumberRef  bit_rate_num;
-    CFNumberRef  quality_num;
     CFNumberRef  bytes_per_second;
     CFNumberRef  one_second;
     CFArrayRef   data_rate_limits;
@@ -1247,11 +1245,13 @@ static int vtenc_create_encoder(AVCodecContext   *avctx,
         return AVERROR_EXTERNAL;
     }
 
-    if (avctx->flags & AV_CODEC_FLAG_QSCALE) {
-        quality = quality >= 100 ? 1.0 : quality / 100;
-        quality_num = CFNumberCreate(kCFAllocatorDefault,
-                                     kCFNumberFloat32Type,
-                                     &quality);
+    if (avctx->flags & AV_CODEC_FLAG_QSCALE || avctx->global_quality > 0) {
+        float factor = (avctx->flags & AV_CODEC_FLAG_QSCALE) ?
+                       FF_QP2LAMBDA * 100.0f : 100.0f;
+        Float32 quality = fminf(avctx->global_quality / factor, 1.0f);
+        CFNumberRef quality_num = CFNumberCreate(kCFAllocatorDefault,
+                                                 kCFNumberFloat32Type,
+                                                 &quality);
         if (!quality_num) return AVERROR(ENOMEM);
 
         status = VTSessionSetProperty(vtctx->session,
@@ -1709,7 +1709,14 @@ static int vtenc_configure_encoder(AVCodecContext *avctx)
 #endif
 
     // low-latency mode: eliminate frame reordering, follow a one-in-one-out encoding mode
-    if ((avctx->flags & AV_CODEC_FLAG_LOW_DELAY) && avctx->codec_id == AV_CODEC_ID_H264) {
+    if ((avctx->flags & AV_CODEC_FLAG_LOW_DELAY) &&
+        ((avctx->codec_id == AV_CODEC_ID_H264) || (TARGET_CPU_ARM64 && avctx->codec_id == AV_CODEC_ID_HEVC))) {
+        if (!avctx->bit_rate) {
+            av_log(avctx, AV_LOG_ERROR, "Doesn't support automatic bitrate in low_delay mode, "
+                                        "please specify bitrate explicitly\n");
+            status = AVERROR(EINVAL);
+            goto init_cleanup;
+        }
         CFDictionarySetValue(enc_info,
                              compat_keys.kVTVideoEncoderSpecification_EnableLowLatencyRateControl,
                              kCFBooleanTrue);

libavcodec/vlc.c

@@ -527,7 +527,7 @@ int ff_vlc_init_multi_from_lengths(VLC *vlc, VLC_MULTI *multi, int nb_bits, int
     if (ret < 0)
         return ret;
 
-    multi->table = av_malloc(sizeof(*multi->table) << nb_bits);
+    multi->table = av_mallocz(sizeof(*multi->table) << nb_bits);
     if (!multi->table)
         goto fail;
 

libavcodec/vp9.c

@@ -1679,8 +1679,6 @@ static int vp9_decode_frame(AVCodecContext *avctx, AVFrame *frame,
                                   &s->s.frames[CUR_FRAME] : &s->s.ref_frames[i]);
         }
 
-        ff_cbs_fragment_reset(&s->current_frag);
-
         goto finish;
     }
 
@@ -1805,6 +1803,8 @@ static int vp9_decode_frame(AVCodecContext *avctx, AVFrame *frame,
     }
 
 finish:
+    ff_cbs_fragment_reset(&s->current_frag);
+
     ff_progress_frame_report(&s->s.frames[CUR_FRAME].tf, INT_MAX);
     // ref frame setup
     for (int i = 0; i < 8; i++)

libavcodec/vulkan_encode_av1.c

@@ -1394,10 +1394,7 @@ const FFCodec ff_av1_vulkan_encoder = {
                       AV_CODEC_CAP_ENCODER_REORDERED_OPAQUE,
     .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
     .defaults       = vulkan_encode_av1_defaults,
-    .p.pix_fmts = (const enum AVPixelFormat[]) {
-        AV_PIX_FMT_VULKAN,
-        AV_PIX_FMT_NONE,
-    },
+    CODEC_PIXFMTS(AV_PIX_FMT_VULKAN),
     .hw_configs     = ff_vulkan_encode_hw_configs,
     .p.wrapper_name = "vulkan",
 };

libavcodec/vulkan_vp9.c

@@ -16,7 +16,7 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
-#include "vp9shared.h"
+#include "vp9dec.h"
 
 #include "vulkan_decode.h"
 
@@ -109,7 +109,9 @@ static int vk_vp9_start_frame(AVCodecContext          *avctx,
 {
     int err;
     int ref_count = 0;
-    const VP9SharedContext *s = avctx->priv_data;
+    const VP9Context *priv = avctx->priv_data;
+    const CodedBitstreamVP9Context *vp9 = priv->cbc->priv_data;
+    const VP9SharedContext *s = &priv->s;
     uint32_t frame_id_alloc_mask = 0;
 
     const VP9Frame *pic = &s->frames[CUR_FRAME];
@@ -182,15 +184,14 @@ static int vk_vp9_start_frame(AVCodecContext          *avctx,
         .update_mode_delta = 0x0,
     };
 
-    for (int i = 0; i < 2; i++)
-        ap->loop_filter.update_mode_delta |= pic->frame_header->update_mode_delta[i];
-
     for (int i = 0; i < STD_VIDEO_VP9_MAX_REF_FRAMES; i++) {
-        ap->loop_filter.loop_filter_ref_deltas[i] = pic->frame_header->loop_filter_ref_deltas[i];
+        ap->loop_filter.loop_filter_ref_deltas[i] = vp9->loop_filter_ref_deltas[i];
         ap->loop_filter.update_ref_delta |= pic->frame_header->update_ref_delta[i];
     }
-    for (int i = 0; i < STD_VIDEO_VP9_LOOP_FILTER_ADJUSTMENTS; i++)
-        ap->loop_filter.loop_filter_mode_deltas[i] = pic->frame_header->loop_filter_mode_deltas[i];
+    for (int i = 0; i < STD_VIDEO_VP9_LOOP_FILTER_ADJUSTMENTS; i++) {
+        ap->loop_filter.loop_filter_mode_deltas[i] = vp9->loop_filter_mode_deltas[i];
+        ap->loop_filter.update_mode_delta |= pic->frame_header->update_mode_delta[i];
+    }
 
     ap->segmentation = (StdVideoVP9Segmentation) {
         .flags = (StdVideoVP9SegmentationFlags) {
@@ -202,16 +203,16 @@ static int vk_vp9_start_frame(AVCodecContext          *avctx,
     };
 
     for (int i = 0; i < STD_VIDEO_VP9_MAX_SEGMENTATION_TREE_PROBS; i++)
-        ap->segmentation.segmentation_tree_probs[i] = pic->frame_header->segmentation_tree_probs[i];
+        ap->segmentation.segmentation_tree_probs[i] = vp9->segmentation_tree_probs[i];
     for (int i = 0; i < STD_VIDEO_VP9_MAX_SEGMENTATION_PRED_PROB; i++)
-        ap->segmentation.segmentation_pred_prob[i] = pic->frame_header->segmentation_pred_prob[i];
+        ap->segmentation.segmentation_pred_prob[i] = vp9->segmentation_pred_prob[i];
     for (int i = 0; i < STD_VIDEO_VP9_MAX_SEGMENTS; i++) {
         ap->segmentation.FeatureEnabled[i] = 0x0;
         for (int j = 0; j < STD_VIDEO_VP9_SEG_LVL_MAX; j++) {
-            ap->segmentation.FeatureEnabled[i] |= pic->frame_header->feature_enabled[i][j] << j;
-            ap->segmentation.FeatureData[i][j] = pic->frame_header->feature_sign[i][j] ?
-                                                 -pic->frame_header->feature_value[i][j] :
-                                                 +pic->frame_header->feature_value[i][j];
+            ap->segmentation.FeatureEnabled[i] |= vp9->feature_enabled[i][j] << j;
+            ap->segmentation.FeatureData[i][j] = vp9->feature_sign[i][j] ?
+                                                 -vp9->feature_value[i][j] :
+                                                 +vp9->feature_value[i][j];
         }
     }
 

libavcodec/x86/Makefile

@@ -61,6 +61,7 @@ OBJS-$(CONFIG_MLP_DECODER)             += x86/mlpdsp_init.o
 OBJS-$(CONFIG_MPEG4_DECODER)           += x86/mpeg4videodsp.o x86/xvididct_init.o
 OBJS-$(CONFIG_PNG_DECODER)             += x86/pngdsp_init.o
 OBJS-$(CONFIG_PRORES_DECODER)          += x86/proresdsp_init.o
+OBJS-$(CONFIG_PRORES_RAW_DECODER)      += x86/proresdsp_init.o
 OBJS-$(CONFIG_RV40_DECODER)            += x86/rv40dsp_init.o
 OBJS-$(CONFIG_SBC_ENCODER)             += x86/sbcdsp_init.o
 OBJS-$(CONFIG_SVQ1_ENCODER)            += x86/svq1enc_init.o

libavcodec/x86/pngdsp.asm

@@ -151,6 +151,7 @@ cglobal add_png_paeth_prediction, 5, 7, %1, dst, src, top, w, bpp, end, cntr
     dec              cntrq
     jge .bpp_loop
     POP               dstq
+    emms
     RET
 %endmacro
 

libavdevice/lavfi.c

@@ -255,12 +255,9 @@ av_cold static int lavfi_read_header(AVFormatContext *avctx)
                 goto end;
             }
 
-            ret = av_opt_set_bin(sink, "sample_fmts", (const uint8_t*)sample_fmts,
-                                 sizeof(sample_fmts), AV_OPT_SEARCH_CHILDREN);
-            if (ret < 0)
-                goto end;
-            ret = av_opt_set_int(sink, "all_channel_counts", 1,
-                                 AV_OPT_SEARCH_CHILDREN);
+            ret = av_opt_set_array(sink, "sample_formats", AV_OPT_SEARCH_CHILDREN, 0,
+                                   FF_ARRAY_ELEMS(sample_fmts), AV_OPT_TYPE_SAMPLE_FMT,
+                                   sample_fmts);
             if (ret < 0)
                 goto end;
 

libavfilter/af_whisper.c

@@ -150,7 +150,7 @@ static int init(AVFilterContext *ctx)
     }
 
     av_log(ctx, AV_LOG_INFO,
-           "Whisper filter initialized: model: %s lang: %s queue: %ld ms\n",
+           "Whisper filter initialized: model: %s lang: %s queue: %" PRId64 " ms\n",
            wctx->model_path, wctx->language, wctx->queue / 1000);
 
     return 0;
@@ -194,7 +194,7 @@ static void run_transcription(AVFilterContext *ctx, AVFrame *frame, int samples)
     const float duration = (float) samples / WHISPER_SAMPLE_RATE;
 
     av_log(ctx, AV_LOG_INFO,
-           "run transcription at %ld ms, %d/%d samples (%.2f seconds)...\n",
+           "run transcription at %" PRId64 " ms, %d/%d samples (%.2f seconds)...\n",
            timestamp_ms, samples, wctx->audio_buffer_fill_size, duration);
 
     struct whisper_full_params params = whisper_full_default_params(WHISPER_SAMPLING_GREEDY);
@@ -215,7 +215,9 @@ static void run_transcription(AVFilterContext *ctx, AVFrame *frame, int samples)
 
     for (int i = 0; i < n_segments; ++i) {
         const char *text = whisper_full_get_segment_text(wctx->ctx_wsp, i);
-        char *text_cleaned = av_strireplace(text + 1, "[BLANK_AUDIO]", "");
+        if (av_isspace(text[0]))
+            text++;
+        char *text_cleaned = av_strireplace(text, "[BLANK_AUDIO]", "");
 
         if (av_strnlen(text_cleaned, 1) == 0) {
             av_freep(&text_cleaned);
@@ -226,7 +228,7 @@ static void run_transcription(AVFilterContext *ctx, AVFrame *frame, int samples)
         const int64_t t0_ms = whisper_full_get_segment_t0(wctx->ctx_wsp, i) * 10;
         const int64_t t1_ms = whisper_full_get_segment_t1(wctx->ctx_wsp, i) * 10;
 
-        av_log(ctx, AV_LOG_DEBUG, "  [%ld-%ld%s]: \"%s\"\n",
+        av_log(ctx, AV_LOG_DEBUG, "  [%" PRId64 "-%" PRId64 "%s]: \"%s\"\n",
                timestamp_ms + t0_ms, timestamp_ms + t1_ms, turn ? " (turn)" : "", text_cleaned);
 
         if (segments_text) {
@@ -244,13 +246,15 @@ static void run_transcription(AVFilterContext *ctx, AVFrame *frame, int samples)
             if (!av_strcasecmp(wctx->format, "srt")) {
                 buf =
                     av_asprintf
-                    ("%d\n%02ld:%02ld:%02ld.%03ld --> %02ld:%02ld:%02ld.%03ld\n%s\n\n",
+                    ("%d\n%02" PRId64 ":%02" PRId64 ":%02" PRId64 ",%03" PRId64 " --> %02" PRId64 ":%02" PRId64 ":%02" PRId64 ",%03" PRId64 "\n%s\n\n",
                      wctx->index, start_t / 3600000,
                      (start_t / 60000) % 60, (start_t / 1000) % 60,
                      start_t % 1000, end_t / 3600000, (end_t / 60000) % 60,
                      (end_t / 1000) % 60, end_t % 1000, text_cleaned);
+
+                wctx->index++;
             } else if (!av_strcasecmp(wctx->format, "json")) {
-                buf = av_asprintf("{\"start\":%ld,\"end\":%ld,\"text\":\"%s\"}\n", start_t, end_t, text_cleaned);
+                buf = av_asprintf("{\"start\":%" PRId64 ",\"end\":%" PRId64 ",\"text\":\"%s\"}\n", start_t, end_t, text_cleaned);
             } else
                 buf = av_strdup(text_cleaned);
 
@@ -263,8 +267,6 @@ static void run_transcription(AVFilterContext *ctx, AVFrame *frame, int samples)
         av_freep(&text_cleaned);
     }
 
-    wctx->index++;
-
     AVDictionary **metadata = &frame->metadata;
     if (metadata && segments_text) {
         av_dict_set(metadata, "lavfi.whisper.text", segments_text, 0);
@@ -428,7 +430,8 @@ static int query_formats(const AVFilterContext *ctx,
 #define HOURS 3600000000
 
 static const AVOption whisper_options[] = {
-    { "model", "Path to the whisper.cpp model file", OFFSET(model_path), AV_OPT_TYPE_STRING,.flags = FLAGS }, { "language", "Language for transcription ('auto' for auto-detect)", OFFSET(language), AV_OPT_TYPE_STRING, {.str = "auto"}, .flags = FLAGS },
+    { "model", "Path to the whisper.cpp model file", OFFSET(model_path), AV_OPT_TYPE_STRING,.flags = FLAGS },
+    { "language", "Language for transcription ('auto' for auto-detect)", OFFSET(language), AV_OPT_TYPE_STRING, {.str = "auto"}, .flags = FLAGS },
     { "queue", "Audio queue size", OFFSET(queue), AV_OPT_TYPE_DURATION, {.i64 = 3000000}, 20000, HOURS, .flags = FLAGS },
     { "use_gpu", "Use GPU for processing", OFFSET(use_gpu), AV_OPT_TYPE_BOOL, {.i64 = 1}, 0, 1, .flags = FLAGS },
     { "gpu_device", "GPU device to use", OFFSET(gpu_device), AV_OPT_TYPE_INT, {.i64 = 0}, 0, INT_MAX, .flags = FLAGS },

libavfilter/dnn/dnn_backend_tf.c

@@ -833,14 +833,12 @@ static int dnn_execute_model_tf(const DNNModel *model, DNNExecBaseParams *exec_p
 
     ret = extract_lltask_from_task(task, tf_model->lltask_queue);
     if (ret != 0) {
-        av_freep(&task);
         av_log(ctx, AV_LOG_ERROR, "unable to extract last level task from task.\n");
         return ret;
     }
 
     request = ff_safe_queue_pop_front(tf_model->request_queue);
     if (!request) {
-        av_freep(&task);
         av_log(ctx, AV_LOG_ERROR, "unable to get infer request.\n");
         return AVERROR(EINVAL);
     }

libavfilter/f_ebur128.c

@@ -657,7 +657,7 @@ double ff_ebur128_find_peak_c(double *restrict ch_peaks, const int nb_channels,
     for (int ch = 0; ch < nb_channels; ch++) {
         double ch_peak = ch_peaks[ch];
         for (int i = 0; i < nb_samples; i++) {
-            const double sample = fabs(samples[i * nb_channels]);
+            const double sample = fabs(samples[i * nb_channels + ch]);
             ch_peak = FFMAX(ch_peak, sample);
         }
         maxpeak = FFMAX(maxpeak, ch_peak);

libavfilter/vf_drawtext.c

@@ -1011,7 +1011,7 @@ static av_cold int init(AVFilterContext *ctx)
             av_log(ctx, AV_LOG_WARNING, "Multiple texts provided, will use text_source only\n");
             av_free(s->text);
         }
-        s->text = av_mallocz(AV_DETECTION_BBOX_LABEL_NAME_MAX_SIZE *
+        s->text = av_mallocz((AV_DETECTION_BBOX_LABEL_NAME_MAX_SIZE + 1) *
                              (AV_NUM_DETECTION_BBOX_CLASSIFY + 1));
         if (!s->text)
             return AVERROR(ENOMEM);
@@ -1394,8 +1394,7 @@ static int measure_text(AVFilterContext *ctx, TextMetrics *metrics)
 {
     DrawTextContext *s = ctx->priv;
     char *text = s->expanded_text.str;
-    char *textdup = NULL, *start = NULL;
-    int num_chars = 0;
+    char *textdup = NULL;
     int width64 = 0, w64 = 0;
     int cur_min_y64 = 0, first_max_y64 = -32000;
     int first_min_x64 = 32000, last_max_x64 = -32000;
@@ -1405,7 +1404,7 @@ static int measure_text(AVFilterContext *ctx, TextMetrics *metrics)
     Glyph *glyph = NULL;
 
     int i, tab_idx = 0, last_tab_idx = 0, line_offset = 0;
-    char* p;
+    uint8_t *start, *p;
     int ret = 0;
 
     // Count the lines and the tab characters
@@ -1458,7 +1457,7 @@ continue_on_failed2:
             TextLine *cur_line = &s->lines[line_count];
             HarfbuzzData *hb = &cur_line->hb_data;
             cur_line->cluster_offset = line_offset;
-            ret = shape_text_hb(s, hb, start, num_chars);
+            ret = shape_text_hb(s, hb, start, p - start);
             if (ret != 0) {
                 goto done;
             }
@@ -1516,14 +1515,12 @@ continue_on_failed2:
             if (w64 > width64) {
                 width64 = w64;
             }
-            num_chars = -1;
             start = p;
             ++line_count;
             line_offset = i + 1;
         }
 
         if (code == 0) break;
-        ++num_chars;
     }
 
     metrics->line_height64 = s->face->size->metrics.height;

libavfilter/vf_lcevc.c

@@ -139,7 +139,11 @@ static int send_frame(AVFilterLink *inlink, AVFrame *in)
         return ret;
 
     if (sd) {
+#ifdef LCEVC_DEC_VERSION_MAJOR
+        res = LCEVC_SendDecoderEnhancementData(lcevc->decoder, in->pts, sd->data, sd->size);
+#else
         res = LCEVC_SendDecoderEnhancementData(lcevc->decoder, in->pts, 0, sd->data, sd->size);
+#endif
         if (res == LCEVC_Again)
             return AVERROR(EAGAIN);
         else if (res != LCEVC_Success) {
@@ -148,7 +152,11 @@ static int send_frame(AVFilterLink *inlink, AVFrame *in)
         }
     }
 
+#ifdef LCEVC_DEC_VERSION_MAJOR
+    res = LCEVC_SendDecoderBase(lcevc->decoder, in->pts, picture, -1, in);
+#else
     res = LCEVC_SendDecoderBase(lcevc->decoder, in->pts, 0, picture, -1, in);
+#endif
     if (res != LCEVC_Success) {
         av_log(ctx, AV_LOG_ERROR, "LCEVC_SendDecoderBase failed\n");
         LCEVC_FreePicture(lcevc->decoder, picture);

libavfilter/vulkan/bwdif.comp

@@ -47,7 +47,7 @@ vec4 process_line(vec4 prev2[5], vec4 prev1[2], vec4 cur[4], vec4 next1[2], vec4
    vec4 temp_diff[3];
    temp_diff[0] = abs(prev2[2] - next2[2]);
    temp_diff[1] = (abs(prev1[0] - fc) + abs(prev1[1] - fe)) / 2;
-   temp_diff[1] = (abs(next1[0] - fc) + abs(next1[1] - fe)) / 2;
+   temp_diff[2] = (abs(next1[0] - fc) + abs(next1[1] - fe)) / 2;
    vec4 diff = max(temp_diff[0] / 2, max(temp_diff[1], temp_diff[2]));
    bvec4 diff_mask = equal(diff, vec4(0));
 

libavformat/aviobuf.c

@@ -308,7 +308,7 @@ int64_t avio_seek(AVIOContext *s, int64_t offset, int whence)
         ctx->seek_count++;
         if (!s->write_flag)
             s->buf_end = s->buffer;
-        s->buf_ptr = s->buf_ptr_max = s->buffer;
+        s->checksum_ptr = s->buf_ptr = s->buf_ptr_max = s->buffer;
         s->pos = offset;
     }
     s->eof_reached = 0;

libavformat/demux.c

@@ -1167,7 +1167,10 @@ static int parse_packet(AVFormatContext *s, AVPacket *pkt,
     AVPacket *out_pkt = si->parse_pkt;
     AVStream *st = s->streams[stream_index];
     FFStream *const sti = ffstream(st);
+    const AVPacketSideData *sd = NULL;
     const uint8_t *data = pkt->data;
+    uint8_t *extradata = sti->avctx->extradata;
+    int extradata_size = sti->avctx->extradata_size;
     int size = pkt->size;
     int ret = 0, got_output = flush;
 
@@ -1184,6 +1187,16 @@ static int parse_packet(AVFormatContext *s, AVPacket *pkt,
         }
     }
 
+    if (pkt->side_data_elems)
+        sd = av_packet_side_data_get(pkt->side_data, pkt->side_data_elems,
+                                     AV_PKT_DATA_NEW_EXTRADATA);
+    if (sd) {
+        av_assert1(size && !flush);
+
+        sti->avctx->extradata      = sd->data;
+        sti->avctx->extradata_size = sd->size;
+    }
+
     while (size > 0 || (flush && got_output)) {
         int64_t next_pts = pkt->pts;
         int64_t next_dts = pkt->dts;
@@ -1277,6 +1290,11 @@ static int parse_packet(AVFormatContext *s, AVPacket *pkt,
     }
 
 fail:
+    if (sd) {
+        sti->avctx->extradata      = extradata;
+        sti->avctx->extradata_size = extradata_size;
+    }
+
     if (ret < 0)
         av_packet_unref(out_pkt);
     av_packet_unref(pkt);
@@ -1370,6 +1388,11 @@ static int read_frame_internal(AVFormatContext *s, AVPacket *pkt)
 
         st->event_flags |= AVSTREAM_EVENT_FLAG_NEW_PACKETS;
 
+        int new_extradata = !!av_packet_side_data_get(pkt->side_data, pkt->side_data_elems,
+                                                      AV_PKT_DATA_NEW_EXTRADATA);
+        if (new_extradata)
+            sti->need_context_update = 1;
+
         /* update context if required */
         if (sti->need_context_update) {
             if (avcodec_is_open(sti->avctx)) {
@@ -1380,8 +1403,9 @@ static int read_frame_internal(AVFormatContext *s, AVPacket *pkt)
                     return ret;
             }
 
-            /* close parser, because it depends on the codec */
-            if (sti->parser && sti->avctx->codec_id != st->codecpar->codec_id) {
+            /* close parser, because it depends on the codec and extradata */
+            if (sti->parser &&
+                (sti->avctx->codec_id != st->codecpar->codec_id || new_extradata)) {
                 av_parser_close(sti->parser);
                 sti->parser = NULL;
             }

libavformat/dhav.c

@@ -251,7 +251,7 @@ static int64_t get_duration(AVFormatContext *s)
     unsigned date;
     int64_t size = avio_size(s->pb);
 
-    if (start_pos + 16 > size)
+    if (start_pos + 20 > size)
         return 0;
 
     avio_skip(s->pb, 16);
@@ -279,7 +279,7 @@ static int64_t get_duration(AVFormatContext *s)
         }
     }
 
-    if (pos < buffer_pos || pos + 16 > buffer_pos + buffer_size)
+    if (pos < buffer_pos || pos + 20 > buffer_pos + buffer_size)
         goto fail;
 
     date = AV_RL32(buffer + (pos - buffer_pos) + 16);

libavformat/dump.c

@@ -367,11 +367,11 @@ static void dump_content_light_metadata(void *ctx, const AVPacketSideData *sd,
            metadata->MaxCLL, metadata->MaxFALL);
 }
 
-static void dump_ambient_viewing_environment_metadata(void *ctx, const AVPacketSideData *sd)
+static void dump_ambient_viewing_environment_metadata(void *ctx, const AVPacketSideData *sd, int log_level)
 {
     const AVAmbientViewingEnvironment *ambient =
         (const AVAmbientViewingEnvironment *)sd->data;
-    av_log(ctx, AV_LOG_INFO, "Ambient Viewing Environment, "
+    av_log(ctx, log_level, "Ambient Viewing Environment, "
            "ambient_illuminance=%f, ambient_light_x=%f, ambient_light_y=%f",
            av_q2d(ambient->ambient_illuminance),
            av_q2d(ambient->ambient_light_x),
@@ -445,12 +445,12 @@ static void dump_s12m_timecode(void *ctx, AVRational avg_frame_rate, const AVPac
     }
 }
 
-static void dump_cropping(void *ctx, const AVPacketSideData *sd)
+static void dump_cropping(void *ctx, const AVPacketSideData *sd, int log_level)
 {
     uint32_t top, bottom, left, right;
 
     if (sd->size < sizeof(uint32_t) * 4) {
-        av_log(ctx, AV_LOG_ERROR, "invalid data\n");
+        av_log(ctx, log_level, "invalid data\n");
         return;
     }
 
@@ -459,15 +459,15 @@ static void dump_cropping(void *ctx, const AVPacketSideData *sd)
     left   = AV_RL32(sd->data +  8);
     right  = AV_RL32(sd->data + 12);
 
-    av_log(ctx, AV_LOG_INFO, "%d/%d/%d/%d", left, right, top, bottom);
+    av_log(ctx, log_level, "%d/%d/%d/%d", left, right, top, bottom);
 }
 
-static void dump_tdrdi(void *ctx, const AVPacketSideData *sd)
+static void dump_tdrdi(void *ctx, const AVPacketSideData *sd, int log_level)
 {
     const AV3DReferenceDisplaysInfo *tdrdi =
         (const AV3DReferenceDisplaysInfo *)sd->data;
 
-    av_log(ctx, AV_LOG_INFO, "number of reference displays: %u", tdrdi->num_ref_displays);
+    av_log(ctx, log_level, "number of reference displays: %u", tdrdi->num_ref_displays);
 }
 
 static void dump_sidedata(void *ctx, const AVPacketSideData *side_data, int nb_side_data,
@@ -543,15 +543,15 @@ static void dump_sidedata(void *ctx, const AVPacketSideData *side_data, int nb_s
             dump_s12m_timecode(ctx, avg_frame_rate, sd, log_level);
             break;
         case AV_PKT_DATA_AMBIENT_VIEWING_ENVIRONMENT:
-            dump_ambient_viewing_environment_metadata(ctx, sd);
+            dump_ambient_viewing_environment_metadata(ctx, sd, log_level);
             break;
         case AV_PKT_DATA_FRAME_CROPPING:
             av_log(ctx, AV_LOG_INFO, "Frame cropping: ");
-            dump_cropping(ctx, sd);
+            dump_cropping(ctx, sd, log_level);
             break;
         case AV_PKT_DATA_3D_REFERENCE_DISPLAYS:
             av_log(ctx, log_level, "3D Reference Displays Information: ");
-            dump_tdrdi(ctx, sd);
+            dump_tdrdi(ctx, sd, log_level);
             break;
         default:
             av_log(ctx, log_level, "unknown side data type %d "
@@ -693,7 +693,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
 
     if (st->start_time != AV_NOPTS_VALUE && st->start_time != 0 && st->time_base.den && st->time_base.num) {
         const double stream_start = av_q2d(st->time_base) * st->start_time;
-        av_log(NULL, AV_LOG_INFO, ", start %.6f", stream_start);
+        av_log(NULL, log_level, ", start %.6f", stream_start);
     }
 
     dump_disposition(st->disposition, log_level);

libavformat/hlsproto.c

@@ -206,10 +206,10 @@ static int hls_open(URLContext *h, const char *uri, int flags)
         goto fail;
     }
     av_log(h, AV_LOG_WARNING,
-           "Using the hls protocol is discouraged, please try using the "
-           "hls demuxer instead. The hls demuxer should be more complete "
-           "and work as well as the protocol implementation. (If not, "
-           "please report it.) To use the demuxer, simply use %s as url.\n",
+           "Using the hls protocol is deprecated and it will be remove in "
+           "a future release, please use the hls demuxer instead. "
+           "If encountering issues with it, please report them. "
+           "To use the demuxer, simply use %s as url.\n",
            s->playlisturl);
 
     if ((ret = parse_playlist(h, s->playlisturl)) < 0)

libavformat/http.c

@@ -24,6 +24,7 @@
 #include "config.h"
 #include "config_components.h"
 
+#include <string.h>
 #include <time.h>
 #if CONFIG_ZLIB
 #include <zlib.h>
@@ -214,7 +215,7 @@ static int http_open_cnx_internal(URLContext *h, AVDictionary **options)
     const char *path, *proxy_path, *lower_proto = "tcp", *local_path;
     char *env_http_proxy, *env_no_proxy;
     char *hashmark;
-    char hostname[1024], hoststr[1024], proto[10];
+    char hostname[1024], hoststr[1024], proto[10], tmp_host[1024];
     char auth[1024], proxyauth[1024] = "";
     char path1[MAX_URL_SIZE], sanitized_path[MAX_URL_SIZE + 1];
     char buf[1024], urlbuf[MAX_URL_SIZE];
@@ -224,7 +225,14 @@ static int http_open_cnx_internal(URLContext *h, AVDictionary **options)
     av_url_split(proto, sizeof(proto), auth, sizeof(auth),
                  hostname, sizeof(hostname), &port,
                  path1, sizeof(path1), s->location);
-    ff_url_join(hoststr, sizeof(hoststr), NULL, NULL, hostname, port, NULL);
+
+    av_strlcpy(tmp_host, hostname, sizeof(tmp_host));
+    // In case of an IPv6 address, we need to strip the Zone ID,
+    // if any. We do it at the first % sign, as percent encoding
+    // can be used in the Zone ID itself.
+    if (strchr(tmp_host, ':'))
+        tmp_host[strcspn(tmp_host, "%")] = '\0';
+    ff_url_join(hoststr, sizeof(hoststr), NULL, NULL, tmp_host, port, NULL);
 
     env_http_proxy = getenv_utf8("http_proxy");
     proxy_path = s->http_proxy ? s->http_proxy : env_http_proxy;
@@ -1867,7 +1875,7 @@ static int store_icy(URLContext *h, int size)
             ret = http_read_stream_all(h, data, len);
             if (ret < 0)
                 return ret;
-            data[len + 1] = 0;
+            data[len] = 0;
             if ((ret = av_opt_set(s, "icy_metadata_packet", data, 0)) < 0)
                 return ret;
             update_metadata(h, data);

libavformat/lrcdec.c

@@ -78,7 +78,7 @@ static int64_t count_ts(const char *p)
 static int64_t read_ts(const char *p, int64_t *start)
 {
     int64_t offset = 0;
-    uint64_t mm;
+    uint32_t mm;
     double ss;
     char prefix[3];
 
@@ -88,11 +88,11 @@ static int64_t read_ts(const char *p, int64_t *start)
     if(p[offset] != '[') {
         return 0;
     }
-    int ret = sscanf(p, "%2[[-]%"SCNu64":%lf]", prefix, &mm, &ss);
-    if (ret != 3 || prefix[0] != '[') {
+    int ret = sscanf(p, "%2[[-]%"SCNu32":%lf]", prefix, &mm, &ss);
+    if (ret != 3 || prefix[0] != '[' || ss < 0 || ss > 60) {
         return 0;
     }
-    *start = (mm * 60 + ss) * AV_TIME_BASE;
+    *start = llrint((mm * 60 + ss) * AV_TIME_BASE);
     if (prefix[1] == '-') {
         *start = - *start;
     }

libavformat/mov.c

@@ -5456,10 +5456,6 @@ static int heif_add_stream(MOVContext *c, HEIFItem *item)
     if (!sc->chunk_offsets)
         goto fail;
     sc->chunk_count = 1;
-    sc->sample_sizes = av_malloc_array(1, sizeof(*sc->sample_sizes));
-    if (!sc->sample_sizes)
-        goto fail;
-    sc->sample_count = 1;
     sc->stts_data = av_malloc_array(1, sizeof(*sc->stts_data));
     if (!sc->stts_data)
         goto fail;
@@ -8957,6 +8953,7 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom)
         return AVERROR(ENOMEM);
     }
 
+    av_freep(&item->name);
     av_bprint_finalize(&item_name, ret ? &item->name : NULL);
     item->item_id = item_id;
     item->type    = item_type;
@@ -10470,11 +10467,13 @@ static int mov_parse_heif_items(AVFormatContext *s)
         st->codecpar->width  = item->width;
         st->codecpar->height = item->height;
 
+        sc->sample_size  = sc->stsz_sample_size = item->extent_length;
+        sc->sample_count = 1;
+
         err = sanity_checks(s, sc, item->item_id);
-        if (err || !sc->sample_count)
+        if (err)
             return AVERROR_INVALIDDATA;
 
-        sc->sample_sizes[0]  = item->extent_length;
         sc->chunk_offsets[0] = item->extent_offset + offset;
 
         if (item->item_id == mov->primary_item_id)

libavformat/movenc.c

@@ -7463,6 +7463,14 @@ static int mov_create_chapter_track(AVFormatContext *s, int tracknum)
         return ret;
     memcpy(track->par->extradata, stub_header, sizeof(stub_header));
 
+    if (track->extradata == NULL) {
+        track->stsd_count     = 1;
+        track->extradata      = av_calloc(1, sizeof(*track->extradata));
+        track->extradata_size = av_calloc(1, sizeof(*track->extradata_size));
+        if (!track->extradata || !track->extradata_size)
+            return AVERROR(ENOMEM);
+    }
+
     track->extradata[0] = av_memdup(stub_header, sizeof(stub_header));
     if (!track->extradata[0])
         return AVERROR(ENOMEM);

libavformat/rtmpproto.c

@@ -163,6 +163,13 @@ static int handle_chunk_size(URLContext *s, RTMPPacket *pkt);
 static int handle_window_ack_size(URLContext *s, RTMPPacket *pkt);
 static int handle_set_peer_bw(URLContext *s, RTMPPacket *pkt);
 
+static size_t zstrlen(const char *c)
+{
+    if(c)
+        return strlen(c);
+    return 0;
+}
+
 static int add_tracked_method(RTMPContext *rt, const char *name, int id)
 {
     int err;
@@ -327,7 +334,16 @@ static int gen_connect(URLContext *s, RTMPContext *rt)
     int ret;
 
     if ((ret = ff_rtmp_packet_create(&pkt, RTMP_SYSTEM_CHANNEL, RTMP_PT_INVOKE,
-                                     0, 4096 + APP_MAX_LENGTH)) < 0)
+                                     0, 4096 + APP_MAX_LENGTH
+                                     + strlen(rt->auth_params) + strlen(rt->flashver)
+                                     + zstrlen(rt->enhanced_codecs)/5*7
+                                     + zstrlen(rt->swfurl)
+                                     + zstrlen(rt->swfverify)
+                                     + zstrlen(rt->tcurl)
+                                     + zstrlen(rt->auth_params)
+                                     + zstrlen(rt->pageurl)
+                                     + zstrlen(rt->conn)*3
+                                     )) < 0)
         return ret;
 
     p = pkt.data;
@@ -1926,7 +1942,9 @@ static int write_status(URLContext *s, RTMPPacket *pkt,
 
     if ((ret = ff_rtmp_packet_create(&spkt, RTMP_SYSTEM_CHANNEL,
                                      RTMP_PT_INVOKE, 0,
-                                     RTMP_PKTDATA_DEFAULT_SIZE)) < 0) {
+                                     RTMP_PKTDATA_DEFAULT_SIZE
+                                     + strlen(status) + strlen(description)
+                                     + zstrlen(details))) < 0) {
         av_log(s, AV_LOG_ERROR, "Unable to create response packet\n");
         return ret;
     }
@@ -2859,6 +2877,12 @@ reconnect:
                     "FMLE/3.0 (compatible; %s)", LIBAVFORMAT_IDENT);
         }
     }
+    if (   strlen(rt->flashver) > FLASHVER_MAX_LENGTH
+        || strlen(rt->tcurl   ) >    TCURL_MAX_LENGTH
+    ) {
+        ret = AVERROR(EINVAL);
+        goto fail;
+    }
 
     rt->receive_report_size = 1048576;
     rt->bytes_read = 0;

libavformat/rtpdec_rfc4175.c

@@ -23,7 +23,9 @@
 
 #include "avio_internal.h"
 #include "rtpdec_formats.h"
+#include "libavutil/avassert.h"
 #include "libavutil/avstring.h"
+#include "libavutil/imgutils.h"
 #include "libavutil/mem.h"
 #include "libavutil/pixdesc.h"
 #include "libavutil/parseutils.h"
@@ -128,7 +130,7 @@ static int rfc4175_parse_fmtp(AVFormatContext *s, AVStream *stream,
         data->width = atoi(value);
     else if (!strncmp(attr, "height", 6))
         data->height = atoi(value);
-    else if (!strncmp(attr, "sampling", 8))
+    else if (data->sampling == NULL && !strncmp(attr, "sampling", 8))
         data->sampling = av_strdup(value);
     else if (!strncmp(attr, "depth", 5))
         data->depth = atoi(value);
@@ -172,30 +174,39 @@ static int rfc4175_parse_fmtp(AVFormatContext *s, AVStream *stream,
 }
 
 static int rfc4175_parse_sdp_line(AVFormatContext *s, int st_index,
-                                  PayloadContext *data, const char *line)
+                                  PayloadContext *data_arg, const char *line)
 {
     const char *p;
 
     if (st_index < 0)
         return 0;
 
+    av_assert0(!data_arg->sampling);
+
     if (av_strstart(line, "fmtp:", &p)) {
         AVStream *stream = s->streams[st_index];
+        PayloadContext data0 = *data_arg, *data = &data0;
         int ret = ff_parse_fmtp(s, stream, data, p, rfc4175_parse_fmtp);
 
-        if (ret < 0)
-            return ret;
-
-
         if (!data->sampling || !data->depth || !data->width || !data->height)
-            return AVERROR(EINVAL);
+            ret =  AVERROR(EINVAL);
+
+        if (ret < 0)
+            goto fail;
+
+        ret = av_image_check_size(data->width, data->height, 0, s);
+        if (ret < 0)
+            goto fail;
 
         stream->codecpar->width = data->width;
         stream->codecpar->height = data->height;
 
         ret = rfc4175_parse_format(stream, data);
         av_freep(&data->sampling);
-
+        if (ret >= 0)
+            *data_arg = *data;
+fail:
+        av_freep(&data->sampling);
         return ret;
     }
 
@@ -296,6 +307,9 @@ static int rfc4175_handle_packet(AVFormatContext *ctx, PayloadContext *data,
         if (data->interlaced)
             line = 2 * line + field;
 
+        if (line >= data->height)
+            return AVERROR_INVALIDDATA;
+
         /* prevent ill-formed packets to write after buffer's end */
         copy_offset = (line * data->width + offset) * data->pgroup / data->xinc;
         if (copy_offset + length > data->frame_size || !data->frame)

libavformat/rtpenc_h264_hevc.c

@@ -196,6 +196,9 @@ void ff_rtp_send_h264_hevc(AVFormatContext *s1, const uint8_t *buf1, int size)
             r1 = ff_nal_mp4_find_startcode(r, end, s->nal_length_size);
             if (!r1)
                 r1 = end;
+            // Check that the last is not truncated
+            if (r1 - r < s->nal_length_size)
+                break;
             r += s->nal_length_size;
         } else {
             while (!*(r++));

libavformat/rtsp.c

@@ -1239,9 +1239,12 @@ start:
         q = buf;
         for (;;) {
             ret = ffurl_read_complete(rt->rtsp_hd, &ch, 1);
+            if (ret != 1) {
+                ret = (ret < 0) ? ret : AVERROR(EIO);
+                av_log(s, AV_LOG_WARNING, "Failed reading RTSP data: %s\n", av_err2str(ret));
+                return ret;
+            }
             av_log(s, AV_LOG_TRACE, "ret=%d c=%02x [%c]\n", ret, ch, ch);
-            if (ret != 1)
-                return ret < 0 ? ret : AVERROR(EIO);
             if (ch == '\n')
                 break;
             if (ch == '$' && q == buf) {
@@ -1271,6 +1274,7 @@ start:
             if (!strncmp(buf1, "RTSP/", 5)) {
                 get_word(buf1, sizeof(buf1), &p);
                 reply->status_code = atoi(buf1);
+                p += strspn(p, SPACE_CHARS);
                 av_strlcpy(reply->reason, p, sizeof(reply->reason));
             } else {
                 av_strlcpy(reply->reason, buf1, sizeof(reply->reason)); // method

libavformat/sctp.c

@@ -334,6 +334,9 @@ static int sctp_write(URLContext *h, const uint8_t *buf, int size)
     }
 
     if (s->max_streams) {
+        if (size < 2)
+            return AVERROR(EINVAL);
+
         /*StreamId is introduced as a 2byte code into the stream*/
         struct sctp_sndrcvinfo info = { 0 };
         info.sinfo_stream           = AV_RB16(buf);

libavformat/tls_openssl.c

@@ -34,8 +34,8 @@
 #include <openssl/x509v3.h>
 
 /**
- * Returns a heap‐allocated null‐terminated string containing
- * the PEM‐encoded public key.  Caller must free.
+ * Returns a heap-allocated null-terminated string containing
+ * the PEM-encoded public key. Caller must free.
  */
 static char *pkey_to_pem_string(EVP_PKEY *pkey) {
     BIO        *mem = NULL;
@@ -60,7 +60,7 @@ static char *pkey_to_pem_string(EVP_PKEY *pkey) {
     if (!pem_str)
         goto err;
 
-    // Copy data & NUL‐terminate
+    // Copy data & NUL-terminate
     memcpy(pem_str, bptr->data, bptr->length);
     pem_str[bptr->length] = '\0';
 
@@ -425,7 +425,7 @@ error:
 
 
 /**
- * Deserialize a PEM‐encoded private or public key from a NUL-terminated C string.
+ * Deserialize a PEM-encoded private or public key from a NUL-terminated C string.
  *
  * @param pem_str   The PEM text, e.g.
  *                  "-----BEGIN PRIVATE KEY-----\n…\n-----END PRIVATE KEY-----\n"
@@ -456,7 +456,7 @@ static EVP_PKEY *pkey_from_pem_string(const char *pem_str, int is_priv)
 }
 
 /**
- * Deserialize a PEM‐encoded certificate from a NUL-terminated C string.
+ * Deserialize a PEM-encoded certificate from a NUL-terminated C string.
  *
  * @param pem_str   The PEM text, e.g.
  *                  "-----BEGIN CERTIFICATE-----\n…\n-----END CERTIFICATE-----\n"

libavformat/udp.c

@@ -280,14 +280,12 @@ static int udp_set_multicast_sources(URLContext *h,
                                      struct sockaddr_storage *sources,
                                      int nb_sources, int include)
 {
-    int i;
     if (addr->sa_family != AF_INET) {
 #if HAVE_STRUCT_GROUP_SOURCE_REQ && defined(MCAST_BLOCK_SOURCE)
         /* For IPv4 prefer the old approach, as that alone works reliably on
          * Windows and it also supports supplying the interface based on its
          * address. */
-        int i;
-        for (i = 0; i < nb_sources; i++) {
+        for (int i = 0; i < nb_sources; i++) {
             struct group_source_req mreqs;
             int level = addr->sa_family == AF_INET ? IPPROTO_IP : IPPROTO_IPV6;
 
@@ -314,7 +312,7 @@ static int udp_set_multicast_sources(URLContext *h,
 #endif
     }
 #if HAVE_STRUCT_IP_MREQ_SOURCE && defined(IP_BLOCK_SOURCE)
-    for (i = 0; i < nb_sources; i++) {
+    for (int i = 0; i < nb_sources; i++) {
         struct ip_mreq_source mreqs;
         if (sources[i].ss_family != AF_INET) {
             av_log(h, AV_LOG_ERROR, "Source/block address %d is of incorrect protocol family\n", i + 1);
@@ -542,6 +540,7 @@ static void *circular_buffer_task_rx( void *_URLContext)
     }
     while(1) {
         UDPQueuedPacketHeader pkt_header;
+        pkt_header.addr_len = sizeof(pkt_header.addr);
 
         pthread_mutex_unlock(&s->mutex);
         /* Blocking operations are always cancellation points;

libavformat/whip.c

@@ -1541,8 +1541,8 @@ static int create_rtp_muxer(AVFormatContext *s)
          * therefore, we deactivate the extradata detection for the RTP muxer.
          */
         if (s->streams[i]->codecpar->codec_id == AV_CODEC_ID_H264) {
-            av_freep(&rtp_ctx->streams[i]->codecpar->extradata);
-            rtp_ctx->streams[i]->codecpar->extradata_size = 0;
+            av_freep(&rtp_ctx->streams[0]->codecpar->extradata);
+            rtp_ctx->streams[0]->codecpar->extradata_size = 0;
         }
 
         buffer = av_malloc(buffer_size);

libavutil/aes_ctr.c

@@ -34,6 +34,7 @@
 typedef struct AVAESCTR {
     DECLARE_ALIGNED(8, uint8_t, counter)[AES_BLOCK_SIZE];
     DECLARE_ALIGNED(8, uint8_t, encrypted_counter)[AES_BLOCK_SIZE];
+    int block_offset;
     AVAES aes;
 } AVAESCTR;
 
@@ -46,11 +47,13 @@ void av_aes_ctr_set_iv(struct AVAESCTR *a, const uint8_t* iv)
 {
     memcpy(a->counter, iv, AES_CTR_IV_SIZE);
     memset(a->counter + AES_CTR_IV_SIZE, 0, sizeof(a->counter) - AES_CTR_IV_SIZE);
+    a->block_offset = 0;
 }
 
 void av_aes_ctr_set_full_iv(struct AVAESCTR *a, const uint8_t* iv)
 {
     memcpy(a->counter, iv, sizeof(a->counter));
+    a->block_offset = 0;
 }
 
 const uint8_t* av_aes_ctr_get_iv(struct AVAESCTR *a)
@@ -73,6 +76,7 @@ int av_aes_ctr_init(struct AVAESCTR *a, const uint8_t *key)
     av_aes_init(&a->aes, key, 128, 0);
 
     memset(a->counter, 0, sizeof(a->counter));
+    a->block_offset = 0;
 
     return 0;
 }
@@ -92,10 +96,21 @@ void av_aes_ctr_increment_iv(struct AVAESCTR *a)
 {
     av_aes_ctr_increment_be64(a->counter);
     memset(a->counter + AES_CTR_IV_SIZE, 0, sizeof(a->counter) - AES_CTR_IV_SIZE);
+    a->block_offset = 0;
 }
 
 void av_aes_ctr_crypt(struct AVAESCTR *a, uint8_t *dst, const uint8_t *src, int count)
 {
+    if (a->block_offset && count > 0) {
+        int left = FFMIN(count, AES_BLOCK_SIZE - a->block_offset);
+        for (int len = 0; len < left; len++)
+            dst[len] = src[len] ^ a->encrypted_counter[a->block_offset++];
+        a->block_offset &= AES_BLOCK_SIZE - 1;
+        dst += left;
+        src += left;
+        count -= left;
+    }
+
     while (count >= AES_BLOCK_SIZE) {
         av_aes_crypt(&a->aes, a->encrypted_counter, a->counter, 1, NULL, 0);
         av_aes_ctr_increment_be64(a->counter + 8);
@@ -115,6 +130,6 @@ void av_aes_ctr_crypt(struct AVAESCTR *a, uint8_t *dst, const uint8_t *src, int
         av_aes_crypt(&a->aes, a->encrypted_counter, a->counter, 1, NULL, 0);
         av_aes_ctr_increment_be64(a->counter + 8);
         for (int len = 0; len < count; len++)
-            dst[len] = src[len] ^ a->encrypted_counter[len];
+            dst[len] = src[len] ^ a->encrypted_counter[a->block_offset++];
     }
 }

libavutil/arm/cpu.c

@@ -31,30 +31,32 @@
      CORE_FLAG(VFPV3)   |                       \
      CORE_FLAG(NEON))
 
-#if defined __linux__ || defined __ANDROID__
+#if defined __linux__ || defined __ANDROID__ || HAVE_ELF_AUX_INFO
 
 #include <stdint.h>
 #include <stdio.h>
 #include <string.h>
 #include "libavutil/avstring.h"
 
-#if HAVE_GETAUXVAL
+#if HAVE_GETAUXVAL || HAVE_ELF_AUX_INFO
 #include <sys/auxv.h>
 #endif
 
+#ifndef AT_HWCAP
 #define AT_HWCAP        16
+#endif
 
 /* Relevant HWCAP values from kernel headers */
-#define HWCAP_VFP       (1 << 6)
-#define HWCAP_EDSP      (1 << 7)
-#define HWCAP_THUMBEE   (1 << 11)
-#define HWCAP_NEON      (1 << 12)
-#define HWCAP_VFPv3     (1 << 13)
-#define HWCAP_TLS       (1 << 15)
+#define HWCAP_ARM_VFP     (1 << 6)
+#define HWCAP_ARM_EDSP    (1 << 7)
+#define HWCAP_ARM_THUMBEE (1 << 11)
+#define HWCAP_ARM_NEON    (1 << 12)
+#define HWCAP_ARM_VFPv3   (1 << 13)
+#define HWCAP_ARM_TLS     (1 << 15)
 
 static int get_auxval(uint32_t *hwcap)
 {
-#if HAVE_GETAUXVAL
+#if HAVE_GETAUXVAL || HAVE_ELF_AUX_INFO
     unsigned long ret = ff_getauxval(AT_HWCAP);
     if (ret == 0)
         return -1;
@@ -65,6 +67,7 @@ static int get_auxval(uint32_t *hwcap)
 #endif
 }
 
+#if defined __linux__ || defined __ANDROID__
 static int get_hwcap(uint32_t *hwcap)
 {
     struct { uint32_t a_type; uint32_t a_val; } auxv;
@@ -98,25 +101,26 @@ static int get_cpuinfo(uint32_t *hwcap)
     while (fgets(buf, sizeof(buf), f)) {
         if (av_strstart(buf, "Features", NULL)) {
             if (strstr(buf, " edsp "))
-                *hwcap |= HWCAP_EDSP;
+                *hwcap |= HWCAP_ARM_EDSP;
             if (strstr(buf, " tls "))
-                *hwcap |= HWCAP_TLS;
+                *hwcap |= HWCAP_ARM_TLS;
             if (strstr(buf, " thumbee "))
-                *hwcap |= HWCAP_THUMBEE;
+                *hwcap |= HWCAP_ARM_THUMBEE;
             if (strstr(buf, " vfp "))
-                *hwcap |= HWCAP_VFP;
+                *hwcap |= HWCAP_ARM_VFP;
             if (strstr(buf, " vfpv3 "))
-                *hwcap |= HWCAP_VFPv3;
+                *hwcap |= HWCAP_ARM_VFPv3;
             if (strstr(buf, " neon ") || strstr(buf, " asimd "))
-                *hwcap |= HWCAP_NEON;
+                *hwcap |= HWCAP_ARM_NEON;
             if (strstr(buf, " fp ")) // Listed on 64 bit ARMv8 kernels
-                *hwcap |= HWCAP_VFP | HWCAP_VFPv3;
+                *hwcap |= HWCAP_ARM_VFP | HWCAP_ARM_VFPv3;
             break;
         }
     }
     fclose(f);
     return 0;
 }
+#endif
 
 int ff_get_cpu_flags_arm(void)
 {
@@ -124,12 +128,14 @@ int ff_get_cpu_flags_arm(void)
     uint32_t hwcap;
 
     if (get_auxval(&hwcap) < 0)
+#if defined __linux__ || defined __ANDROID__
         if (get_hwcap(&hwcap) < 0)
             if (get_cpuinfo(&hwcap) < 0)
+#endif
                 return flags;
 
 #define check_cap(cap, flag) do {               \
-        if (hwcap & HWCAP_ ## cap)              \
+        if (hwcap & HWCAP_ARM_ ## cap)          \
             flags |= AV_CPU_FLAG_ ## flag;      \
     } while (0)
 

libavutil/common.h

@@ -486,13 +486,13 @@ static av_always_inline av_const int av_parity_c(uint32_t v)
  * to prevent undefined results.
  */
 #define GET_UTF8(val, GET_BYTE, ERROR)\
-    val= (GET_BYTE);\
+    val= (uint8_t)(GET_BYTE);\
     {\
         uint32_t top = (val & 128) >> 1;\
         if ((val & 0xc0) == 0x80 || val >= 0xFE)\
             {ERROR}\
         while (val & top) {\
-            unsigned int tmp = (GET_BYTE) - 128;\
+            unsigned int tmp = (uint8_t)(GET_BYTE) - 128;\
             if(tmp>>6)\
                 {ERROR}\
             val= (val<<6) + tmp;\
@@ -511,11 +511,11 @@ static av_always_inline av_const int av_parity_c(uint32_t v)
  *                  typically a goto statement.
  */
 #define GET_UTF16(val, GET_16BIT, ERROR)\
-    val = (GET_16BIT);\
+    val = (uint16_t)(GET_16BIT);\
     {\
         unsigned int hi = val - 0xD800;\
         if (hi < 0x800) {\
-            val = (GET_16BIT) - 0xDC00;\
+            val = (uint16_t)(GET_16BIT) - 0xDC00;\
             if (val > 0x3FFU || hi > 0x3FFU)\
                 {ERROR}\
             val += (hi<<10) + 0x10000;\

libavutil/hwcontext_vulkan.c

@@ -1868,6 +1868,8 @@ static int vulkan_device_init(AVHWDeviceContext *ctx)
     p->props.sType = VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_PROPERTIES_2;
     p->props.pNext = &p->hprops;
     p->hprops.sType = VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_EXTERNAL_MEMORY_HOST_PROPERTIES_EXT;
+    p->hprops.pNext = &p->dprops;
+    p->dprops.sType = VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_DRIVER_PROPERTIES;
 
     vk->GetPhysicalDeviceProperties2(hwctx->phys_dev, &p->props);
     av_log(ctx, AV_LOG_VERBOSE, "Using device: %s\n",
@@ -2464,7 +2466,7 @@ static int prepare_frame(AVHWFramesContext *hwfc, FFVkExecPool *ectx,
     VkImageMemoryBarrier2 img_bar[AV_NUM_DATA_POINTERS];
     int nb_img_bar = 0;
 
-    uint32_t dst_qf = VK_QUEUE_FAMILY_IGNORED;
+    uint32_t dst_qf = p->nb_img_qfs > 1 ? VK_QUEUE_FAMILY_IGNORED : p->img_qfs[0];
     VkImageLayout new_layout;
     VkAccessFlags2 new_access;
     VkPipelineStageFlagBits2 src_stage = VK_PIPELINE_STAGE_2_NONE;
@@ -2906,7 +2908,7 @@ static int vulkan_frames_init(AVHWFramesContext *hwfc)
     if (p->dev_is_nvidia &&
         (((fmt->nb_images == 1) && (fmt->vk_planes > 1)) ||
          (av_pix_fmt_desc_get(hwfc->sw_format)->nb_components == 1)))
-        supported_usage &= ~VK_IMAGE_USAGE_HOST_TRANSFER_BIT;
+        supported_usage &= ~VK_IMAGE_USAGE_HOST_TRANSFER_BIT_EXT;
 
     /* Image usage flags */
     if (!hwctx->usage) {
@@ -3986,7 +3988,7 @@ static VkImageAspectFlags plane_index_to_aspect(int plane) {
     if (plane == 2) return VK_IMAGE_ASPECT_MEMORY_PLANE_2_BIT_EXT;
     if (plane == 3) return VK_IMAGE_ASPECT_MEMORY_PLANE_3_BIT_EXT;
 
-    av_assert2 (false && "Invalid plane index");
+    av_assert2 (0 && "Invalid plane index");
     return VK_IMAGE_ASPECT_MEMORY_PLANE_0_BIT_EXT;
 }
 
@@ -4546,7 +4548,7 @@ static int vulkan_transfer_frame(AVHWFramesContext *hwfc,
                                  VK_ACCESS_TRANSFER_READ_BIT,
                         upload ? VK_IMAGE_LAYOUT_TRANSFER_DST_OPTIMAL :
                                  VK_IMAGE_LAYOUT_TRANSFER_SRC_OPTIMAL,
-                        VK_QUEUE_FAMILY_IGNORED);
+                        p->nb_img_qfs > 1 ? VK_QUEUE_FAMILY_IGNORED : p->img_qfs[0]);
 
     vk->CmdPipelineBarrier2(cmd_buf, &(VkDependencyInfo) {
             .sType = VK_STRUCTURE_TYPE_DEPENDENCY_INFO,

libavutil/tests/aes_ctr.c

@@ -19,18 +19,23 @@
 #include <string.h>
 
 #include "libavutil/random_seed.h"
+#include "libavutil/lfg.h"
 #include "libavutil/log.h"
 #include "libavutil/mem_internal.h"
 #include "libavutil/aes_ctr.h"
 
 static const DECLARE_ALIGNED(8, uint8_t, plain)[] = {
+    0x6d, 0x6f, 0x73, 0x74, 0x20, 0x72, 0x61, 0x6e, 0x64, 0x6f,
+    0x6d, 0x6f, 0x73, 0x74, 0x20, 0x72, 0x61, 0x6e, 0x64, 0x6f,
     0x6d, 0x6f, 0x73, 0x74, 0x20, 0x72, 0x61, 0x6e, 0x64, 0x6f,
     0x6d, 0x6f, 0x73, 0x74, 0x20, 0x72, 0x61, 0x6e, 0x64, 0x6f
 };
 
 static const DECLARE_ALIGNED(8, uint8_t, encrypted)[] = {
     0x95, 0xcd, 0x9a, 0x8a, 0x83, 0xa2, 0x1a, 0x84, 0x92, 0xed,
-    0xd6, 0xf2, 0x57, 0x2f, 0x61, 0x98, 0xbc, 0x20, 0x98, 0xee
+    0xd6, 0xf2, 0x57, 0x2f, 0x61, 0x98, 0xbc, 0x20, 0x98, 0xee,
+    0x6c, 0xed, 0x53, 0xae, 0x2f, 0xc4, 0x18, 0x7c, 0xeb, 0x62,
+    0xbb, 0x3a, 0x71, 0x24, 0x22, 0x8c, 0xd9, 0xfa, 0xee, 0x10
 };
 
 static const DECLARE_ALIGNED(8, uint8_t, fixed_iv)[] = {
@@ -44,14 +49,17 @@ static const DECLARE_ALIGNED(8, uint8_t, fixed_key)[] = {
 
 static DECLARE_ALIGNED(8, uint32_t, key)[4];
 
-static DECLARE_ALIGNED(8, uint8_t, tmp)[20];
+static DECLARE_ALIGNED(8, uint8_t, tmp)[40];
 
 int main (void)
 {
     int ret = 1;
+    AVLFG lfg;
     struct AVAESCTR *ae, *ad;
     const uint8_t *iv, *k;
 
+    av_lfg_init(&lfg, av_get_random_seed());
+
     for (int i = 0; i < 2; i++) {
         ae = av_aes_ctr_alloc();
         ad = av_aes_ctr_alloc();
@@ -85,13 +93,30 @@ int main (void)
         iv =   av_aes_ctr_get_iv(ae);
         av_aes_ctr_set_full_iv(ad, iv);
 
-        av_aes_ctr_crypt(ae, tmp, plain, sizeof(tmp));
+        uint8_t *dst = tmp;
+        const uint8_t *src = plain;
+        int left = sizeof(plain);
+        while (left > 0) {
+            int count = (av_lfg_get(&lfg) % left) + 1;
+            av_aes_ctr_crypt(ae, dst, src, count);
+            dst += count;
+            src += count;
+            left -= count;
+        }
         if (i && memcmp(tmp, encrypted, sizeof(tmp)) != 0) {
             av_log(NULL, AV_LOG_ERROR, "test failed\n");
             goto ERROR;
         }
 
-        av_aes_ctr_crypt(ad, tmp, tmp,   sizeof(tmp));
+        dst = tmp;
+        left = sizeof(plain);
+        while (left > 0) {
+            int count = (av_lfg_get(&lfg) % left) + 1;
+            av_aes_ctr_crypt(ad, dst, dst, count);
+            dst += count;
+            left -= count;
+        }
+
         if (memcmp(tmp, plain, sizeof(tmp)) != 0){
             av_log(NULL, AV_LOG_ERROR, "test failed\n");
             goto ERROR;

libswscale/graph.c

@@ -279,6 +279,7 @@ static void legacy_chr_pos(SwsGraph *graph, int *chr_pos, int override, int *war
     *chr_pos = override;
 }
 
+/* Takes over ownership of `sws` */
 static int init_legacy_subpass(SwsGraph *graph, SwsContext *sws,
                                SwsPass *input, SwsPass **output)
 {
@@ -293,17 +294,19 @@ static int init_legacy_subpass(SwsGraph *graph, SwsContext *sws,
     if (c->cascaded_context[0]) {
         const int num_cascaded = c->cascaded_context[2] ? 3 : 2;
         for (int i = 0; i < num_cascaded; i++) {
-            SwsContext *sub = c->cascaded_context[i];
             const int is_last = i + 1 == num_cascaded;
+
+            /* Steal cascaded context, so we can manage its lifetime independently */
+            SwsContext *sub = c->cascaded_context[i];
+            c->cascaded_context[i] = NULL;
+
             ret = init_legacy_subpass(graph, sub, input, is_last ? output : &input);
             if (ret < 0)
-                return ret;
-            /* Steal cascaded context, so we can free the parent */
-            c->cascaded_context[i] = NULL;
+                break;
         }
 
         sws_free_context(&sws);
-        return 0;
+        return ret;
     }
 
     if (sws->dither == SWS_DITHER_ED && !c->convert_unscaled)
@@ -311,20 +314,26 @@ static int init_legacy_subpass(SwsGraph *graph, SwsContext *sws,
 
     if (c->src0Alpha && !c->dst0Alpha && isALPHA(sws->dst_format)) {
         ret = pass_append(graph, AV_PIX_FMT_RGBA, src_w, src_h, &input, 1, c, run_rgb0);
-        if (ret < 0)
+        if (ret < 0) {
+            sws_free_context(&sws);
             return ret;
+        }
     }
 
     if (c->srcXYZ && !(c->dstXYZ && unscaled)) {
         ret = pass_append(graph, AV_PIX_FMT_RGB48, src_w, src_h, &input, 1, c, run_xyz2rgb);
-        if (ret < 0)
+        if (ret < 0) {
+            sws_free_context(&sws);
             return ret;
+        }
     }
 
     pass = ff_sws_graph_add_pass(graph, sws->dst_format, dst_w, dst_h, input, align, sws,
                                  c->convert_unscaled ? run_legacy_unscaled : run_legacy_swscale);
-    if (!pass)
+    if (!pass) {
+        sws_free_context(&sws);
         return AVERROR(ENOMEM);
+    }
     pass->setup = setup_legacy_swscale;
     pass->free = free_legacy_swscale;
 
@@ -444,13 +453,7 @@ static int add_legacy_sws_pass(SwsGraph *graph, SwsFormat src, SwsFormat dst,
                                 brightness, contrast, saturation);
     }
 
-    ret = init_legacy_subpass(graph, sws, input, output);
-    if (ret < 0) {
-        sws_free_context(&sws);
-        return ret;
-    }
-
-    return 0;
+    return init_legacy_subpass(graph, sws, input, output);
 }
 
 /**************************

libswscale/output.c

@@ -503,8 +503,8 @@ static void yuv2nv12cX_c(enum AVPixelFormat dstFormat, const uint8_t *chrDither,
             int v = chrDither[(i + 3) & 7] << 12;
             int j;
             for (j=0; j<chrFilterSize; j++) {
-                u += (unsigned)(chrUSrc[j][i] * chrFilter[j]);
-                v += (unsigned)(chrVSrc[j][i] * chrFilter[j]);
+                u += chrUSrc[j][i] * (unsigned)chrFilter[j];
+                v += chrVSrc[j][i] * (unsigned)chrFilter[j];
             }
 
             dest[2*i]= av_clip_uint8(u>>19);
@@ -516,8 +516,8 @@ static void yuv2nv12cX_c(enum AVPixelFormat dstFormat, const uint8_t *chrDither,
             int v = chrDither[(i + 3) & 7] << 12;
             int j;
             for (j=0; j<chrFilterSize; j++) {
-                u += (unsigned)(chrUSrc[j][i] * chrFilter[j]);
-                v += (unsigned)(chrVSrc[j][i] * chrFilter[j]);
+                u += chrUSrc[j][i] * (unsigned)chrFilter[j];
+                v += chrVSrc[j][i] * (unsigned)chrFilter[j];
             }
 
             dest[2*i]= av_clip_uint8(v>>19);
@@ -577,8 +577,8 @@ static void yuv2p01xcX_c(int big_endian, const uint8_t *chrDither,
         int v = 1 << (shift - 1);
 
         for (j = 0; j < chrFilterSize; j++) {
-            u += (unsigned)(chrUSrc[j][i] * chrFilter[j]);
-            v += (unsigned)(chrVSrc[j][i] * chrFilter[j]);
+            u += chrUSrc[j][i] * (unsigned)chrFilter[j];
+            v += chrVSrc[j][i] * (unsigned)chrFilter[j];
         }
 
         output_pixel(&dest[2*i]  , u);
@@ -678,8 +678,8 @@ yuv2mono_X_c_template(SwsInternal *c, const int16_t *lumFilter,
         int Y2 = 1 << 18;
 
         for (j = 0; j < lumFilterSize; j++) {
-            Y1 += (unsigned)(lumSrc[j][i]   * lumFilter[j]);
-            Y2 += (unsigned)(lumSrc[j][i+1] * lumFilter[j]);
+            Y1 += lumSrc[j][i]   * (unsigned)lumFilter[j];
+            Y2 += lumSrc[j][i+1] * (unsigned)lumFilter[j];
         }
         Y1 >>= 19;
         Y2 >>= 19;
@@ -896,12 +896,12 @@ yuv2422_X_c_template(SwsInternal *c, const int16_t *lumFilter,
         int V  = 1 << 18;
 
         for (j = 0; j < lumFilterSize; j++) {
-            Y1 += (unsigned)(lumSrc[j][i * 2]     * lumFilter[j]);
-            Y2 += (unsigned)(lumSrc[j][i * 2 + 1] * lumFilter[j]);
+            Y1 += lumSrc[j][i * 2]     * (unsigned)lumFilter[j];
+            Y2 += lumSrc[j][i * 2 + 1] * (unsigned)lumFilter[j];
         }
         for (j = 0; j < chrFilterSize; j++) {
-            U += (unsigned)(chrUSrc[j][i] * chrFilter[j]);
-            V += (unsigned)(chrVSrc[j][i] * chrFilter[j]);
+            U += chrUSrc[j][i] * (unsigned)chrFilter[j];
+            V += chrVSrc[j][i] * (unsigned)chrFilter[j];
         }
         Y1 >>= 19;
         Y2 >>= 19;
@@ -1028,7 +1028,7 @@ yuv2ya16_X_c_template(SwsInternal *c, const int16_t *lumFilter,
         int A = 0xffff;
 
         for (j = 0; j < lumFilterSize; j++)
-            Y += (unsigned)(lumSrc[j][i] * lumFilter[j]);
+            Y += lumSrc[j][i] * (unsigned)lumFilter[j];
 
         Y >>= 15;
         Y += (1<<3) + 0x8000;
@@ -1037,7 +1037,7 @@ yuv2ya16_X_c_template(SwsInternal *c, const int16_t *lumFilter,
         if (hasAlpha) {
             A = -0x40000000 + (1<<14);
             for (j = 0; j < lumFilterSize; j++)
-                A += (unsigned)(alpSrc[j][i] * lumFilter[j]);
+                A += alpSrc[j][i] * (unsigned)lumFilter[j];
 
             A >>= 15;
             A += 0x8000;
@@ -1802,12 +1802,12 @@ yuv2rgb_X_c_template(SwsInternal *c, const int16_t *lumFilter,
         const void *r, *g, *b;
 
         for (j = 0; j < lumFilterSize; j++) {
-            Y1 += (unsigned)(lumSrc[j][i * 2]     * lumFilter[j]);
-            Y2 += (unsigned)(lumSrc[j][i * 2 + 1] * lumFilter[j]);
+            Y1 += lumSrc[j][i * 2]     * (unsigned)lumFilter[j];
+            Y2 += lumSrc[j][i * 2 + 1] * (unsigned)lumFilter[j];
         }
         for (j = 0; j < chrFilterSize; j++) {
-            U += (unsigned)(chrUSrc[j][i] * chrFilter[j]);
-            V += (unsigned)(chrVSrc[j][i] * chrFilter[j]);
+            U += chrUSrc[j][i] * (unsigned)chrFilter[j];
+            V += chrVSrc[j][i] * (unsigned)chrFilter[j];
         }
         Y1 >>= 19;
         Y2 >>= 19;
@@ -1817,8 +1817,8 @@ yuv2rgb_X_c_template(SwsInternal *c, const int16_t *lumFilter,
             A1 = 1 << 18;
             A2 = 1 << 18;
             for (j = 0; j < lumFilterSize; j++) {
-                A1 += (unsigned)(alpSrc[j][i * 2    ] * lumFilter[j]);
-                A2 += (unsigned)(alpSrc[j][i * 2 + 1] * lumFilter[j]);
+                A1 += alpSrc[j][i * 2    ] * (unsigned)lumFilter[j];
+                A2 += alpSrc[j][i * 2 + 1] * (unsigned)lumFilter[j];
             }
             A1 >>= 19;
             A2 >>= 19;
@@ -2179,11 +2179,11 @@ yuv2rgb_full_X_c_template(SwsInternal *c, const int16_t *lumFilter,
         int V = (1<<9)-(128 << 19);
 
         for (j = 0; j < lumFilterSize; j++) {
-            Y += (unsigned)(lumSrc[j][i] * lumFilter[j]);
+            Y += lumSrc[j][i] * (unsigned)lumFilter[j];
         }
         for (j = 0; j < chrFilterSize; j++) {
-            U += (unsigned)(chrUSrc[j][i] * chrFilter[j]);
-            V += (unsigned)(chrVSrc[j][i] * chrFilter[j]);
+            U += chrUSrc[j][i] * (unsigned)chrFilter[j];
+            V += chrVSrc[j][i] * (unsigned)chrFilter[j];
         }
         Y >>= 10;
         U >>= 10;
@@ -2191,7 +2191,7 @@ yuv2rgb_full_X_c_template(SwsInternal *c, const int16_t *lumFilter,
         if (hasAlpha) {
             A = 1 << 18;
             for (j = 0; j < lumFilterSize; j++) {
-                A += (unsigned)(alpSrc[j][i] * lumFilter[j]);
+                A += alpSrc[j][i] * (unsigned)lumFilter[j];
             }
             A >>= 19;
             if (A & 0x100)
@@ -2360,11 +2360,11 @@ yuv2gbrp_full_X_c(SwsInternal *c, const int16_t *lumFilter,
         int R, G, B;
 
         for (j = 0; j < lumFilterSize; j++)
-            Y += (unsigned)(lumSrc[j][i] * lumFilter[j]);
+            Y += lumSrc[j][i] * (unsigned)lumFilter[j];
 
         for (j = 0; j < chrFilterSize; j++) {
-            U += (unsigned)(chrUSrc[j][i] * chrFilter[j]);
-            V += (unsigned)(chrVSrc[j][i] * chrFilter[j]);
+            U += chrUSrc[j][i] * (unsigned)chrFilter[j];
+            V += chrVSrc[j][i] * (unsigned)chrFilter[j];
         }
 
         Y >>= 10;
@@ -2375,7 +2375,7 @@ yuv2gbrp_full_X_c(SwsInternal *c, const int16_t *lumFilter,
             A = 1 << 18;
 
             for (j = 0; j < lumFilterSize; j++)
-                A += (unsigned)(alpSrc[j][i] * lumFilter[j]);
+                A += alpSrc[j][i] * (unsigned)lumFilter[j];
 
             if (A & 0xF8000000)
                 A =  av_clip_uintp2(A, 27);
@@ -2679,7 +2679,7 @@ yuv2ya8_X_c(SwsInternal *c, const int16_t *lumFilter,
         int Y = 1 << 18, A = 1 << 18;
 
         for (j = 0; j < lumFilterSize; j++)
-            Y += (unsigned)(lumSrc[j][i] * lumFilter[j]);
+            Y += lumSrc[j][i] * (unsigned)lumFilter[j];
 
         Y >>= 19;
         if (Y  & 0x100)
@@ -2687,7 +2687,7 @@ yuv2ya8_X_c(SwsInternal *c, const int16_t *lumFilter,
 
         if (hasAlpha) {
             for (j = 0; j < lumFilterSize; j++)
-                A += (unsigned)(alpSrc[j][i] * lumFilter[j]);
+                A += alpSrc[j][i] * (unsigned)lumFilter[j];
 
             A >>= 19;
 
@@ -2793,11 +2793,11 @@ yuv2v30_X_c_template(SwsInternal *c, const int16_t *lumFilter,
         int j;
 
         for (j = 0; j < lumFilterSize; j++)
-            Y += (unsigned)(lumSrc[j][i] * lumFilter[j]);
+            Y += lumSrc[j][i] * (unsigned)lumFilter[j];
 
         for (j = 0; j < chrFilterSize; j++) {
-            U += (unsigned)(chrUSrc[j][i] * chrFilter[j]);
-            V += (unsigned)(chrVSrc[j][i] * chrFilter[j]);
+            U += chrUSrc[j][i] * (unsigned)chrFilter[j];
+            V += chrVSrc[j][i] * (unsigned)chrFilter[j];
         }
 
         Y = av_clip_uintp2(Y >> 17, 10);
@@ -2847,11 +2847,11 @@ yuv2xv36_X_c(SwsInternal *c, const int16_t *lumFilter,
         int j;
 
         for (j = 0; j < lumFilterSize; j++)
-            Y += (unsigned)(lumSrc[j][i] * lumFilter[j]);
+            Y += lumSrc[j][i] * (unsigned)lumFilter[j];
 
         for (j = 0; j < chrFilterSize; j++) {
-            U += (unsigned)(chrUSrc[j][i] * chrFilter[j]);
-            V += (unsigned)(chrVSrc[j][i] * chrFilter[j]);
+            U += chrUSrc[j][i] * (unsigned)chrFilter[j];
+            V += chrVSrc[j][i] * (unsigned)chrFilter[j];
         }
 
         output_pixels(dest + 8 * i + 2, Y, 15, 12, 4)
@@ -3011,13 +3011,13 @@ yuv2ayuv_X_c_template(SwsInternal *c, const int16_t *lumFilter,
         int V = 1 << 18, A = 255;
 
         for (j = 0; j < lumFilterSize; j++)
-            Y += (unsigned)(lumSrc[j][i] * lumFilter[j]);
+            Y += lumSrc[j][i] * (unsigned)lumFilter[j];
 
         for (j = 0; j < chrFilterSize; j++)
-            U += (unsigned)(chrUSrc[j][i] * chrFilter[j]);
+            U += chrUSrc[j][i] * (unsigned)chrFilter[j];
 
         for (j = 0; j < chrFilterSize; j++)
-            V += (unsigned)(chrVSrc[j][i] * chrFilter[j]);
+            V += chrVSrc[j][i] * (unsigned)chrFilter[j];
 
         Y >>= 19;
         U >>= 19;
@@ -3034,7 +3034,7 @@ yuv2ayuv_X_c_template(SwsInternal *c, const int16_t *lumFilter,
             A = 1 << 18;
 
             for (j = 0; j < lumFilterSize; j++)
-                A += (unsigned)(alpSrc[j][i] * lumFilter[j]);
+                A += alpSrc[j][i] * (unsigned)lumFilter[j];
 
             A >>= 19;
 
@@ -3105,13 +3105,13 @@ AYUVPACKEDWRAPPER(uyva, AV_PIX_FMT_UYVA)
             int U  = 1 << (shift - 1), V  = 1 << (shift - 1);           \
                                                                         \
             for (j = 0; j < lumFilterSize; j++) {                       \
-                Y1 += (unsigned)(lumSrc[j][i * 2]     * lumFilter[j]);              \
-                Y2 += (unsigned)(lumSrc[j][i * 2 + 1] * lumFilter[j]);              \
+                Y1 += lumSrc[j][i * 2]     * (unsigned)lumFilter[j];    \
+                Y2 += lumSrc[j][i * 2 + 1] * (unsigned)lumFilter[j];    \
             }                                                           \
                                                                         \
             for (j = 0; j < chrFilterSize; j++) {                       \
-                U += (unsigned)(chrUSrc[j][i] * chrFilter[j]);                      \
-                V += (unsigned)(chrVSrc[j][i] * chrFilter[j]);                      \
+                U += chrUSrc[j][i] * (unsigned)chrFilter[j];            \
+                V += chrVSrc[j][i] * (unsigned)chrFilter[j];            \
             }                                                           \
                                                                         \
             output_pixel(dest + 8 * i + 0, Y1, bits);                   \
@@ -3259,13 +3259,13 @@ yuv2vyu444_X_c(SwsInternal *c, const int16_t *lumFilter,
         int V = 1 << 18;
 
         for (j = 0; j < lumFilterSize; j++)
-            Y += (unsigned)(lumSrc[j][i] * lumFilter[j]);
+            Y += lumSrc[j][i] * (unsigned)lumFilter[j];
 
         for (j = 0; j < chrFilterSize; j++)
-            U += (unsigned)(chrUSrc[j][i] * chrFilter[j]);
+            U += chrUSrc[j][i] * (unsigned)chrFilter[j];
 
         for (j = 0; j < chrFilterSize; j++)
-            V += (unsigned)(chrVSrc[j][i] * chrFilter[j]);
+            V += chrVSrc[j][i] * (unsigned)chrFilter[j];
 
         Y >>= 19;
         U >>= 19;

libswscale/swscale.c

@@ -581,7 +581,8 @@ static void solve_range_convert(uint16_t src_min, uint16_t src_max,
     int total_shift = mult_shift + src_shift;
     *coeff = AV_CEIL_RSHIFT(((uint64_t) dst_range << total_shift) / src_range, src_shift);
     *offset = ((int64_t) dst_max << total_shift) -
-              ((int64_t) src_max << src_shift) * *coeff;
+              ((int64_t) src_max << src_shift) * *coeff +
+              (1U << (mult_shift - 1));
 }
 
 static void init_range_convert_constants(SwsInternal *c)

libswscale/swscale_internal.h

@@ -545,8 +545,8 @@ struct SwsInternal {
     int use_mmx_vfilter;
 
 /* pre defined color-spaces gamma */
-#define XYZ_GAMMA (2.6f)
-#define RGB_GAMMA (2.2f)
+#define XYZ_GAMMA (2.6)
+#define RGB_GAMMA (2.2)
     uint16_t *xyzgamma;
     uint16_t *rgbgamma;
     uint16_t *xyzgammainv;

libswscale/swscale_unscaled.c

@@ -2676,10 +2676,13 @@ void ff_get_unscaled_swscale(SwsInternal *c)
          isSemiPlanarYUV(srcFormat) == isSemiPlanarYUV(dstFormat) &&
          isSwappedChroma(srcFormat) == isSwappedChroma(dstFormat))))
     {
-        if (isPacked(c->opts.src_format))
+        if (isPacked(c->opts.src_format)) {
             c->convert_unscaled = packedCopyWrapper;
-        else /* Planar YUV or gray */
+        } else { /* Planar YUV or gray */
             c->convert_unscaled = planarCopyWrapper;
+            if (c->opts.dither != SWS_DITHER_NONE)
+                c->dst_slice_align = 8 << c->chrDstVSubSample;
+        }
     }
 
 #if ARCH_PPC

tests/fate/subtitles.mak

@@ -131,20 +131,24 @@ fate-sub-rcwt: CMP = oneline
 fate-sub-rcwt: REF = d86f179094a5752d68aa97d82cf887b0
 
 FATE_SUBTITLES-$(call ALLYES, AVDEVICE LAVFI_INDEV MOVIE_FILTER MPEGTS_DEMUXER MCC_MUXER EIA608_TO_SMPTE436M_BSF) += fate-sub-mcc
-fate-sub-mcc: CMD = md5 -f lavfi -i "movie=$(TARGET_SAMPLES)/sub/scte20.ts[out0+subcc]" -map 0:s -c copy -override_time_code_rate ntsc -creation_time "1970-01-01T00:00:00" -bitexact -f mcc
+fate-sub-mcc: CMD = md5 -f lavfi -i "movie=$(TARGET_SAMPLES)/sub/scte20.ts[out0+subcc]" -map 0:s -c copy -override_time_code_rate ntsc -creation_time "1970-01-02T00:00:00" -bitexact -f mcc
 fate-sub-mcc: CMP = oneline
-fate-sub-mcc: REF = 752c60c3a74445a2a76e1a6465064763
+fate-sub-mcc: REF = 779ca7759324441febd6aa6039f29308
 
 FATE_SUBTITLES-$(call DEMMUX, MCC, MCC, SMPTE436M_TO_EIA608_BSF EIA608_TO_SMPTE436M_BSF) += fate-sub-mcc-remux-eia608-bsf
-fate-sub-mcc-remux-eia608-bsf: CMD = fmtstdout mcc -f mcc -i tests/ref/fate/sub-mcc-remux -map 0:s -c copy -bsf "eia608_to_smpte436m=cdp_frame_rate=60000/1001:initial_cdp_sequence_cntr=65535:line_number=11" -override_time_code_rate ntsc -creation_time "1970-01-01T00:00:00"
+fate-sub-mcc-remux-eia608-bsf: CMD = fmtstdout mcc -f mcc -i $(SRC_PATH)/tests/ref/fate/sub-mcc-remux -map 0:s -c copy -bsf "eia608_to_smpte436m=cdp_frame_rate=60000/1001:initial_cdp_sequence_cntr=65535:line_number=11" -override_time_code_rate ntsc -creation_time "1970-01-02T00:00:00"
 fate-sub-mcc-remux-eia608-bsf: CMP = rawdiff
 
 FATE_SUBTITLES-$(call DEMMUX, MCC, MCC, SMPTE436M_TO_EIA608_BSF EIA608_TO_SMPTE436M_BSF) += fate-sub-mcc-remux-eia608
-fate-sub-mcc-remux-eia608: CMD = fmtstdout mcc -f mcc -i tests/ref/fate/sub-mcc-remux -map 0:s -c copy -override_time_code_rate ntsc -creation_time "1970-01-01T00:00:00"
+fate-sub-mcc-remux-eia608: CMD = fmtstdout mcc -f mcc -i $(SRC_PATH)/tests/ref/fate/sub-mcc-remux -map 0:s -c copy -override_time_code_rate ntsc -creation_time "1970-01-02T00:00:00"
 fate-sub-mcc-remux-eia608: CMP = rawdiff
 
+FATE_SUBTITLES-$(call DEMMUX, MCC, MCC, SMPTE436M_TO_EIA608_BSF EIA608_TO_SMPTE436M_BSF) += fate-sub-mcc-remux-eia608-recode
+fate-sub-mcc-remux-eia608-recode: CMD = fmtstdout mcc -eia608_extract 0 -f mcc -i $(SRC_PATH)/tests/ref/fate/sub-mcc-remux -map 0:d -c copy -bsf smpte436m_to_eia608 -override_time_code_rate ntsc -creation_time "1970-01-02T00:00:00"
+fate-sub-mcc-remux-eia608-recode: CMP = rawdiff
+
 FATE_SUBTITLES-$(call DEMMUX, MCC, MCC) += fate-sub-mcc-remux
-fate-sub-mcc-remux: CMD = fmtstdout mcc -eia608_extract 0 -f mcc -i tests/ref/fate/sub-mcc-remux -map 0:d -c copy -override_time_code_rate ntsc -creation_time "1970-01-01T00:00:00"
+fate-sub-mcc-remux: CMD = fmtstdout mcc -eia608_extract 0 -f mcc -i $(SRC_PATH)/tests/ref/fate/sub-mcc-remux -map 0:d -c copy -override_time_code_rate ntsc -creation_time "1970-01-02T00:00:00"
 fate-sub-mcc-remux: CMP = rawdiff
 
 FATE_SUBTITLES-$(call FRAMECRC, MPEGTS, DVBSUB, DVBSUB_ENCODER) += fate-sub-dvb

tests/ref/fate/cbs-vp9-vp90-2-03-deltaq

@@ -1 +1 @@
-0f43cdcbdc97ea6651c56540d97610e5
+fe62460fe28202e0666e628afd8602ca

tests/ref/fate/cbs-vp9-vp90-2-05-resize

@@ -1 +1 @@
-af456bb18c4f5e6fb83c559769ce1b07
+6838422ebb45df353a2bad62b9aff8e9

tests/ref/fate/cbs-vp9-vp90-2-06-bilinear

@@ -1 +1 @@
-af98321cd43a36f065f8c728e22f2c06
+179e228004c396a301c89f34b6c72f68

tests/ref/fate/cbs-vp9-vp90-2-09-lf_deltas

@@ -1 +1 @@
-8b4ce818cde9621481b6bf7997b544b8
+1d1f0768c547461ae2abef57f0aabc24

tests/ref/fate/cbs-vp9-vp90-2-10-show-existing-frame

@@ -1 +1 @@
-ea65b698e86322709257caf9038da40a
+13fa042ee1b4079c227a5c5c96e2db38