Bump micro for 8.1.1

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
avcodec/av1dec: check that primary_ref_frame is within range
2026-05-04 00:07:35 +02:00 · 2026-05-03 15:58:37 -03:00 · 2026-05-03 19:42:27 +02:00 · 2026-05-03 19:25:01 +02:00 · 2026-05-03 19:25:01 +02:00 · 2026-05-03 19:25:00 +02:00
120 changed files with 1013 additions and 366 deletions
@@ -1,8 +1,89 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.

-version <next>:
-
+version 8.1.1:
+ avcodec/aac/aacdec_usac_mps212: fix attach_lsb() OOB after huff_decode
+ avcodec/dfpwmdec: Check nb_samples
+ avcodec/alsdec: do not set nbits invalidly
+ swscale/swscale_unscaled: adjust last line copy
+ swscale/swscale: Check srcSliceY and srcSliceH
+ avformat/avidec: check LIST size in avi_load_index()
+ avformat/avidec: validate INFO list size before parsing
+ avformat/matroskadec: Check audio.sub_packet_h * audio.frame_size
+ libavformat/xwma: fix overflow in seek position
+ avformat/pcm: Use 64bit for byte_rate
+ avcodec/adpcm: signed integer overflow in ADPCM_N64
+ avcodec/hevc/ps: validate rep_format dimensions in multi-layer SPS
+ avfilter/vf_kerndeint: Check for minimum height
+ avcodec/ralf: Add the missing return statement after the error log
+ avfilter/vf_codecview: Clamp block to the visible frame region
+ avcodec/zmbv: reject XOR data that overruns the decompression buffer
+ avcodec/rasc: fix heap use-after-free in decode_move()
+ avformat/rtpdec_mpeg4: reject zero-length AU header sections
+ avcodec/hevc/refs: Check multiplication in alloc_frame()
+ fftools/ffmpeg_opt: validate stream index in negative map handling
+ avformat/rtmpproto: prevent integer overflow accumulating FLV buffer size
+ avformat/rtmpproto: validate compressed SWF header length
+ avformat/rtsp: Fix out-of-bounds read in SDP parser when control_url is empty
+ avformat/rtpdec_latm: avoid integer overflow in LATM length parsing
+ avcodec/h264: recompute per-slice direct mode state for every slice
+ avcodec/h264_refs: Clear stale pointers from ref_list
+ avcodec/pdvdec: Check input space before buffer allocation
+ avformat/concat: guard total_size overflow
+ avformat/iamf_parse.c: Fix potential integer overflow in opus_decoder_config()
+ avcodec/wmaenc: Fix missing padding in extradata
+ avformat: Fix various extradata padding issues
+ avcodec/tdsc: remove double stride adjustment
+ avformat/cafdec: fix negative index use in read_seek
+ avcodec/notchlc: Check 255 loops
+ avformat/rtpdec_jpeg: check qtable_len
+ avformat/vividas: use-of-uninitialized-value in keybuffer
+ avcodec/tdsc: Check jpeg size
+ avcodec/tdsc: Better input size check
+ avcodec/tdsc: Check tile_size
+ avcodec/decode: Better documentation for ff_set_dimensions()
+ avformat/mov: Limit maximum box size for mov_read_lhvc()
+ avformat/mov: reject dimg references with zero entries
+ avformat/mov: check extradata in mov_read_dops()
+ avformat/mov: Check read size for opus extradata
+ avformat/rtspdec: reject non-positive ANNOUNCE Content-Length
+ avformat/wavdec: Fix use-of-uninitialized-value in find_guid()
+ lavfi: vf_drawtext: check memory allocation
+ avcodec/svq1dec: Check input space for minimum
+ avcodec/vp9: Rollback dimensions when format is rejected
+ avformat/rtpdec_qdm2: Check block_size
+ avfilter/vf_ssim360: fix integer overflow in tape_length allocation
+ avcodec/escape130: Initialize old_y_avg
+ avutil/samplefmt: Dont claim that av_get_sample_fmt_string checks sample_fmt
+ swscale: fix signed integer overflow in color conversion arithmetic
+ avformat: check avio_read() return values in dss/dtshd/mlv
+ avformat/whip: check RTP history packet size before RTX retransmission
+ avcodec/aac/aacdec_usac: Implement missing bits of otts_bands_phase and residual_bands computation
+ avcodec/alsdec: preserve full float value in zero-truncated samples
+ avcodec/alsdec: propagate read_diff_float_data() errors in read_frame_data()
+ avcodec/alsdec: fix mantissa unpacking in compressed Part A path
+ avfilter/vf_drawtext: fix newline rendered as .notdef glyph
+ avcodec/pngdec: fix dead overflow check in decode_text_to_exif()
+ avcodec/vp9: fix cbs fragment leak on error
+ libavfilter/vf_v360: fix operator precedence in stereo loop condition
+ avcodec/alsdec: fix abs(INT_MIN) UB in read_diff_float_data()
+ avformat/rsd: reject short ADPCM_THP extradata reads
+ avformat/mov: Handle integer overflow in MOV parser
+ avcodec/dvdsub_parser: Fix buf_size check
+ avfilter/af_pan: fix sscanf() return value checks in parse_channel_name
+ avutil/bswap: fix implicit conversion warning in av_bswap64
+ avcodec/h2645_sei: don't use provider_code uninitialized
+ (fforge/pr/22943) avformat/hls_sample_encryption: add missing padding for audio setup buffer
+ (fforge/pr/22826) lavc/videotoolbox_vp9: fix vpcC flags offset
+ lavc/videotoolboxenc: return SEI parse errors
+ vulkan: fix encode feedback query handling
+ avcodec/cbs_lcevc: fix writing process blocks with size 6
+ avformat/mov: don't try to create an LCEVC group if there's a single track
+ (fforge/pr/22563) aarch64: Add Armv9.3-A GCS (Guarded Control Stack) support
+ aarch64: hevcdsp: Make returns match the call site
+ (fforge/pr/22545) avcodec/lcevcdec: don't try to derive final dimensions from SAR
+ avcodec/lcevc_parser: move the resolution type table to a header
+ avcodec/cbs_lcevc: don't look for process blocks if the unit was not decomposed

 version 8.1:
 - ffprobe -codec option
@@ -1 +1 @@
-8.0.git
+8.1.1
@@ -0,0 +1,15 @@
+
+              ┌──────────────────────────────────────┐
+              │ RELEASE NOTES for FFmpeg 8.1 "Hoare" │
+              └──────────────────────────────────────┘
+
+   The FFmpeg Project proudly presents FFmpeg 8.1 "Hoare", about 7
+   months after the release of FFmpeg 8.0.
+
+   A complete Changelog is available at the root of the project, and the
+   complete Git history on https://git.ffmpeg.org/gitweb/ffmpeg.git
+
+   We hope you will like this release as much as we enjoyed working on it, and
+   as usual, if you have any questions about it, or any FFmpeg related topic,
+   feel free to join us on the #ffmpeg IRC channel (on irc.libera.chat) or ask
+   on the mailing-lists.
@@ -2,6 +2,10 @@ The last version increases of all libraries were on 2025-03-28

 API changes, most recent first:

+2026-03-14 - xxxxxxxxxx - lavu 60.26.100 - hwcontext_vulkan.h
+  Deprecate AVVulkanDeviceContext.lock_queue and
+  AVVulkanDeviceContext.unlock_queue without replacement.
+
 2026-03-07 - c23d56b173a - lavc 62.26.100 - codec_desc.h
  Add AV_CODEC_PROP_ENHANCEMENT.

@@ -38,7 +38,7 @@ PROJECT_NAME           = FFmpeg
 # could be handy for archiving the generated documentation or if some version
 # control system is used.

-PROJECT_NUMBER         =
+PROJECT_NUMBER         = 8.1.1

 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
@@ -253,7 +253,6 @@ void term_init(void)
 /* read a key without blocking */
 static int read_key(void)
 {
-    unsigned char ch = -1;
 #if HAVE_TERMIOS_H
    int n = 1;
    struct timeval tv;
@@ -265,6 +264,7 @@ static int read_key(void)
    tv.tv_usec = 0;
    n = select(1, &rfds, NULL, NULL, &tv);
    if (n > 0) {
+        unsigned char ch;
        n = read(0, &ch, 1);
        if (n == 1)
            return ch;
@@ -289,6 +289,7 @@ static int read_key(void)
        }
        //Read it
        if(nchars != 0) {
+            unsigned char ch;
            if (read(0, &ch, 1) == 1)
                return ch;
            return 0;
@@ -300,7 +301,7 @@ static int read_key(void)
    if(kbhit())
        return(getch());
 #endif
-    return ch;
+    return -1;
 }

 static int decode_interrupt_cb(void *ctx)
@@ -645,6 +645,8 @@ static int opt_map(void *optctx, const char *opt, const char *arg)
            for (i = 0; i < o->nb_stream_maps; i++) {
                m = &o->stream_maps[i];
                if (file_idx == m->file_index &&
+                    m->stream_index >= 0 &&
+                    m->stream_index < input_files[m->file_index]->nb_streams &&
                    stream_specifier_match(&ss,
                                           input_files[m->file_index]->ctx,
                                           input_files[m->file_index]->ctx->streams[m->stream_index],
@@ -43,6 +43,7 @@

 #include "libavutil/bprint.h"
 #include "libavutil/mem.h"
+#include "libavutil/internal.h"

 #endif

@@ -115,14 +116,22 @@ static void hwctx_lock_queue(void *priv, uint32_t qf, uint32_t qidx)
 {
    AVHWDeviceContext *avhwctx = priv;
    const AVVulkanDeviceContext *hwctx = avhwctx->hwctx;
+#if FF_API_VULKAN_SYNC_QUEUES
+FF_DISABLE_DEPRECATION_WARNINGS
    hwctx->lock_queue(avhwctx, qf, qidx);
+FF_ENABLE_DEPRECATION_WARNINGS
+#endif
 }

 static void hwctx_unlock_queue(void *priv, uint32_t qf, uint32_t qidx)
 {
    AVHWDeviceContext *avhwctx = priv;
    const AVVulkanDeviceContext *hwctx = avhwctx->hwctx;
+#if FF_API_VULKAN_SYNC_QUEUES
+FF_DISABLE_DEPRECATION_WARNINGS
    hwctx->unlock_queue(avhwctx, qf, qidx);
+FF_ENABLE_DEPRECATION_WARNINGS
+#endif
 }

 static int add_instance_extension(const char **ext, unsigned num_ext,
@@ -283,7 +292,11 @@ static void placebo_lock_queue(struct AVHWDeviceContext *dev_ctx,
 {
    RendererContext *ctx = dev_ctx->user_opaque;
    pl_vulkan vk = ctx->placebo_vulkan;
+#if FF_API_VULKAN_SYNC_QUEUES
+FF_DISABLE_DEPRECATION_WARNINGS
    vk->lock_queue(vk, queue_family, index);
+FF_ENABLE_DEPRECATION_WARNINGS
+#endif
 }

 static void placebo_unlock_queue(struct AVHWDeviceContext *dev_ctx,
@@ -292,7 +305,11 @@ static void placebo_unlock_queue(struct AVHWDeviceContext *dev_ctx,
 {
    RendererContext *ctx = dev_ctx->user_opaque;
    pl_vulkan vk = ctx->placebo_vulkan;
+#if FF_API_VULKAN_SYNC_QUEUES
+FF_DISABLE_DEPRECATION_WARNINGS
    vk->unlock_queue(vk, queue_family, index);
+FF_ENABLE_DEPRECATION_WARNINGS
+#endif
 }

 static int get_decode_queue(VkRenderer *renderer, int *index, int *count)
@@ -386,8 +403,12 @@ static int create_vk_by_placebo(VkRenderer *renderer,
    device_ctx->user_opaque = ctx;

    vk_dev_ctx = device_ctx->hwctx;
+#if FF_API_VULKAN_SYNC_QUEUES
+FF_DISABLE_DEPRECATION_WARNINGS
    vk_dev_ctx->lock_queue = placebo_lock_queue;
    vk_dev_ctx->unlock_queue = placebo_unlock_queue;
+FF_ENABLE_DEPRECATION_WARNINGS
+#endif

    vk_dev_ctx->get_proc_addr = ctx->placebo_instance->get_proc_addr;

@@ -3238,7 +3238,7 @@ int main(int argc, char **argv)
    char *buf;
    char *f_name = NULL, *f_args = NULL;
    int ret, input_ret;
-    AVTextFormatDataDump data_dump_format_id;
+    AVTextFormatDataDump data_dump_format_id = AV_TEXTFORMAT_DATADUMP_XXD;

    init_dynload();

@@ -1277,7 +1277,7 @@ OBJS-$(CONFIG_IPU_PARSER)              += ipu_parser.o
 OBJS-$(CONFIG_JPEG2000_PARSER)         += jpeg2000_parser.o
 OBJS-$(CONFIG_JPEGXL_PARSER)           += jpegxl_parser.o jpegxl_parse.o
 OBJS-$(CONFIG_JPEGXS_PARSER)           += jpegxs_parser.o
-OBJS-$(CONFIG_LCEVC_PARSER)            += lcevc_parser.o
+OBJS-$(CONFIG_LCEVC_PARSER)            += lcevc_parser.o lcevctab.o
 OBJS-$(CONFIG_MISC4_PARSER)            += misc4_parser.o
 OBJS-$(CONFIG_MJPEG_PARSER)            += mjpeg_parser.o
 OBJS-$(CONFIG_MLP_PARSER)              += mlp_parse.o mlp_parser.o mlp.o
@@ -215,6 +215,8 @@ static int decode_usac_element_pair(AACDecContext *ac,

    if (e->stereo_config_index) {
        e->mps.freq_res = get_bits(gb, 3); /* bsFreqRes */
+        int numBands = ((int[]){0,28,20,14,10,7,5,4})[e->mps.freq_res]; // ISO/IEC 23003-1:2007, 5.2, Table 39
+
        e->mps.fixed_gain = get_bits(gb, 3); /* bsFixedGainDMX */
        e->mps.temp_shape_config = get_bits(gb, 2); /* bsTempShapeConfig */
        e->mps.decorr_config = get_bits(gb, 2); /* bsDecorrConfig */
@@ -222,12 +224,21 @@ static int decode_usac_element_pair(AACDecContext *ac,
        e->mps.phase_coding = get_bits1(gb); /* bsPhaseCoding */

        e->mps.otts_bands_phase_present = get_bits1(gb);
-        if (e->mps.otts_bands_phase_present) /* bsOttBandsPhasePresent */
-            e->mps.otts_bands_phase = get_bits(gb, 5); /* bsOttBandsPhase */
+        int otts_bands_phase = ((int[]){0,10,10,7,5,3,2,2})[e->mps.freq_res]; // Table 109 — Default value of bsOttBandsPhase
+        if (e->mps.otts_bands_phase_present) { /* bsOttBandsPhasePresent */
+            otts_bands_phase = get_bits(gb, 5); /* bsOttBandsPhase */
+            if (otts_bands_phase > numBands)
+                return AVERROR_INVALIDDATA;
+        }
+        e->mps.otts_bands_phase = otts_bands_phase;

        e->mps.residual_coding = e->stereo_config_index >= 2; /* bsResidualCoding */
        if (e->mps.residual_coding) {
-            e->mps.residual_bands = get_bits(gb, 5); /* bsResidualBands */
+            int residual_bands = get_bits(gb, 5); /* bsResidualBands */
+            if (residual_bands > numBands)
+                return AVERROR_INVALIDDATA;
+            e->mps.residual_bands = residual_bands;
+
            e->mps.otts_bands_phase = FFMAX(e->mps.otts_bands_phase,
                                            e->mps.residual_bands);
            e->mps.pseudo_lr = get_bits1(gb); /* bsPseudoLr */
@@ -1293,7 +1304,8 @@ static void spectrum_decode(AACDecContext *ac, AACUSACConfig *usac,
        SingleChannelElement *sce = &cpe->ch[ch];
        AACUsacElemData *ue = &sce->ue;

-        spectrum_scale(ac, sce, ue);
+        if (!ue->core_mode)
+            spectrum_scale(ac, sce, ue);
    }

    if (nb_channels > 1 && us->common_window) {
@@ -1343,8 +1355,9 @@ static void spectrum_decode(AACDecContext *ac, AACUSACConfig *usac,
        if (sce->tns.present && ((nb_channels == 1) || (us->tns_on_lr)))
            ac->dsp.apply_tns(sce->coeffs, &sce->tns, &sce->ics, 1);

-        ac->oc[1].m4ac.frame_length_short ? ac->dsp.imdct_and_windowing_768(ac, sce) :
-                                            ac->dsp.imdct_and_windowing(ac, sce);
+        if (!sce->ue.core_mode)
+            ac->oc[1].m4ac.frame_length_short ? ac->dsp.imdct_and_windowing_768(ac, sce) :
+                                                ac->dsp.imdct_and_windowing(ac, sce);
    }
 }

@@ -464,10 +464,10 @@ static int ec_pair_dec(GetBitContext *gb,
    }

    if (pair) {
-        p_data[0] = data_pair[0];
-        p_data[1] = data_pair[1];
+        p_data[0] = data_diff[0];
+        p_data[1] = data_diff[1];
    } else {
-        p_data[0] = data_pair[0];
+        p_data[0] = data_diff[0];
        p_data[1] = NULL;
    }

@@ -480,7 +480,7 @@ static int ec_pair_dec(GetBitContext *gb,
    if (pair && (diff_freq[0] || diff_time_back))
        diff_freq[1] = !get_bits1(gb);

-    int time_pair;
+    int time_pair = 0;
    huff_decode(gb, p_data, data_type, diff_freq,
                nb_bands, &time_pair);

@@ -534,11 +534,11 @@ static int ec_pair_dec(GetBitContext *gb,
    }

    /* Decode LSBs */
-    attach_lsb(gb, p_data[0], quant_offset, attach_lsb_flag,
-               nb_bands, p_data[0]);
+    attach_lsb(gb, data_pair[0], quant_offset, attach_lsb_flag,
+               nb_bands, data_pair[0]);
    if (pair)
-        attach_lsb(gb, p_data[1], quant_offset, attach_lsb_flag,
-                   nb_bands, p_data[1]);
+        attach_lsb(gb, data_pair[1], quant_offset, attach_lsb_flag,
+                   nb_bands, data_pair[1]);

    memcpy(&set1[start_band], data_pair[0], 2*nb_bands);
    if (pair)
@@ -591,9 +591,6 @@ static int get_freq_strides(int16_t *freq_strides, int band_stride,
        }
    }

-    for (int i = 0; i <= data_bands; i++)
-        freq_strides[i] = av_clip_uintp2(freq_strides[i], 2);
-
    return data_bands;
 }

@@ -643,7 +640,8 @@ int ff_aac_ec_data_dec(GetBitContext *gb, AACMPSLosslessData *ld,
                fine_to_coarse(ld->last_data, data_type, start_band, end_band);
        }

-        int data_bands = get_freq_strides(ld->freq_res,
+        int16_t freq_stride_map[MPS_MAX_PARAM_BANDS + 1];
+        int data_bands = get_freq_strides(freq_stride_map,
                                          stride_table[ld->freq_res[set_idx]],
                                          start_band, end_band);

@@ -651,7 +649,7 @@ int ff_aac_ec_data_dec(GetBitContext *gb, AACMPSLosslessData *ld,
            return AVERROR(EINVAL);

        for (int j = 0; j < data_bands; j++)
-            ld->last_data[start_band + j] = ld->last_data[ld->freq_res[j]];
+            ld->last_data[start_band + j] = ld->last_data[freq_stride_map[j]];

        int err = ec_pair_dec(gb,
                              ld->data[set_idx + 0], ld->data[set_idx + 1],
@@ -664,11 +662,11 @@ int ff_aac_ec_data_dec(GetBitContext *gb, AACMPSLosslessData *ld,
        if (data_type == MPS_IPD) {
            const int mask = ld->coarse_quant[set_idx] ? 0x7 : 0xF;
            for (int j = 0; j < data_bands; j++)
-                for (int k = ld->freq_res[j + 0]; k < ld->freq_res[j + 1]; k++)
+                for (int k = freq_stride_map[j + 0]; k < freq_stride_map[j + 1]; k++)
                    ld->last_data[k] = ld->data[set_idx + data_pair][start_band + j] & mask;
        } else {
            for (int j = 0; j < data_bands; j++)
-                for (int k = ld->freq_res[j + 0]; k < ld->freq_res[j + 1]; k++)
+                for (int k = freq_stride_map[j + 0]; k < freq_stride_map[j + 1]; k++)
                    ld->last_data[k] = ld->data[set_idx + data_pair][start_band + j];
        }

@@ -511,8 +511,11 @@ function hevc_loop_filter_luma_body_\bitdepth\()_neon, export=0
        sqxtun          v6.8b, v6.8h
        sqxtun          v7.8b, v7.8h
 .endif
+        // Use x15 to signal whether any pixels should be updated or not.
+        mov             x15, #1
+        ret
+3:      mov             x15, #0
        ret
-3:      ret             x6
 endfunc
 .endm

@@ -562,6 +565,7 @@ function ff_hevc_\dir\()_loop_filter_luma_\bitdepth\()_neon, export=1
 .endif
 .endif
        bl              hevc_loop_filter_luma_body_\bitdepth\()_neon
+        cbz             x15, 9f
 .if \bitdepth > 8
 .ifc \dir, v
        transpose_8x8H  v0, v1, v2, v3, v4, v5, v6, v7, v16, v17
@@ -587,6 +591,7 @@ function ff_hevc_\dir\()_loop_filter_luma_\bitdepth\()_neon, export=1
        st1             {v6.8b}, [x10], x1
        st1             {v7.8b}, [x10]
 .endif
+9:
        ret             x6
 endfunc
 .endm
@@ -2704,7 +2704,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, AVFrame *frame,

                    for (int k = i-1; k > -1; k--) {
                        for (int o = 1; o < order; o++)
-                            delta += sf_codes[(i-1) - k] * coefs[(o*8) + k];
+                            delta += sf_codes[(i-1) - k] * (unsigned)coefs[(o*8) + k];
                    }

                    sample = sf_codes[i] * 2048;
@@ -1548,8 +1548,12 @@ static int read_diff_float_data(ALSDecContext *ctx, unsigned int ra_frame) {
                    return AVERROR_INVALIDDATA;
                }

+                j = 0;
                for (i = 0; i < frame_length; ++i) {
-                    ctx->raw_mantissa[c][i] = AV_RB32(larray);
+                    if (ctx->raw_samples[c][i] == 0) {
+                        ctx->raw_mantissa[c][i] = AV_RB32(larray + j);
+                        j += 4;
+                    }
                }
            }
        }
@@ -1560,7 +1564,10 @@ static int read_diff_float_data(ALSDecContext *ctx, unsigned int ra_frame) {
                if (ctx->raw_samples[c][i] != 0) {
                    //The following logic is taken from Table 14.45 and 14.46 from the ISO spec
                    if (av_cmp_sf_ieee754(acf[c], FLOAT_1)) {
-                        nbits[i] = 23 - av_log2(abs(ctx->raw_samples[c][i]));
+                        int nbit = av_log2(FFABSU(ctx->raw_samples[c][i]));
+                        if (nbit > 23)
+                            return AVERROR_INVALIDDATA;
+                        nbits[i] = 23 - nbit;
                    } else {
                        nbits[i] = 23;
                    }
@@ -1634,7 +1641,7 @@ static int read_diff_float_data(ALSDecContext *ctx, unsigned int ra_frame) {
                tmp_32 = (sign << 31) | ((e + EXP_BIAS) << 23) | (mantissa);
                ctx->raw_samples[c][i] = tmp_32;
            } else {
-                ctx->raw_samples[c][i] = raw_mantissa[c][i] & 0x007fffffUL;
+                ctx->raw_samples[c][i] = raw_mantissa[c][i];
            }
        }
        align_get_bits(gb);
@@ -1790,7 +1797,9 @@ static int read_frame_data(ALSDecContext *ctx, unsigned int ra_frame)
    }

    if (sconf->floating) {
-        read_diff_float_data(ctx, ra_frame);
+        ret = read_diff_float_data(ctx, ra_frame);
+        if (ret < 0)
+            return ret;
    }

    if (get_bits_left(gb) < 0) {
@@ -152,8 +152,9 @@ int ff_aom_parse_film_grain_sets(AVFilmGrainAFGS1Params *s,
        payload_4byte = get_bits1(gb);
        payload_size = get_bits(gb, payload_4byte ? 2 : 8);
        set_idx = get_bits(gb, 3);
+
        fgp = av_film_grain_params_alloc(&fgp_size);
-        if (!fgp)
+        if (!fgp || s->sets[set_idx])
            goto error;
        aom = &fgp->codec.aom;

@@ -212,7 +213,7 @@ int ff_aom_parse_film_grain_sets(AVFilmGrainAFGS1Params *s,
        }

        predict_scaling = get_bits1(gb);
-        if (predict_scaling && (!ref || ref == fgp))
+        if (predict_scaling && !ref)
            goto error; // prediction must be from valid, different set

        predict_y_scaling = predict_scaling ? get_bits1(gb) : 0;
@@ -99,12 +99,11 @@ static int32_t decode_signed_subexp_with_ref(uint32_t sub_exp, int low,

 static void read_global_param(AV1DecContext *s, int type, int ref, int idx)
 {
-    uint8_t primary_frame, prev_frame;
+    int primary_frame;
    uint32_t abs_bits, prec_bits, round, prec_diff, sub, mx;
    int32_t r, prev_gm_param;

    primary_frame = s->raw_frame_header->primary_ref_frame;
-    prev_frame = s->raw_frame_header->ref_frame_idx[primary_frame];
    abs_bits = AV1_GM_ABS_ALPHA_BITS;
    prec_bits = AV1_GM_ALPHA_PREC_BITS;

@@ -114,8 +113,10 @@ static void read_global_param(AV1DecContext *s, int type, int ref, int idx)
     */
    if (s->raw_frame_header->primary_ref_frame == AV1_PRIMARY_REF_NONE)
        prev_gm_param = s->cur_frame.gm_params[ref][idx];
-    else
+    else {
+        int prev_frame = s->raw_frame_header->ref_frame_idx[primary_frame];
        prev_gm_param = s->ref[prev_frame].gm_params[ref][idx];
+    }

    if (idx < 2) {
        if (type == AV1_WARP_MODEL_TRANSLATION) {
@@ -30,6 +30,7 @@
 #include "h2645_parse.h"
 #include "h264.h"
 #include "lcevc.h"
+#include "lcevc_parse.h"
 #include "startcode.h"
 #include "vc1_common.h"
 #include "vvc.h"
@@ -268,22 +269,6 @@ static int extract_extradata_h2645(AVBSFContext *ctx, AVPacket *pkt,
    return 0;
 }

-static inline uint64_t get_mb(GetBitContext *s) {
-    int more, i = 0;
-    uint64_t mb = 0;
-
-    do {
-        int byte = get_bits(s, 8);
-        unsigned bits = byte & 0x7f;
-        more = byte & 0x80;
-        mb = (mb << 7) | bits;
-        if (++i == 10)
-            break;
-    } while (more);
-
-    return mb;
-}
-
 /**
 * Rewrite the NALu stripping the unneeded blocks.
 * Given that length fields coded inside the NALu are not aware of any emulation_3bytes
@@ -304,7 +289,8 @@ static int write_lcevc_nalu(AVBSFContext *ctx, PutByteContext *pbc, const H2645N

    while (bytestream2_get_bytes_left(&gbc) > 1) {
        GetBitContext gb;
-        int payload_size_type, payload_type, payload_size;
+        int payload_size_type, payload_type;
+        uint64_t payload_size;
        int block_size, raw_block_size, block_end;

        init_get_bits8(&gb, gbc.buffer, bytestream2_get_bytes_left(&gbc));
@@ -317,6 +303,9 @@ static int write_lcevc_nalu(AVBSFContext *ctx, PutByteContext *pbc, const H2645N
        if (payload_size_type == 7)
            payload_size = get_mb(&gb);

+        if (payload_size > INT_MAX - (get_bits_count(&gb) >> 3))
+            return AVERROR_INVALIDDATA;
+
        block_size = raw_block_size = payload_size + (get_bits_count(&gb) >> 3);
        if (block_size >= bytestream2_get_bytes_left(&gbc))
            return AVERROR_INVALIDDATA;
@@ -380,8 +369,9 @@ static int extract_extradata_lcevc(AVBSFContext *ctx, AVPacket *pkt,
    for (i = 0; i < s->h2645_pkt.nb_nals; i++) {
        H2645NAL *nal = &s->h2645_pkt.nals[i];
        if (val_in_array(extradata_nal_types, nb_extradata_nal_types, nal->type)) {
-            bytestream2_init_writer(&pb_extradata, NULL, 0);
-            // dummy pass to find sc, gc or ai
+            // dummy pass to find sc, gc or ai. A dummy pointer is used to prevent
+            // UB in PutByteContext. Nothing will be written.
+            bytestream2_init_writer(&pb_extradata, nal->data, 0);
            if (!write_lcevc_nalu(ctx, &pb_extradata, nal, 0))
                extradata_size += nal->raw_size + 3;
        }
@@ -407,14 +397,10 @@ static int extract_extradata_lcevc(AVBSFContext *ctx, AVPacket *pkt,
            return AVERROR(ENOMEM);
        }

-        *data = extradata;
-        *size = 0;
-
        bytestream2_init_writer(&pb_extradata, extradata, extradata_size);
        if (s->remove)
            bytestream2_init_writer(&pb_filtered_data, filtered_buf->data, filtered_size);

-        filtered_size = 0;
        for (i = 0; i < s->h2645_pkt.nb_nals; i++) {
            H2645NAL *nal = &s->h2645_pkt.nals[i];
            if (val_in_array(extradata_nal_types, nb_extradata_nal_types,
@@ -422,33 +408,34 @@ static int extract_extradata_lcevc(AVBSFContext *ctx, AVPacket *pkt,
                bytestream2_put_be24(&pb_extradata, 1); //startcode
                ret = write_lcevc_nalu(ctx, &pb_extradata, nal, 0);
                if (ret < 0) {
-                    av_freep(data);
+                    av_freep(&extradata);
                    av_buffer_unref(&filtered_buf);
                    return ret;
                }
-                *size += ret;
                if (s->remove) {
                    bytestream2_put_be24(&pb_filtered_data, 1); //startcode
                    ret = write_lcevc_nalu(ctx, &pb_filtered_data, nal, 1);
                    if (ret < 0) {
-                        av_freep(data);
+                        av_freep(&extradata);
                        av_buffer_unref(&filtered_buf);
                        return ret;
                    }
-                    filtered_size += ret;
                }
            } else if (s->remove) {
                bytestream2_put_be24(&pb_filtered_data, 1); //startcode
                bytestream2_put_bufferu(&pb_filtered_data, nal->raw_data, nal->raw_size);
-                filtered_size += nal->raw_size;
            }
        }
+        *data = extradata;
+        *size = bytestream2_tell_p(&pb_extradata);
+        av_assert0(*size <= extradata_size);

        if (s->remove) {
+            av_assert0(bytestream2_tell_p(&pb_filtered_data) <= filtered_size);
            av_buffer_unref(&pkt->buf);
            pkt->buf  = filtered_buf;
            pkt->data = filtered_buf->data;
-            pkt->size = filtered_size;
+            pkt->size = bytestream2_tell_p(&pb_filtered_data);
        }
    }

@@ -1216,7 +1216,7 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw,
                    int num_subpic_cols = tmp_width_val /
                                     (current->sps_subpic_width_minus1[0] + 1);
                    if (tmp_width_val % (current->sps_subpic_width_minus1[0] + 1) ||
-                        tmp_height_val % (current->sps_subpic_width_minus1[0] + 1) ||
+                        tmp_height_val % (current->sps_subpic_height_minus1[0] + 1) ||
                        current->sps_num_subpics_minus1 !=
                        (num_subpic_cols * tmp_height_val /
                         (current->sps_subpic_height_minus1[0] + 1) - 1))
@@ -1971,6 +1971,8 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw,
                current->slice_top_left_tile_idx[i] = tile_idx;
                tile_x = tile_idx % current->num_tile_columns;
                tile_y = tile_idx / current->num_tile_columns;
+                if (tile_y >= current->num_tile_rows)
+                    return AVERROR_INVALIDDATA;
                if (tile_x != current->num_tile_columns - 1) {
                    ues(pps_slice_width_in_tiles_minus1[i],
                        0, current->num_tile_columns - 1 - tile_x, 1, i);
@@ -3506,7 +3508,7 @@ static int FUNC(slice_header) (CodedBitstreamContext *ctx, RWContext *rw,
                 tile_idx <=
                 current->sh_slice_address +
                 current->sh_num_tiles_in_slice_minus1; tile_idx++) {
-                tile_y = tile_idx / pps->num_tile_rows;
+                tile_y = tile_idx / pps->num_tile_columns;
                height = pps->row_height_val[tile_y];
                current->num_entry_points += (entropy_sync ? height : 1);
            }
@@ -674,6 +674,9 @@ int ff_cbs_lcevc_find_process_block(CodedBitstreamContext *ctx,
        CodedBitstreamUnit *unit = &au->units[i];
        LCEVCRawProcessBlockList *list;

+        if (!unit->content)
+            continue;
+
        err = cbs_lcevc_get_process_block_list(ctx, unit, &list);
        if (err < 0)
            continue;
@@ -635,6 +635,8 @@ static int FUNC(process_block_list)(CodedBitstreamContext *ctx, RWContext *rw,
            *rw = start_state;

            tmp = FFMIN(block->payload_size, 7);
+            if (tmp == 6)
+                tmp = 7;
            xu(3, payload_size_type, tmp, 0, 7, 0);
            xu(5, payload_type, block->payload_type, 0, MAX_UINT_BITS(5), 0);

@@ -98,6 +98,8 @@ typedef struct DecodeContext {
    struct {
        FFLCEVCContext *ctx;
        int frame;
+        int base_width;
+        int base_height;
        int width;
        int height;
    } lcevc;
@@ -1661,7 +1663,7 @@ int ff_attach_decode_data(AVFrame *frame)
    return 0;
 }

-static void update_frame_props(AVCodecContext *avctx, AVFrame *frame)
+static int update_frame_props(AVCodecContext *avctx, AVFrame *frame)
 {
 #if CONFIG_LIBLCEVC_DEC
    AVCodecInternal    *avci = avctx->internal;
@@ -1671,12 +1673,23 @@ static void update_frame_props(AVCodecContext *avctx, AVFrame *frame)
                      av_frame_get_side_data(frame, AV_FRAME_DATA_LCEVC);

    if (dc->lcevc.frame) {
-        dc->lcevc.width  = frame->width;
-        dc->lcevc.height = frame->height;
-        frame->width  = frame->width  * 2 / FFMAX(frame->sample_aspect_ratio.den, 1);
-        frame->height = frame->height * 2 / FFMAX(frame->sample_aspect_ratio.num, 1);
+        int ret = ff_lcevc_parse_frame(dc->lcevc.ctx, frame,
+                                       &dc->lcevc.width, &dc->lcevc.height, avctx);
+        if (ret < 0)
+            return ret;
+
+        // force get_buffer2() to allocate the base frame using the same dimensions
+        // as the final enhanced frame, in order to prevent reinitializing the buffer
+        // pools unnecessarely
+        if (dc->lcevc.width && dc->lcevc.height) {
+            dc->lcevc.base_width  = frame->width;
+            dc->lcevc.base_height = frame->height;
+            frame->width  = dc->lcevc.width;
+            frame->height = dc->lcevc.height;
+        }
    }
 #endif
+    return 0;
 }

 static int attach_post_process_data(AVCodecContext *avctx, AVFrame *frame)
@@ -1690,6 +1703,11 @@ static int attach_post_process_data(AVCodecContext *avctx, AVFrame *frame)
        FFLCEVCFrame *frame_ctx;
        int ret;

+        if (!dc->lcevc.width || !dc->lcevc.height) {
+            dc->lcevc.frame = 0;
+            return 0;
+        }
+
        frame_ctx = av_mallocz(sizeof(*frame_ctx));
        if (!frame_ctx)
            return AVERROR(ENOMEM);
@@ -1701,12 +1719,12 @@ static int attach_post_process_data(AVCodecContext *avctx, AVFrame *frame)
        }

        frame_ctx->lcevc = av_refstruct_ref(dc->lcevc.ctx);
-        frame_ctx->frame->width  = frame->width;
-        frame_ctx->frame->height = frame->height;
+        frame_ctx->frame->width  = dc->lcevc.width;
+        frame_ctx->frame->height = dc->lcevc.height;
        frame_ctx->frame->format = frame->format;

-        frame->width  = dc->lcevc.width;
-        frame->height = dc->lcevc.height;
+        frame->width  = dc->lcevc.base_width;
+        frame->height = dc->lcevc.base_height;

        ret = avctx->get_buffer2(avctx, frame_ctx->frame, 0);
        if (ret < 0) {
@@ -1771,7 +1789,9 @@ int ff_get_buffer(AVCodecContext *avctx, AVFrame *frame, int flags)
        }
    } else {
        avctx->sw_pix_fmt = avctx->pix_fmt;
-        update_frame_props(avctx, frame);
+        ret = update_frame_props(avctx, frame);
+        if (ret < 0)
+            goto fail;
    }

    ret = avctx->get_buffer2(avctx, frame, flags);
@@ -2091,7 +2111,7 @@ av_cold int ff_decode_preinit(AVCodecContext *avctx)
    if (!(avctx->export_side_data & AV_CODEC_EXPORT_DATA_ENHANCEMENTS)) {
        if (avctx->codec_type == AVMEDIA_TYPE_VIDEO) {
 #if CONFIG_LIBLCEVC_DEC
-            ret = ff_lcevc_alloc(&dc->lcevc.ctx);
+            ret = ff_lcevc_alloc(&dc->lcevc.ctx, avctx);
            if (ret < 0 && (avctx->err_recognition & AV_EF_EXPLODE))
                return ret;
 #endif
@@ -2338,6 +2358,8 @@ av_cold void ff_decode_internal_sync(AVCodecContext *dst, const AVCodecContext *
    dst_dc->side_data_pref_mask = src_dc->side_data_pref_mask;
 #if CONFIG_LIBLCEVC_DEC
    av_refstruct_replace(&dst_dc->lcevc.ctx, src_dc->lcevc.ctx);
+    dst_dc->lcevc.width = src_dc->lcevc.width;
+    dst_dc->lcevc.height = src_dc->lcevc.height;
 #endif
 }

@@ -93,9 +93,13 @@ int ff_attach_decode_data(AVFrame *frame);
 */
 int ff_copy_palette(void *dst, const AVPacket *src, void *logctx);

-/**
- * Check that the provided frame dimensions are valid and set them on the codec
- * context.
+/*
+ * Validate and set video frame dimensions on AVCodecContext.
+ *
+ * Dimensions accepted here satisfy FFmpeg's generic image-size validation
+ * (see av_image_check_size2()). Decoder code normally should not duplicate
+ * generic width/height overflow checks before ff_get_buffer(); add local
+ * checks only for codec-specific derived sizes or complexity bounds.
 */
 int ff_set_dimensions(AVCodecContext *s, int width, int height);

@@ -101,15 +101,16 @@ static int dfpwm_dec_frame(struct AVCodecContext *ctx, AVFrame *frame,
 {
    DFPWMState *state = ctx->priv_data;
    int ret;
+    uint64_t nb_samples = packet->size * 8LL / ctx->ch_layout.nb_channels;

    if (packet->size * 8LL % ctx->ch_layout.nb_channels)
        return AVERROR_PATCHWELCOME;

-    frame->nb_samples = packet->size * 8LL / ctx->ch_layout.nb_channels;
-    if (frame->nb_samples <= 0) {
+    if (nb_samples > INT_MAX || !nb_samples) {
        av_log(ctx, AV_LOG_ERROR, "invalid number of samples in packet\n");
        return AVERROR_INVALIDDATA;
    }
+    frame->nb_samples = nb_samples;

    if ((ret = ff_get_buffer(ctx, frame, 0)) < 0)
        return ret;
@@ -60,7 +60,7 @@ static int dvdsub_parse(AVCodecParserContext *s,
        pc->packet = av_malloc(pc->packet_len + AV_INPUT_BUFFER_PADDING_SIZE);
    }
    if (pc->packet) {
-        if (pc->packet_index + buf_size <= pc->packet_len) {
+        if (buf_size <= pc->packet_len - pc->packet_index) {
            memcpy(pc->packet + pc->packet_index, buf, buf_size);
            pc->packet_index += buf_size;
            if (pc->packet_index >= pc->packet_len) {
@@ -125,7 +125,7 @@ static av_cold int escape130_decode_init(AVCodecContext *avctx)
        return AVERROR_INVALIDDATA;
    }

-    s->old_y_avg = av_malloc(avctx->width * avctx->height / 4);
+    s->old_y_avg = av_mallocz(avctx->width * avctx->height / 4);
    s->buf1      = av_malloc(avctx->width * avctx->height * 3 / 2);
    s->buf2      = av_malloc(avctx->width * avctx->height * 3 / 2);
    if (!s->old_y_avg || !s->buf1 || !s->buf2) {
@@ -637,6 +637,9 @@ static int piz_uncompress(const EXRContext *s, const uint8_t *src, int ssize,
                               max_non_zero - min_non_zero + 1);
    memset(td->bitmap + max_non_zero + 1, 0, BITMAP_SIZE - max_non_zero - 1);

+    if (bytestream2_get_bytes_left(&gb) < 4)
+        return AVERROR_INVALIDDATA;
+
    maxval = reverse_lut(td->bitmap, td->lut);

    bytestream2_skip(&gb, 4);
@@ -241,7 +241,7 @@ static int vulkan_encode_ffv1_submit_frame(AVCodecContext *avctx,
    if (maxsize < fv->max_heap_size) {
        out_buf_flags = VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT;
        /* If we can't map host memory, we can't let the GPU copy its buffer. */
-        if (!fv->s.extensions & FF_VK_EXT_EXTERNAL_HOST_MEMORY)
+        if (!(fv->s.extensions & FF_VK_EXT_EXTERNAL_HOST_MEMORY))
            out_buf_flags |= VK_MEMORY_PROPERTY_HOST_VISIBLE_BIT;
    } else {
        out_buf_flags = VK_MEMORY_PROPERTY_HOST_VISIBLE_BIT |
@@ -145,7 +145,7 @@ static int decode_registered_user_data_closed_caption(H2645SEIA53Caption *h,
 static int decode_registered_user_data(H2645SEI *h, GetByteContext *gb,
                                       enum AVCodecID codec_id, void *logctx)
 {
-    int country_code, provider_code;
+    int country_code, provider_code = -1;

    if (bytestream2_get_bytes_left(gb) < 3)
        return AVERROR_INVALIDDATA;
@@ -159,92 +159,128 @@ static int decode_registered_user_data(H2645SEI *h, GetByteContext *gb,
    }

    /* itu_t_t35_payload_byte follows */
-    provider_code = bytestream2_get_be16u(gb);

-    if (country_code == ITU_T_T35_COUNTRY_CODE_US && provider_code == ITU_T_T35_PROVIDER_CODE_ATSC) {
-        uint32_t user_identifier;
+    switch (country_code) {
+    case ITU_T_T35_COUNTRY_CODE_US:
+        provider_code = bytestream2_get_be16u(gb);

-        if (bytestream2_get_bytes_left(gb) < 4)
-            return AVERROR_INVALIDDATA;
+        switch (provider_code) {
+        case ITU_T_T35_PROVIDER_CODE_ATSC: {
+            uint32_t user_identifier;

-        user_identifier = bytestream2_get_be32u(gb);
-        switch (user_identifier) {
-        case MKBETAG('D', 'T', 'G', '1'):       // afd_data
-            return decode_registered_user_data_afd(&h->afd, gb);
-        case MKBETAG('G', 'A', '9', '4'):       // closed captions
-            return decode_registered_user_data_closed_caption(&h->a53_caption, gb);
-        default:
-            av_log(logctx, AV_LOG_VERBOSE,
-                   "Unsupported User Data Registered ITU-T T35 SEI message (atsc user_identifier = 0x%04x)\n",
-                   user_identifier);
+            if (bytestream2_get_bytes_left(gb) < 4)
+                return AVERROR_INVALIDDATA;
+
+            user_identifier = bytestream2_get_be32u(gb);
+            switch (user_identifier) {
+            case MKBETAG('D', 'T', 'G', '1'):       // afd_data
+                return decode_registered_user_data_afd(&h->afd, gb);
+            case MKBETAG('G', 'A', '9', '4'):       // closed captions
+                return decode_registered_user_data_closed_caption(&h->a53_caption, gb);
+            default:
+                av_log(logctx, AV_LOG_VERBOSE,
+                       "Unsupported User Data Registered ITU-T T35 SEI message (atsc user_identifier = 0x%04x)\n",
+                       user_identifier);
+                break;
+            }
            break;
        }
-    } else if (country_code == ITU_T_T35_COUNTRY_CODE_UK && provider_code == ITU_T_T35_PROVIDER_CODE_VNOVA) {
+#if CONFIG_HEVC_SEI
+        case ITU_T_T35_PROVIDER_CODE_AOM: {
+            const uint16_t aom_grain_provider_oriented_code = 0x0001;
+            uint16_t provider_oriented_code;
+
+            if (!IS_HEVC(codec_id))
+                break;
+
+            if (bytestream2_get_bytes_left(gb) < 2)
+                return AVERROR_INVALIDDATA;
+
+            provider_oriented_code = bytestream2_get_byteu(gb);
+            if (provider_oriented_code == aom_grain_provider_oriented_code) {
+                return ff_aom_parse_film_grain_sets(&h->aom_film_grain,
+                                                    gb->buffer,
+                                                    bytestream2_get_bytes_left(gb));
+            }
+            break;
+        }
+        case ITU_T_T35_PROVIDER_CODE_SAMSUNG: {
+            // A/341 Amendment - 2094-40
+            const uint16_t smpte2094_40_provider_oriented_code = 0x0001;
+            const uint8_t smpte2094_40_application_identifier = 0x04;
+            uint16_t provider_oriented_code;
+            uint8_t application_identifier;
+
+            if (!IS_HEVC(codec_id))
+                break;
+
+            if (bytestream2_get_bytes_left(gb) < 3)
+                return AVERROR_INVALIDDATA;
+
+            provider_oriented_code = bytestream2_get_be16u(gb);
+            application_identifier = bytestream2_get_byteu(gb);
+            if (provider_oriented_code == smpte2094_40_provider_oriented_code &&
+                application_identifier == smpte2094_40_application_identifier) {
+                return decode_registered_user_data_dynamic_hdr_plus(&h->dynamic_hdr_plus, gb);
+            }
+            break;
+        }
+#endif
+        default:
+            break;
+        }
+        break;
+    case ITU_T_T35_COUNTRY_CODE_UK:
+        bytestream2_skipu(gb, 1); // t35_uk_country_code_second_octet
        if (bytestream2_get_bytes_left(gb) < 2)
            return AVERROR_INVALIDDATA;

-        bytestream2_skipu(gb, 1); // user_data_type_code
-        return decode_registered_user_data_lcevc(&h->lcevc, gb);
-    }
+        provider_code = bytestream2_get_be16u(gb);
+
+        switch (provider_code) {
+        case ITU_T_T35_PROVIDER_CODE_VNOVA:
+            if (bytestream2_get_bytes_left(gb) < 2)
+                return AVERROR_INVALIDDATA;
+
+            return decode_registered_user_data_lcevc(&h->lcevc, gb);
+        default:
+            break;
+        }
+        break;
 #if CONFIG_HEVC_SEI
-    else if (country_code == ITU_T_T35_COUNTRY_CODE_CN && provider_code == ITU_T_T35_PROVIDER_CODE_HDR_VIVID) {
+    case ITU_T_T35_COUNTRY_CODE_CN: {
        const uint16_t cuva_provider_oriented_code = 0x0005;
        uint16_t provider_oriented_code;

-        if (!IS_HEVC(codec_id))
-            goto unsupported_provider_code;
+        provider_code = bytestream2_get_be16u(gb);

-        if (bytestream2_get_bytes_left(gb) < 2)
-            return AVERROR_INVALIDDATA;
+        switch (provider_code) {
+        case ITU_T_T35_PROVIDER_CODE_HDR_VIVID:
+            if (!IS_HEVC(codec_id))
+                break;

-        provider_oriented_code = bytestream2_get_be16u(gb);
-        if (provider_oriented_code == cuva_provider_oriented_code) {
-            return decode_registered_user_data_dynamic_hdr_vivid(&h->dynamic_hdr_vivid, gb);
-        }
-    } else if(country_code == ITU_T_T35_COUNTRY_CODE_US && provider_code == ITU_T_T35_PROVIDER_CODE_SAMSUNG) {
-        // A/341 Amendment - 2094-40
-        const uint16_t smpte2094_40_provider_oriented_code = 0x0001;
-        const uint8_t smpte2094_40_application_identifier = 0x04;
-        uint16_t provider_oriented_code;
-        uint8_t application_identifier;
-
-        if (!IS_HEVC(codec_id))
-            goto unsupported_provider_code;
-
-        if (bytestream2_get_bytes_left(gb) < 3)
-            return AVERROR_INVALIDDATA;
-
-        provider_oriented_code = bytestream2_get_be16u(gb);
-        application_identifier = bytestream2_get_byteu(gb);
-        if (provider_oriented_code == smpte2094_40_provider_oriented_code &&
-            application_identifier == smpte2094_40_application_identifier) {
-            return decode_registered_user_data_dynamic_hdr_plus(&h->dynamic_hdr_plus, gb);
-        }
-    } else if (country_code == ITU_T_T35_COUNTRY_CODE_US && provider_code == ITU_T_T35_PROVIDER_CODE_AOM) {
-        const uint16_t aom_grain_provider_oriented_code = 0x0001;
-        uint16_t provider_oriented_code;
-
-        if (!IS_HEVC(codec_id))
-            goto unsupported_provider_code;
-
-        if (bytestream2_get_bytes_left(gb) < 2)
-            return AVERROR_INVALIDDATA;
-
-        provider_oriented_code = bytestream2_get_byteu(gb);
-        if (provider_oriented_code == aom_grain_provider_oriented_code) {
-            return ff_aom_parse_film_grain_sets(&h->aom_film_grain,
-                                                gb->buffer,
-                                                bytestream2_get_bytes_left(gb));
+            if (bytestream2_get_bytes_left(gb) < 2)
+                return AVERROR_INVALIDDATA;
+
+            provider_oriented_code = bytestream2_get_be16u(gb);
+            if (provider_oriented_code == cuva_provider_oriented_code) {
+                return decode_registered_user_data_dynamic_hdr_vivid(&h->dynamic_hdr_vivid, gb);
+            }
+            break;
+        default:
+            break;
        }
+        break;
    }
 #endif
-    else {
-        unsupported_provider_code:
-        av_log(logctx, AV_LOG_VERBOSE,
-               "Unsupported User Data Registered ITU-T T35 SEI message (country_code = %d, provider_code = %d)\n",
-               country_code, provider_code);
+    default:
+        break;
    }

+    av_log(logctx, AV_LOG_VERBOSE,
+           "Unsupported User Data Registered ITU-T T35 SEI message (country_code = %d, provider_code = %d)\n",
+           country_code, provider_code);
+
    return 0;
 }

@@ -121,26 +121,30 @@ void ff_h264_direct_ref_list_init(const H264Context *const h, H264SliceContext *
 {
    H264Ref *const ref1 = &sl->ref_list[1][0];
    H264Picture *const cur = h->cur_pic_ptr;
-    int list, j, field;
+    int list, field;
    int sidx     = (h->picture_structure & 1) ^ 1;
    int ref1sidx = (ref1->reference      & 1) ^ 1;

-    for (list = 0; list < sl->list_count; list++) {
-        cur->ref_count[sidx][list] = sl->ref_count[list];
-        for (j = 0; j < sl->ref_count[list]; j++)
-            cur->ref_poc[sidx][list][j] = 4 * sl->ref_list[list][j].parent->frame_num +
-                                          (sl->ref_list[list][j].reference & 3);
-    }
+    /* Updates to cur_pic are not safe once ff_thread_finish_setup() has been
+     * called (other threads may already be reading these fields). */
+    if (!h->setup_finished) {
+        for (list = 0; list < sl->list_count; list++) {
+            cur->ref_count[sidx][list] = sl->ref_count[list];
+            for (int j = 0; j < sl->ref_count[list]; j++)
+                cur->ref_poc[sidx][list][j] = 4 * sl->ref_list[list][j].parent->frame_num +
+                                                 (sl->ref_list[list][j].reference & 3);
+        }

-    if (h->picture_structure == PICT_FRAME) {
-        memcpy(cur->ref_count[1], cur->ref_count[0], sizeof(cur->ref_count[0]));
-        memcpy(cur->ref_poc[1],   cur->ref_poc[0],   sizeof(cur->ref_poc[0]));
-    }
+        if (h->picture_structure == PICT_FRAME) {
+            memcpy(cur->ref_count[1], cur->ref_count[0], sizeof(cur->ref_count[0]));
+            memcpy(cur->ref_poc[1],   cur->ref_poc[0],   sizeof(cur->ref_poc[0]));
+        }

-    if (h->current_slice == 0) {
-        cur->mbaff = FRAME_MBAFF(h);
-    } else {
-        av_assert0(cur->mbaff == FRAME_MBAFF(h));
+        if (h->current_slice == 0) {
+            cur->mbaff = FRAME_MBAFF(h);
+        } else {
+            av_assert0(cur->mbaff == FRAME_MBAFF(h));
+        }
    }

    sl->col_fieldoff = 0;
@@ -156,8 +156,7 @@ static void h264_initialise_ref_list(H264Context *h, H264SliceContext *sl)
                                  h->long_ref, 16, 1, h->picture_structure);
            av_assert0(len <= 32);

-            if (len < sl->ref_count[list])
-                memset(&sl->ref_list[list][len], 0, sizeof(H264Ref) * (sl->ref_count[list] - len));
+            memset(&sl->ref_list[list][len], 0, sizeof(H264Ref) * (32 - len));
            lens[list] = len;
        }

@@ -178,8 +177,7 @@ static void h264_initialise_ref_list(H264Context *h, H264SliceContext *sl)
                              h-> long_ref, 16, 1, h->picture_structure);
        av_assert0(len <= 32);

-        if (len < sl->ref_count[0])
-            memset(&sl->ref_list[0][len], 0, sizeof(H264Ref) * (sl->ref_count[0] - len));
+        memset(&sl->ref_list[0][len], 0, sizeof(H264Ref) * (32 - len));
    }
 #ifdef TRACE
    for (int i = 0; i < sl->ref_count[0]; i++) {
@@ -1949,8 +1949,7 @@ static int h264_slice_init(H264Context *h, H264SliceContext *sl,

    if (sl->slice_type_nos == AV_PICTURE_TYPE_B && !sl->direct_spatial_mv_pred)
        ff_h264_direct_dist_scale_factor(h, sl);
-    if (!h->setup_finished)
-        ff_h264_direct_ref_list_init(h, sl);
+    ff_h264_direct_ref_list_init(h, sl);

    if (h->avctx->skip_loop_filter >= AVDISCARD_ALL ||
        (h->avctx->skip_loop_filter >= AVDISCARD_NONKEY &&
@@ -1979,6 +1978,12 @@ static int h264_slice_init(H264Context *h, H264SliceContext *sl,
                          h->ps.pps->chroma_qp_index_offset[1]) +
                   6 * (h->ps.sps->bit_depth_luma - 8);

+    // slice_table is uint16_t initialized to 0xFFFF as a sentinel.
+    if (h->current_slice >= 0xFFFE) {
+        av_log(h->avctx, AV_LOG_ERROR, "Too many slices (%d)\n", h->current_slice + 1);
+        return AVERROR_PATCHWELCOME;
+    }
+
    sl->slice_num       = ++h->current_slice;

    if (sl->slice_num)
@@ -1280,6 +1280,9 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id,
        sps->bit_depth             = rf->bit_depth_luma;
        sps->width                 = rf->pic_width_in_luma_samples;
        sps->height                = rf->pic_height_in_luma_samples;
+        if ((ret = av_image_check_size(sps->width,
+                                       sps->height, 0, avctx)) < 0)
+            return ret;

        sps->pic_conf_win.left_offset   = rf->conf_win_left_offset;
        sps->pic_conf_win.right_offset  = rf->conf_win_right_offset;
@@ -162,7 +162,10 @@ static HEVCFrame *alloc_frame(HEVCContext *s, HEVCLayerContext *l)
        if (ret < 0)
            goto fail;

-        frame->rpl = av_refstruct_allocz(s->pkt.nb_nals * sizeof(*frame->rpl));
+        size_t rpl_bytes;
+        if (av_size_mult(s->pkt.nb_nals, sizeof(*frame->rpl), &rpl_bytes) < 0)
+            goto fail;
+        frame->rpl = av_refstruct_allocz(rpl_bytes);
        if (!frame->rpl)
            goto fail;
        frame->nb_rpl_elems = s->pkt.nb_nals;
@@ -30,10 +30,8 @@
 // - CN providers
 #define ITU_T_T35_PROVIDER_CODE_HDR_VIVID    0x0004
 // - UK providers
-// V-Nova should be 0x5000 according to UK Register of Manufacturer Codes
 // https://www.cix.co.uk/~bpechey/H221/h221code.htm
-// but FFmpeg has been using 0x0050
-#define ITU_T_T35_PROVIDER_CODE_VNOVA        0x0050
+#define ITU_T_T35_PROVIDER_CODE_VNOVA        0x5000
 // - US providers
 #define ITU_T_T35_PROVIDER_CODE_ATSC         0x0031
 #define ITU_T_T35_PROVIDER_CODE_DOLBY        0x003B
@@ -0,0 +1,42 @@
+/*
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#ifndef AVCODEC_LCEVC_PARSE_H
+#define AVCODEC_LCEVC_PARSE_H
+
+#include <stdint.h>
+
+#include "get_bits.h"
+
+static inline uint64_t get_mb(GetBitContext *s) {
+    int more, i = 0;
+    uint64_t mb = 0;
+
+    do {
+        int byte = get_bits(s, 8);
+        unsigned bits = byte & 0x7f;
+        more = byte & 0x80;
+        mb = (mb << 7) | bits;
+        if (++i == 10)
+            break;
+    } while (more);
+
+    return mb;
+}
+
+#endif /* AVCODEC_LCEVC_PARSE_H */
@@ -25,6 +25,8 @@
 #include "get_bits.h"
 #include "h2645_parse.h"
 #include "lcevc.h"
+#include "lcevc_parse.h"
+#include "lcevctab.h"
 #include "parser.h"
 #include "parser_internal.h"

@@ -81,41 +83,6 @@ static const enum AVPixelFormat pix_fmts[4][4] = {
      AV_PIX_FMT_YUV422P14, AV_PIX_FMT_YUV444P14, },
 };

-static const struct {
-    int width;
-    int height;
-} resolution_type_lut[63] = {
-    { 0, 0},
-    { 360,  200 },  { 400,  240 },  { 480,  320 },  { 640,  360 },
-    { 640,  480 },  { 768,  480 },  { 800,  600 },  { 852,  480 },
-    { 854,  480 },  { 856,  480 },  { 960,  540 },  { 960,  640 },
-    { 1024, 576 },  { 1024, 600 },  { 1024, 768 },  { 1152, 864 },
-    { 1280, 720 },  { 1280, 800 },  { 1280, 1024 }, { 1360, 768 },
-    { 1366, 768 },  { 1920, 1200 }, { 2048, 1080 }, { 2048, 1152 },
-    { 2048, 1536 }, { 2160, 1440 }, { 2560, 1440 }, { 2560, 1600 },
-    { 2560, 2048 }, { 3200, 1800 }, { 3200, 2048 }, { 3200, 2400 },
-    { 3440, 1440 }, { 3840, 1600 }, { 3840, 2160 }, { 3840, 2400 },
-    { 4096, 2160 }, { 4096, 3072 }, { 5120, 2880 }, { 5120, 3200 },
-    { 5120, 4096 }, { 6400, 4096 }, { 6400, 4800 }, { 7680, 4320 },
-    { 7680, 4800 },
-};
-
-static inline uint64_t get_mb(GetBitContext *s) {
-    int more, i = 0;
-    uint64_t mb = 0;
-
-    do {
-        int byte = get_bits(s, 8);
-        unsigned bits = byte & 0x7f;
-        more = byte & 0x80;
-        mb = (mb << 7) | bits;
-        if (++i == 10)
-            break;
-    } while (more);
-
-    return mb;
-}
-
 static int parse_nal_unit(AVCodecParserContext *s, AVCodecContext *avctx,
                          const H2645NAL *nal)
 {
@@ -125,10 +92,13 @@ static int parse_nal_unit(AVCodecParserContext *s, AVCodecContext *avctx,

    while (bytestream2_get_bytes_left(&gbc) > 1) {
        GetBitContext gb;
-        int payload_size_type, payload_type, payload_size;
+        uint64_t payload_size;
+        int payload_size_type, payload_type;
        int block_size;

-        init_get_bits8(&gb, gbc.buffer, bytestream2_get_bytes_left(&gbc));
+        int ret = init_get_bits8(&gb, gbc.buffer, bytestream2_get_bytes_left(&gbc));
+        if (ret < 0)
+            return ret;

        payload_size_type = get_bits(&gb, 3);
        payload_type      = get_bits(&gb, 5);
@@ -138,6 +108,9 @@ static int parse_nal_unit(AVCodecParserContext *s, AVCodecContext *avctx,
        if (payload_size_type == 7)
            payload_size = get_mb(&gb);

+        if (payload_size > INT_MAX - (get_bits_count(&gb) >> 3))
+            return AVERROR_INVALIDDATA;
+
        block_size = payload_size + (get_bits_count(&gb) >> 3);
        if (block_size >= bytestream2_get_bytes_left(&gbc))
            return AVERROR_INVALIDDATA;
@@ -161,8 +134,8 @@ static int parse_nal_unit(AVCodecParserContext *s, AVCodecContext *avctx,
            s->format = pix_fmts[bit_depth][chroma_format_idc];

            if (resolution_type < 63) {
-                s->width  = resolution_type_lut[resolution_type].width;
-                s->height = resolution_type_lut[resolution_type].height;
+                s->width  = ff_lcevc_resolution_type[resolution_type].width;
+                s->height = ff_lcevc_resolution_type[resolution_type].height;
            } else {
                int upsample_type, tile_dimensions_type;
                int temporal_step_width_modifier_signalled_flag, level1_filtering_signalled_flag;
@@ -23,8 +23,12 @@
 #include "libavutil/mem.h"
 #include "libavutil/refstruct.h"

+#include "cbs.h"
+#include "cbs_lcevc.h"
 #include "decode.h"
+#include "lcevc_parse.h"
 #include "lcevcdec.h"
+#include "lcevctab.h"

 static LCEVC_ColorFormat map_format(int format)
 {
@@ -191,6 +195,15 @@ static int generate_output(void *logctx, FFLCEVCFrame *frame_ctx, AVFrame *out)
    out->width = desc.width + out->crop_left + out->crop_right;
    out->height = desc.height + out->crop_top + out->crop_bottom;

+    av_log(logctx, AV_LOG_DEBUG, "out PTS %"PRId64", %dx%d, "
+                                 "%zu/%zu/%zu/%zu, "
+                                 "SAR %d:%d, "
+                                 "hasEnhancement %d, enhanced %d\n",
+           out->pts, out->width, out->height,
+           out->crop_top, out->crop_bottom, out->crop_left, out->crop_right,
+           out->sample_aspect_ratio.num, out->sample_aspect_ratio.den,
+           info.hasEnhancement, info.enhanced);
+
    res = LCEVC_FreePicture(lcevc->decoder, picture);
    if (res != LCEVC_Success)
        return AVERROR_EXTERNAL;
@@ -256,6 +269,10 @@ static void lcevc_free(AVRefStructOpaque unused, void *obj)
        lcevc_flush_pictures(lcevc);
        LCEVC_DestroyDecoder(lcevc->decoder);
    }
+    if (lcevc->frag)
+        ff_cbs_fragment_free(lcevc->frag);
+    av_freep(&lcevc->frag);
+    ff_cbs_close(&lcevc->cbc);
    memset(lcevc, 0, sizeof(*lcevc));
 }

@@ -313,14 +330,74 @@ int ff_lcevc_process(void *logctx, AVFrame *frame)
    return 0;
 }

-int ff_lcevc_alloc(FFLCEVCContext **plcevc)
+int ff_lcevc_parse_frame(FFLCEVCContext *lcevc, const AVFrame *frame,
+                         int *width, int *height, void *logctx)
+{
+    LCEVCRawProcessBlock *block = NULL;
+    LCEVCRawGlobalConfig *gc = NULL;
+    AVFrameSideData *sd = av_frame_get_side_data(frame, AV_FRAME_DATA_LCEVC);
+    int ret;
+
+    ret = ff_cbs_read(lcevc->cbc, lcevc->frag, sd->buf, sd->data, sd->size);
+    if (ret < 0) {
+        av_log(logctx, AV_LOG_ERROR, "Failed to parse Access Unit.\n");
+        goto end;
+    }
+
+    ret = ff_cbs_lcevc_find_process_block(lcevc->cbc, lcevc->frag,
+                                          LCEVC_PAYLOAD_TYPE_GLOBAL_CONFIG, &block);
+    if (ret < 0) {
+        ret = 0;
+        goto end;
+    }
+
+    gc = block->payload;
+    if (gc->resolution_type < 63) {
+        *width  = ff_lcevc_resolution_type[gc->resolution_type].width;
+        *height = ff_lcevc_resolution_type[gc->resolution_type].height;
+    } else {
+        *width  = gc->custom_resolution_width;
+        *height = gc->custom_resolution_height;
+    }
+
+    ret = 0;
+end:
+    ff_cbs_fragment_reset(lcevc->frag);
+
+    return ret;
+}
+
+static const CodedBitstreamUnitType decompose_unit_types[] = {
+    LCEVC_IDR_NUT,
+};
+
+int ff_lcevc_alloc(FFLCEVCContext **plcevc, void *logctx)
 {
    FFLCEVCContext *lcevc = NULL;
+    int ret;
+
    lcevc = av_refstruct_alloc_ext(sizeof(*lcevc), 0, NULL, lcevc_free);
    if (!lcevc)
        return AVERROR(ENOMEM);
+
+    lcevc->frag = av_mallocz(sizeof(*lcevc->frag));
+    if (!lcevc->frag) {
+        ret = AVERROR(ENOMEM);
+        goto fail;
+    }
+
+    ret = ff_cbs_init(&lcevc->cbc, AV_CODEC_ID_LCEVC, logctx);
+    if (ret < 0)
+        goto fail;
+
+    lcevc->cbc->decompose_unit_types    = decompose_unit_types;
+    lcevc->cbc->nb_decompose_unit_types = FF_ARRAY_ELEMS(decompose_unit_types);
+
    *plcevc = lcevc;
    return 0;
+fail:
+    av_refstruct_unref(&lcevc);
+    return ret;
 }

 void ff_lcevc_unref(void *opaque)
@@ -28,8 +28,13 @@
 typedef uintptr_t LCEVC_DecoderHandle;
 #endif

+struct CodedBitstreamContext;
+struct CodedBitstreamFragment;
+
 typedef struct FFLCEVCContext {
    LCEVC_DecoderHandle decoder;
+    struct CodedBitstreamContext *cbc;
+    struct CodedBitstreamFragment *frag;
    int initialized;
 } FFLCEVCContext;

@@ -40,7 +45,9 @@ typedef struct FFLCEVCFrame {
    struct AVFrame *frame;
 } FFLCEVCFrame;

-int ff_lcevc_alloc(FFLCEVCContext **plcevc);
+int ff_lcevc_alloc(FFLCEVCContext **plcevc, void *logctx);
 int ff_lcevc_process(void *logctx, struct AVFrame *frame);
+int ff_lcevc_parse_frame(FFLCEVCContext *lcevc, const struct AVFrame *frame,
+                         int *width, int *height, void *logctx);
 void ff_lcevc_unref(void *opaque);
 #endif /* AVCODEC_LCEVCDEC_H */
@@ -0,0 +1,19 @@
+/*
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include "lcevctab.h"
@@ -0,0 +1,41 @@
+/*
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#ifndef AVCODEC_LCEVCTAB_H
+#define AVCODEC_LCEVCTAB_H
+
+static const struct {
+    int width;
+    int height;
+} ff_lcevc_resolution_type[63] = {
+    { 0, 0},
+    { 360,  200 },  { 400,  240 },  { 480,  320 },  { 640,  360 },
+    { 640,  480 },  { 768,  480 },  { 800,  600 },  { 852,  480 },
+    { 854,  480 },  { 856,  480 },  { 960,  540 },  { 960,  640 },
+    { 1024, 576 },  { 1024, 600 },  { 1024, 768 },  { 1152, 864 },
+    { 1280, 720 },  { 1280, 800 },  { 1280, 1024 }, { 1360, 768 },
+    { 1366, 768 },  { 1920, 1200 }, { 2048, 1080 }, { 2048, 1152 },
+    { 2048, 1536 }, { 2160, 1440 }, { 2560, 1440 }, { 2560, 1600 },
+    { 2560, 2048 }, { 3200, 1800 }, { 3200, 2048 }, { 3200, 2400 },
+    { 3440, 1440 }, { 3840, 1600 }, { 3840, 2160 }, { 3840, 2400 },
+    { 4096, 2160 }, { 4096, 3072 }, { 5120, 2880 }, { 5120, 3200 },
+    { 5120, 4096 }, { 6400, 4096 }, { 6400, 4800 }, { 7680, 4320 },
+    { 7680, 4800 },
+};
+
+#endif /* AVCODEC_LCEVCTAB_H */
@@ -175,7 +175,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
    int height = avctx->height; // Real image height
    unsigned int mszh_dlen;
    unsigned char yq, y1q, uq, vq;
-    int uqvq, ret;
+    int ret;
    unsigned int mthread_inlen, mthread_outlen;
    unsigned int len = buf_size;
    int linesize, offset;
@@ -306,7 +306,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
            for (row = 0; row < height; row++) {
                pixel_ptr = row * width * 3;
                yq = encoded[pixel_ptr++];
-                uqvq = AV_RL16(encoded+pixel_ptr);
+                unsigned uqvq = AV_RL16(encoded+pixel_ptr);
                pixel_ptr += 2;
                for (col = 1; col < width; col++) {
                    encoded[pixel_ptr] = yq -= encoded[pixel_ptr];
@@ -90,6 +90,8 @@ static int lz4_decompress(AVCodecContext *avctx,
            unsigned char current;
            do {
                current = bytestream2_get_byte(gb);
+                if (current > INT_MAX - num_literals)
+                    return AVERROR_INVALIDDATA;
                num_literals += current;
            } while (current == 255);
        }
@@ -122,6 +124,8 @@ static int lz4_decompress(AVCodecContext *avctx,

            do {
                current = bytestream2_get_byte(gb);
+                if (current > INT_MAX - match_length)
+                    return AVERROR_INVALIDDATA;
                match_length += current;
            } while (current == 255);
        }
@@ -463,6 +463,8 @@ int ff_celt_decode_frame(CeltFrame *f, OpusRangeCoder *rc,
                                                  block->emph_coeff,
                                                  ff_opus_deemph_weights,
                                                  frame_size);
+        if (!isnormal(block->emph_coeff))
+            block->emph_coeff = 0.0;
    }

    if (channels == 1)
@@ -77,6 +77,9 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
        return AVERROR_INVALIDDATA;
    }

+    if (avpkt->size * 1032LL < ((avctx->width + 7) >> 3) * avctx->height) //Asymptotic max compression of deflate
+        return AVERROR_INVALIDDATA;
+
    if ((ret = ff_get_buffer(avctx, frame, AV_GET_BUFFER_FLAG_REF)) < 0)
        return ret;

@@ -558,7 +558,7 @@ static int decode_text_to_exif(PNGDecContext *s, const char *txt_utf8)
    }

    // first condition checks for overflow in 2 * exif_len
-    if ((exif_len & ~SIZE_MAX) || end - ptr < 2 * exif_len)
+    if (exif_len > SIZE_MAX / 2 || end - ptr < 2 * exif_len)
        return AVERROR_INVALIDDATA;
    if (exif_len < 10)
        return AVERROR_INVALIDDATA;
@@ -403,6 +403,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
        dst->hwaccel_flags = src->hwaccel_flags;

        av_refstruct_replace(&dst->internal->pool, src->internal->pool);
+        ff_decode_internal_sync(dst, src);
    }

    if (for_user) {
@@ -157,6 +157,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
    if (ctx->max_frame_size > (1 << 20) || !ctx->max_frame_size) {
        av_log(avctx, AV_LOG_ERROR, "invalid frame size %d\n",
               ctx->max_frame_size);
+        return AVERROR_INVALIDDATA;
    }
    ctx->max_frame_size = FFMAX(ctx->max_frame_size, avctx->sample_rate);

@@ -51,6 +51,8 @@ typedef struct RASCContext {
    GetByteContext  gb;
    uint8_t        *delta;
    int             delta_size;
+    uint8_t        *mv_scratch;
+    unsigned int    mv_scratch_size;
    uint8_t        *cursor;
    int             cursor_size;
    unsigned        cursor_w;
@@ -294,10 +296,8 @@ static int decode_move(AVCodecContext *avctx,
                b2 -= s->frame2->linesize[0];
            }
        } else if (type == 0) {
-            uint8_t *buffer;
-
-            av_fast_padded_malloc(&s->delta, &s->delta_size, w * h * s->bpp);
-            buffer = s->delta;
+            av_fast_padded_malloc(&s->mv_scratch, &s->mv_scratch_size, w * h * s->bpp);
+            uint8_t *buffer = s->mv_scratch;
            if (!buffer)
                return AVERROR(ENOMEM);

@@ -772,6 +772,8 @@ static av_cold int decode_close(AVCodecContext *avctx)
    s->cursor_size = 0;
    av_freep(&s->delta);
    s->delta_size = 0;
+    av_freep(&s->mv_scratch);
+    s->mv_scratch_size = 0;
    av_frame_free(&s->frame1);
    av_frame_free(&s->frame2);
    ff_inflate_end(&s->zstream);
@@ -696,6 +696,11 @@ static int svq1_decode_frame(AVCodecContext *avctx, AVFrame *cur,
        avctx->skip_frame >= AVDISCARD_ALL)
        return buf_size;

+    // Reject obviously too-small packets early: require at least one remaining bit per aligned luma macroblock.
+    // FFALIGN(s->width,  16) * FFALIGN(s->height, 16) / 256 represent the number of Macroblocks
+    if (get_bits_left(&s->gb) < FFALIGN(s->width,  16) * FFALIGN(s->height, 16) / 256)
+        return AVERROR_INVALIDDATA;
+
    result = ff_get_buffer(avctx, cur, s->nonref ? 0 : AV_GET_BUFFER_FLAG_REF);
    if (result < 0)
        return result;
@@ -240,7 +240,6 @@ static int tdsc_load_cursor(AVCodecContext *avctx)
                    bits <<= 1;
                }
            }
-            dst += ctx->cursor_stride - ctx->cursor_w * 4;
        }

        dst = ctx->cursor;
@@ -272,7 +271,6 @@ static int tdsc_load_cursor(AVCodecContext *avctx)
                    bits <<= 1;
                }
            }
-            dst += ctx->cursor_stride - ctx->cursor_w * 4;
        }
        break;
    case CUR_FMT_BGRA:
@@ -358,7 +356,8 @@ static int tdsc_decode_jpeg_tile(AVCodecContext *avctx, int tile_size,
    }

    ret = avcodec_receive_frame(ctx->jpeg_avctx, ctx->jpgframe);
-    if (ret < 0 || ctx->jpgframe->format != AV_PIX_FMT_YUVJ420P) {
+    if (ret < 0 || ctx->jpgframe->format != AV_PIX_FMT_YUVJ420P ||
+        w > ctx->jpgframe->width || h > ctx->jpgframe->height) {
        av_log(avctx, AV_LOG_ERROR,
               "JPEG decoding error (%d).\n", ret);

@@ -402,7 +401,7 @@ static int tdsc_decode_tiles(AVCodecContext *avctx, int number_tiles)
        }

        tile_size = bytestream2_get_le32(&ctx->gbc);
-        if (bytestream2_get_bytes_left(&ctx->gbc) < tile_size)
+        if (bytestream2_get_bytes_left(&ctx->gbc) < tile_size + 24LL)
            return AVERROR_INVALIDDATA;

        tile_mode = bytestream2_get_le32(&ctx->gbc);
@@ -435,6 +434,9 @@ static int tdsc_decode_tiles(AVCodecContext *avctx, int number_tiles)
            if (ret < 0)
                return ret;
        } else if (tile_mode == MKTAG(' ','W','A','R')) {
+            if (3LL * w * h > tile_size)
+                return AVERROR_INVALIDDATA;
+
            /* Just copy the buffer to output */
            av_image_copy_plane(ctx->refframe->data[0] + x * 3 +
                                ctx->refframe->linesize[0] * y,
@@ -30,7 +30,7 @@
 #include "version_major.h"

 #define LIBAVCODEC_VERSION_MINOR  28
-#define LIBAVCODEC_VERSION_MICRO 100
+#define LIBAVCODEC_VERSION_MICRO 101

 #define LIBAVCODEC_VERSION_INT  AV_VERSION_INT(LIBAVCODEC_VERSION_MAJOR, \
                                               LIBAVCODEC_VERSION_MINOR, \
@@ -83,7 +83,7 @@ CFDataRef ff_videotoolbox_vpcc_extradata_create(AVCodecContext *avctx)
    p = vt_extradata;

    *p++ = 1; /* version */
-    AV_WB24(p + 1, 0); /* flags */
+    AV_WB24(p, 0); /* flags */
    p += 3;

   *p++ = h->h.profile;
@@ -2150,7 +2150,7 @@ static int copy_replace_length_codes(
            uint8_t *new_sei;
            old_sei_length = find_sei_end(avctx, dst_box, box_len, &new_sei);
            if (old_sei_length < 0)
-                return status;
+                return old_sei_length;

            wrote_bytes = write_sei(sei,
                                    SEI_TYPE_USER_DATA_REGISTERED_ITU_T_T35,
@@ -255,8 +255,10 @@ static int update_size(AVCodecContext *avctx, int w, int h)
        *fmtp = AV_PIX_FMT_NONE;

        ret = ff_get_format(avctx, pix_fmts);
-        if (ret < 0)
+        if (ret < 0) {
+            ff_set_dimensions(avctx, s->w, s->h);
            return ret;
+        }

        avctx->pix_fmt = ret;
        s->gf_fmt  = s->pix_fmt;
@@ -1825,6 +1827,7 @@ finish:

    return pkt->size;
 fail:
+    ff_cbs_fragment_reset(&s->current_frag);
    ff_progress_frame_report(&s->s.frames[CUR_FRAME].tf, INT_MAX);
    return ret;
 }
@@ -751,6 +751,8 @@ av_cold int ff_vulkan_encode_init(AVCodecContext *avctx, FFVulkanEncodeContext *

    VkVideoFormatPropertiesKHR *ret_info;
    uint32_t nb_out_fmts = 0;
+    const uint32_t feedback_flags = VK_VIDEO_ENCODE_FEEDBACK_BITSTREAM_BUFFER_OFFSET_BIT_KHR |
+                                    VK_VIDEO_ENCODE_FEEDBACK_BITSTREAM_BYTES_WRITTEN_BIT_KHR;

    VkPhysicalDeviceVideoEncodeQualityLevelInfoKHR quality_info;

@@ -770,6 +772,14 @@ av_cold int ff_vulkan_encode_init(AVCodecContext *avctx, FFVulkanEncodeContext *
        return AVERROR(EINVAL);
    }

+    if ((ctx->enc_caps.supportedEncodeFeedbackFlags & feedback_flags) !=
+        feedback_flags) {
+        av_log (avctx, AV_LOG_ERROR,
+                "Driver does not support required encode feedback flags "
+                "(BUFFER_OFFSET and BYTES_WRITTEN).\n");
+        return AVERROR(ENOTSUP);
+    }
+
    ctx->base.op = &vulkan_base_encode_ops;
    ctx->codec = codec;

@@ -879,8 +889,7 @@ av_cold int ff_vulkan_encode_init(AVCodecContext *avctx, FFVulkanEncodeContext *
    query_create = (VkQueryPoolVideoEncodeFeedbackCreateInfoKHR) {
        .sType = VK_STRUCTURE_TYPE_QUERY_POOL_VIDEO_ENCODE_FEEDBACK_CREATE_INFO_KHR,
        .pNext = &ctx->profile,
-        .encodeFeedbackFlags = ctx->enc_caps.supportedEncodeFeedbackFlags &
-                               (~VK_VIDEO_ENCODE_FEEDBACK_BITSTREAM_HAS_OVERRIDES_BIT_KHR),
+        .encodeFeedbackFlags = feedback_flags,
    };
    err = ff_vk_exec_pool_init(s, ctx->qf_enc, &ctx->enc_pool, base_ctx->async_depth,
                               1, VK_QUERY_TYPE_VIDEO_ENCODE_FEEDBACK_KHR, 0,
@@ -65,14 +65,14 @@ static av_cold int encode_init(AVCodecContext *avctx)
    flags1 = 0;
    flags2 = 1;
    if (avctx->codec->id == AV_CODEC_ID_WMAV1) {
-        extradata             = av_malloc(4);
+        extradata             = av_mallocz(4 + AV_INPUT_BUFFER_PADDING_SIZE);
        if (!extradata)
            return AVERROR(ENOMEM);
        avctx->extradata_size = 4;
        AV_WL16(extradata, flags1);
        AV_WL16(extradata + 2, flags2);
    } else if (avctx->codec->id == AV_CODEC_ID_WMAV2) {
-        extradata             = av_mallocz(10);
+        extradata             = av_mallocz(10 + AV_INPUT_BUFFER_PADDING_SIZE);
        if (!extradata)
            return AVERROR(ENOMEM);
        avctx->extradata_size = 10;
@@ -343,6 +343,8 @@ static int parse_mb_skip(WMV2DecContext *w)
                    mb_type[mb_y * h->c.mb_stride + mb_x] =
                        MB_TYPE_SKIP | MB_TYPE_16x16 | MB_TYPE_FORWARD_MV;
            } else {
+                if (get_bits_left(&h->gb) < h->c.mb_width)
+                    return AVERROR_INVALIDDATA;
                for (int mb_x = 0; mb_x < h->c.mb_width; mb_x++)
                    mb_type[mb_y * h->c.mb_stride + mb_x] =
                        (get_bits1(&h->gb) ? MB_TYPE_SKIP : 0) | MB_TYPE_16x16 | MB_TYPE_FORWARD_MV;
@@ -358,6 +360,8 @@ static int parse_mb_skip(WMV2DecContext *w)
                    mb_type[mb_y * h->c.mb_stride + mb_x] =
                        MB_TYPE_SKIP | MB_TYPE_16x16 | MB_TYPE_FORWARD_MV;
            } else {
+                if (get_bits_left(&h->gb) < h->c.mb_height)
+                    return AVERROR_INVALIDDATA;
                for (int mb_y = 0; mb_y < h->c.mb_height; mb_y++)
                    mb_type[mb_y * h->c.mb_stride + mb_x] =
                        (get_bits1(&h->gb) ? MB_TYPE_SKIP : 0) | MB_TYPE_16x16 | MB_TYPE_FORWARD_MV;
@@ -68,7 +68,7 @@ static av_cold int xan_decode_init(AVCodecContext *avctx)
    }

    s->buffer_size = avctx->width * avctx->height;
-    s->y_buffer = av_malloc(s->buffer_size);
+    s->y_buffer = av_mallocz(s->buffer_size);
    if (!s->y_buffer)
        return AVERROR(ENOMEM);
    s->scratch_buffer = av_malloc(s->buffer_size + 130);
@@ -138,6 +138,8 @@ static int zmbv_decode_xor_8(ZmbvContext *c)
            }

            if (d) { /* apply XOR'ed difference */
+                if (c->decomp_len - (src - c->decomp_buf) < bw2 * bh2)
+                    return AVERROR_INVALIDDATA;
                out = output + x;
                for (j = 0; j < bh2; j++) {
                    for (i = 0; i < bw2; i++)
@@ -212,6 +214,8 @@ static int zmbv_decode_xor_16(ZmbvContext *c)
            }

            if (d) { /* apply XOR'ed difference */
+                if (c->decomp_len - (src - c->decomp_buf) < bw2 * bh2 * 2)
+                    return AVERROR_INVALIDDATA;
                out = output + x;
                for (j = 0; j < bh2; j++){
                    for (i = 0; i < bw2; i++) {
@@ -296,6 +300,8 @@ static int zmbv_decode_xor_24(ZmbvContext *c)
            }

            if (d) { /* apply XOR'ed difference */
+                if (c->decomp_len - (src - c->decomp_buf) < bw2 * bh2 * 3)
+                    return AVERROR_INVALIDDATA;
                out = output + x * 3;
                for (j = 0; j < bh2; j++) {
                    for (i = 0; i < bw2; i++) {
@@ -374,6 +380,8 @@ static int zmbv_decode_xor_32(ZmbvContext *c)
            }

            if (d) { /* apply XOR'ed difference */
+                if (c->decomp_len - (src - c->decomp_buf) < bw2 * bh2 * 4)
+                    return AVERROR_INVALIDDATA;
                out = output + x;
                for (j = 0; j < bh2; j++){
                    for (i = 0; i < bw2; i++) {
@@ -568,8 +576,10 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
        frame->pict_type = AV_PICTURE_TYPE_P;
        if (c->decomp_len < 2LL * ((c->width + c->bw - 1) / c->bw) * ((c->height + c->bh - 1) / c->bh))
            return AVERROR_INVALIDDATA;
-        if (c->decomp_len)
-            c->decode_xor(c);
+        if (c->decomp_len) {
+            if ((ret = c->decode_xor(c)) < 0)
+                return ret;
+        }
    }

    /* update frames */
@@ -30,7 +30,7 @@
 #include "version_major.h"

 #define LIBAVDEVICE_VERSION_MINOR   3
-#define LIBAVDEVICE_VERSION_MICRO 100
+#define LIBAVDEVICE_VERSION_MICRO 101

 #define LIBAVDEVICE_VERSION_INT AV_VERSION_INT(LIBAVDEVICE_VERSION_MAJOR, \
                                               LIBAVDEVICE_VERSION_MINOR, \
@@ -74,6 +74,7 @@ typedef struct LV2Context {
    float *controls;

    LilvInstance *instance;
+    int           instance_activated;

    LilvNode  *atom_AtomPort;
    LilvNode  *atom_Sequence;
@@ -387,6 +388,9 @@ static int config_output(AVFilterLink *outlink)
        inlink->min_samples = inlink->max_samples = 4096;
    }

+    lilv_instance_activate(s->instance);
+    s->instance_activated = 1;
+
    return 0;
 }

@@ -562,6 +566,8 @@ static av_cold void uninit(AVFilterContext *ctx)
 {
    LV2Context *s = ctx->priv;

+    if (s->instance_activated)
+        lilv_instance_deactivate(s->instance);
    lilv_node_free(s->powerOf2BlockLength);
    lilv_node_free(s->fixedBlockLength);
    lilv_node_free(s->boundedBlockLength);
@@ -70,7 +70,7 @@ static int parse_channel_name(char **arg, int *rchannel, int *rnamed)

    skip_spaces(arg);
    /* try to parse a channel name, e.g. "FL" */
-    if (sscanf(*arg, "%7[A-Z]%n", buf, &len)) {
+    if (sscanf(*arg, "%7[A-Z]%n", buf, &len) >= 1) {
        channel_id = av_channel_from_string(buf);
        if (channel_id < 0)
            return channel_id;
@@ -81,7 +81,7 @@ static int parse_channel_name(char **arg, int *rchannel, int *rnamed)
        return 0;
    }
    /* try to parse a channel number, e.g. "c2" */
-    if (sscanf(*arg, "c%d%n", &channel_id, &len) &&
+    if (sscanf(*arg, "c%d%n", &channel_id, &len) >= 1 &&
        channel_id >= 0 && channel_id < MAX_CHANNELS) {
        *rchannel = channel_id;
        *rnamed = 0;
@@ -32,7 +32,7 @@
 #include "version_major.h"

 #define LIBAVFILTER_VERSION_MINOR  14
-#define LIBAVFILTER_VERSION_MICRO 100
+#define LIBAVFILTER_VERSION_MICRO 101


 #define LIBAVFILTER_VERSION_INT AV_VERSION_INT(LIBAVFILTER_VERSION_MAJOR, \
@@ -77,11 +77,20 @@ static int filter_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs)
            uint8_t *next = &yadif->next->data[td->plane][y * linesize];
            uint8_t *dst  = &td->frame->data[td->plane][y * td->frame->linesize[td->plane]];
            if (yadif->current_field == YADIF_FIELD_END) {
-                s->dsp.filter_intra(dst, cur, td->w, (y + df) < td->h ? refs : -refs,
-                                y > (df - 1) ? -refs : refs,
-                                (y + 3*df) < td->h ? 3 * refs : -refs,
-                                y > (3*df - 1) ? -3 * refs : refs,
-                                td->parity ^ td->tff, clip_max);
+                if ((y < 3) || ((y + 3) >= td->h)) {
+                    s->dsp.filter_edge(dst, prev, cur, next, td->w,
+                                   (y + df) < td->h ? refs : -refs,
+                                   y > (df - 1) ? -refs : refs,
+                                   refs << 1, -(refs << 1),
+                                   td->parity ^ td->tff, clip_max,
+                                   (y < 2) || ((y + 3) > td->h) ? 0 : 1);
+                } else {
+                    s->dsp.filter_intra(dst, cur, td->w, (y + df) < td->h ? refs : -refs,
+                                    y > (df - 1) ? -refs : refs,
+                                    (y + 3*df) < td->h ? 3 * refs : -refs,
+                                    y > (3*df - 1) ? -3 * refs : refs,
+                                    td->parity ^ td->tff, clip_max);
+                }
            } else if ((y < 4) || ((y + 5) > td->h)) {
                s->dsp.filter_edge(dst, prev, cur, next, td->w,
                               (y + df) < td->h ? refs : -refs,
@@ -266,9 +266,22 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *frame)
            if (par->nb_blocks) {
                for (int block_idx = 0; block_idx < par->nb_blocks; block_idx++) {
                    AVVideoBlockParams *b = av_video_enc_params_block(par, block_idx);
-                    uint8_t *buf = frame->data[0] + b->src_y * stride;

-                    draw_block_rectangle(buf, b->src_x, b->src_y, b->w, b->h, stride, 100);
+                    int64_t x0 = b->src_x;
+                    int64_t y0 = b->src_y;
+                    int64_t x1 = x0 + b->w;
+                    int64_t y1 = y0 + b->h;
+
+                    x0 = FFMAX(x0, 0);
+                    y0 = FFMAX(y0, 0);
+                    x1 = FFMIN(x1, frame->width);
+                    y1 = FFMIN(y1, frame->height);
+
+                    if (x1 <= x0 || y1 <= y0)
+                        continue;
+
+                    uint8_t *buf = frame->data[0] + y0 * stride;
+                    draw_block_rectangle(buf, x0, y0, x1-x0, y1-y0, stride, 100);
                }
            }
        }
@@ -1435,8 +1435,13 @@ continue_on_failed:
    }

    s->line_count = line_count;
-    s->lines = av_mallocz(line_count * sizeof(TextLine));
-    s->tab_clusters = av_mallocz(s->tab_count * sizeof(uint32_t));
+    s->lines = av_calloc(line_count, sizeof(TextLine));
+    s->tab_clusters = av_calloc(s->tab_count, sizeof(uint32_t));
+    if ((line_count > 0 && !s->lines) ||
+        (s->tab_count > 0 && !s->tab_clusters)) {
+        ret = AVERROR(ENOMEM);
+        goto done;
+    }
    for (i = 0; i < s->tab_count; ++i) {
        s->tab_clusters[i] = -1;
    }
@@ -1452,13 +1457,14 @@ continue_on_failed:
            s->tab_clusters[tab_idx++] = i;
            *p = ' ';
        }
+        size_t len = p - start;
        GET_UTF8(code, *p ? *p++ : 0, code = 0xfffd; goto continue_on_failed2;);
 continue_on_failed2:
        if (ff_is_newline(code) || code == 0) {
            TextLine *cur_line = &s->lines[line_count];
            HarfbuzzData *hb = &cur_line->hb_data;
            cur_line->cluster_offset = line_offset;
-            ret = shape_text_hb(s, hb, start, p - start);
+            ret = shape_text_hb(s, hb, start, len);
            if (ret != 0) {
                goto done;
            }
@@ -85,6 +85,12 @@ static int config_props(AVFilterLink *inlink)

    kerndeint->is_packed_rgb = av_pix_fmt_desc_get(inlink->format)->flags & AV_PIX_FMT_FLAG_RGB;
    kerndeint->vsub = desc->log2_chroma_h;
+    if (AV_CEIL_RSHIFT(inlink->h, kerndeint->vsub) < 4) {
+        av_log(inlink->dst, AV_LOG_ERROR,
+               "Input height %d is too small; minimum chroma plane height is 4\n",
+               inlink->h);
+        return AVERROR(EINVAL);
+    }

    ret = av_image_alloc(kerndeint->tmp_data, kerndeint->tmp_linesize,
                         inlink->w, inlink->h, inlink->format, 16);
@@ -667,14 +667,22 @@ static void lock_queue(void *priv, uint32_t qf, uint32_t qidx)
 {
    AVHWDeviceContext *avhwctx = priv;
    const AVVulkanDeviceContext *hwctx = avhwctx->hwctx;
+#if FF_API_VULKAN_SYNC_QUEUES
+FF_DISABLE_DEPRECATION_WARNINGS
    hwctx->lock_queue(avhwctx, qf, qidx);
+FF_ENABLE_DEPRECATION_WARNINGS
+#endif
 }

 static void unlock_queue(void *priv, uint32_t qf, uint32_t qidx)
 {
    AVHWDeviceContext *avhwctx = priv;
    const AVVulkanDeviceContext *hwctx = avhwctx->hwctx;
+#if FF_API_VULKAN_SYNC_QUEUES
+FF_DISABLE_DEPRECATION_WARNINGS
    hwctx->unlock_queue(avhwctx, qf, qidx);
+FF_ENABLE_DEPRECATION_WARNINGS
+#endif
 }
 #endif

@@ -1034,10 +1034,16 @@ generate_eye_tape_map(SSIM360Context *s,
    float x_range = end_x - start_x;

    // Ensure tape length is a multiple of 4, for full SSIM block coverage
-    int tape_length = s->tape_length[plane] = ((int)ROUNDED_DIV(x_range, 4)) << 2;
+    float tape_length_f = ROUNDED_DIV(x_range, 4);
+    int tape_length;

-    s->ref_tape_map[plane][eye]  = av_malloc_array(tape_length * 8, sizeof(BilinearMap));
-    s->main_tape_map[plane][eye] = av_malloc_array(tape_length * 8, sizeof(BilinearMap));
+    if (!(tape_length_f > 0.f) || tape_length_f > INT_MAX / 4.0f)
+        return AVERROR(EINVAL);
+
+    tape_length = s->tape_length[plane] = (int)tape_length_f << 2;
+
+    s->ref_tape_map[plane][eye]  = av_malloc_array(tape_length, 8 * sizeof(BilinearMap));
+    s->main_tape_map[plane][eye] = av_malloc_array(tape_length, 8 * sizeof(BilinearMap));
    if (!s->ref_tape_map[plane][eye] || !s->main_tape_map[plane][eye])
        return AVERROR(ENOMEM);

@@ -291,7 +291,7 @@ static int remap##ws##_##bits##bit_slice(AVFilterContext *ctx, void *arg, int jo
                                                                                                           \
    av_assert1(s->nb_planes <= AV_VIDEO_MAX_PLANES);                                                       \
                                                                                                           \
-    for (int stereo = 0; stereo < 1 + s->out_stereo > STEREO_2D; stereo++) {                               \
+    for (int stereo = 0; stereo < 1 + (s->out_stereo > STEREO_2D); stereo++) {                               \
        for (int plane = 0; plane < s->nb_planes; plane++) {                                               \
            const unsigned map = s->map[plane];                                                            \
            const int in_linesize  = in->linesize[plane];                                                  \
@@ -23,6 +23,7 @@
 #include "libavutil/dict.h"
 #include "libavutil/mem.h"
 #include "avformat.h"
+#include "avio_internal.h"
 #include "demux.h"
 #include "internal.h"
 #include "pcm.h"
@@ -368,9 +369,10 @@ static int aiff_read_header(AVFormatContext *s)
                    if (len == 11 && size > 11) {
                        uint8_t chunk[11];

-                        ret = avio_read(pb, chunk, 11);
-                        if (ret > 0)
-                            size -= ret;
+                        ret = ffio_read_size(pb, chunk, 11);
+                        if (ret < 0)
+                            return ret;
+                        size -= ret;
                        if (!memcmp(chunk, "VADPCMCODES", sizeof(chunk))) {
                            if ((ret = ff_get_extradata(s, st->codecpar, pb, size)) < 0)
                                return ret;
@@ -562,9 +562,11 @@ static int avi_read_header(AVFormatContext *s)
                    avi->movi_end = avi->fsize;
                av_log(s, AV_LOG_TRACE, "movi end=%"PRIx64"\n", avi->movi_end);
                goto end_of_header;
-            } else if (tag1 == MKTAG('I', 'N', 'F', 'O'))
+            } else if (tag1 == MKTAG('I', 'N', 'F', 'O')) {
+                if (size < 4)
+                    return AVERROR_INVALIDDATA;
                ff_read_riff_info(s, size - 4);
-            else if (tag1 == MKTAG('n', 'c', 'd', 't'))
+            } else if (tag1 == MKTAG('n', 'c', 'd', 't'))
                avi_read_nikon(s, list_end);

            break;
@@ -1834,6 +1836,10 @@ static int avi_load_index(AVFormatContext *s)
            avi->index_loaded=2;
            ret = 0;
        }else if (tag == MKTAG('L', 'I', 'S', 'T')) {
+            if (size < 4) {
+                av_log(s, AV_LOG_WARNING, "Invalid size (%u) LIST in index\n", size);
+                break;
+            }
            uint32_t tag1 = avio_rl32(pb);

            if (tag1 == MKTAG('I', 'N', 'F', 'O'))
@@ -566,6 +566,8 @@ static int read_seek(AVFormatContext *s, int stream_index,
        frame_cnt  = caf->frames_per_packet * packet_cnt - st->codecpar->initial_padding;
    } else if (sti->nb_index_entries) {
        packet_cnt = av_index_search_timestamp(st, timestamp, flags);
+        if (packet_cnt < 0)
+            return -1;
        frame_cnt  = sti->index_entries[packet_cnt].timestamp;
        pos        = sti->index_entries[packet_cnt].pos;
    } else {
@@ -113,6 +113,12 @@ static av_cold int concat_open(URLContext *h, const char *uri, int flags)
            break;
        }

+        if (total_size > INT64_MAX - size) {
+            ffurl_close(uc);
+            err = AVERROR_INVALIDDATA;
+            break;
+        }
+
        /* assembling */
        nodes[i].uc   = uc;
        nodes[i].size = size;
@@ -282,6 +288,12 @@ static av_cold int concatf_open(URLContext *h, const char *uri, int flags)
            break;
        }

+        if (total_size > INT64_MAX - size) {
+            ffurl_close(uc);
+            err = AVERROR_INVALIDDATA;
+            break;
+        }
+
        nodes = av_fast_realloc(data->nodes, &nodes_size, sizeof(*nodes) * len);
        if (!nodes) {
            ffurl_close(uc);
@@ -252,7 +252,7 @@ static int64_t get_duration(AVFormatContext *s)
    int64_t size = avio_size(s->pb);
    int64_t ret = 0;

-    if (start_pos + 20 > size)
+    if (start_pos < 0 || start_pos > size - 20)
        return 0;

    avio_skip(s->pb, 16);
@@ -26,6 +26,7 @@
 #include "avformat.h"
 #include "demux.h"
 #include "internal.h"
+#include "avio_internal.h"

 #define DSS_HEAD_OFFSET_AUTHOR        0xc
 #define DSS_AUTHOR_SIZE               16
@@ -339,7 +340,9 @@ static int dss_read_seek(AVFormatContext *s, int stream_index,
    if (ret < 0)
        return ret;

-    avio_read(s->pb, header, DSS_AUDIO_BLOCK_HEADER_SIZE);
+    ret = ffio_read_size(s->pb, header, DSS_AUDIO_BLOCK_HEADER_SIZE);
+    if (ret < 0)
+        return ret;
    ctx->swap = !!(header[0] & 0x80);
    offset = 2*header[1] + 2*ctx->swap;
    if (offset < DSS_AUDIO_BLOCK_HEADER_SIZE)
@@ -26,6 +26,7 @@
 #include "avformat.h"
 #include "demux.h"
 #include "internal.h"
+#include "avio_internal.h"

 #define AUPR_HDR 0x415550522D484452
 #define AUPRINFO 0x41555052494E464F
@@ -125,7 +126,11 @@ static int dtshd_read_header(AVFormatContext *s)
            value = av_malloc(chunk_size);
            if (!value)
                goto skip;
-            avio_read(pb, value, chunk_size);
+            ret = ffio_read_size(pb, value, chunk_size);
+            if (ret < 0) {
+                av_free(value);
+                goto skip;
+            }
            value[chunk_size - 1] = 0;
            av_dict_set(&s->metadata, "fileinfo", value,
                        AV_DICT_DONT_STRDUP_VAL);
@@ -88,6 +88,7 @@ void ff_hls_senc_read_audio_setup_info(HLSAudioSetupInfo *info, const uint8_t *b
        return;

    memcpy(info->setup_data, buf, info->setup_data_length);
+    memset(info->setup_data + info->setup_data_length, 0, AV_INPUT_BUFFER_PADDING_SIZE);
 }

 int ff_hls_senc_parse_audio_setup_info(AVStream *st, HLSAudioSetupInfo *info)
@@ -52,7 +52,7 @@ typedef struct HLSAudioSetupInfo {
    uint16_t            priming;
    uint8_t             version;
    uint8_t             setup_data_length;
-    uint8_t             setup_data[HLS_MAX_AUDIO_SETUP_DATA_LEN];
+    uint8_t             setup_data[HLS_MAX_AUDIO_SETUP_DATA_LEN + AV_INPUT_BUFFER_PADDING_SIZE];
 } HLSAudioSetupInfo;


@@ -118,6 +118,10 @@ static int hxvs_probe(const AVProbeData *p)
        i += 4;
        if (tag == HXVF || tag == HXAF) {
            bytes = AV_RL32(&p->buf[i]);
+
+            if (12 + bytes > INT_MAX - i)
+                return 0;
+
            i += 12 + bytes;
            flag |= (tag == HXVF) ? 2 : 4;
            continue;
@@ -38,7 +38,7 @@ static int opus_decoder_config(IAMFCodecConfig *codec_config,
 {
    int ret, left = len - avio_tell(pb);

-    if (left < 11 || codec_config->audio_roll_distance >= 0)
+    if (left < 11 || codec_config->audio_roll_distance >= 0 || left > INT_MAX - 8)
        return AVERROR_INVALIDDATA;

    codec_config->extradata = av_malloc(left + 8);
@@ -126,9 +126,14 @@ static int fill_codec_config(IAMFContext *iamf, const AVStreamGroup *stg,
    }
    populate_audio_roll_distance(codec_config);
    if (st->codecpar->extradata_size) {
-        codec_config->extradata = av_memdup(st->codecpar->extradata, st->codecpar->extradata_size);
+        if (st->codecpar->extradata_size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE)
+            return AVERROR_INVALIDDATA;
+
+        codec_config->extradata = av_malloc(st->codecpar->extradata_size + AV_INPUT_BUFFER_PADDING_SIZE);
        if (!codec_config->extradata)
            return AVERROR(ENOMEM);
+        memcpy(codec_config->extradata, st->codecpar->extradata, st->codecpar->extradata_size);
+        memset(codec_config->extradata + st->codecpar->extradata_size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
        codec_config->extradata_size = st->codecpar->extradata_size;
        ret = update_extradata(codec_config);
        if (ret < 0)
@@ -1237,15 +1242,17 @@ int ff_iamf_write_audio_frame(const IAMFContext *iamf, AVIOContext *pb,
                                                               AV_PKT_DATA_NEW_EXTRADATA,
                                                               &new_extradata_size);

-        if (!new_extradata)
+        if (!new_extradata || new_extradata_size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE)
            return AVERROR_INVALIDDATA;

        av_free(codec_config->extradata);
-        codec_config->extradata = av_memdup(new_extradata, new_extradata_size);
+        codec_config->extradata = av_malloc(new_extradata_size + AV_INPUT_BUFFER_PADDING_SIZE);
        if (!codec_config->extradata) {
            codec_config->extradata_size = 0;
            return AVERROR(ENOMEM);
        }
+        memcpy(codec_config->extradata, new_extradata, new_extradata_size);
+        memset(codec_config->extradata + new_extradata_size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
        codec_config->extradata_size = new_extradata_size;

        return update_extradata(codec_config);
@@ -2783,6 +2783,10 @@ static int mka_parse_audio_codec(MatroskaTrack *track, AVCodecParameters *par,
            par->block_align  = track->audio.sub_packet_size;
            *extradata_offset = 78;
        }
+        if (par->block_align <= 0 ||
+            track->audio.sub_packet_h * (unsigned)track->audio.frame_size > INT_MAX ||
+            track->audio.frame_size * track->audio.sub_packet_h < par->block_align)
+            return AVERROR_INVALIDDATA;
        track->audio.buf = av_malloc_array(track->audio.sub_packet_h,
                                            track->audio.frame_size);
        if (!track->audio.buf)
@@ -36,6 +36,7 @@
 #include "avformat.h"
 #include "demux.h"
 #include "internal.h"
+#include "avio_internal.h"
 #include "riff.h"

 #define MLV_VERSION "v2.0"
@@ -74,12 +75,15 @@ static int check_file_header(AVIOContext *pb, uint64_t guid)
 {
    unsigned int size;
    uint8_t version[8];
+    int ret;

    avio_skip(pb, 4);
    size = avio_rl32(pb);
    if (size < 52)
        return AVERROR_INVALIDDATA;
-    avio_read(pb, version, 8);
+    ret = ffio_read_size(pb, version, 8);
+    if (ret < 0)
+        return ret;
    if (memcmp(version, MLV_VERSION, 5) || avio_rl64(pb) != guid)
        return AVERROR_INVALIDDATA;
    avio_skip(pb, size - 24);
@@ -932,10 +932,9 @@ static int mov_read_iacb(MOVContext *c, AVIOContext *pb, MOVAtom atom)
        return AVERROR(ENOMEM);
    iamf = &sc->iamf->iamf;

-    st->codecpar->extradata = av_malloc(descriptors_size);
-    if (!st->codecpar->extradata)
-        return AVERROR(ENOMEM);
-    st->codecpar->extradata_size = descriptors_size;
+    ret = ff_alloc_extradata(st->codecpar, descriptors_size);
+    if (ret < 0)
+        return ret;

    ret = avio_read(pb, st->codecpar->extradata, descriptors_size);
    if (ret != descriptors_size)
@@ -3697,6 +3696,9 @@ static int mov_read_sdtp(MOVContext *c, AVIOContext *pb, MOVAtom atom)
    av_freep(&sc->sdtp_data);
    sc->sdtp_count = 0;

+    if (entries < 0 || entries > SIZE_MAX)
+        return AVERROR(ERANGE);
+
    sc->sdtp_data = av_malloc(entries);
    if (!sc->sdtp_data)
        return AVERROR(ENOMEM);
@@ -4327,7 +4329,12 @@ static void mov_fix_index(MOVContext *mov, AVStream *st)
               st->index, edit_list_index, edit_list_media_time, edit_list_duration);
        edit_list_index++;
        edit_list_dts_counter = edit_list_dts_entry_end;
-        edit_list_dts_entry_end += edit_list_duration;
+        edit_list_dts_entry_end = av_sat_add64(edit_list_dts_entry_end, edit_list_duration);
+        if (edit_list_dts_entry_end == INT64_MAX) {
+            av_log(mov->fc, AV_LOG_ERROR, "Cannot calculate dts entry length with duration %"PRId64"\n",
+                   edit_list_duration);
+            break;
+        }
        num_discarded_begin = 0;
        if (!found_non_empty_edit && edit_list_media_time == -1) {
            empty_edits_sum_duration += edit_list_duration;
@@ -8559,7 +8566,7 @@ static int mov_read_dops(MOVContext *c, AVIOContext *pb, MOVAtom atom)
        return 0;
    st = c->fc->streams[c->fc->nb_streams-1];

-    if ((uint64_t)atom.size > (1<<30) || atom.size < 11)
+    if ((uint64_t)atom.size > (1<<30) || atom.size < 11 || st->codecpar->extradata)
        return AVERROR_INVALIDDATA;

    /* Check OpusSpecificBox version. */
@@ -8577,7 +8584,11 @@ static int mov_read_dops(MOVContext *c, AVIOContext *pb, MOVAtom atom)
    AV_WL32A(st->codecpar->extradata, MKTAG('O','p','u','s'));
    AV_WL32A(st->codecpar->extradata + 4, MKTAG('H','e','a','d'));
    AV_WB8(st->codecpar->extradata + 8, 1); /* OpusHead version */
-    avio_read(pb, st->codecpar->extradata + 9, size - 9);
+    if ((ret = ffio_read_size(pb, st->codecpar->extradata + 9, size - 9)) < 0) {
+        av_freep(&st->codecpar->extradata);
+        st->codecpar->extradata_size = 0;
+        return ret;
+    }

    /* OpusSpecificBox is stored in big-endian, but OpusHead is
       little-endian; aside from the preceding magic and version they're
@@ -8665,8 +8676,10 @@ static int mov_read_lhvc(MOVContext *c, AVIOContext *pb, MOVAtom atom)
        // TODO: handle lhvC when present before hvcC
        return 0;

-    if (atom.size < 6 || st->codecpar->extradata_size < 23)
+    if (atom.size < 6 || st->codecpar->extradata_size < 23 ||
+        atom.size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) {
        return AVERROR_INVALIDDATA;
+    }

    buf = av_malloc(atom.size + AV_INPUT_BUFFER_PADDING_SIZE);
    if (!buf)
@@ -9199,6 +9212,13 @@ static int mov_read_iref_dimg(MOVContext *c, AVIOContext *pb, int version)
        return AVERROR_INVALIDDATA;
    }

+    entries = avio_rb16(pb);
+    if (!entries) {
+        av_log(c->fc, AV_LOG_ERROR,
+               "Derived image item references no input images\n");
+        return AVERROR_INVALIDDATA;
+    }
+
    grid = av_realloc_array(c->heif_grid, c->nb_heif_grid + 1U,
                            sizeof(*c->heif_grid));
    if (!grid)
@@ -9206,7 +9226,6 @@ static int mov_read_iref_dimg(MOVContext *c, AVIOContext *pb, int version)
    c->heif_grid = grid;
    grid = &grid[c->nb_heif_grid];

-    entries = avio_rb16(pb);
    grid->tile_id_list = av_malloc_array(entries, sizeof(*grid->tile_id_list));
    grid->tile_idx_list = av_calloc(entries, sizeof(*grid->tile_idx_list));
    grid->tile_item_list = av_calloc(entries, sizeof(*grid->tile_item_list));
@@ -10790,6 +10809,10 @@ static int mov_parse_lcevc_streams(AVFormatContext *s)
 {
    int err;

+    // Don't try to add a group if there's only one track
+    if (s->nb_streams <= 1)
+        return 0;
+
    for (int i = 0; i < s->nb_streams; i++) {
        AVStreamGroup *stg;
        AVStream *st = s->streams[i];
@@ -1041,10 +1041,10 @@ static int new_pes_packet(PESContext *pes, AVPacket *pkt)
                   "Invalid JPEG-XS header size %"PRIu32" > packet size %d\n",
                   header_size, pkt->size);
            pes->flags |= AV_PKT_FLAG_CORRUPT;
-            return AVERROR_INVALIDDATA;
+        } else {
+            pkt->data += header_size;
+            pkt->size -= header_size;
        }
-        pkt->data += header_size;
-        pkt->size -= header_size;
    }

    memset(pkt->data + pkt->size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
@@ -1703,7 +1703,7 @@ static int mp4_read_iods(AVFormatContext *s, const uint8_t *buf, unsigned size,

    ret = parse_mp4_descr(&d, avio_tell(&d.pb.pub), size, MP4IODescrTag);

-    *descr_count = d.descr_count;
+    *descr_count += d.descr_count;
    return ret;
 }

@@ -2614,7 +2614,7 @@ static void pmt_cb(MpegTSFilter *filter, const uint8_t *section, int section_len
            get8(&p, p_end); // label
            len -= 2;
            mp4_read_iods(ts->stream, p, len, mp4_descr + mp4_descr_count,
-                          &mp4_descr_count, MAX_MP4_DESCR_COUNT);
+                          &mp4_descr_count, MAX_MP4_DESCR_COUNT - mp4_descr_count);
        } else if (tag == REGISTRATION_DESCRIPTOR && len >= 4) {
            prog_reg_desc = bytestream_get_le32(&p);
            len -= 4;
@@ -74,7 +74,8 @@ int ff_pcm_read_seek(AVFormatContext *s,
                     int stream_index, int64_t timestamp, int flags)
 {
    AVStream *st;
-    int block_align, byte_rate;
+    int block_align;
+    int64_t byte_rate;
    int64_t pos, ret;

    st = s->streams[0];
@@ -82,9 +83,9 @@ int ff_pcm_read_seek(AVFormatContext *s,
    block_align = st->codecpar->block_align ? st->codecpar->block_align :
        (av_get_bits_per_sample(st->codecpar->codec_id) * st->codecpar->ch_layout.nb_channels) >> 3;
    byte_rate = st->codecpar->bit_rate ? st->codecpar->bit_rate >> 3 :
-        block_align * st->codecpar->sample_rate;
+        block_align * (int64_t)st->codecpar->sample_rate;

-    if (block_align <= 0 || byte_rate <= 0)
+    if (block_align <= 0 || byte_rate <= 0 || FFMAX(timestamp, st->time_base.num) > INT64_MAX / byte_rate)
        return -1;
    if (timestamp < 0) timestamp = 0;

@@ -93,6 +94,9 @@ int ff_pcm_read_seek(AVFormatContext *s,
                         st->time_base.num,
                         st->time_base.den * (int64_t)block_align,
                         (flags & AVSEEK_FLAG_BACKWARD) ? AV_ROUND_DOWN : AV_ROUND_UP);
+
+    if (pos > (INT64_MAX - FFMAX(ffformatcontext(s)->data_offset, 0)) / block_align)
+        return -1;
    pos *= block_align;

    /* recompute exact position */
@@ -22,6 +22,7 @@
 #include "libavutil/intreadwrite.h"
 #include "avformat.h"
 #include "avio.h"
+#include "avio_internal.h"
 #include "demux.h"
 #include "internal.h"

@@ -131,9 +132,9 @@ static int rsd_read_header(AVFormatContext *s)
            return ret;

        for (i = 0; i < par->ch_layout.nb_channels; i++) {
-            if (avio_feof(pb))
-                return AVERROR_EOF;
-            avio_read(s->pb, st->codecpar->extradata + 32 * i, 32);
+            ret = ffio_read_size(s->pb, st->codecpar->extradata + 32 * i, 32);
+            if (ret < 0)
+                return ret;
            avio_skip(s->pb, 8);
        }
        break;
@@ -1209,6 +1209,10 @@ static int rtmp_calc_swfhash(URLContext *s)
    if (!memcmp(in_data, "CWS", 3)) {
 #if CONFIG_ZLIB
        int64_t out_size;
+        if (in_size < 8) {
+            ret = AVERROR_INVALIDDATA;
+            goto fail;
+        }
        /* Decompress the SWF player file using Zlib. */
        if (!(out_data = av_malloc(8))) {
            ret = AVERROR(ENOMEM);
@@ -2269,9 +2273,14 @@ static int update_offset(RTMPContext *rt, int size)
 {
    int old_flv_size;

+    if (size < 0)
+        return AVERROR(EINVAL);
+
    // generate packet header and put data into buffer for FLV demuxer
    if (rt->flv_off < rt->flv_size) {
        // There is old unread data in the buffer, thus append at the end
+        if (rt->flv_size > INT_MAX - size)
+            return AVERROR(ERANGE);
        old_flv_size  = rt->flv_size;
        rt->flv_size += size;
    } else {
@@ -2298,7 +2307,11 @@ static int append_flv_data(RTMPContext *rt, RTMPPacket *pkt, int skip)
        rt->has_video = 1;
    }

+    if (size > INT_MAX - 15)
+        return AVERROR(ERANGE);
    old_flv_size = update_offset(rt, size + 15);
+    if (old_flv_size < 0)
+        return old_flv_size;

    if ((ret = av_reallocp(&rt->flv_data, rt->flv_size)) < 0) {
        rt->flv_size = rt->flv_off = 0;
@@ -2428,48 +2441,50 @@ static int rtmp_parse_result(URLContext *s, RTMPContext *rt, RTMPPacket *pkt)
 static int handle_metadata(RTMPContext *rt, RTMPPacket *pkt)
 {
    int ret, old_flv_size, type;
-    const uint8_t *next;
-    uint8_t *p;
+    PutByteContext pbc;
+    GetByteContext gbc;
    uint32_t size;
    uint32_t ts, cts, pts = 0;

    old_flv_size = update_offset(rt, pkt->size);
+    if (old_flv_size < 0)
+        return old_flv_size;

    if ((ret = av_reallocp(&rt->flv_data, rt->flv_size)) < 0) {
        rt->flv_size = rt->flv_off = 0;
        return ret;
    }

-    next = pkt->data;
-    p    = rt->flv_data + old_flv_size;
+    bytestream2_init(&gbc, pkt->data, pkt->size);
+    bytestream2_init_writer(&pbc, rt->flv_data, rt->flv_size);
+    bytestream2_skip_p(&pbc, old_flv_size);

    /* copy data while rewriting timestamps */
    ts = pkt->timestamp;

-    while (next - pkt->data < pkt->size - RTMP_HEADER) {
-        type = bytestream_get_byte(&next);
-        size = bytestream_get_be24(&next);
-        cts  = bytestream_get_be24(&next);
-        cts |= bytestream_get_byte(&next) << 24;
+    while (bytestream2_get_bytes_left(&gbc) > RTMP_HEADER) {
+        type = bytestream2_get_byte(&gbc);
+        size = bytestream2_get_be24(&gbc);
+        cts  = bytestream2_get_be24(&gbc);
+        cts |= bytestream2_get_byte(&gbc) << 24;
        if (!pts)
            pts = cts;
        ts += cts - pts;
        pts = cts;
-        if (size + 3 + 4 > pkt->data + pkt->size - next)
+        if (size + 3 + 4 > bytestream2_get_bytes_left(&gbc))
            break;
-        bytestream_put_byte(&p, type);
-        bytestream_put_be24(&p, size);
-        bytestream_put_be24(&p, ts);
-        bytestream_put_byte(&p, ts >> 24);
-        memcpy(p, next, size + 3 + 4);
-        p    += size + 3;
-        bytestream_put_be32(&p, size + RTMP_HEADER);
-        next += size + 3 + 4;
+        bytestream2_put_byte(&pbc, type);
+        bytestream2_put_be24(&pbc, size);
+        bytestream2_put_be24(&pbc, ts);
+        bytestream2_put_byte(&pbc, ts >> 24);
+        bytestream2_copy_buffer(&pbc, &gbc, size + 3);
+        bytestream2_skip(&gbc, 4);
+        bytestream2_put_be32(&pbc, size + RTMP_HEADER);
    }
-    if (p != rt->flv_data + rt->flv_size) {
+    if (bytestream2_tell_p(&pbc) != rt->flv_size) {
        av_log(rt, AV_LOG_WARNING, "Incomplete flv packets in "
                                     "RTMP_PT_METADATA packet\n");
-        rt->flv_size = p - rt->flv_data;
+        rt->flv_size = bytestream2_tell_p(&pbc);
    }

    return 0;
@@ -2736,7 +2751,8 @@ static int rtmp_open(URLContext *s, const char *uri, int flags, AVDictionary **o
        if (rt->listen)
            ff_url_join(buf, sizeof(buf), "tcp", NULL, hostname, port,
                        "?listen&listen_timeout=%d&tcp_nodelay=%d",
-                        rt->listen_timeout * 1000, rt->tcp_nodelay);
+                        rt->listen_timeout < 0 ? -1 : rt->listen_timeout * 1000,
+                        rt->tcp_nodelay);
        else
            ff_url_join(buf, sizeof(buf), "tcp", NULL, hostname, port, "?tcp_nodelay=%d", rt->tcp_nodelay);
    }
@@ -276,6 +276,12 @@ static int jpeg_parse_packet(AVFormatContext *ctx, PayloadContext *jpeg,
                av_log(ctx, AV_LOG_WARNING, "Only 8-bit precision is supported.\n");

            if (qtable_len > 0) {
+                if (qtable_len != 128) {
+                    av_log(ctx, AV_LOG_ERROR, "Invalid RTP/JPEG packet. Invalid qtable length %d.\n", qtable_len);
+                    if (qtable_len%64 || qtable_len > 4*64)
+                        return AVERROR_INVALIDDATA;
+                }
+
                if (len < qtable_len) {
                    av_log(ctx, AV_LOG_ERROR, "Too short RTP/JPEG packet.\n");
                    return AVERROR_INVALIDDATA;
@@ -73,11 +73,15 @@ static int latm_parse_packet(AVFormatContext *ctx, PayloadContext *data,
    cur_len = 0;
    while (data->pos < data->len) {
        uint8_t val = data->buf[data->pos++];
+        if (val > data->len - cur_len) {
+            av_log(ctx, AV_LOG_ERROR, "Malformed LATM packet\n");
+            return AVERROR_INVALIDDATA;
+        }
        cur_len += val;
        if (val != 0xff)
            break;
    }
-    if (data->pos + cur_len > data->len) {
+    if (cur_len > data->len - data->pos) {
        av_log(ctx, AV_LOG_ERROR, "Malformed LATM packet\n");
        return AVERROR(EIO);
    }
@@ -138,7 +138,7 @@ static int rtp_parse_mp4_au(PayloadContext *data, const uint8_t *buf, int len)
       length in bits */
    au_headers_length = AV_RB16(buf);

-    if (au_headers_length > RTP_MAX_PACKET_LENGTH)
+    if (au_headers_length == 0 || au_headers_length > RTP_MAX_PACKET_LENGTH)
      return -1;

    data->au_headers_length_bytes = (au_headers_length + 7) / 8;
@@ -186,8 +186,9 @@ static int qdm2_parse_subpacket(PayloadContext *qdm, AVStream *st,
 */
 static int qdm2_restore_block(PayloadContext *qdm, AVStream *st, AVPacket *pkt)
 {
-    int to_copy, n, res, include_csum;
+    int to_copy, n, res;
    uint8_t *p, *csum_pos = NULL;
+    int include_csum = qdm->block_type == 2 || qdm->block_type == 4;

    /* create packet to hold subpkts into a superblock */
    av_assert0(qdm->cache > 0);
@@ -196,6 +197,11 @@ static int qdm2_restore_block(PayloadContext *qdm, AVStream *st, AVPacket *pkt)
            break;
    av_assert0(n < 0x80);

+    int min_size = 2 + (qdm->len[n] > 0xff) + 2*include_csum;
+
+    if (qdm->block_size < min_size)
+        return AVERROR_INVALIDDATA;
+
    if ((res = av_new_packet(pkt, qdm->block_size)) < 0)
        return res;
    memset(pkt->data, 0, pkt->size);
@@ -211,7 +217,7 @@ static int qdm2_restore_block(PayloadContext *qdm, AVStream *st, AVPacket *pkt)
        *p++ = qdm->block_type;
        *p++ = qdm->len[n];
    }
-    if ((include_csum = (qdm->block_type == 2 || qdm->block_type == 4))) {
+    if (include_csum) {
        csum_pos = p;
        p       += 2;
    }
@@ -612,7 +612,8 @@ static void sdp_parse_line(AVFormatContext *s, SDPParseState *s1,
                             NULL, NULL, 0, p);
                if (proto[0] == '\0') {
                    /* relative control URL */
-                    if (rtsp_st->control_url[strlen(rtsp_st->control_url)-1]!='/')
+                    size_t len = strlen(rtsp_st->control_url);
+                    if (len == 0 || rtsp_st->control_url[len - 1] != '/')
                        av_strlcat(rtsp_st->control_url, "/",
                                   sizeof(rtsp_st->control_url));
                    av_strlcat(rtsp_st->control_url, p,
@@ -191,7 +191,7 @@ static int rtsp_read_announce(AVFormatContext *s)
        rtsp_send_reply(s, RTSP_STATUS_SERVICE, NULL, request.seq);
        return AVERROR_OPTION_NOT_FOUND;
    }
-    if (request.content_length) {
+    if (request.content_length > 0) {
        sdp = av_malloc(request.content_length + 1);
        if (!sdp)
            return AVERROR(ENOMEM);
@@ -215,10 +215,10 @@ static int rtsp_read_announce(AVFormatContext *s)
        return 0;
    }
    av_log(s, AV_LOG_ERROR,
-           "Content-Length header value exceeds sdp allocated buffer (4KB)\n");
+           "Invalid ANNOUNCE Content-Length %d\n", request.content_length);
    rtsp_send_reply(s, RTSP_STATUS_INTERNAL,
-                    "Content-Length exceeds buffer size", request.seq);
-    return AVERROR(EIO);
+                    "Invalid Content-Length", request.seq);
+    return AVERROR_INVALIDDATA;
 }

 static int rtsp_read_options(AVFormatContext *s)
@@ -32,7 +32,7 @@
 #include "version_major.h"

 #define LIBAVFORMAT_VERSION_MINOR  12
-#define LIBAVFORMAT_VERSION_MICRO 100
+#define LIBAVFORMAT_VERSION_MICRO 101

 #define LIBAVFORMAT_VERSION_INT AV_VERSION_INT(LIBAVFORMAT_VERSION_MAJOR, \
                                               LIBAVFORMAT_VERSION_MINOR, \
@@ -589,7 +589,9 @@ static int viv_read_header(AVFormatContext *s)
        block_type = avio_r8(pb);

        if (block_type == 22) {
-            avio_read(pb, keybuffer, 187);
+            ret = ffio_read_size(pb, keybuffer, 187);
+            if (ret < 0)
+                return ret;
            b22_key = decode_key(keybuffer);
            b22_size = avio_rl32(pb);
        }
@@ -694,7 +694,8 @@ static int64_t find_guid(AVIOContext *pb, const uint8_t guid1[16])
    int64_t size;

    while (!avio_feof(pb)) {
-        avio_read(pb, guid, 16);
+        if (avio_read(pb, guid, 16) != 16)
+            break;
        size = avio_rl64(pb);
        if (size <= 24 || size > INT64_MAX - 8)
            return AVERROR_INVALIDDATA;
@@ -1906,6 +1906,12 @@ static void handle_rtx_packet(AVFormatContext *s, uint16_t seq)
    ori_buf = it->buf;
    ori_size = it->size;

+    /* A valid RTP packet must have at least a RTP header. */
+    if (ori_size < WHIP_RTP_HEADER_SIZE) {
+        av_log(whip, AV_LOG_WARNING, "RTX history packet too small, size=%d\n", ori_size);
+        goto end;
+    }
+
    /* RTX packet format: header + original seq (2 bytes) + payload */
    if (ori_size + 2 > sizeof(rtx_buf)) {
        av_log(whip, AV_LOG_WARNING, "RTX packet is too large, size=%d\n", ori_size);
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .0.git
 .1.1