doc/t2h: Support texinfo 7.1 and 7.2 pretest

Here is a proposed patch for portability of doc/t2h.pm for GNU Texinfo 7.1 and 7.1.90 (7.2 pretest). I tested against 7.1 and 7.1.90 (7.2 pretest). There is a difference in the headings compared to the website version, maybe related to FA_ICONS not being set the same, but the result seems correct. I also renamed $element to $output_unit in ffmpeg_heading_command as in new equivalent makeinfo/texi2any code the $element variable is the $command variable in ffmpeg_heading_command, which is very confusing. I left as is the $command variable to have a patch easier to read, but it could make sense to rename $command as $element later on. The patch could also have effects with Texinfo 7.0, since some of the changes are for that version, but that probably never show up because it is for situations that may not exist in ffmpeg manuals (for example @node without sectioning command), or because the code is robust to some missing information (case of $heading_level in ffmpeg_heading_command that was not set, as far as I can tell). Signed-off-by: James Almer <jamrial@gmail.com> (cherry picked from commit 4d9cdf82ee)
Update for 6.1.6
2026-06-21 21:20:25 +02:00 · 2026-06-20 21:45:17 +02:00 · 2026-06-20 17:42:28 +02:00 · 2026-06-20 17:42:28 +02:00 · 2026-06-20 17:42:28 +02:00 · 2026-06-20 17:42:28 +02:00
728 changed files with 7097 additions and 2956 deletions
@@ -0,0 +1,23 @@
+exclude: ^tests/ref/
+
+repos:
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v5.0.0
+  hooks:
+    - id: check-case-conflict
+    - id: check-executables-have-shebangs
+    - id: check-illegal-windows-names
+    - id: check-shebang-scripts-are-executable
+    - id: check-yaml
+    - id: end-of-file-fixer
+    - id: fix-byte-order-marker
+    - id: mixed-line-ending
+    - id: trailing-whitespace
+- repo: local
+  hooks:
+    - id: aarch64-asm-indent
+      name: fix aarch64 assembly indentation
+      files: ^.*/aarch64/.*\.S$
+      language: script
+      entry: ./tools/check_arm_indent.sh --apply
+      pass_filenames: false
@@ -0,0 +1,29 @@
+name: Lint
+
+on:
+  push:
+    branches:
+      - release/6.1
+  pull_request:
+
+jobs:
+  lint:
+    name: Pre-Commit
+    runs-on: utilities
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Install pre-commit CI
+        id: install
+        run: |
+            python3 -m venv ~/pre-commit
+            ~/pre-commit/bin/pip install --upgrade pip setuptools
+            ~/pre-commit/bin/pip install pre-commit
+            echo "envhash=$({ python3 --version && cat .forgejo/pre-commit/config.yaml; } | sha256sum | cut -d' ' -f1)" >> $FORGEJO_OUTPUT
+      - name: Cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/pre-commit
+          key: pre-commit-${{ steps.install.outputs.envhash }}
+      - name: Run pre-commit CI
+        run: ~/pre-commit/bin/pre-commit run -c .forgejo/pre-commit/config.yaml --show-diff-on-failure --color=always --all-files
@@ -0,0 +1,80 @@
+name: Test
+
+on:
+  push:
+    branches:
+      - release/6.1
+  pull_request:
+
+jobs:
+  run_fate:
+    name: Fate (${{ matrix.runner }}, ${{ matrix.shared }}, ${{ matrix.bits }} bit)
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [linux-aarch64]
+        shared: ['static']
+        bits: ['64']
+        include:
+          - runner: linux-amd64
+            shared: 'static'
+            bits: '32'
+          - runner: linux-amd64
+            shared: 'shared'
+            bits: '64'
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Configure
+        run: |
+          ./configure --enable-gpl --enable-nonfree --enable-memory-poisoning --assert-level=2 \
+              $([ "${{ matrix.bits }}" != "32" ] || echo --arch=x86_32 --extra-cflags=-m32 --extra-cxxflags=-m32 --extra-ldflags=-m32) \
+              $([ "${{ matrix.shared }}" != "shared" ] || echo --enable-shared --disable-static) \
+              || CFGRES=$? && CFGRES=$?
+          cat ffbuild/config.log
+          exit $CFGRES
+      - name: Build
+        run: make -j$(nproc)
+      - name: Restore Cached Fate-Suite
+        id: cache
+        uses: actions/cache/restore@v4
+        with:
+          path: fate-suite
+          key: fate-suite
+          restore-keys: |
+            fate-suite-
+      - name: Sync Fate-Suite
+        id: fate
+        run: |
+          make fate-rsync SAMPLES=$PWD/fate-suite
+          echo "hash=$(find fate-suite -type f -printf "%P %s %T@\n" | sort | sha256sum | cut -d' ' -f1)" >> $FORGEJO_OUTPUT
+      - name: Cache Fate-Suite
+        uses: actions/cache/save@v4
+        if: ${{ format('fate-suite-{0}', steps.fate.outputs.hash) != steps.cache.outputs.cache-matched-key }}
+        with:
+          path: fate-suite
+          key: fate-suite-${{ steps.fate.outputs.hash }}
+      - name: Run Fate
+        run: LD_LIBRARY_PATH="$(printf "%s:" "$PWD"/lib*)$PWD" make fate fate-build SAMPLES=$PWD/fate-suite -j$(nproc)
+  compile_only:
+    name: Fate (Win64, Build-Only)
+    strategy:
+      fail-fast: false
+      matrix:
+        image: ["ghcr.io/btbn/ffmpeg-builds/win64-gpl-6.1:latest"]
+    runs-on: linux-amd64
+    container: ${{ matrix.image }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Configure
+        run: |
+          ./configure --pkg-config-flags="--static" $FFBUILD_TARGET_FLAGS $FF_CONFIGURE \
+              --cc="$CC" --cxx="$CXX" --ar="$AR" --ranlib="$RANLIB" --nm="$NM" \
+              --extra-cflags="$FF_CFLAGS" --extra-cxxflags="$FF_CXXFLAGS" \
+              --extra-libs="$FF_LIBS" --extra-ldflags="$FF_LDFLAGS" --extra-ldexeflags="$FF_LDEXEFLAGS"
+      - name: Build
+        run: make -j$(nproc)
+      - name: Run Fate
+        run: make -j$(nproc) fate-build
@@ -55,7 +55,7 @@ modified by someone else and passed on, the recipients should know
 that what they have is not the original version, so that the original
 author's reputation will not be affected by problems that might be
 introduced by others.
-
+
  Finally, software patents pose a constant threat to the existence of
 any free program.  We wish to make sure that a company cannot
 effectively restrict the users of a free program by obtaining a
@@ -111,7 +111,7 @@ modification follow.  Pay close attention to the difference between a
 "work based on the library" and a "work that uses the library".  The
 former contains code derived from the library, whereas the latter must
 be combined with the library in order to run.
-
+
                  GNU LESSER GENERAL PUBLIC LICENSE
   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION

@@ -158,7 +158,7 @@ Library.
  You may charge a fee for the physical act of transferring a copy,
 and you may at your option offer warranty protection in exchange for a
 fee.
-
+
  2. You may modify your copy or copies of the Library or any portion
 of it, thus forming a work based on the Library, and copy and
 distribute such modifications or work under the terms of Section 1
@@ -216,7 +216,7 @@ instead of to this License.  (If a newer version than version 2 of the
 ordinary GNU General Public License has appeared, then you can specify
 that version instead if you wish.)  Do not make any other change in
 these notices.
-
+
  Once this change is made in a given copy, it is irreversible for
 that copy, so the ordinary GNU General Public License applies to all
 subsequent copies and derivative works made from that copy.
@@ -267,7 +267,7 @@ Library will still fall under Section 6.)
 distribute the object code for the work under the terms of Section 6.
 Any executables containing that work also fall under Section 6,
 whether or not they are linked directly with the Library itself.
-
+
  6. As an exception to the Sections above, you may also combine or
 link a "work that uses the Library" with the Library to produce a
 work containing portions of the Library, and distribute that work
@@ -329,7 +329,7 @@ restrictions of other proprietary libraries that do not normally
 accompany the operating system.  Such a contradiction means you cannot
 use both them and the Library together in an executable that you
 distribute.
-
+
  7. You may place library facilities that are a work based on the
 Library side-by-side in a single library together with other library
 facilities not covered by this License, and distribute such a combined
@@ -370,7 +370,7 @@ subject to these terms and conditions.  You may not impose any further
 restrictions on the recipients' exercise of the rights granted herein.
 You are not responsible for enforcing compliance by third parties with
 this License.
-
+
  11. If, as a consequence of a court judgment or allegation of patent
 infringement or for any other reason (not limited to patent issues),
 conditions are imposed on you (whether by court order, agreement or
@@ -422,7 +422,7 @@ conditions either of that version or of any later version published by
 the Free Software Foundation.  If the Library does not specify a
 license version number, you may choose any version ever published by
 the Free Software Foundation.
-
+
  14. If you wish to incorporate parts of the Library into other free
 programs whose distribution conditions are incompatible with these,
 write to the author to ask for permission.  For software which is
@@ -456,7 +456,7 @@ SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
 DAMAGES.

                     END OF TERMS AND CONDITIONS
-
+
           How to Apply These Terms to Your New Libraries

  If you develop a new library, and you want it to be of the greatest
@@ -1,7 +1,983 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.

-version <next>:
+version 6.1.6:
+ configure: do not use interval regexp operators with awk
+ configure: fix symbol prefix detection
+ configure: Disable linker warnings for common symbols
+ avformat/av1dec: Check bits left before get_leb128()
+ avformat/dhav: Check amount read
+ avformat/mov: ensure required number of bytes is read
+ avcodec/cbs_sei: Always zero-initialize SEI payload
+ avformat/nuv: return early if header id fails to read
+ avformat/mpegts: Don't use uninitialized value in av_log()
+ avformat/hls: update current segment reference before use
+ avcodec/parser: Reset *buf_size on realloc failure
+ avfilter/af_stereotools: round-up max size of buffer
+ avcodec/hevc/hevcdec: Clean sao_pixel_buffer_v on allocation
+ avcodec/hevc/hevcdec: initialize qp_y_tab
+ swscale/alphablend: don't overread alpha plane on subsampled odd size
+ avformat/mov: fix crash when trying to get a fragment time for a non-existing fragment
+ aarch64/hpeldsp_neon: fix out-of-bounds read
+ avcodec/jpeg2000dec: clear array length when freeing it
+ av1dec: Don't crash if decoding of some frames have failed
+ avformat/dashdec: Fail with any inner stream count being 0
+ swscale/x86/rgb_2_rgb: fix uyvytoyuv422 overwrite on odd width
+ avcodec/snowenc: fix SIGFPE in get_dc() when a block lies outside the plane
+ avcodec/snowenc: fix out-of-bounds OBMC read in get_dc() for narrow planes
+ avcodec/snowenc: fix out-of-bounds memcpy in get_block_rd() for narrow planes
+ avformat/icecast: reject CR/LF in metadata header values
+ avfilter/avf_showspectrum: Fix allocation check
+ avformat/sctp: add size check in sctp_read() matching sctp_write()
+ avcodec/cbs_av1_syntax_template: reset seen_frame_header on sequence headers
+ avfilter/convolution: compute user matrix products in unsigned
+ avformat/mpegts: use av_fast_realloc() for prg
+ avfilter/avf_showcwt: avoid undefined float to int conversion of nb_consumed_samples
+ avfilter/avf_showcwt: fix out of array read in compute_kernel
+ avfilter/v360: compute remap table offsets in 64bit
+ avfilter/v360: reject out-of-range dimensions
+ swresample/x86/resample: write only int16 in the int16 resampler
+ avformat/rtpenc_amr: Check input size
+ swscale/ppc: fix ASAN stack-buffer-overflow in yuv2planeX
+ swscale/ppc: fix LOAD_FILTER overread in VSX path
+ avfilter: use ff_slice_pos() for per-slice boundary computation
+ avfilter: add ff_slice_pos() helper for slice boundaries
+ avfilter/estdif: avoid signed overflow in slice boundary calculation
+ avformat/rtspdec: bound Content-Length in the ANNOUNCE handler to SDP_MAX_SIZE
+ avcodec/cbs_h266_syntax_template: reject subpic info with res_change_in_clvs
+ avcodec/misc4: Check nb channels
+ avcodec/rv10, rv34: check init_get_bits8() before RealVideo bit access
+ avformat/http: reject request-line tokens not terminated by whitespace
+ avcodec/agm: validate actual src_y against prev plane in decode_inter_plane
+ avcodec/hevc/ps: Check window parameters
+ avcodec/hevc/ps: Factor window reading out
+ avcodec/truespeech: reject iterations count whose * 240 product overflows 32-bit
+ avcodec/on2avc: reject subframe count whose * SUBFRAME_SIZE product overflows 32-bit
+ avfilter/zmq: initialize send_buf before shared cleanup on parse failure
+ avcodec/adpcm: fix signed integer overflow in get_nb_samples()
+ avformat/matroskadec: avoid signed overflow in DASH cue time differences
+ avcodec/fastaudio: reject subframes count whose * 256 product overflows 32-bit
+ avcodec/vc2enc_dwt: avoid signed overflow in the 9/7 DWT lifting
+ avcodec/vc2enc_dwt: avoid signed overflow in the 5/3 and Haar DWT
+ avcodec/mwsc: do not dereference a missing reference frame
+ avcodec/misc4: reject invalid sample rate
+ tools/target_dem_fuzzer: do not exit on io_buffer allocation failure
+ avformat/gxfenc: Check timecode and propagate error
+ swscale/rgb2rgb_template: use unsigned for <<24
+ avformat/matroskadec: bound TRACKENTRY parsing by max_streams
+ avcodec/diracdec: fix heap buffer overflow in edge_emu_buffer
+ avformat/rtmppkt: Check recursion depth
+ avcodec/jpeglsdec: only apply color transform to decoded rows
+ avcodec/aac/aacdec: reject decoded frame without a valid sample rate
+ avformat/iff: check av_get_packet() result in ANIM branch
+ avcodec/cbs_h266_syntax_template: Fix pps_exp_slice_height_in_ctus_minus1 range
+ lavc/vvc: Stricter bound on pps_exp_slice_height_in_ctus_minus1
+ avfilter/vf_drawtext: Avoid double free in glyph_enu_border_free()
+ avfilter/vf_drawtext: plug error-path leaks in measure_text/draw_text
+ avfilter/vf_drawtext: avoid double-free of aliased FT_Glyph in glyph_enu_free
+ avfilter/vf_drawtext: don't double-free glyph that has been cached in tree
+ avfilter/vf_drawtext: always check pixel_mode == FT_PIXEL_MODE_MONO
+ avcodec/cook: bound subpacket channel sum against channel count
+ avformat/mxfdec: Remove unneeded check
+ avformat/ftp: Check string used for RNTO
+ avformat/ftp: Check for Telnet IAC characters and other non printable ASCII chars
+ avformat/ftp: reject CR/LF in the URL path to prevent FTP command injection
+ avcodec/jpeg2000dec: Clear header derived variables
+ avformat/avc: Adjust get_ue_golomb() to handle 32 bit
+ avcodec/x86/vorbisdsp: change cmpleps to cmpltps in inverse coupling
+ avfilter/af_join: fix wrong loop bound in buffer dedup (use-after-free)
+ avcodec/h264_slice: guard color_frame() against chroma-width underflow
+ avcodec/magicyuv: reject slice_height misaligned with chroma vshift
+ avcodec/magicyuv: Expand the s->interlaced slice-height sanity check
+ avcodec/magicyuv: Fix 1 line MEDIAN slices
+ avformat/mxfdec: zero-init Sony MPEG-4 extradata and add padding
+ avformat/soxdec: Check sample_rate for nan
+ tests/tiny_ssim: fixed mistake in ssim_c1 calculation
+ avformat/hls: Check TIME-OFFSET value
+ avformat/hls: Check url_offset and size
+ avformat/ty: check rec_size
+ avformat/rtpenc_xiph: bail out when the max payload size underflows
+ avformat/rtpenc_aac: reject packets smaller than the ADTS header
+ avcodec/jpeg2000dec: compute mask in decode_clnpass() like in decode_sigpass()
+ avformat/vividas: fix misaligned access
+ avcodec/g2meet: The stack is EPIC_PIX_STACK_SIZE
+ avfilter/boxblur: Fix off by one errors
+ avcodec/diracdec: Enlarge `mctmp` to cover the worst-case `blheight·ybsep + yblen` rows, and break the MC loop when no output rows remain
+ tools/zmqsend: free the AVBprint buffer after using it
+ [Wave] Fix issues with unaligned metadata chunks.
+ avcodec/cbs_h266_syntax_template: tighten sh_num_tiles_in_slice_minus1 upper bound
+ avcodec/hevc: limit missing-ref fill to coded planes
+ avcodec/hdrdec: fix pixel count decrement in RLE decompress loop
+ (fforge/pr/23191) avformat/oggparsecelt: bound extra_headers to avoid an effectively infinite loop
+ (fforge/pr/23115) avformat/demux: use correct close function for custom io
+ avformat/hlsenc: use correct close function for custom io
+ avformat/hlsenc: respect io_open set in AVFormatContext
+ avformat/dashenc: respect io_open set in AVFormatContext
+ avformat/dashdec: respect io_open set in AVFormatContext
+
+version 6.1.5
+ avcodec/dfpwmdec: Check nb_samples
+ avcodec/alsdec: do not set nbits invalidly
+ swscale/swscale_unscaled: adjust last line copy
+ avformat/avidec: check LIST size in avi_load_index()
+ avformat/avidec: validate INFO list size before parsing
+ avformat/matroskadec: Check audio.sub_packet_h * audio.frame_size
+ libavformat/xwma: fix overflow in seek position
+ avformat/pcm: Use 64bit for byte_rate
+ avfilter/vf_kerndeint: Check for minimum height
+ avcodec/ralf: Add the missing return statement after the error log
+ avfilter/vf_codecview: Clamp block to the visible frame region
+ avcodec/zmbv: reject XOR data that overruns the decompression buffer
+ avcodec/rasc: fix heap use-after-free in decode_move()
+ avformat/rtpdec_mpeg4: reject zero-length AU header sections
+ fftools/ffmpeg_opt: validate stream index in negative map handling
+ avformat/rtmpproto: prevent integer overflow accumulating FLV buffer size
+ avformat/rtmpproto: validate compressed SWF header length
+ avformat/rtsp: Fix out-of-bounds read in SDP parser when control_url is empty
+ avformat/rtpdec_latm: avoid integer overflow in LATM length parsing
+ avcodec/h264: recompute per-slice direct mode state for every slice
+ avcodec/h264_refs: Clear stale pointers from ref_list
+ avcodec/pdvdec: Check input space before buffer allocation
+ avformat/concat: guard total_size overflow
+ avcodec/wmaenc: Fix missing padding in extradata
+ avcodec/tdsc: remove double stride adjustment
+ avformat/cafdec: fix negative index use in read_seek
+ avcodec/notchlc: Check 255 loops
+ avformat/rtpdec_jpeg: check qtable_len
+ avformat/vividas: use-of-uninitialized-value in keybuffer
+ avcodec/tdsc: Check jpeg size
+ avcodec/tdsc: Better input size check
+ avcodec/tdsc: Check tile_size
+ avcodec/decode: Better documentation for ff_set_dimensions()
+ avformat/mov: check extradata in mov_read_dops()
+ avformat/mov: Check read size for opus extradata
+ avformat/rtspdec: reject non-positive ANNOUNCE Content-Length
+ avformat/wavdec: Fix use-of-uninitialized-value in find_guid()
+ avformat/hls_sample_encryption: add missing padding for audio setup buffer
+ lavfi: vf_drawtext: check memory allocation
+ avcodec/svq1dec: Check input space for minimum
+ avcodec/vp9: Rollback dimensions when format is rejected
+ avformat/rtpdec_qdm2: Check block_size
+ avfilter/vf_ssim360: fix integer overflow in tape_length allocation
+ avcodec/escape130: Initialize old_y_avg
+ avutil/samplefmt: Dont claim that av_get_sample_fmt_string checks sample_fmt
+ avformat: check avio_read() return values in dss/dtshd/mlv
+ avcodec/alsdec: preserve full float value in zero-truncated samples
+ avcodec/alsdec: propagate read_diff_float_data() errors in read_frame_data()
+ avcodec/alsdec: fix mantissa unpacking in compressed Part A path
+ avfilter/vf_drawtext: fix newline rendered as .notdef glyph
+ libavfilter/vf_v360: fix operator precedence in stereo loop condition
+ avcodec/alsdec: fix abs(INT_MIN) UB in read_diff_float_data()
+ avformat/rsd: reject short ADPCM_THP extradata reads
+ avformat/mov: Handle integer overflow in MOV parser
+ avcodec/dvdsub_parser: Fix buf_size check
+ avfilter/af_pan: fix sscanf() return value checks in parse_channel_name
+ avutil/bswap: fix implicit conversion warning in av_bswap64
+ avcodec/h2645_sei: don't use provider_code uninitialized
+ avformat/mpegts: fix descriptor accounting across multiple IOD descriptors
+ avcodec/xxan: zero-initialize y_buffer
+ avcodec/exr: Check input space before reverse_lut()
+ avcodec/cbs_h266_syntax_template: Check tile_y
+ avcodec/h264_slice: reject slice_num >= 0xFFFF
+ lavfi/bwdif: fix heap-buffer-overflow with small height videos
+ avcodec/cbs_h266_syntax_template: Fix w/h typo
+ avutil/timecode: Check for integer overflow in av_timecode_init_from_components()
+ avcodec/cbs_h266_syntax_template: Fix rows vs columns
+ avformat/mov: do not allocate out-of-range buffers
+ avfilter/af_lv2: call lilv_instance_activate before lilv_instance_run
+ avformat/rtmpproto: fix listen_timeout conversion for special negative values
+ swscale/output: fix integer overflows in chroma in yuv2rgba64_X_c_template()
+ avcodec/lcldec: Fixes uqvq overflow
+ fftools/ffmpeg_demux: Check metadata provided filename
+ avcodec/av1dec: sync frame header and tile group behavior with CBS
+ avformat/mlvdec: avoid uninitialized read in read_string()
+ avcodec/magicyuv: fix small median images
+ swscale/output: Fix integer overflow in alpha in yuv2rgba64_1_c_template()
+ swscale/utils: Check *Inc
+ avfilter/vf_scale: Fix integer overflow in config_props()
+ swscale/output: Fixes integer overflow in yuv2planeX_8_c
+ swscale/utils: initialize chroma when luma switched to cascade
+ avcodec/utils: fix duration computation based on frame_bytes
+ avcodec/cbs_h266_syntax_template: bound slice width/height by remaining tiles
+ avformat/rtsp: Pass blacklist
+ avformat/rtsp: Explicitly check protocol
+ avfilter/vf_convolution: Use avpriv_mirror
+ avfilter/vf_convolution: Handle corner cases with small frames
+ avcodec/pnmdec: Check input size against width*height assuming at least 1bit per pixel
+ avcodec/snowenc: avoid NULL ptr arithmetic
+ avformat/mov: use 64bit in CENC subsample bounds checks
+ avutil/eval: Check depth of AVExpr
+ avformat/vividas: Reset n_audio_subpackets on error
+ avformat/matroskadec: Check that end_time_ns >= start_time_ns
+ avcodec/vp3: Sanity check cropping
+ avformat/dhav: Check avio_seek() return
+ avformat/segafilm: dont read uninitialized value
+ avcodec/mpegvideo_enc: Restructure ff_h263_encode_gob_header() relation to update_mb_info()
+ avcodec/exr: check tile_attr.x/ySize
+ avformat/demux: Fix integer overflows in select_from_pts_buffer()
+ avcodec/golomb: Fix get_ur_golomb_jpegls() with esclen = 0
+ swresample/resample_template: add casts to avoid undefined overflows
+ avcodec/h264_parser: Check pts for overflow
+ avformat/wtvdec: Check that language is fully read
+ avcodec/imm5: Dont pass EAGAIN on as is
+ avcodec/interplayacm: Check input for fill_block()
+ avcodec/hdrdec: Check input size before buffer allocation
+ avcodec/flashsv: Check for input space before (re)allocating frame
+ avcodec/mdec: Check input space vs minimal block size
+ avcodec/h264_parser: Check remaining input length in loop in scan_mmco_reset()
+ avcodec/exr: fix AVERROR typo
+ avcodec/jpeg2000htdec: Check Lcup and Lref
+ avcodec/cfhd: Check transform type before continuing
+ avcodec/cfhd: Add CFHDSegment enum and named identifiers
+ avcodec/hevc/ps: Check bit_depth_cm in/out relation
+ avformat/icodec: Check size
+ avformat/lrcdec: Check ss for finiteness
+ avformat/http: Also count redirects from the cache
+ avformat/http: allow adjusting the redirect limit
+ fftools/ffmpeg_opt: limit recursion of presets
+ swscale/rgb2rgb_template: fix signed shift into sign bit
+ swresample: Check ch layouts in swr_alloc_set_opts2()
+ swresample: Check user chlayout in swr_set_matrix()
+ avcodec/bmp: fix indention
+ avcodec/exr: Handle axmax like bxmin in 04d7a6d3db56ea1a93908ff2d3d312e3fc40a58c
+ avformat/flvdec: Check *size in cts parsing
+ avformat/cafdec: Check nb_entries in read_info_chunk()
+ avcodec/vp9: Reallocate on resolution change which does not change tile_cols
+ avformat/img2dec: Check avio_size() for failure
+ avformat/mpegtsenc: Check remaining space in SDT
+ avformat/img2enc: Check split planes packet size
+ avformat/yuv4mpegen: Sanity check input packet frame dimensions
+ avformat/iff: Error out with 0 channel loudspeaker configuration
+ Fix overflow in STSD parser
+ avcodec/adpcm: Check input buffer size
+ avformat/scd: Use ffio_read_size()
+ avformat/hls: Check for integer overflow with #EXTINF:
+ avcodec/dca_xll: Clear padding in ff_dca_xll_parse()
+ vfilter/vf_find_rect: Clamp x/y min/max to valid values
+ avcodec/dca_xll: Check get_rice_array()
+ avformat/mpegts: Check program_info_length
+ avformat/mpegts: Check IOD_DESCRIPTOR len
+ avcodec/qdm2: fix heap-use-after-free in qdm2_decode_frame
+ avcodec/jpeg2000dec: Print bpno level when erroring out
+ avformat/dashdec: check value valid after read value from mpd xml
+ swscale/utils: zero init filter memory as before
+ lavc/j2kdec: Do not ignore colour association for packed formats
+ swscale/utils: Sanity check sizeFactor
+ swscale/utils: Avoid FF_ALLOC_TYPED_ARRAY() and use av_malloc_array() directly
+ avcodec/mjpegdec: fix segfault on extern_huff and no extradata
+ avcodec/exr: use av_realloc_array()
+ avcodec/omx: Check extradata size and nFilledLen
+ avfilter/scale_eval: Use 64bit for factor_w/h
+ avfilter/scale_eval: Avoid undefined behavior with double to int cast
+ avformat/http: Check that the protocol of redirects is http or https
+ doc/mailing-list-faq.texi: Fix typo in link anchor
+ avfilter/vf_find_rect: Fix handling odd sized images
+ avcodec/notchlc: zero-initialize history buffer
+ avfilter/vf_stack: add checks for the final canvas dimensions
+ lavc/vvc: Prevent OOB write to slice_top_left_ctu_x in PPS CBS
+ avcodec/mjpegdec: only test the size bound in sequential mjpeg
+ avcodec/jpeg2000htdec: Check pLSB
+ avformat/hls: fix double space
+ avformat/hls: Check seg size and offset for overflow
+ avformat/flac_picture: Correct check
+ avfilter/vf_neighbor_opencl: add error condition when filter name doesn't match
+ avfilter/vf_libopencv: make sure there is space for null-terminator in shape_str
+ fate: add missing options in config template
+ (fforge/pr/22395) swscale/x86/yuv2rgb_template: Add emms to MMX(EXT) functions
+ (fforge/pr/21701) avcodec/tableprint_vlc: Unbreak hardcoded tables
+ forgejo: backport CI job names
+ (fforge/pr/21339) avformat/img2dec: reject input images too big to fit into a single packet
+ avfilter/af_amerge: fix possible crash with custom layouts
+ (fforge/pr/21061) avfilter/stack_internal: fix checkheaders test
+ doc/examples/qsv_transcode: EINVAL is more appropriate and ENAVAIL will fail build with visual studio
+ all: apply linter fixes
+ tools/check_arm_indent: skip empty glob
+ forgejo: apply needed CI changes for 6.1
+ forgejo: backport CI to release/6.1
+
+
+
+version 6.1.4:
+ avutil/common: cast GET_BYTE/GET_16BIT returned value
+ avfilter/vf_drawtext: fix call GET_UTF8 with invalid argument
+ avfilter/vf_drawtext: fix incorrect text length
+ avfilter/vf_drawtext: Account for bbox text seperator
+ avcodec/utvideodec: Set B for the width= 1 case in restore_median_planar_il()
+ avcodec/osq: Fix 32bit sample overflow
+ avformat/rtpdec_rfc4175: Only change PayloadContext on success
+ avformat/rtpdec_rfc4175: Check dimensions
+ avformat/rtpdec_rfc4175: Fix memleak of sampling
+ avformat/http: Fix off by 1 error
+ avcodec/exr: spelling
+ avcodec/exr: use tile dimensions in pxr24 UINT case
+ avcodec/exr: Simple check for available channels
+ avformat/sctp: Check size in sctp_write()
+ avformat/rtmpproto: consider command line argument lengths
+ avformat/rtmpproto_ Check tcurl and flashver length
+ avcodec/g723_1enc: Make min_err 64bit
+ avcodec/vlc: Clear val8/16 in vlc_multi_gen() by av_mallocz()
+ avformat/rtpenc_h264_hevc: Check space for nal_length_size in ff_rtp_send_h264_hevc()
+ swscale/output: Fix integer overflow in yuv2ya16_X_c_template()
+ avcodec/exr: Check that DWA has 3 channels
+ avcodec/exr: check ac_size
+ avcodec/exr: Round dc_w/h up
+ avcodec/mjpegdec: Explain buf_size/width/height check
+ avformat/avidec: Fix integer overflow iff ULONG_MAX < INT64_MAX
+ fftools/ffmpeg_mux_init: Fix double-free on error
+ avformat/aviobuf: Keep checksum_ptr consistent in avio_seek()
+ avcodec/librsvgdec: fix compilation with librsvg 2.50.3
+ aacenc_tns: clamp filter direction energy measurement
+ avcodec/dxv: Check coded_height, to avoid invalid av_clip()
+ avcodec/aac/aacdec: dont allow ff_aac_output_configure() allocating a new frame if it has no frame
+ avformat/lrcdec: Fix fate-sub-lrc-ms-remux on x86-32
+ avcodec/sanm: Check w,h,left,top
+ avcodec/utvideodec: Clear plane_start array
+ fftools/ffmpeg_mux_init: Use 64bit for score computation in map_auto_video()
+ lavc/aarch64: Fix addp overflow in ff_pred16x16_plane_neon_10
+ avcodec/x86/pngdsp: add missing emms at the end of add_png_paeth_prediction
+
+
+version 6.1.3:
+ libavfilter/dnn/dnn_backend_tf: Remove redundant av_freep() to avoid double free
+ avcodec/dxv: Check that we initialize op_data
+ avcodec/exr: Check for pixel type consistency in DWA
+ avcodec/libvorbisdec: avoid overflow when assinging sample rate from long to int
+ avcodec/g726: init missing sample rate
+ avformat/lrcdec: limit input timestamp range to avoid overflows
+ avcodec/scpr3: Clear clr
+ avcodec/ilbcdec: Clear cbvec when used with create_augmented_vector()
+ avcodec/jpeg2000dec: Make sure the 4 extra bytes allocated are initialized
+ avfilter/avf_showcqt: fix unbounded index when copying to fft_data
+ avcodec/aacsbr_template: Check ilb
+ avcodec/utvideodec: Set B for the width= 1 case
+ avcodec/ffv1: Clear state on alloc
+ avcodec/jpeg2000dec: implement cdef remapping during pixel format matching
+ avcodec/jpeg2000dec: move cdef default check into get_siz()
+ avcodec/exr: Check rle_raw_data and surroundings
+ avcodec/exr: Dont access outside xsize/ysize
+ examples: Add check and replace av_free() to avoid potential memory errors
+ libavcodec/tests/snowenc: Add av_free() to avoid memory leak
+ libavfilter/af_firequalizer: Add check for av_malloc_array()
+ libavcodec/videotoolbox_vp9: Move av_malloc() to avoid memory leak
+ avcodec/mpc8: init avctx->sample_rate
+ avcodec/cbs_h266_syntax_template: fix out of bounds access
+ avformat/libopenmpt: fix seeking weirdness
+ avformat/hls: add cmfv/cmfa exceptions
+ avformat/lrcdec: support arbitrary precision timestamp
+ avcodec/ffv1dec: Disable frame threading due to race condition
+ swscale/swscale_unscaled: use 8 line alignment for planarCopyWrapper with dithering
+ Update for 6.1.3
+ libavcodec/tests/motion: Add check for avcodec_alloc_context3()
+ avcodec/tests/avpacket: Add av_free() to avoid memory leak
+ examples: Add av_freep to avoid potential memory leak
+ avcodec/tests/avpacket: Add av_packet_free() to avoid memory leak
+ avcodec/fits: Clear naxis
+ avcodec/vqavideo; Check bytestream2_get_buffer() reading next_codebook_buffer
+ avcodec/lzf: Check for input space
+ avcodec/imc: Clear padding of buf16
+ avcodec/iff: Clear ham_buf
+ avcodec/cri: Check bytestream2_get_buffer() for end
+ avcodec/cri: Factor read_len out
+ avformat/dashdec: Allocate space for appended "/"
+ avcodec/mpegvideo_dec: Fix lowres=3 field select interlaced mpeg4 frame
+ avformat/mxg: clear AV_INPUT_BUFFER_PADDING_SIZE
+ avformat/vqf: Ensure that comm_chunk is fully read
+ avformat/mov: make sure file_checksum is fully initialized
+ avformat/asfdec_f: Check amount of value read
+ avcodec/jpegxl_parser: add sanity check for frame size
+ avformat/concatdec: Clip duration in one more case in get_best_effort_duration()
+ avcodec/ffv1dec: Check k in get_vlc_symbol()
+ avcodec/cfhd: Check idwt_buf size before allocation
+ avcodec/ivi: Check luma/chroma mb_size
+ avcodec/motion_est: don't add offsets to NULL pointers
+ swscale/swscale_unscaled: don't add offsets to NULL pointers
+ libavcodec/alsdec.c: Add check for av_malloc_array() and av_calloc()
+ avcodec/psd: Move frame allocation after RLE processing
+ avcodec/smacker: Move buffer allocation to later
+ avcodec/opus: don't materialize buf pointer from null
+ avcodec/speexdec: consider differing frame sizes in remaining space check
+ avformat/iff: Check nb_channels == 0 in CHNL
+ avcodec/osq: Request a coding mode 2 sample
+ avcodec/osq: Switch back to av_ceil_log2()
+ avcodec/osq: Add note about update_stats() count
+ avcodec/osq: Fix signed integer overflow in update_stats()
+ avcodec/mss2dsp: use FF_PTR_ADD to add offsets to a pointer
+ avformat/movenc: fix writing reserved bits in EC3SpecificBox
+ avcodec/hevc/hevcdec: Check num_entry_point_offsets
+ avcodec/speexdec: Pass and check remaining packets to decode functions
+ avcodec/rkmppdec: Fix double-free on error
+ avcodec/ppc/vp8dsp_altivec: Fix out-of-bounds access
+ fftools/ffmpeg_demux: don't flag timestamps as unreliable if they are generated
+ avformat/matroskadec: check that channels fit in signed 32bit int
+ avcodec/takdec: Check remaining space for first predictors
+ avcodec/svq3: Check there are bits left before decompression
+ avcodec/sonic: Check num_taps
+ avformat/imf_cpl: fix indention after previous commit
+ avformat/imf_cpl: do not continue looping forever
+ avformat/mov: reject negative ELST durations
+ avformat/avidec: Ignore duplicate GAB2
+ avcodec/h264_mb: Fix tmp_cr for arm
+ avcodec/vorbisdec: Dont treat overread as error
+ avformat/iff: Check nb_channels == 0 in MHDR
+ tests/fate/filter-video: Fix dependancy for codecview
+ libpostproc: check minimum size
+ avformat/hls: Fix flash1.bogulus.cfd support
+ avformat/hls: Split allowed_segment_extensions off allowed_extensions
+ avformat/hls: Fix Youtube AAC
+ avformat/hls: add fmp4 to allowed_extensions
+ avformat/hls: Add ec3 to allowed_extensions
+ avformat/hls: Add cmfv and cmfa to allowed_extensions
+ postproc/postprocess_template: Fix reading uninitialized pixels in dering_C()
+ configure: Clearer documentation for "disable-safe-bitstream-reader"
+ avcodec/osq: avoid undefined negation
+ swscale/output: Fix integer overflow in yuv2gbrp_full_X_c()
+ avcodec/libtheora: fix setting keyframe_mask
+ avfilter/buffersrc: check for valid sample rate
+ doc: replace http/git by https urls
+ configure: update copyright year
+ avformat/hls: Partially revert "reduce default max reload to 3"
+ avfilter/asrc_afirsrc: fix by one smaller allocation of buffer
+ avfilter/bwdif: account for chroma sub-sampling in min size calculation
+ avfilter/af_afwtdn: fix crash with EOF handling
+ avfilter/vf_colorcorrect: fix memory leaks
+ avfilter/vf_codecview: fix heap buffer overflow
+ avformat/iff: Check that we have a stream in read_dst_frame()
+ avformat/mlvdec: fix size checks
+ avformat/wavdec: Fix overflow of intermediate in block_align check
+ avformat/mxfdec: Check edit unit for overflow in mxf_set_current_edit_unit()
+ avformat/hls: Fix twitter
+ libavformat/hls: Be more restrictive on mpegts extensions
+ avformat/hls: .ts is always ok even if its a mov/mp4
+ avcodec/h263dec: Check against previous dimensions instead of coded
+ avformat/hls: Print input format in error message
+ avformat/hls: Be more picky on extensions
+ avformat/mxfdec: Check avio_read() success in mxf_decrypt_triplet()
+ avcodec/huffyuvdec: Initialize whole output for decode_gray_bitstream()
+ avformat/ipmovie: Check signature_buffer read
+ avformat/wtvdec: Initialize buf
+ avcodec/cbs_vp9: Initialize VP9RawSuperframeIndex
+ avformat/vqf: Propagate errors from add_metadata()
+ avformat/vqf: Check avio_read() in add_metadata()
+ avformat/dashdec: Check whitelist
+ avutil/avstring: dont mess with NULL pointers in av_match_list()
+ avfilter/vf_v360: Fix NULL pointer use
+ avcodec/mpegvideo_enc: Check FLV1 resolution limits
+ avcodec/ffv1enc: Fix handling of 32bit unsigned symbols
+ avcodec/vc1dec: Clear block_index in vc1_decode_reset()
+ avcodec/aacsbr_template: Clear n_q on error
+ avcodec/osq: Fixes several undefined overflows in do_decode()
+ swscale/output: Fix undefined overflow in yuv2rgba64_full_X_c_template()
+ avfilter/af_pan: Fix sscanf() use
+ avfilter/vf_grayworld: Use the correct pointer for av_log()
+ avfilter/vf_addroi: Add missing NULL termination to addroi_var_names[]()
+ avcodec/get_buffer: Use av_buffer_mallocz() for audio same as its done for video
+ avformat/jpegxl_anim_dec: clear buffer padding
+ avformat/rmdec: check that buf if completely filled
+ avcodec/cfhdenc: Clear dwt_tmp
+ avcodec/hapdec: Clear tex buffer
+ avformat/mxfdec: Check that key was read sucessfull
+ avformat/rpl: Fix check for negative values
+ avformat/mlvdec: Check avio_read()
+ avcodec/utils: Fix block align overflow for ADPCM_IMA_WAV
+ avformat/matroskadec: Check pre_ns for overflow
+ tools/target_dec_fuzzer: Adjust threshold for EACMV
+ tools/target_dec_fuzzer: Adjust threshold for MVC1
+ tools/target_dec_fuzzer: Adjust Threshold for indeo5
+ avutil/timecode: Avoid fps overflow in av_timecode_get_smpte_from_framenum()
+ avcodec/webp: Check ref_x/y
+ avcodec/ilbcdec: Initialize tempbuff2
+ avformat/qcp: Check for read failure in header
+ avcodec/eatgq: Check bytestream2_get_buffer() for failure
+ avformat/dxa: check bpc
+ swscale/slice: clear allocated memory in alloc_lines()
+ avcodec/h2645_parse: Ignore NAL with nuh_layer_id == 63
+ avcodec/mjpegdec: Disallow progressive bayer images
+ avformat/icodec: fix integer overflow with nb_pal
+ doc/developer: Document relationship between git accounts and MAINTAINERS
+ avformat/vividas: Check avio_read() for failure
+ avformat/ilbc: Check avio_read() for failure
+ avformat/nistspheredec: Clear buffer
+ avformat/mccdec: Initialize and check rate.den
+ avformat/rpl: check channels
+ INSTALL: explain the circular dependency issue and solution
+ avformat/mpegts: Initialize predefined_SLConfigDescriptor_seen
+ avformat/mxfdec: Fix overflow in midpoint computation
+ swscale/output: used unsigned for bit accumulation
+ avcodec/rangecoder: only perform renorm check/loop for callers that need it
+ avcodec/ffv1dec: Fix end computation with ec=2
+ avcodec/ffv1enc: Prevent generation of files with broken slices
+ avformat/matroskadec: Check desc_bytes so bits fit in 64bit
+ avformat/mov: Avoid overflow in dts
+ avcodec/ffv1enc: Correct error message about unsupported version
+ avcodec/ffv1enc: Slice combination is unsupported
+ avcodec/ffv1enc: 2Pass mode is not possible with golomb coding
+ avcodec/ffv1enc: Fix >8bit context size
+ avcodec/xan: Add basic input size check
+ avcodec/imm4: Check input size
+ avcodec/svq3: Check for minimum size input
+ avcodec/eacmv: Check input size for intra frames
+ tools/target_dec_fuzzer: Adapt threshold for RASC
+ avcodec/encode: Check bitrate
+ avcodec/cbs_h266_syntax_template: Check bit depth with range extension
+ avcodec/osq: use unsigned for decorrelation
+ avcodec/jfdctint_template: use unsigned z* in row_fdct()
+ avformat/asf: Check picsize
+ avcodec/osq: Treat sum = 0 as k = 0
+ avformat/mxfdec: Check timecode for overflow
+ avformat/mxfdec: More offset_temp checks
+ swscale/output: Fix undefined integer overflow in yuv2rgba64_2_c_template()
+ swscale/swscale: Use unsigned operation to avoid undefined behavior
+ avcodec/vc2enc: basic sanity check on slice_max_bytes
+ avformat/mvdec: Check if name was fully read
+ avcodec/wmavoice: Do not use uninitialized pitch[0]
+ avformat/argo_brp: Check that ASF chunk header is completely read
+ avcodec/notchlc: Check bytes left before reading
+ avcodec/vc1_block: propagate error codes
+ avformat/apetag: Check APETAGEX
+ avcodec/magicyuvenc: better slice height
+ avcodec/avcodec: Warn about data returned from get_buffer*()
+ avformat/av1dec: Better fix for 70872/clusterfuzz-testcase-minimized-ffmpeg_dem_OBU_fuzzer-6005782487826432
+ avcodec/apac: Fix discards ‘const’ qualifier
+ avcodec/alsdec: clear last_acf_mantissa
+ avcodec/aic: Clear slice_data
+ avcodec/vc1dec: Clear mb_type_base and ttblk_base
+ avcodec/shorten: clear padding
+ avformat/mpeg: Check an avio_read() for failure
+ avcodec/apac: Clean padding space
+ avcodec/mvha: Clear remaining space after inflate()
+ bsf/media100_to_mjpegb: Clear output buffer padding
+ avformat/segafilm: Set keyframe
+ avcodec/sga: av_assert1 check init_get_bits8()
+ tools/target_dec_fuzzer: Check that FFv1 doesnt leave uninitialized memory in its buffers
+ avdevice/dshow: Initialize 2 pointers
+ avcodec/dxva2: initialize hr in ff_dxva2_common_end_frame()
+ avcodec/dxva2: initialize validate
+ avcodec/dxva2: Initialize ConfigBitstreamRaw
+ avcodec/dxva2: Initialize dxva_size and check it
+ avfilter/vf_xfade: Compute w2, h2 with float
+ avfilter/vf_v360: Assert that vf was initialized
+ avfilter/vf_tonemap_opencl: Dereference after NULL check
+ avfilter/af_surround: Check output format
+ avfilter/vf_xfade_opencl: Check ff_inlink_consume_frame() for failure
+ avformat/lmlm4: Eliminate some AVERROR(EIO)
+ tools/target_dec_fuzzer: Use av_buffer_allocz() to avoid missing slices to have unpredictable content
+ avformat/wtvdec: Check length of read mpeg2_descriptor
+ avformat/wtvdec: clear sectors
+ avcodec/parser: ensure input padding is zeroed
+ avformat/jpegxl_anim_dec: ensure input padding is zeroed
+ avformat/img2dec: Clear padding data after EOF
+ avformat/wavdec: Check if there are 16 bytes before testing them
+ Revert "avformat/mpegts: update stream info when PMT ES stream_type changes"
+ configure: Use MSYSTEM_CARCH for default arch on msys2
+ avfilter/avfiltergraph: fix regression in picking channel layout
+ avformat/mpegts: update stream info when PMT ES stream_type changes
+ avformat/wavdec: increase requested probe score for codec probe
+ lsws/ppc/yuv2rgb_altivec: Fix build in non-VSX environments with Clang v2
+ lsws/ppc/yuv2rgb_altivec: Fix build in non-VSX environments with Clang
+ avformat/mov: (v4) fix get_eia608_packet
+ configure: Improve the check for the rsync --contimeout option
+ rtmpproto: Avoid rare crashes in the fail: codepath in rtmp_open
+ lavc/hevcdec: pass an actual codec context to ff_h2645_sei_to_frame()
+ lavc/aarch64: Fix ff_pred16x16_plane_neon_10
+ lavc/aarch64: Fix ff_pred8x8_plane_neon_10
+ vp9: recon: Use emulated edge to prevent buffer overflows
+ arm: vp9mc: Load only 12 pixels in the 4 pixel wide horizontal filter
+ aarch64: vp9mc: Load only 12 pixels in the 4 pixel wide horizontal filter
+ riscv: test for assembler support
+ avfilter/f_loop: fix aloop activate logic
+ avfilter/f_loop: fix length of aloop leftover buffer
+ avcodec/jpegxl_parser: fix reading lz77-pair as initial entropy symbol
+ avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value
+ avutil/hwcontext: Don't assume frames_uninit is reentrant
+ avutil/wchar_filename: re-introduce explicit cast of void* to char*
+ avcodec/libx265: unbreak build for X265_BUILD >= 213
+ lavc/hevcdec: set per-CTB filter parameters for WPP
+ lavc/hevc: check framerate num/den to be strictly positive
+ lavc/libx265: unbreak build for X265_BUILD >= 210
+ avformat/libzmq: fix check for zmq protocol prefix
+ configure: improve check for POSIX ioctl
+ configure: restore autodetection of v4l2 and fbdev
+ avformat/hlsenc: correctly reset subtitle stream counter per-varstream
+ libavcodec/arm/mlpdsp_armv5te: fix label format to work with binutils 2.43
+
+
+version 6.1.2
+ avcodec/snow: Fix off by 1 error in run_buffer
+ avcodec/utils: apply the same alignment to YUV410 as we do to YUV420 for snow
+ swscale: [loongarch] Fix checkasm-sw_yuv2rgb failure.
+ avcodec/pngenc: fix sBIT writing for indexed-color PNGs
+ avcodec/pngdec: use 8-bit sBIT cap for indexed PNGs per spec
+ avcodec/videotoolboxenc: Fix bitrate doesn't work as expected
+ Changelog: update
+ avdevice/dshow: Don't skip audio devices if no video device is present
+ avcodec/hdrenc: Allocate more space
+ avcodec/cfhdenc: Height of 16 is not supported
+ avcodec/cfhdenc: Allocate more space
+ avcodec/osq: fix integer overflow when applying factor
+ avcodec/osq: avoid using too large numbers for shifts and integers in update_residue_parameter()
+ avcodec/vaapi_encode: Check hwctx
+ avcodec/proresdec: Consider negative bits left
+ avcodec/alsdec: Clear shift_value
+ avcodec/hevc/hevcdec: Do not allow slices to depend on failed slices
+ avfilter/vf_xfade: Check ff_inlink_consume_frame() for failure
+ avutil/slicethread: Check pthread_*_init() for failure
+ avutil/frame: Check log2_crop_align
+ avutil/buffer: Check ff_mutex_init() for failure
+ avformat/xmv: Check this_packet_size
+ avformat/ty: rec_size seems to only need 32bit
+ avformat/tty: Check avio_size()
+ avformat/siff: Basic pkt_size check
+ avformat/sauce: Check avio_size() for failure
+ avformat/sapdec: Check ffurl_get_file_handle() for error
+ avformat/nsvdec: Check asize for PCM
+ avformat/mp3dec: Check header_filesize
+ avformat/mp3dec; Check for avio_size() failure
+ avformat/mov: Use 64bit for str_size
+ avformat/mm: Check length
+ avformat/hnm: Check *chunk_size
+ avformat/hlsenc: Check ret
+ avformat/bintext: Check avio_size() return
+ avformat/asfdec_o: Check size of index object
+ avfilter/vf_scale: Check ff_scale_adjust_dimensions() for failure
+ avfilter/scale_eval: Use 64bit, check values in ff_scale_adjust_dimensions()
+ avfilter/vf_lut3d: Check av_scanf()
+ avfilter/vf_elbg: Use unsigned for shifting into the top bit
+ avfilter/vf_deshake_opencl: Ensure that the first iteration initializes the best variables
+ swscale/output: Fix integer overflows in yuv2rgba64_X_c_template
+ avformat/mxfdec: Reorder elements of expression in bisect loop
+ avutil/timecode: Use a 64bit framenum internally
+ avcodec/pnmdec: Use 64bit for input size check
+ avcodec/mpeg12enc: Use av_rescale() in vbv_buffer_size computation
+ avcodec/utvideoenc: Use unsigned shift to build flags
+ avcodec/j2kenc: Merge dwt_norm into lambda
+ avcodec/vc2enc: Fix overflows with storing large values
+ avcodec/mpegvideo_enc: Do not duplicate pictures on shifting
+ avdevice/dshow_capture: Fix error handling in ff_dshow_##prefix##_Create()
+ avcodec/tiff: Check value on positive signed targets
+ avfilter/vf_convolution_opencl: Assert that the filter name is one of the filters
+ avfilter/vf_bm3d: Dont round MSE2SSE to an integer
+ avdevice/dshow: Remove NULL check on pin
+ avdevice/dshow: check ff_dshow_pin_ConnectionMediaType() for failure
+ avdevice/dshow: Check device_filter_unique_name before use
+ avdevice/dshow: Cleanup also on av_log case
+ avdevice/dshow_filter: Use wcscpy_s()
+ avcodec/flac_parser: Assert that we do not overrun the link_penalty array
+ avcodec/osq: avoid signed overflow in downsample path
+ avcodec/pixlet: Simplify pfx computation
+ avcodec/motion_est: Fix score squaring overflow
+ avcodec/mlpenc: Use 64 for ml, mr
+ avcodec/loco: Check loco_get_rice() for failure
+ avcodec/loco: check get_ur_golomb_jpegls() for failure
+ avcodec/imm4: check cbphi for error
+ avcodec/iff: Use signed count
+ avcodec/golomb: Assert that k is in the supported range for get_ur/sr_golomb()
+ avcodec/golomb: Document return for get_ur_golomb_jpegls() and get_sr_golomb_flac()
+ avcodec/dxv: Fix type in get_opcodes()
+ avcodec/cri: Check length
+ avcodec/xsubdec: Check parse_timecode()
+ avutil/imgutils: av_image_check_size2() ensure width and height fit in 32bit
+ doc/examples/mux: remove nop
+ avcodec/proresenc_kostya: use unsigned alpha for rotation
+ avformat/rtpenc_rfc4175: Use 64bit in computation if copy_offset
+ avformat/rtmppkt: Simplify and deobfuscate amf_tag_skip() slightly
+ avformat/rmdec: use 64bit for audio_framesize checks
+ avutil/wchar_filename: Correct sizeof
+ avutil/hwcontext_d3d11va: correct sizeof IDirect3DSurface9
+ avutil/hwcontext_d3d11va: Free AVD3D11FrameDescriptor on error
+ avutil/hwcontext_d3d11va: correct sizeof AVD3D11FrameDescriptor
+ doc/examples/vaapi_encode: Try to check fwrite() for failure
+ avformat/usmdec: Initialize value
+ avformat/tls_schannel: Initialize ret
+ avformat/subfile: Assert that whence is a known case
+ avformat/subfile: Merge if into switch()
+ avformat/rtsp: Check that lower transport is handled in one of the if()
+ avformat/rtsp: initialize reply1
+ avformat/rtsp: use < 0 for error check
+ avformat/rtpenc_vc2hq: Check sizes
+ avfilter/af_aderivative: Free out on error
+ swscale/swscale: Use ptrdiff_t for linesize computations
+ avfilter/af_afir: Assert format
+ avfilter/af_afftdn: Assert format
+ avfilter/af_pan: check nb_output_channels before use
+ cbs_av1: Reject thirty-two zero bits in uvlc code
+ avfilter/af_mcompand: compute half frequency in double
+ avfilter/af_channelsplit: Assert that av_channel_layout_channel_from_index() succeeds
+ avfilter/af_aresample: Cleanup on av_channel_layout_copy() failure
+ tools/coverity: Phase 1 study of anti-halicogenic for coverity av_rescale()
+ avfilter/vf_avgblur: Check plane instead of AVFrame
+ avfilter/drawutils: Fix depthb computation
+ avfilter/avf_showcwt: Check av_parse_video_rate() for failure
+ avformat/rdt: Check pkt_len
+ avformat/mpeg: Check len in mpegps_probe()
+ avformat/mxfenc: resurrects the error print
+ avdevice/dshow: Check ICaptureGraphBuilder2_SetFiltergraph() for failure
+ avcodec/mfenc: check IMFSample_ConvertToContiguousBuffer() for failure
+ avcodec/vc1_loopfilter: Factor duplicate code in vc1_b_h_intfi_loop_filter()
+ avformat/img2dec: assert no pipe on ts_from_file
+ avcodec/cbs_jpeg: Try to move the read entity to one side in a test
+ fftools/ffmpeg_enc: Initialize fd
+ fftools/ffmpeg_enc: simplify opaque_ref check
+ avformat/mov: Check edit list for overflow
+ fftools/ffmpeg: Check read() for failure
+ MAINTAINERS: Add Timo Rothenpieler to server admins
+ swscale/output: Avoid undefined overflow in yuv2rgb_write_full()
+ swscale/output: alpha can become negative after scaling, use multiply
+ avcodec/targaenc: Allocate space for the palette
+ avcodec/r210enc: Use av_rescale for bitrate
+ avcodec/jfdctint_template: Fewer integer anomalies
+ avcodec/snowenc: MV limits due to mv_penalty table size
+ tools/target_dec_fuzzer: Adjust threshold for MV30
+ tools/target_dec_fuzzer: Adjust threshold for jpeg2000
+ avformat/mxfdec: Check container_ul->desc before use
+ avcodec/libvpxenc: Cleanup on error
+ MAINTAINERS: Update the entries for the release maintainer for FFmpeg
+ configure: update copyright year
+ doc/developer: Provide information about git send-email and gmail
+ avfilter/vf_rotate: Check ff_draw_init2() return value
+ avformat/mov: Use int64_t in intermediate for corrected_dts
+ avformat/mov: Use 64bit in intermediate for current_dts
+ avformat/matroskadec: Assert that num_levels is non negative
+ avformat/libzmq: Check av_strstart()
+ avformat/img2dec: Little JFIF / Exif cleanup
+ avformat/img2dec: Move DQT after unrelated if()
+ avformat/imfdec: Simplify get_next_track_with_minimum_timestamp()
+ avdevice/xcbgrab: Check sscanf() return
+ fftools/cmdutils: Add protective () to FLAGS
+ avformat/sdp: Check before appending ","
+ avcodec/ilbcdec: Remove dead code
+ avcodec/vp8: Check cond init
+ avcodec/vp8: Check mutex init
+ avcodec/proresenc_anatoliy: Assert that AV_PROFILE_UNKNOWN is replaced
+ avcodec/pcm-dvdenc: 64bit pkt-size
+ avcodec/notchlc: Check init_get_bits8() for failure
+ avcodec/tests/dct: Use 64bit in intermediate for error computation
+ avcodec/scpr3: Check add_dec() for failure
+ avcodec/rv34: assert that size is not 0 in rv34_gen_vlc_ext()
+ avcodec/wavpackenc: Use unsigned for potential 31bit shift
+ avcodec/tests/jpeg2000dwt: Use 64bit in comparission
+ avcodec/tests/jpeg2000dwt: Use 64bit in err2 computation
+ avformat/fwse: Remove always false expression
+ avcodec/sga: Make it clear that the return is intentionally not checked
+ avformat/asfdec_f: Use 64bit for preroll computation
+ avformat/argo_asf: Use 64bit in offset intermediate
+ avformat/ape: Use 64bit for final frame size
+ avformat/ac4dec: Check remaining space in ac4_probe()
+ avdevice/pulse_audio_enc: Use av_rescale() to avoid integer overflow
+ avcodec/vlc: Cleanup on multi table alloc failure in ff_vlc_init_multi_from_lengths()
+ avcodec/tiff: Assert init_get_bits8() success in unpack_gray()
+ avcodec/tiff: Assert init_get_bits8() success in horizontal_fill()
+ tools/decode_simple: Check avcodec_send_packet() for errors on flushing
+ swscale/yuv2rgb: Use 64bit for brightness computation
+ swscale/x86/swscale: use a clearer name for INPUT_PLANER_RGB_A_FUNC_CASE
+ avutil/tests/opt: Check av_set_options_string() for failure
+ avutil/tests/dict: Check av_dict_set() before get for failure
+ avdevice/dshow: fix badly indented line
+ avformat/demux: resurrect dead stores
+ avcodec/tests/bitstream_template: Assert bits_init8() return
+ tools/enc_recon_frame_test: Assert that av_image_get_linesize() succeeds
+ fftools/ffmpeg: prefer real errors over EOF in err_merge()
+ avcodec/png: more informative error message for invalid sBIT size
+ avcodec/pngdec: avoid erroring with sBIT on indexed-color images
+ avcodec/nvenc: fix segfault in intra-only mode
+ aarch64: Add OpenBSD runtime detection of dotprod and i8mm using sysctl
+ qsv: Initialize impl_value
+ avutil/hwcontext_qsv: fix GCC 14.1 warnings
+ lavc/vp9: reset segmentation fields when segmentation isn't enabled
+ configure: enable ffnvcodec, nvenc, nvdec for FreeBSD
+ avcodec/mscc & mwsc: Check loop counts before use
+ avcodec/mpegvideo_enc: Fix potential overflow in RD
+ avcodec/mpeg4videodec: assert impossible wrap points
+ avcodec/mpeg12dec: Use 64bit in bit computation
+ avcodec/vqcdec: Check init_get_bits8() for failure
+ avcodec/vble: Check av_image_get_buffer_size() for failure
+ avcodec/vp3: Replace check by assert
+ avcodec/vp8: Forward return of ff_vpx_init_range_decoder()
+ avcodec/jpeg2000dec: remove ST=3 case
+ avcodec/qsvdec: Check av_image_get_buffer_size() for failure
+ avcodec/exr: Fix preview overflow
+ avcodec/decode: decode_simple_internal() only implements audio and video
+ avcodec/fmvc: remove dead assignment
+ avcodec/h2645_sei: Remove dead checks
+ avcodec/h264_slice: Remove dead sps check
+ avcodec/lpc: copy levenson coeffs only when they have been computed
+ avutil/tests/base64: Check with too short output array
+ libavutil/base64: Try not to write over the array end
+ avcodec/cbs_av1: Avoid shift overflow
+ fftools/ffplay: Check return of swr_alloc_set_opts2()
+ tools/opt_common: Check for malloc failure
+ doc/examples/demux_decode: Simplify loop
+ avformat/concatdec: Check file
+ avcodec/mpegvideo_enc: Fix 1 line and one column images
+ avcodec/amrwbdec: assert mode to be valid in decode_fixed_vector()
+ avcodec/wavarc: fix integer overflow in decode_5elp() block type 2
+ swscale/output: Fix integer overflow in yuv2rgba64_full_1_c_template()
+ swscale/output: Fix integer overflow in yuv2rgba64_1_c_template
+ avcodec/av1dec: Change bit_depth to int
+ avcodec/av1dec: bit_depth cannot be another values than 8,10,12
+ avcodec/avs3_parser: assert the return value of init_get_bits()
+ avcodec/avs2_parser: Assert init_get_bits8() success with const size 15
+ avformat/mxfdec: Check body_offset
+ avformat/kvag: Check sample_rate
+ avcodec/atrac9dec: Check init_get_bits8() for failure
+ avcodec/ac3_parser: Check init_get_bits8() for failure
+ avcodec/pngdec: Check last AVFrame before deref
+ avcodec/hevcdec: Check ref frame
+ doc/examples/qsv_transcode: Initialize pointer before free
+ doc/examples/qsv_transcode: Simplify str_to_dict() loop
+ doc/examples/vaapi_transcode: Simplify loop
+ doc/examples/qsv_transcode: Simplify loop
+ avcodec/cbs_h2645: Check NAL space
+ avfilter/vf_thumbnail_cuda: Set ret before checking it
+ avfilter/signature_lookup: Dont copy uninitialized stuff around
+ avfilter/signature_lookup: Fix 2 differences to the refernce SW
+ avcodec/x86/vp3dsp_init: Set correct function pointer, fix crash
+ avformat/mp3dec: change bogus error message if read_header encounters EOF
+ avformat/mp3dec: simplify inner frame size check in mp3_read_header
+ avformat/mp3dec: only call ffio_ensure_seekback once
+ avutil/thread: fix pthread_setname_np parameters for NetBSD and Apple
+ avutil/thread: add support for setting thread name on *bsd and solaris
+ avutil/ppc/cpu: Also use the machdep.altivec sysctl on NetBSD
+ lavd/v4l2: Use proper field type for second parameter of ioctl() with BSD's
+ avfilter/avfilter: fix OOM case for default activate
+ avfilter/buffersrc: switch to activate
+ avcodec/mediacodecenc: set quality in cq mode
+ Update for 6.1.2
+ fate/subtitles: Ignore line endings for sub-scc test
+ avformat/mxfdec: Check index_edit_rate
+ swscale/utils: Fix xInc overflow
+ avcodec/wavarc: fix signed integer overflow in block type 6/19
+ doc/developer: (security) researchers should be credited
+ avformat/isom: Uninit layout in ff_mp4_read_dec_config_descr()
+ avcodec/exr: Dont use 64bits to hold 6bits
+ avcodec/exr: Check for remaining bits in huf_unpack_enc_table()
+ avcodec/apedec: Use NABS to avoid undefined negation
+ avformat/mpegts: Reset local nb_prg on add_program() failure
+ avformat/aiffdec: Check for previously set channels
+ avformat/mxfdec: Make edit_unit_byte_count unsigned
+ avformat/movenc: Check that cts fits in 32bit
+ avformat/mxfdec: Check first case of offset_temp computation for overflow
+ avcodec/jpeg2000htdec: warn about non zero roi shift
+ avcodec/jpeg2000htdec: Check magp before using it in a shift
+ avfilter/vf_signature: Dont crash on no frames
+ avformat/westwood_vqa: Fix 2g packets
+ avformat/matroskadec: Check timescale
+ avformat/wavdec: satuarte next_tag_ofs, data_end
+ avformat/wavdec: sanity check channels and bps before using them for block_align
+ avformat/sbgdec: Check for negative duration
+ avformat/rpl: Use 64bit for total_audio_size and check it
+ avformat/timecode: use 64bit for intermediate for rounding in fps_from_frame_rate()
+ avformat/mov: use 64bit for intermediate for rounding
+ avformat/jacosubdec: Use 64bit for abs
+ avformat/concatdec: Check user_duration sum
+ avcodec/wavarc: avoid signed integer overflow in AC code
+ avcodec/wavarc: Avoid signed integer overflow in sample
+ avcodec/truemotion1: Height not being a multiple of 4 is unsupported
+ avcodec/rtv1: fix undefined FFALIGN
+ avcodec/hcadec: do not allow code to continue after failed init
+ avcodec/hcadec: do not set hfr_group_count to invalid values
+ avformat/concatdec: clip outpoint - inpoint overflow in get_best_effort_duration()
+ avcodec/osq: avoid several signed integer overflows
+ avformat/jacosubdec: clarify code
+ avformat/cafdec: Check that data chunk end fits within 64bit
+ avformat/iff: Saturate avio_tell() + 12
+ avformat/dxa: Adjust order of operations around block align
+ avformat/cafdec: dont seek beyond 64bit
+ avformat/id3v2: read_uslt() check for the amount read
+ avcodec/vmixdec: Check shift before use
+ avformat/mov: Check sample_count and auxiliary_info_default_size to be 0
+ avformat/wady: Check >0 samplerate and channels 1 || 2.
+ avcodec/cbs_h266_syntax_template: Check tile_y
+ avcodec/proresenc_kostya: Remove bug similarity text
+ avcodec/vorbisdec: Check remaining data in vorbis_residue_decode_internal()
+ avformat/concatdec: Check in and outpoints to be to produce a positive representable duration
+ avcodec/8bps: Consider width in the minimal size check
+ libswscale/utils: Fix bayer to yuvj
+ swscale/swscale: Check srcSliceH for bayer
+ swscale/utils: Allocate more dithererror
+ avcodec/indeo3: Round dimensions up in allocate_frame_buffers()
+ avutil/rational: Document what is to be expected from av_d2q() of doubles representing rational numbers
+ avfilter/signature_lookup: Do not dereference NULL pointers after malloc failure
+ avfilter/signature_lookup: dont leave uncleared pointers in sll_free()
+ avcodec/mpegvideo_enc: Use ptrdiff_t for stride
+ libavformat/hlsenc.c: Populate OTI using AAC profile in write_codec_attr.
+ avformat/mov: Check if a key is longer than the atom containing it
+ avcodec/nvenc: support SDK 12.2 bit depth API
+ avcodec/nvenc: stop using long deprecated format specifiers
+ avfilter/buffersrc: fix overriding unknown channel layouts with negotiated one
+ avfilter/af_channelmap: disallow channel index 64
+ avfilter/af_channelmap: fix mapping if in_channel was a string but out_channel was not specified
+ avfilter/af_channelmap: fix error message if FL source channel was missing
+ avcodec/nvdec: reset bitstream_len/nb_slices when resetting bitstream pointer
+ avformat/mov: don't abort on duplicate Mastering Display Metadata boxes
+ fftools/ffplay: use correct buffersink channel layout parameters
+ avformat/mpegts: detect synchronous metadata KLV more reliably
+ swresample/resample: fix rounding errors with filter_size=1 and phase_shift=0
+ avformat/mxfdec: remove resolve_strong_ref usage with AnyType
+ avfilter/vf_convolution: add float user_rdiv[4] to allow user options to apply correctly
+ avformat/libsrt: use SRT_EPOLL_IN for waiting for an incoming connection
+ avformat/mxfdec: do not use AnyType when resolving Descriptors and MultipleDescriptors
+ avformat/mxfdec: move resolving Descriptors to the multi descriptor resolve function
+ avutil/hwcontext_d3d11va: prefer DXGI 1.1 factory when available
+ avcodec/libsvtav1: send the EOS signal without a one frame delay to allow for the library to operate in a low-delay mode
+ avcodec/libsvtav1: add version guard for external param
+ lavc/vvc: Read subpic ID when only one subpicture is present
+ lavc/vvc: Correct sps_num_subpics_minus1 minimum
+ avcodec/cbs_h2645: Avoid function pointer casts, fix UB
+ avcodec/cbs_h266_syntax_template: Don't omit unused function parameter
+ avcodec/cbs_h266_syntax_template: check aps_adaptation_parameter_set_id
+ lavc/vvc: Add check to num_multi_layer_olss
+ avcodec/cbs_h266: fix logic setting num_layers_in_ols when vps_ols_mode_idc is 2
+ avcodec/av1dec: fix matrix coefficients exposed by codec context
+ {avcodec,tests}: rename the bundled Mesa AV1 vulkan video headers
+ avformat/mov_chan: never override number of channels based on chan atom
+ avformat/mov_chan: do not assume channels are in native order
+ avfft: avoid overreads with RDFT API users
+ avcodec/nvdec: don't free NVDECContext->bitstream
+ avcodec/mediacodecdec: fix return EAGAIN after EOF
+
+
+version 6.1.1
+- avcodec/mpegvideo_enc: Dont copy beyond the image
+- avfilter/vf_minterpolate: Check pts before division
+- avfilter/avf_showwaves: Check history_nb_samples
+- avformat/flacdec: Avoid double AVERRORS
+- avfilter/vf_vidstabdetect: Avoid double AVERRORS
+- avcodec/vaapi_encode: Avoid double AVERRORS
+- avfilter/vf_swaprect: round coordinates down
+- avfilter/vf_swaprect: Use height for vertical variables
+- avfilter/vf_swaprect: assert that rectangles are within memory
+- avfilter/af_alimiter: Check nextpos before use
+- avfilter/f_reverse: Apply PTS compensation only when pts is available
+- avfilter/af_stereowiden: Check length
+- avformat/mov: Fix MSAN issue with stsd_id
+- avcodec/jpegxl_parser: Check get_vlc2()
+- avfilter/vf_weave: Fix odd height handling
+- avfilter/edge_template: Fix small inputs with gaussian_blur()
+- avfilter/vf_gradfun: Do not overread last line
+- avfilter/avf_showspectrum: fix off by 1 error
+- avcodec/jpegxl_parser: Add padding to cs_buffer
+- avformat/mov: do not set sign bit for chunk_offsets
+- avcodec/jpeglsdec: Check Jpeg-LS LSE
+- avcodec/osq: Implement flush()
+- configure: Enable section_data_rel_ro for FreeBSD and NetBSD aarch64 / arm
+- avcodec/cbs_h266: more restrictive check on pps_tile_idx_delta_val
+- avcodec/jpeg2000htdec: check if block decoding will exceed internal precision
+- tools/target_dec_fuzzer: Adjust threshold for VMIX
+- avcodec/av1dec: Fix resolving zero divisor
+- avformat/mov: Ignore duplicate ftyp
+- avformat/mov: Fix integer overflow in mov_read_packet().
+- lavc/qsvdec: return 0 if more data is required
+- avcodec/jpegxl_parser: check ANS cluster alphabet size vs bundle size
+- libavformat/vvc: Make probe more conservative
+- hwcontext_vulkan: guard unistd.h include
+- lavc/Makefile: build vulkan decode code if vulkan_av1 has been enabled
+- lavc/dvdsubenc: only check canvas size when it is actually set
+- avcodec/decode: validate hw_frames_ctx when AVHWAccel.free_frame_priv is used
+- avcoded/fft: Fix memory leak if ctx2 is used
+- avcodec/fft: Use av_mallocz to avoid invalid free/uninit
+
+
+version 6.1:
 - libaribcaption decoder
 - Playdate video decoder and demuxer
 - Extend VAAPI support for libva-win32 on Windows
@@ -15,3 +15,11 @@ NOTICE
 ------

 - Non system dependencies (e.g. libx264, libvpx) are disabled by default.
+
+NOTICE for Package Maintainers
+------------------------------
+
+ - It is recommended to build FFmpeg twice, first with minimal external dependencies so
+   that 3rd party packages, which depend on FFmpegs libavutil/libavfilter/libavcodec/libavformat
+   can then be built. And last build FFmpeg with full dependancies (which may in turn depend on
+   some of these 3rd party packages). This avoids circular dependencies during build.
@@ -34,8 +34,8 @@ Miscellaneous Areas
 ===================

 documentation                           Stefano Sabatini, Mike Melanson, Timothy Gu, Gyan Doshi
-project server day to day operations    Árpád Gereöffy, Michael Niedermayer, Reimar Doeffinger, Alexander Strasser, Nikolay Aleksandrov
-project server emergencies              Árpád Gereöffy, Reimar Doeffinger, Alexander Strasser, Nikolay Aleksandrov
+project server day to day operations    Árpád Gereöffy, Michael Niedermayer, Reimar Doeffinger, Alexander Strasser, Nikolay Aleksandrov, Timo Rothenpieler
+project server emergencies              Árpád Gereöffy, Reimar Doeffinger, Alexander Strasser, Nikolay Aleksandrov, Timo Rothenpieler
 presets                                 Robert Swain
 metadata subsystem                      Aurelien Jacobs
 release management                      Michael Niedermayer
@@ -588,10 +588,12 @@ wm4
 Releases
 ========

+7.0                                     Michael Niedermayer
+6.1                                     Michael Niedermayer
+5.1                                     Michael Niedermayer
+4.4                                     Michael Niedermayer
+3.4                                     Michael Niedermayer
 2.8                                     Michael Niedermayer
-2.7                                     Michael Niedermayer
-2.6                                     Michael Niedermayer
-2.5                                     Michael Niedermayer

 If you want to maintain an older release, please contact us

@@ -93,10 +93,10 @@ ffbuild/.config: $(CONFIGURABLE_COMPONENTS)
 SUBDIR_VARS := CLEANFILES FFLIBS HOSTPROGS TESTPROGS TOOLS               \
               HEADERS ARCH_HEADERS BUILT_HEADERS SKIPHEADERS            \
               ARMV5TE-OBJS ARMV6-OBJS ARMV8-OBJS VFP-OBJS NEON-OBJS     \
-               ALTIVEC-OBJS VSX-OBJS RVV-OBJS MMX-OBJS X86ASM-OBJS       \
+               ALTIVEC-OBJS VSX-OBJS MMX-OBJS X86ASM-OBJS                \
               MIPSFPU-OBJS MIPSDSPR2-OBJS MIPSDSP-OBJS MSA-OBJS         \
-               MMI-OBJS LSX-OBJS LASX-OBJS OBJS SLIBOBJS SHLIBOBJS       \
-               STLIBOBJS HOSTOBJS TESTOBJS
+               MMI-OBJS LSX-OBJS LASX-OBJS RV-OBJS RVV-OBJS              \
+               OBJS SLIBOBJS SHLIBOBJS STLIBOBJS HOSTOBJS TESTOBJS

 define RESET
 $(1) :=
@@ -1 +1 @@
-5.1.git
+6.1.6
@@ -0,0 +1,15 @@
+
+            ┌──────────────────────────────────────────┐
+            │ RELEASE NOTES for FFmpeg 6.1 "Heaviside" │
+            └──────────────────────────────────────────┘
+
+   The FFmpeg Project proudly presents FFmpeg 6.1 "Heaviside", about 8
+   months after the release of FFmpeg 6.0.
+
+   A complete Changelog is available at the root of the project, and the
+   complete Git history on https://git.ffmpeg.org/gitweb/ffmpeg.git
+
+   We hope you will like this release as much as we enjoyed working on it, and
+   as usual, if you have any questions about it, or any FFmpeg related topic,
+   feel free to join us on the #ffmpeg IRC channel (on irc.libera.chat) or ask
+   on the mailing-lists.
@@ -420,7 +420,9 @@ Advanced options (experts only):
  --enable-hardcoded-tables use hardcoded tables instead of runtime generation
  --disable-safe-bitstream-reader
                           disable buffer boundary checking in bitreaders
-                           (faster, but may crash)
+                           (This disables some security checks and can cause undefined behavior,
+                            crashes and arbitrary code execution, it may be faster, but
+                            should only be used with trusted input)
  --sws-max-filter-size=N  the max filter size swscale uses [$sws_max_filter_size_default]

 Optimization options (experts only):
@@ -2146,10 +2148,12 @@ ARCH_EXT_LIST_PPC="
    ldbrx
    power8
    ppc4xx
+    vec_xl
    vsx
 "

 ARCH_EXT_LIST_RISCV="
+    rv
    rvv
 "

@@ -2227,6 +2231,7 @@ HEADERS_LIST="
    opencv2_core_core_c_h
    OpenGL_gl3_h
    poll_h
+    pthread_np_h
    sys_param_h
    sys_resource_h
    sys_select_h
@@ -2329,6 +2334,8 @@ SYSTEM_FUNCS="
    posix_memalign
    prctl
    pthread_cancel
+    pthread_set_name_np
+    pthread_setname_np
    sched_getaffinity
    SecItemImport
    SetConsoleTextAttribute
@@ -2447,6 +2454,7 @@ HAVE_LIST="
    opencl_vaapi_intel_media
    perl
    pod2man
+    posix_ioctl
    texi2html
    xmllint
    zlib_gzip
@@ -2671,10 +2679,12 @@ altivec_deps="ppc"
 dcbzl_deps="ppc"
 ldbrx_deps="ppc"
 ppc4xx_deps="ppc"
+vec_xl_deps="altivec"
 vsx_deps="altivec"
 power8_deps="vsx"

-rvv_deps="riscv"
+rv_deps="riscv"
+rvv_deps="rv"

 loongson2_deps="mips"
 loongson3_deps="mips"
@@ -3957,6 +3967,8 @@ if test "$target_os_default" = aix; then
    arch_default=$(uname -p)
    strip_default="strip -X32_64"
    nm_default="nm -g -X32_64"
+elif test "$MSYSTEM_CARCH" != ""; then
+    arch_default="$MSYSTEM_CARCH"
 else
    arch_default=$(uname -m)
 fi
@@ -5585,6 +5597,7 @@ case $target_os in
        ;;
    netbsd)
        disable symver
+        enable section_data_rel_ro
        oss_indev_extralibs="-lossaudio"
        oss_outdev_extralibs="-lossaudio"
        enabled gcc || check_ldflags -Wl,-zmuldefs
@@ -5603,6 +5616,7 @@ case $target_os in
        disable symver
        ;;
    freebsd)
+        enable section_data_rel_ro
        ;;
    bsd/os)
        add_extralibs -lpoll -lgnugetopt
@@ -5975,9 +5989,11 @@ enabled pic && enable_weak_pic
 test_cc <<EOF || die "Symbol mangling check failed."
 int ff_extern;
 EOF
-sym=$($nm $TMPO | awk '/ff_extern/{ print substr($0, match($0, /[^ \t]*ff_extern/)) }')
+sym=$($nm $TMPO | awk '/[ \t]+[^ \t]?ff_extern$/{ print substr($0, match($0, /[^ \t]?ff_extern$/)) }')
 extern_prefix=${sym%%ff_extern*}

+log "Symbol prefix detected as: '${extern_prefix}'"
+
 ! disabled inline_asm && check_inline_asm inline_asm '"" ::'

 for restrict_keyword in restrict __restrict__ __restrict ""; do
@@ -6210,8 +6226,14 @@ elif enabled ppc; then
        check_cpp_condition power8 "altivec.h" "defined(_ARCH_PWR8)"
    fi

+    if enabled altivec; then
+        check_cc vec_xl altivec.h "const unsigned char *y1i = { 0 };
+                                   vector unsigned char y0 = vec_xl(0, y1i);"
+    fi
+
 elif enabled riscv; then

+    enabled rv && check_inline_asm rv '".option arch, +zbb\nrev8 t0, t1"'
    enabled rvv && check_inline_asm rvv '".option arch, +v\nvsetivli zero, 0, e8, m1, ta, ma"'

 elif enabled x86; then
@@ -6458,6 +6480,7 @@ check_headers malloc.h
 check_headers mftransform.h
 check_headers net/udplite.h
 check_headers poll.h
+check_headers pthread_np.h
 check_headers sys/param.h
 check_headers sys/resource.h
 check_headers sys/select.h
@@ -6623,6 +6646,12 @@ if ! disabled pthreads && ! enabled w32threads && ! enabled os2threads; then
    if enabled pthreads; then
        check_builtin sem_timedwait semaphore.h "sem_t *s; sem_init(s,0,0); sem_timedwait(s,0); sem_destroy(s)" $pthreads_extralibs
        check_func pthread_cancel $pthreads_extralibs
+        hdrs=pthread.h
+        if enabled pthread_np_h; then
+            hdrs="$hdrs pthread_np.h"
+        fi
+        check_lib pthread_set_name_np "$hdrs" pthread_set_name_np -lpthread
+        check_lib pthread_setname_np "$hdrs" pthread_setname_np -lpthread
    fi
 fi

@@ -6677,7 +6706,7 @@ enabled libaom            && require_pkg_config libaom "aom >= 1.0.0" aom/aom_co
 enabled libaribb24        && { check_pkg_config libaribb24 "aribb24 > 1.0.3" "aribb24/aribb24.h" arib_instance_new ||
                               { enabled gpl && require_pkg_config libaribb24 aribb24 "aribb24/aribb24.h" arib_instance_new; } ||
                               die "ERROR: libaribb24 requires version higher than 1.0.3 or --enable-gpl."; }
-enabled libaribcaption    && require_pkg_config libaribcaption "libaribcaption >= 0.1.0" "aribcaption/aribcaption.h" aribcc_context_alloc
+enabled libaribcaption    && require_pkg_config libaribcaption "libaribcaption >= 1.1.1" "aribcaption/aribcaption.h" aribcc_context_alloc
 enabled lv2               && require_pkg_config lv2 lilv-0 "lilv/lilv.h" lilv_world_new
 enabled libiec61883       && require libiec61883 libiec61883/iec61883.h iec61883_cmp_connect -lraw1394 -lavc1394 -lrom1394 -liec61883
 enabled libass            && require_pkg_config libass "libass >= 0.11.0" ass/ass.h ass_library_init
@@ -6970,14 +6999,16 @@ enabled makeinfo \
 disabled makeinfo_html && texi2html --help 2> /dev/null | grep -q 'init-file' && enable texi2html || disable texi2html
 perl -v            > /dev/null 2>&1 && enable perl      || disable perl
 pod2man --help     > /dev/null 2>&1 && enable pod2man   || disable pod2man
-rsync --help 2> /dev/null | grep -q 'contimeout' && enable rsync_contimeout || disable rsync_contimeout
+rsync --help 2> /dev/null | grep -q 'contimeout=' && enable rsync_contimeout || disable rsync_contimeout
 xmllint --version  > /dev/null 2>&1 && enable xmllint   || disable xmllint

+check_headers linux/fb.h
+check_headers linux/videodev2.h
+test_code cc linux/videodev2.h "struct v4l2_frmsizeenum vfse; vfse.discrete.width = 0;" && enable_sanitized struct_v4l2_frmivalenum_discrete
+test_code cc sys/ioctl.h "int ioctl(int, int, ...)" && enable posix_ioctl
+
 # check V4L2 codecs available in the API
 if enabled v4l2_m2m; then
-    check_headers linux/fb.h
-    check_headers linux/videodev2.h
-    test_code cc linux/videodev2.h "struct v4l2_frmsizeenum vfse; vfse.discrete.width = 0;" && enable_sanitized struct_v4l2_frmivalenum_discrete
    check_cc v4l2_m2m linux/videodev2.h "int i = V4L2_CAP_VIDEO_M2M_MPLANE | V4L2_CAP_VIDEO_M2M | V4L2_BUF_FLAG_LAST;"
    check_cc vc1_v4l2_m2m linux/videodev2.h "int i = V4L2_PIX_FMT_VC1_ANNEX_G;"
    check_cc mpeg1_v4l2_m2m linux/videodev2.h "int i = V4L2_PIX_FMT_MPEG1;"
@@ -7158,7 +7189,7 @@ fi

 if enabled x86; then
    case $target_os in
-        mingw32*|mingw64*|win32|win64|linux|cygwin*)
+        freebsd|mingw32*|mingw64*|win32|win64|linux|cygwin*)
            ;;
        *)
            disable ffnvcodec cuvid nvdec nvenc
@@ -7257,7 +7288,6 @@ void (^block)(void);
 EOF

 # add some linker flags
-check_ldflags -Wl,--warn-common
 check_ldflags -Wl,-rpath-link=:libpostproc:libswresample:libswscale:libavfilter:libavdevice:libavformat:libavcodec:libavutil
 enabled rpath && add_ldexeflags -Wl,-rpath,$libdir && add_ldsoflags -Wl,-rpath,$libdir
 test_ldflags -Wl,-Bsymbolic && append SHFLAGS -Wl,-Bsymbolic
@@ -7736,6 +7766,7 @@ if enabled ppc; then
    echo "POWER8 enabled            ${power8-no}"
    echo "PPC 4xx optimizations     ${ppc4xx-no}"
    echo "dcbzl available           ${dcbzl-no}"
+    echo "vec_xl available          ${vec_xl-no}"
 fi
 if enabled loongarch; then
    echo "LSX enabled               ${lsx-no}"
@@ -7984,7 +8015,7 @@ cat > $TMPH <<EOF
 #define FFMPEG_CONFIG_H
 #define FFMPEG_CONFIGURATION "$(c_escape $FFMPEG_CONFIGURATION)"
 #define FFMPEG_LICENSE "$(c_escape $license)"
-#define CONFIG_THIS_YEAR 2023
+#define CONFIG_THIS_YEAR 2026
 #define FFMPEG_DATADIR "$(eval c_escape $datadir)"
 #define AVCONV_DATADIR "$(eval c_escape $datadir)"
 #define CC_IDENT "$(c_escape ${cc_ident:-Unknown compiler})"
@@ -2,174 +2,176 @@ The last version increases of all libraries were on 2023-02-09

 API changes, most recent first:

-2023-10-27 - xxxxxxxxxx - lavu 58.28.100 - channel_layout.h
+-------- 8< --------- FFmpeg 6.1 was cut here -------- 8< ---------
+
+2023-10-27 - 52a97642604 - lavu 58.28.100 - channel_layout.h
  Add AV_CH_LAYOUT_3POINT1POINT2 and AV_CHANNEL_LAYOUT_3POINT1POINT2.
  Add AV_CH_LAYOUT_5POINT1POINT2_BACK and AV_CHANNEL_LAYOUT_5POINT1POINT2_BACK.
  Add AV_CH_LAYOUT_5POINT1POINT4_BACK and AV_CHANNEL_LAYOUT_5POINT1POINT4_BACK.
  Add AV_CH_LAYOUT_7POINT1POINT2 and AV_CHANNEL_LAYOUT_7POINT1POINT2.
  Add AV_CH_LAYOUT_7POINT1POINT4_BACK and AV_CHANNEL_LAYOUT_7POINT1POINT4_BACK.

-2023-10-06 - xxxxxxxxxx - lavc 60.30.101 - avcodec.h
+2023-10-06 - 804be7f9e3c - lavc 60.30.101 - avcodec.h
  AVCodecContext.coded_side_data may now be used during decoding, to be set
  by user before calling avcodec_open2() for initialization.

-2023-10-06 - xxxxxxxxxx - lavc 60.15.100 - avformat.h
+2023-10-06 - 5432d2aacad - lavc 60.15.100 - avformat.h
  Deprecate AVFormatContext.{nb_,}side_data, av_stream_add_side_data(),
  av_stream_new_side_data(), and av_stream_get_side_data(). Side data fields
  from AVFormatContext.codecpar should be used from now on.

-2023-10-06 - xxxxxxxxxx - lavc 60.30.100 - codec_par.h
+2023-10-06 - 21d7cc6fa9a - lavc 60.30.100 - codec_par.h
  Added {nb_,}coded_side_data to AVCodecParameters.
  The AVCodecParameters helpers will copy it to and from its AVCodecContext
  namesake.

-2023-10-06 - xxxxxxxxxx - lavc 60.29.100 - packet.h
+2023-10-06 - 74279227dd2 - lavc 60.29.100 - packet.h
  Added av_packet_side_data_new(), av_packet_side_data_add(),
  av_packet_side_data_get(), av_packet_side_data_remove, and
  av_packet_side_data_free().

-2023-10-03 - xxxxxxxxxx - lavc 60.28.100 - codec_par.h defs.h
+2023-10-03 - ea14e8bc302 - lavc 60.28.100 - codec_par.h defs.h
  Move the definition of enum AVFieldOrder from codec_par.h to defs.h.

-2023-10-03 - xxxxxxxxxx - lavf 60.14.100 - avformat.h
+2023-10-03 - dd48e49d547 - lavf 60.14.100 - avformat.h
  Deprecate AVFMT_ALLOW_FLUSH without replacement. Users can always
  flush any muxer by sending a NULL packet.

-2023-09-28 - xxxxxxxxxx - lavu 58.27.100 - pixfmt.h
+2023-09-28 - 8e1ef7c38f6 - lavu 58.27.100 - pixfmt.h
  Add AV_PIX_FMT_GBRAP14BE, AV_PIX_FMT_GBRAP14LE pixel formats.

-2023-09-28 - xxxxxxxxxx - lavu 58.26.100 - hwcontext_cuda.h
+2023-09-28 - 05f8b2ca0f7 - lavu 58.26.100 - hwcontext_cuda.h
  Add AV_CUDA_USE_CURRENT_CONTEXT.

-2023-09-19 - xxxxxxxxxx - lavu 58.25.100 - avutil.h
+2023-09-19 - ba9cd06c763 - lavu 58.25.100 - avutil.h
  Make AV_TIME_BASE_Q compatible with C++.

-2023-09-xx - xxxxxxxxxx - lavf 60 - avformat.h
+2023-09-18 - 85e075587dc - lavf 60 - avformat.h
  Deprecate AVFMT_FLAG_SHORTEST without replacement.

-2023-09-07 - xxxxxxxxxx - lavu 58.24.100 - imgutils.h
+2023-09-07 - 423b6a7e493 - lavu 58.24.100 - imgutils.h
  Add av_image_copy2(), a wrapper around the av_image_copy()
  to overcome limitations of automatic conversions.

-2023-09-07 - xxxxxxxxxx - lavu 58.23.100 - fifo.h
+2023-09-07 - 5094d1f429e - lavu 58.23.100 - fifo.h
  Constify the AVFifo pointees in av_fifo_peek() and av_fifo_peek_to_cb().

-2023-09-07 - xxxxxxxxxx - lavu 58.22.100 - audio_fifo.h
+2023-09-07 - fa4bf5793a0 - lavu 58.22.100 - audio_fifo.h
  Constify some pointees in av_audio_fifo_write(), av_audio_fifo_read(),
  av_audio_fifo_peek() and av_audio_fifo_peek_at().

-2023-09-07 - xxxxxxxxxx - lavu 58.21.100 - samplefmt.h
+2023-09-07 - 9bf31f60960 - lavu 58.21.100 - samplefmt.h
  Constify some pointees in av_samples_copy() and av_samples_set_silence().

-2023-09-07 - xxxxxxxxxx - lavu 58.20.100 - imgutils.h
+2023-09-07 - 41285890e03 - lavu 58.20.100 - imgutils.h
  Constify some pointees in av_image_copy(), av_image_copy_uc_from() and
  av_image_fill_black().

-2023-09-07 - xxxxxxxxxx - lavf 60.12.100 - avio.h
+2023-09-07 - 2a68d945cd7 - lavf 60.12.100 - avio.h
  Constify the buffer pointees in the write_packet and write_data_type
  callbacks of AVIOContext on the next major bump.

-2023-09-07 - xxxxxxxxxx - lavc 60.26.100 - defs.h
+2023-09-07 - 8238bc0b5e3 - lavc 60.26.100 - defs.h
  Add AV_PROFILE_* and AV_LEVEL_* replacements in defs.h for the
  defines from avcodec.h. The latter are deprecated.

-2023-09-06 - xxxxxxxxxx - lavc 60.25.101 - avcodec.h
+2023-09-06 - b6627a57f41 - lavc 60.25.101 - avcodec.h
  AVCodecContext.rc_buffer_size may now be set by decoders.

-2023-09-02 - xxxxxxxxxx - lavu 58.19.100 - executor.h
+2023-09-02 - 25ecc94d58f - lavu 58.19.100 - executor.h
  Add AVExecutor API

-2023-09-xx - xxxxxxxxxx - lavc 60.25.100 - avfft.h
+2023-09-01 - 139e54911c8 - lavc 60.25.100 - avfft.h
  The entire header will be deprecated and removed in two major bumps.
  For a replacement to av_dct, av_rdft, av_fft and av_mdct, use
  the new API from libavutil/tx.h.

-2023-07-xx - xxxxxxxxxx - lavu 58.18.100 - tx.h
+2023-09-01 - 11e22730e1e - lavu 58.18.100 - tx.h
  Add AV_TX_REAL_TO_REAL and AV_TX_REAL_TO_IMAGINARY

-2023-08-18 - xxxxxxxxxx - lavu 58.17.100 - channel_layout.h
+2023-08-18 - ff094f5ebbd - lavu 58.17.100 - channel_layout.h
  All AV_CHANNEL_LAYOUT_* macros are now compatible with C++ 17 and older.

-2023-08-08 - xxxxxxxxxx - lavu 58.15.100 - video_hint.h
+2023-08-08 - 5012b4ab4ca - lavu 58.15.100 - video_hint.h
  Add AVVideoHint API.

-2023-07-xx - xxxxxxxxxx - lavc 60 - avcodec.h
+2023-08-08 - 5012b4ab4ca - lavc 60 - avcodec.h
  Deprecate AV_CODEC_FLAG_DROPCHANGED without replacement.

-2023-07-05 - xxxxxxxxxx - lavu 58.14.100 - random_seed.h
+2023-07-05 - d694c25b44c - lavu 58.14.100 - random_seed.h
  Add av_random_bytes()

-2023-05-29 - xxxxxxxxxx - lavc 60.16.100 - avcodec.h codec_id.h
+2023-05-29 - 637afea88ed - lavc 60.16.100 - avcodec.h codec_id.h
  Add AV_CODEC_ID_EVC, FF_PROFILE_EVC_BASELINE, and FF_PROFILE_EVC_MAIN.

-2023-05-29 - xxxxxxxxxx - lavu 58.12.100 - mathematics.h
+2023-05-29 - 75918016ab1 - lavu 58.12.100 - mathematics.h
  Add av_bessel_i0()

-2023-05-xx - xxxxxxxxxx - lavc 60.15.100 - avcodec.h
+2023-05-29 - f3795e18574 - lavc 60.15.100 - avcodec.h
  Add AVHWAccel.update_thread_context, AVHWAccel.free_frame_priv,
  AVHWAccel.flush.

-2023-05-xx - xxxxxxxxxx - lavu 58.11.100 - hwcontext_vulkan.h
+2023-05-29 - db1d0227812 - lavu 58.11.100 - hwcontext_vulkan.h
  Add AVVulkanDeviceContext.lock_queue, AVVulkanDeviceContext.unlock_queue,
  AVVulkanFramesContext.format, AVVulkanFramesContext.lock_frame,
  AVVulkanFramesContext.unlock_frame, AVVkFrame.queue_family.
  Deprecate AV_VK_FRAME_FLAG_CONTIGUOUS_MEMORY (use multiplane images instead).

-2023-05-xx - xxxxxxxxxx - lavu 58.10.100 - pixfmt.h
+2023-05-29 - bef86ba86cc - lavu 58.10.100 - pixfmt.h
  Add AV_PIX_FMT_P212BE, AV_PIX_FMT_P212LE, AV_PIX_FMT_P412BE,
  AV_PIX_FMT_P412LE.

-2023-05-xx - xxxxxxxxxx - lavu 58.8.100 - frame.h
+2023-05-18 - 01d444c077e - lavu 58.8.100 - frame.h
  Add av_frame_replace().

-2023-05-xx - xxxxxxxxxx - lavu 58 - frame.h
+2023-05-18 - 63767b79a57 - lavu 58 - frame.h
  Deprecate AVFrame.palette_has_changed without replacement.

-2023-05-xx - xxxxxxxxxx - lavc 60 - avcodec.h
+2023-05-15 - 7d1d61cc5f5 - lavc 60 - avcodec.h
  Depreate AVCodecContext.ticks_per_frame in favor of
  AVCodecContext.framerate (encoding) and
  AV_CODEC_PROP_FIELDS (decoding).

-2023-05-xx - xxxxxxxxxx - lavc 60.12.100 - codec_desc.h
+2023-05-15 - 70433abf7fb - lavc 60.12.100 - codec_desc.h
  Add AV_CODEC_PROP_FIELDS.

-2023-05-xx - xxxxxxxxxx - lavc 60 - codec.h
+2023-05-15 - 8b20d0dcb5c - lavc 60 - codec.h
  Depreate AV_CODEC_CAP_SUBFRAMES without replacement.

-2023-05-xx - xxxxxxxxxx - lavc 60.11.100 - codec_par.h
+2023-05-07 - c2ae8e30b7f - lavc 60.11.100 - codec_par.h
  Add AVCodecParameters.framerate.

-2023-05-04 - xxxxxxxxxx - lavu 58.7.100 - frame.h
+2023-05-04 - 0fc9c1f6828 - lavu 58.7.100 - frame.h
  Deprecate AVFrame.interlaced_frame, AVFrame.top_field_first, and
  AVFrame.key_frame.
  Add AV_FRAME_FLAG_INTERLACED, AV_FRAME_FLAG_TOP_FIELD_FIRST, and
  AV_FRAME_FLAG_KEY flags as replacement.

-2023-04-10 - xxxxxxxxxx - lavu 58.6.100 - frame.h
+2023-04-10 - 4eaaa38d3df - lavu 58.6.100 - frame.h
  av_frame_get_plane_buffer() now accepts const AVFrame*.

-2023-04-04 - xxxxxxxxxx - lavu 58.6.100 - hdr_dynamic_metadata.h
+2023-04-04 - 61b27b15fc9 - lavu 58.6.100 - hdr_dynamic_metadata.h
  Add AV_HDR_PLUS_MAX_PAYLOAD_SIZE.
  av_dynamic_hdr_plus_create_side_data() now accepts a user provided
  buffer.

-2023-03-xx - xxxxxxxxxx - lavfi 9.5.100 - avfilter.h
+2023-03-24 - 632c3499319 - lavfi 9.5.100 - avfilter.h
  Add AVFILTER_FLAG_HWDEVICE.

-2023-03-21 - xxxxxxxxxx - lavu 58.5.100 - hdr_dynamic_metadata.h
+2023-03-21 - 0a3ce5f7384 - lavu 58.5.100 - hdr_dynamic_metadata.h
  Add av_dynamic_hdr_plus_from_t35() and av_dynamic_hdr_plus_to_t35()
  functions to convert between raw T.35 payloads containing dynamic
  HDR10+ metadata and their parsed representations as AVDynamicHDRPlus.

-2023-03-17 - xxxxxxxxxx - lavu 58.4.100 - hdr_dynamic_vivid_metadata.h
+2023-03-17 - 3be46ee7672 - lavu 58.4.100 - hdr_dynamic_vivid_metadata.h
  Add two group of three spline params.
  Deprecate previous define which only supports one group of params.

-2023-03-02 - xxxxxxxxxx - lavc 60.6.100 - avcodec.h
+2023-03-02 - 373ef1c4fae - lavc 60.6.100 - avcodec.h
  Add FF_PROFILE_EAC3_DDP_ATMOS, FF_PROFILE_TRUEHD_ATMOS,
  FF_PROFILE_DTS_HD_MA_X and FF_PROFILE_DTS_HD_MA_X_IMAX.

-2023-02-25 - xxxxxxxxxx - lavc 60.5.100 - avcodec.h
+2023-02-25 - f4593775436 - lavc 60.5.100 - avcodec.h
  Add FF_PROFILE_HEVC_SCC.

 -------- 8< --------- FFmpeg 6.0 was cut here -------- 8< ---------
@@ -38,7 +38,7 @@ PROJECT_NAME           = FFmpeg
 # could be handy for archiving the generated documentation or if some version
 # control system is used.

-PROJECT_NUMBER         =
+PROJECT_NUMBER         = 6.1.6

 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
@@ -63,4 +63,3 @@ make -j<num>
 make -k
    Continue build in case of errors, this is useful for the regression tests
    sometimes but note that it will still not run all reg tests.
-
@@ -391,7 +391,7 @@ Specifies the encoding scheme of input subtitle text.

@table @samp
@item auto
-Automatically detect text encoding.
+Automatically detect text encoding (default).
@item jis
 8bit-char JIS encoding defined in ARIB STD B24.
 This encoding used in Japan for ISDB captions.
@@ -403,9 +403,6 @@ Latin character encoding defined in ABNT NBR 15606-1.
 This encoding is used in South America for SBTVD / ISDB-Tb captions.
@end table

-The default is @dfn{ass} as same as @dfn{libaribb24} decoder.
-Some present players (e.g., @dfn{mpv}) expect ASS format for ARIB caption.
-
@item -font @var{font_name[,font_name2,...]}
 Specify comma-separated list of font family names to be used for @dfn{bitmap}
 or @dfn{ass} type subtitle rendering.
@@ -427,12 +424,6 @@ If your player cannot handle AVSubtitles with multiple ASS rectangles properly,
 set this option to @var{true} or define @env{ASS_SINGLE_RECT=1} to change
 default behavior at compilation.

-@item -replace_fullwidth_ascii @var{boolean}
-Specify whether to replace MSZ (Middle Size, half width) fullwidth
-alphanumerics with halfwidth alphanumerics.
-
-The default is @var{true}.
-
@item -force_outline_text @var{boolean}
 Specify whether always render outline text for all characters regardless of
 the indication by charactor style.
@@ -459,6 +450,28 @@ Specify whether to render replaced DRCS characters as Unicode characters.

 The default is @var{true}.

+@item -replace_msz_ascii @var{boolean}
+Specify whether to replace MSZ (Middle Size; half width) fullwidth
+alphanumerics with halfwidth alphanumerics.
+
+The default is @var{true}.
+
+@item -replace_msz_japanese @var{boolean}
+Specify whether to replace some MSZ (Middle Size; half width) fullwidth
+japanese special characters with halfwidth ones.
+
+The default is @var{true}.
+
+@item -replace_msz_glyph @var{boolean}
+Specify whether to replace MSZ (Middle Size; half width) characters
+with halfwidth glyphs if the fonts supports it.
+This option works under FreeType or DirectWrite renderer
+with Adobe-Japan1 compliant fonts.
+e.g., IBM Plex Sans JP, Morisawa BIZ UDGothic, Morisawa BIZ UDMincho,
+Yu Gothic, Yu Mincho, and Meiryo.
+
+The default is @var{true}.
+
@item -canvas_size @var{image_size}
 Specify the resolution of the canvas to render subtitles to; usually, this
 should be frame size of input video.
@@ -405,6 +405,13 @@ prefer to use #EXT-X-START if it's in playlist instead of live_start_index.
@item allowed_extensions
 ',' separated list of file extensions that hls is allowed to access.

+@item extension_picky
+This blocks disallowed extensions from probing
+It also requires all available segments to have matching extensions to the format
+except mpegts, which is always allowed.
+It is recommended to set the whitelists correctly instead of depending on extensions
+Enabled by default.
+
@item max_reload
 Maximum number of times a insufficient list is attempted to be reloaded.
 Default value is 1000.
@@ -396,6 +396,10 @@ If you apply a patch, send an
 answer to ffmpeg-devel (or wherever you got the patch from) saying that
 you applied the patch.

+@subheading Credit any researchers
+If a commit/patch fixes an issues found by some researcher, always credit the
+researcher in the commit message for finding/reporting the issue.
+
@subheading Always wait long enough before pushing changes
 Do NOT commit to code actively maintained by others without permission.
 Send a patch to ffmpeg-devel. If no one answers within a reasonable
@@ -640,6 +644,11 @@ patch is inline or attached per mail.
 You can check @url{https://patchwork.ffmpeg.org}, if your patch does not show up, its mime type
 likely was wrong.

+@subheading How to setup git send-email?
+
+Please see @url{https://git-send-email.io/}.
+For gmail additionally see @url{https://shallowsky.com/blog/tech/email/gmail-app-passwds.html}.
+
@subheading Sending patches from email clients
 Using @code{git send-email} might not be desirable for everyone. The
 following trick allows to send patches via email clients in a safe
@@ -924,6 +933,25 @@ In case you need finer control over how valgrind is invoked, use the
@code{--target-exec='valgrind <your_custom_valgrind_options>} option in
 your configure line instead.

+@anchor{Maintenance}
+@chapter Maintenance process
+
+@anchor{MAINTAINERS}
+@section MAINTAINERS
+
+The developers maintaining each part of the codebase are listed in @file{MAINTAINERS}.
+Being listed in @file{MAINTAINERS}, gives one the right to have git write access to
+the specific repository.
+
+@anchor{Becoming a maintainer}
+@section Becoming a maintainer
+
+People add themselves to @file{MAINTAINERS} by sending a patch like any other code
+change. These get reviewed by the community like any other patch. It is expected
+that, if someone has an objection to a new maintainer, she is willing to object
+in public with her full name and is willing to take over maintainership for the area.
+
+
@anchor{Release process}
@chapter Release process

@@ -95,6 +95,7 @@ int main(int argc, char *argv[])
    avio_ctx = avio_alloc_context(avio_ctx_buffer, avio_ctx_buffer_size,
                                  0, &bd, &read_packet, NULL, NULL);
    if (!avio_ctx) {
+        av_freep(&avio_ctx_buffer);
        ret = AVERROR(ENOMEM);
        goto end;
    }
@@ -128,6 +128,10 @@ int main(int argc, char **argv)
    outfilename = argv[2];

    pkt = av_packet_alloc();
+    if (!pkt) {
+        fprintf(stderr, "Could not allocate AVPacket\n");
+        exit(1); /* or proper cleanup and returning */
+    }

    /* find the MPEG audio decoder */
    codec = avcodec_find_decoder(AV_CODEC_ID_MP2);
@@ -161,7 +165,7 @@ int main(int argc, char **argv)
    }
    outfile = fopen(outfilename, "wb");
    if (!outfile) {
-        av_free(c);
+        fprintf(stderr, "Could not open %s\n", outfilename);
        exit(1);
    }

@@ -138,11 +138,9 @@ static int decode_packet(AVCodecContext *dec, const AVPacket *pkt)
            ret = output_audio_frame(frame);

        av_frame_unref(frame);
-        if (ret < 0)
-            return ret;
    }

-    return 0;
+    return ret;
 }

 static int open_codec_context(int *stream_idx,
@@ -347,8 +347,7 @@ static int write_audio_frame(AVFormatContext *oc, OutputStream *ost)
    if (frame) {
        /* convert samples from native format to destination codec format, using the resampler */
        /* compute destination number of samples */
-        dst_nb_samples = av_rescale_rnd(swr_get_delay(ost->swr_ctx, c->sample_rate) + frame->nb_samples,
-                                        c->sample_rate, c->sample_rate, AV_ROUND_UP);
+        dst_nb_samples = swr_get_delay(ost->swr_ctx, c->sample_rate) + frame->nb_samples;
        av_assert0(dst_nb_samples == frame->nb_samples);

        /* when we pass a frame to the encoder, it may keep a reference to it
@@ -62,10 +62,10 @@ static int str_to_dict(char* optstr, AVDictionary **opt)
        return 0;
    key = strtok(optstr, " ");
    if (key == NULL)
-        return AVERROR(ENAVAIL);
+        return AVERROR(EINVAL);
    value = strtok(NULL, " ");
    if (value == NULL)
-        return AVERROR(ENAVAIL);
+        return AVERROR(EINVAL);
    av_dict_set(opt, key, value, 0);
    do {
        key = strtok(NULL, " ");
@@ -73,10 +73,9 @@ static int str_to_dict(char* optstr, AVDictionary **opt)
            return 0;
        value = strtok(NULL, " ");
        if (value == NULL)
-            return AVERROR(ENAVAIL);
+            return AVERROR(EINVAL);
        av_dict_set(opt, key, value, 0);
-    } while(key != NULL);
-    return 0;
+    } while(1);
 }

 static int dynamic_set_parameter(AVCodecContext *avctx)
@@ -181,7 +180,7 @@ static int open_input_file(char *filename)
        break;
    default:
        fprintf(stderr, "Codec is not supportted by qsv\n");
-        return AVERROR(ENAVAIL);
+        return AVERROR(EINVAL);
    }

    if (!(decoder_ctx = avcodec_alloc_context3(decoder)))
@@ -334,17 +333,15 @@ static int dec_enc(AVPacket *pkt, const AVCodec *enc_codec, char *optstr)

 fail:
        av_frame_free(&frame);
-        if (ret < 0)
-            return ret;
    }
-    return 0;
+    return ret;
 }

 int main(int argc, char **argv)
 {
    const AVCodec *enc_codec;
    int ret = 0;
-    AVPacket *dec_pkt;
+    AVPacket *dec_pkt = NULL;

    if (argc < 5 || (argc - 5) % 2) {
        av_log(NULL, AV_LOG_ERROR, "Usage: %s <input file> <encoder> <output file>"
@@ -88,6 +88,10 @@ static int encode_write(AVCodecContext *avctx, AVFrame *frame, FILE *fout)
        enc_pkt->stream_index = 0;
        ret = fwrite(enc_pkt->data, enc_pkt->size, 1, fout);
        av_packet_unref(enc_pkt);
+        if (ret != enc_pkt->size) {
+            ret = AVERROR(errno);
+            break;
+        }
    }

 end:
@@ -215,10 +215,8 @@ static int dec_enc(AVPacket *pkt, const AVCodec *enc_codec)

 fail:
        av_frame_free(&frame);
-        if (ret < 0)
-            return ret;
    }
-    return 0;
+    return ret;
 }

 int main(int argc, char **argv)
@@ -1,5 +1,5 @@
 slot=                                    # some unique identifier
-repo=git://source.ffmpeg.org/ffmpeg.git  # the source repository
+repo=https://git.ffmpeg.org/ffmpeg.git   # the source repository
 #branch=release/2.6                       # the branch to test
 samples=                                 # path to samples directory
 workdir=                                 # directory in which to do all the work
@@ -11,16 +11,21 @@ ignore_tests=
 # the following are optional and map to configure options
 arch=
 cpu=
+toolchain=
 cross_prefix=
 as=
 cc=
+cxx=
 ld=
+nm=
 target_os=
 sysroot=
 target_exec=
 target_path=
 target_samples=
 extra_cflags=
+extra_cxxflags=
+extra_objcflags=
 extra_ldflags=
 extra_libs=
 extra_conf=     # extra configure options not covered above
@@ -143,7 +143,7 @@ git log <filename(s)>
@end example

 You may also use the graphical tools like @command{gitview} or @command{gitk}
-or the web interface available at @url{http://source.ffmpeg.org/}.
+or the web interface available at @url{https://git.ffmpeg.org/ffmpeg.git}.

@section Checking source tree status

@@ -344,7 +344,7 @@ recommended.
 Avoid sending the same message to multiple mailing lists.

@item
-Please follow our @url{https://ffmpeg.org/community.html#Code-of-conduct, Code of Conduct}.
+Please follow our @url{https://ffmpeg.org/community.html#Code-of-Conduct, Code of Conduct}.
@end itemize

@chapter Help
@@ -157,4 +157,3 @@ PFD[32]   would for example be signed 32 bit little-endian IEEE float
@item XVID @tab non-compliant MPEG-4 generated by old Xvid
@item XVIX @tab non-compliant MPEG-4 generated by old Xvid with interlacing bug
@end multitable
-
@@ -20,8 +20,57 @@
 # License along with FFmpeg; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA

+# Texinfo 7.0 changed the syntax of various functions.
+# Provide a shim for older versions.
+sub ff_set_from_init_file($$) {
+    my $key = shift;
+    my $value = shift;
+    if (exists &{'texinfo_set_from_init_file'}) {
+        texinfo_set_from_init_file($key, $value);
+    } else {
+        set_from_init_file($key, $value);
+    }
+}
+
+sub ff_get_conf($) {
+    my $key = shift;
+    if (exists &{'texinfo_get_conf'}) {
+        texinfo_get_conf($key);
+    } else {
+        get_conf($key);
+    }
+}
+
+sub get_formatting_function($$) {
+    my $obj = shift;
+    my $func = shift;
+
+    my $sub = $obj->can('formatting_function');
+    if ($sub) {
+        return $obj->formatting_function($func);
+    } else {
+        return $obj->{$func};
+    }
+}
+
+# determine texinfo version
+my $package_version = ff_get_conf('PACKAGE_VERSION');
+$package_version =~ s/\+dev$//;
+my $program_version_num = version->declare($package_version)->numify;
+my $program_version_6_8 = $program_version_num >= 6.008000;
+
 # no navigation elements
-set_from_init_file('HEADERS', 0);
+ff_set_from_init_file('HEADERS', 0);
+
+my %sectioning_commands = %Texinfo::Common::sectioning_commands;
+if (scalar(keys(%sectioning_commands)) == 0) {
+  %sectioning_commands = %Texinfo::Commands::sectioning_heading_commands;
+}
+
+my %root_commands = %Texinfo::Common::root_commands;
+if (scalar(keys(%root_commands)) == 0) {
+  %root_commands = %Texinfo::Commands::root_commands;
+}

 sub ffmpeg_heading_command($$$$$)
 {
@@ -40,6 +89,9 @@ sub ffmpeg_heading_command($$$$$)
        return $result;
    }

+    # no need to set it as the $element_id is output unconditionally
+    my $heading_id;
+
    my $element_id = $self->command_id($command);
    $result .= "<a name=\"$element_id\"></a>\n"
        if (defined($element_id) and $element_id ne '');
@@ -47,24 +99,40 @@ sub ffmpeg_heading_command($$$$$)
    print STDERR "Process $command "
        .Texinfo::Structuring::_print_root_command_texi($command)."\n"
            if ($self->get_conf('DEBUG'));
-    my $element;
-    if ($Texinfo::Common::root_commands{$command->{'cmdname'}}
-        and $command->{'parent'}
-        and $command->{'parent'}->{'type'}
-        and $command->{'parent'}->{'type'} eq 'element') {
-        $element = $command->{'parent'};
+    my $output_unit;
+    if ($root_commands{$command->{'cmdname'}}) {
+        if ($command->{'associated_unit'}) {
+          $output_unit = $command->{'associated_unit'};
+        } elsif ($command->{'structure'}
+                 and $command->{'structure'}->{'associated_unit'}) {
+          $output_unit = $command->{'structure'}->{'associated_unit'};
+        } elsif ($command->{'parent'}
+                 and $command->{'parent'}->{'type'}
+                 and $command->{'parent'}->{'type'} eq 'element') {
+          $output_unit = $command->{'parent'};
+        }
    }
-    if ($element) {
-        $result .= &{$self->{'format_element_header'}}($self, $cmdname,
-                                                       $command, $element);
+
+    if ($output_unit) {
+        $result .= &{get_formatting_function($self, 'format_element_header')}($self, $cmdname,
+                                                       $command, $output_unit);
    }

    my $heading_level;
    # node is used as heading if there is nothing else.
    if ($cmdname eq 'node') {
-        if (!$element or (!$element->{'extra'}->{'section'}
-            and $element->{'extra'}->{'node'}
-            and $element->{'extra'}->{'node'} eq $command
+        if (!$output_unit or
+            (((!$output_unit->{'extra'}->{'section'}
+              and $output_unit->{'extra'}->{'node'}
+              and $output_unit->{'extra'}->{'node'} eq $command)
+             or
+             ((($output_unit->{'extra'}->{'unit_command'}
+                and $output_unit->{'extra'}->{'unit_command'} eq $command)
+               or
+               ($output_unit->{'unit_command'}
+                and $output_unit->{'unit_command'} eq $command))
+              and $command->{'extra'}
+              and not $command->{'extra'}->{'associated_section'}))
             # bogus node may not have been normalized
            and defined($command->{'extra'}->{'normalized'}))) {
            if ($command->{'extra'}->{'normalized'} eq 'Top') {
@@ -74,7 +142,15 @@ sub ffmpeg_heading_command($$$$$)
            }
        }
    } else {
-        $heading_level = $command->{'level'};
+        if (defined($command->{'extra'})
+            and defined($command->{'extra'}->{'section_level'})) {
+          $heading_level = $command->{'extra'}->{'section_level'};
+        } elsif ($command->{'structure'}
+                 and defined($command->{'structure'}->{'section_level'})) {
+          $heading_level = $command->{'structure'}->{'section_level'};
+        } else {
+          $heading_level = $command->{'level'};
+        }
    }

    my $heading = $self->command_text($command);
@@ -82,8 +158,8 @@ sub ffmpeg_heading_command($$$$$)
    # if there is an error in the node.
    if (defined($heading) and $heading ne '' and defined($heading_level)) {

-        if ($Texinfo::Common::root_commands{$cmdname}
-            and $Texinfo::Common::sectioning_commands{$cmdname}) {
+        if ($root_commands{$cmdname}
+            and $sectioning_commands{$cmdname}) {
            my $content_href = $self->command_contents_href($command, 'contents',
                                                            $self->{'current_filename'});
            if ($content_href) {
@@ -103,7 +179,13 @@ sub ffmpeg_heading_command($$$$$)
            }
        }

-        if ($self->in_preformatted()) {
+        my $in_preformatted;
+        if ($program_version_num >= 7.001090) {
+          $in_preformatted = $self->in_preformatted_context();
+        } else {
+          $in_preformatted = $self->in_preformatted();
+        }
+        if ($in_preformatted) {
            $result .= $heading."\n";
        } else {
            # if the level was changed, set the command name right
@@ -112,37 +194,41 @@ sub ffmpeg_heading_command($$$$$)
                $cmdname
                    = $Texinfo::Common::level_to_structuring_command{$cmdname}->[$heading_level];
            }
-            $result .= &{$self->{'format_heading_text'}}(
+            if ($program_version_num >= 7.000000) {
+                $result .= &{get_formatting_function($self,'format_heading_text')}($self,
+                     $cmdname, [$cmdname], $heading,
+                     $heading_level +$self->get_conf('CHAPTER_HEADER_LEVEL') -1,
+                     $heading_id, $command);
+
+            } else {
+              $result .= &{get_formatting_function($self,'format_heading_text')}(
                        $self, $cmdname, $heading,
                        $heading_level +
                        $self->get_conf('CHAPTER_HEADER_LEVEL') - 1, $command);
+            }
        }
    }
    $result .= $content if (defined($content));
    return $result;
 }

-foreach my $command (keys(%Texinfo::Common::sectioning_commands), 'node') {
+foreach my $command (keys(%sectioning_commands), 'node') {
    texinfo_register_command_formatting($command, \&ffmpeg_heading_command);
 }

-# determine if texinfo is at least version 6.8
-my $program_version_num = version->declare(get_conf('PACKAGE_VERSION'))->numify;
-my $program_version_6_8 = $program_version_num >= 6.008000;
-
 # print the TOC where @contents is used
 if ($program_version_6_8) {
-    set_from_init_file('CONTENTS_OUTPUT_LOCATION', 'inline');
+    ff_set_from_init_file('CONTENTS_OUTPUT_LOCATION', 'inline');
 } else {
-    set_from_init_file('INLINE_CONTENTS', 1);
+    ff_set_from_init_file('INLINE_CONTENTS', 1);
 }

 # make chapters <h2>
-set_from_init_file('CHAPTER_HEADER_LEVEL', 2);
+ff_set_from_init_file('CHAPTER_HEADER_LEVEL', 2);

 # Do not add <hr>
-set_from_init_file('DEFAULT_RULE', '');
-set_from_init_file('BIG_RULE', '');
+ff_set_from_init_file('DEFAULT_RULE', '');
+ff_set_from_init_file('BIG_RULE', '');

 # Customized file beginning
 sub ffmpeg_begin_file($$$)
@@ -151,17 +237,56 @@ sub ffmpeg_begin_file($$$)
    my $filename = shift;
    my $element = shift;

-    my $command;
-    if ($element and $self->get_conf('SPLIT')) {
-        $command = $self->element_command($element);
+    my ($element_command, $node_command, $command_for_title);
+    if ($element) {
+        if ($element->{'unit_command'}) {
+          $element_command = $element->{'unit_command'};
+        } elsif ($self->can('tree_unit_element_command')) {
+          $element_command = $self->tree_unit_element_command($element);
+        } elsif ($self->can('tree_unit_element_command')) {
+          $element_command = $self->element_command($element);
+        }
+
+       $node_command = $element_command;
+       if ($element_command and $element_command->{'cmdname'}
+           and $element_command->{'cmdname'} ne 'node'
+           and $element_command->{'extra'}
+           and $element_command->{'extra'}->{'associated_node'}) {
+         $node_command = $element_command->{'extra'}->{'associated_node'};
+       }
+
+       $command_for_title = $element_command if ($self->get_conf('SPLIT'));
    }

-    my ($title, $description, $encoding, $date, $css_lines,
-        $doctype, $bodytext, $copying_comment, $after_body_open,
-        $extra_head, $program_and_version, $program_homepage,
-        $program, $generator) = $self->_file_header_informations($command);
+    my ($title, $description, $keywords, $encoding, $date, $css_lines, $doctype,
+        $root_html_element_attributes, $body_attributes, $copying_comment,
+        $after_body_open, $extra_head, $program_and_version, $program_homepage,
+        $program, $generator);
+    if ($program_version_num >= 7.001090) {
+        ($title, $description, $keywords, $encoding, $date, $css_lines, $doctype,
+         $root_html_element_attributes, $body_attributes, $copying_comment,
+         $after_body_open, $extra_head, $program_and_version, $program_homepage,
+         $program, $generator) = $self->_file_header_information($command_for_title,
+                                                                 $filename);
+    } elsif ($program_version_num >= 7.000000) {
+        ($title, $description, $encoding, $date, $css_lines, $doctype,
+         $root_html_element_attributes, $copying_comment, $after_body_open,
+         $extra_head, $program_and_version, $program_homepage,
+         $program, $generator) = $self->_file_header_information($command_for_title,
+                                                                 $filename);
+    } else {
+        ($title, $description, $encoding, $date, $css_lines,
+         $doctype, $root_html_element_attributes, $copying_comment,
+         $after_body_open, $extra_head, $program_and_version, $program_homepage,
+         $program, $generator) = $self->_file_header_informations($command_for_title);
+    }

-    my $links = $self->_get_links ($filename, $element);
+    my $links;
+    if ($program_version_num >= 7.000000) {
+      $links = $self->_get_links($filename, $element, $node_command);
+    } else {
+      $links = $self->_get_links ($filename, $element);
+    }

    my $head1 = $ENV{"FFMPEG_HEADER1"} || <<EOT;
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
@@ -204,13 +329,25 @@ sub ffmpeg_program_string($)
  if (defined($self->get_conf('PROGRAM'))
      and $self->get_conf('PROGRAM') ne ''
      and defined($self->get_conf('PACKAGE_URL'))) {
-    return $self->convert_tree(
+    if ($program_version_num >= 7.001090) {
+     return $self->convert_tree(
+      $self->cdt('This document was generated using @uref{{program_homepage}, @emph{{program}}}.',
+         { 'program_homepage' => {'text' => $self->get_conf('PACKAGE_URL')},
+           'program' => {'text' => $self->get_conf('PROGRAM') }}));
+    } else {
+     return $self->convert_tree(
      $self->gdt('This document was generated using @uref{{program_homepage}, @emph{{program}}}.',
-         { 'program_homepage' => $self->get_conf('PACKAGE_URL'),
-           'program' => $self->get_conf('PROGRAM') }));
+         { 'program_homepage' => {'text' => $self->get_conf('PACKAGE_URL')},
+           'program' => {'text' => $self->get_conf('PROGRAM') }}));
+    }
  } else {
-    return $self->convert_tree(
-      $self->gdt('This document was generated automatically.'));
+    if ($program_version_num >= 7.001090) {
+      return $self->convert_tree(
+        $self->cdt('This document was generated automatically.'));
+    } else {
+      return $self->convert_tree(
+        $self->gdt('This document was generated automatically.'));
+    }
  }
 }
 if ($program_version_6_8) {
@@ -223,7 +360,7 @@ if ($program_version_6_8) {
 sub ffmpeg_end_file($)
 {
    my $self = shift;
-    my $program_string = &{$self->{'format_program_string'}}($self);
+    my $program_string = &{get_formatting_function($self,'format_program_string')}($self);
    my $program_text = <<EOT;
      <p style="font-size: small;">
        $program_string
@@ -244,7 +381,7 @@ if ($program_version_6_8) {

 # Dummy title command
 # Ignore title. Title is handled through ffmpeg_begin_file().
-set_from_init_file('USE_TITLEPAGE_FOR_TITLE', 1);
+ff_set_from_init_file('USE_TITLEPAGE_FOR_TITLE', 1);
 sub ffmpeg_title($$$$)
 {
    return '';
@@ -262,8 +399,14 @@ sub ffmpeg_float($$$$$)
    my $args = shift;
    my $content = shift;

-    my ($caption, $prepended) = Texinfo::Common::float_name_caption($self,
-                                                                $command);
+    my ($caption, $prepended);
+    if ($program_version_num >= 7.000000) {
+        ($caption, $prepended) = Texinfo::Convert::Converter::float_name_caption($self,
+                                                                                 $command);
+    } else {
+        ($caption, $prepended) = Texinfo::Common::float_name_caption($self,
+                                                                     $command);
+    }
    my $caption_text = '';
    my $prepended_text;
    my $prepended_save = '';
@@ -335,8 +478,13 @@ sub ffmpeg_float($$$$$)
            $caption->{'args'}->[0], 'float caption');
    }
    if ($prepended_text.$caption_text ne '') {
-        $prepended_text = $self->_attribute_class('div','float-caption'). '>'
-                . $prepended_text;
+        if ($program_version_num >= 7.000000) {
+            $prepended_text = $self->html_attribute_class('div',['float-caption']). '>'
+                    . $prepended_text;
+        } else {
+            $prepended_text = $self->_attribute_class('div','float-caption'). '>'
+                    . $prepended_text;
+        }
        $caption_text .= '</div>';
    }
    my $html_class = '';
@@ -349,8 +497,13 @@ sub ffmpeg_float($$$$$)
        $prepended_text = '';
        $caption_text   = '';
    }
-    return $self->_attribute_class('div', $html_class). '>' . "\n" .
-        $prepended_text . $caption_text . $content . '</div>';
+    if ($program_version_num >= 7.000000) {
+        return $self->html_attribute_class('div', [$html_class]). '>' . "\n" .
+            $prepended_text . $caption_text . $content . '</div>';
+    } else {
+        return $self->_attribute_class('div', $html_class). '>' . "\n" .
+            $prepended_text . $caption_text . $content . '</div>';
+    }
 }

 texinfo_register_command_formatting('float',
@@ -44,4 +44,3 @@ a+b*c;
 here the reader knows that a,b,c are meant to be signed integers but for C
 standard compliance / to avoid undefined behavior they are stored in unsigned
 ints.
-
@@ -15,6 +15,7 @@ OBJS-$(HAVE_LASX)      += $(LASX-OBJS)       $(LASX-OBJS-yes)
 OBJS-$(HAVE_ALTIVEC) += $(ALTIVEC-OBJS) $(ALTIVEC-OBJS-yes)
 OBJS-$(HAVE_VSX)     += $(VSX-OBJS) $(VSX-OBJS-yes)

+OBJS-$(HAVE_RV)      += $(RV-OBJS)      $(RV-OBJS-yes)
 OBJS-$(HAVE_RVV)     += $(RVV-OBJS)     $(RVV-OBJS-yes)

 OBJS-$(HAVE_MMX)     += $(MMX-OBJS)     $(MMX-OBJS-yes)
@@ -1,3 +1,5 @@
+#!/bin/sh
+
 toupper(){
    echo "$@" | tr abcdefghijklmnopqrstuvwxyz ABCDEFGHIJKLMNOPQRSTUVWXYZ
 }
@@ -512,7 +512,7 @@ static const AVOption *opt_find(void *obj, const char *name, const char *unit,
    return o;
 }

-#define FLAGS (o->type == AV_OPT_TYPE_FLAGS && (arg[0]=='-' || arg[0]=='+')) ? AV_DICT_APPEND : 0
+#define FLAGS ((o->type == AV_OPT_TYPE_FLAGS && (arg[0]=='-' || arg[0]=='+')) ? AV_DICT_APPEND : 0)
 int opt_default(void *optctx, const char *opt, const char *arg)
 {
    const AVOption *o;
@@ -325,8 +325,9 @@ static int read_key(void)
        }
        //Read it
        if(nchars != 0) {
-            read(0, &ch, 1);
-            return ch;
+            if (read(0, &ch, 1) == 1)
+                return ch;
+            return 0;
        }else{
            return -1;
        }
@@ -282,6 +282,8 @@ typedef struct OptionsContext {
    int        nb_enc_stats_post_fmt;
    SpecifierOpt *mux_stats_fmt;
    int        nb_mux_stats_fmt;
+
+    int depth;
 } OptionsContext;

 typedef struct InputFilter {
@@ -883,11 +885,12 @@ void update_benchmark(const char *fmt, ...);
 /**
 * Merge two return codes - return one of the error codes if at least one of
 * them was negative, 0 otherwise.
- * Currently just picks the first one, eventually we might want to do something
- * more sophisticated, like sorting them by priority.
 */
 static inline int err_merge(int err0, int err1)
 {
+    // prefer "real" errors over EOF
+    if ((err0 >= 0 || err0 == AVERROR_EOF) && err1 < 0)
+        return err1;
    return (err0 < 0) ? err0 : FFMIN(err1, 0);
 }

@@ -1280,6 +1280,56 @@ static int ist_add(const OptionsContext *o, Demuxer *d, AVStream *st)
    return 0;
 }

+static int is_windows_reserved_device_name(const char *f)
+{
+#if HAVE_DOS_PATHS
+    for (const char *p = f; p && *p; ) {
+        char stem[6], *s;
+        av_strlcpy(stem, p, sizeof(stem));
+        if ((s = strchr(stem, '.')))
+            *s = 0;
+        if ((s = strpbrk(stem, "123456789")))
+            *s = '1';
+
+        if( !av_strcasecmp(stem, "AUX") ||
+            !av_strcasecmp(stem, "CON") ||
+            !av_strcasecmp(stem, "NUL") ||
+            !av_strcasecmp(stem, "PRN") ||
+            !av_strcasecmp(stem, "COM1") ||
+            !av_strcasecmp(stem, "LPT1")
+        )
+            return 1;
+
+        p = strchr(p, '/');
+        if (p)
+            p++;
+    }
+#endif
+    return 0;
+}
+
+static int safe_filename(const char *f, int allow_subdir)
+{
+    const char *start = f;
+
+    if (!*f || is_windows_reserved_device_name(f))
+        return 0;
+
+    for (; *f; f++) {
+        /* A-Za-z0-9_- */
+        if (!((unsigned)((*f | 32) - 'a') < 26 ||
+              (unsigned)(*f - '0') < 10 || *f == '_' || *f == '-')) {
+            if (f == start)
+                return 0;
+            else if (allow_subdir && *f == '/')
+                start = f + 1;
+            else if (*f != '.')
+                return 0;
+        }
+    }
+    return 1;
+}
+
 static int dump_attachment(InputStream *ist, const char *filename)
 {
    AVStream *st = ist->st;
@@ -1291,8 +1341,13 @@ static int dump_attachment(InputStream *ist, const char *filename)
        av_log(ist, AV_LOG_WARNING, "No extradata to dump.\n");
        return 0;
    }
-    if (!*filename && (e = av_dict_get(st->metadata, "filename", NULL, 0)))
+    if (!*filename && (e = av_dict_get(st->metadata, "filename", NULL, 0))) {
        filename = e->value;
+        if (!safe_filename(filename, 0)) {
+            av_log(ist, AV_LOG_ERROR, "Filename %s is unsafe\n", filename);
+            return AVERROR(EINVAL);
+        }
+    }
    if (!*filename) {
        av_log(ist, AV_LOG_FATAL, "No filename specified and no 'filename' tag");
        return AVERROR(EINVAL);
@@ -1363,6 +1418,8 @@ int ifile_open(const OptionsContext *o, const char *filename)
    char *    data_codec_name = NULL;
    int scan_all_pmts_set = 0;

+    int64_t use_wallclock_as_timestamps;
+
    int64_t start_time     = o->start_time;
    int64_t start_time_eof = o->start_time_eof;
    int64_t stop_time      = o->stop_time;
@@ -1595,6 +1652,12 @@ int ifile_open(const OptionsContext *o, const char *filename)
    d->nb_streams_warn = ic->nb_streams;

    f->format_nots = !!(ic->iformat->flags & AVFMT_NOTIMESTAMPS);
+    ret = av_opt_get_int(ic, "use_wallclock_as_timestamps", 0, &use_wallclock_as_timestamps);
+    if (ret < 0)
+        return ret;
+
+    if (use_wallclock_as_timestamps)
+        f->format_nots = 0;

    f->readrate = o->readrate ? o->readrate : 0.0;
    if (f->readrate < 0.0f) {
@@ -490,9 +490,9 @@ void enc_stats_write(OutputStream *ost, EncStats *es,
    AVRational  tbi = (AVRational){ 0, 1};
    int64_t    ptsi = INT64_MAX;

-    const FrameData *fd;
+    const FrameData *fd = NULL;

-    if ((frame && frame->opaque_ref) || (pkt && pkt->opaque_ref)) {
+    if (frame ? frame->opaque_ref : pkt->opaque_ref) {
        fd   = (const FrameData*)(frame ? frame->opaque_ref->data : pkt->opaque_ref->data);
        tbi  = fd->dec.tb;
        ptsi = fd->dec.pts;
@@ -845,6 +845,7 @@ static int new_stream_audio(Muxer *mux, const OptionsContext *o,
        int channels = 0;
        char *layout = NULL;
        char *sample_fmt = NULL;
+        const char *apad = NULL;

        MATCH_PER_STREAM_OPT(audio_channels, i, channels, oc, st);
        if (channels) {
@@ -882,8 +883,12 @@ static int new_stream_audio(Muxer *mux, const OptionsContext *o,

        MATCH_PER_STREAM_OPT(audio_sample_rate, i, audio_enc->sample_rate, oc, st);

-        MATCH_PER_STREAM_OPT(apad, str, ost->apad, oc, st);
-        ost->apad = av_strdup(ost->apad);
+        MATCH_PER_STREAM_OPT(apad, str, apad, oc, st);
+        if (apad) {
+            ost->apad = av_strdup(apad);
+            if (!ost->apad)
+                return AVERROR(ENOMEM);
+        }

 #if FFMPEG_OPT_MAP_CHANNEL
        /* check for channel mapping for this audio stream */
@@ -1467,7 +1472,7 @@ static int map_auto_video(Muxer *mux, const OptionsContext *o)
 {
    AVFormatContext *oc = mux->fc;
    InputStream *best_ist = NULL;
-    int best_score = 0;
+    int64_t best_score = 0;
    int qcr;

    /* video: highest resolution */
@@ -1478,16 +1483,16 @@ static int map_auto_video(Muxer *mux, const OptionsContext *o)
    for (int j = 0; j < nb_input_files; j++) {
        InputFile *ifile = input_files[j];
        InputStream *file_best_ist = NULL;
-        int file_best_score = 0;
+        int64_t file_best_score = 0;
        for (int i = 0; i < ifile->nb_streams; i++) {
            InputStream *ist = ifile->streams[i];
-            int score;
+            int64_t score;

            if (ist->user_set_discard == AVDISCARD_ALL ||
                ist->st->codecpar->codec_type != AVMEDIA_TYPE_VIDEO)
                continue;

-            score = ist->st->codecpar->width * ist->st->codecpar->height
+            score = ist->st->codecpar->width * (int64_t)ist->st->codecpar->height
                       + 100000000 * !!(ist->st->event_flags & AVSTREAM_EVENT_FLAG_NEW_PACKETS)
                       + 5000000*!!(ist->st->disposition & AV_DISPOSITION_DEFAULT);
            if((qcr!=MKTAG('A', 'P', 'I', 'C')) && (ist->st->disposition & AV_DISPOSITION_ATTACHED_PIC))
@@ -2182,11 +2187,11 @@ static int copy_metadata(Muxer *mux, AVFormatContext *ic,
    if (ret < 0)
        return ret;

-    if (type_in == 'g' || type_out == 'g' || !*outspec)
+    if (type_in == 'g' || type_out == 'g' || (!*outspec && !ic))
        *metadata_global_manual = 1;
-    if (type_in == 's' || type_out == 's' || !*outspec)
+    if (type_in == 's' || type_out == 's' || (!*outspec && !ic))
        *metadata_streams_manual = 1;
-    if (type_in == 'c' || type_out == 'c' || !*outspec)
+    if (type_in == 'c' || type_out == 'c' || (!*outspec && !ic))
        *metadata_chapters_manual = 1;

    /* ic is NULL when just disabling automatic mappings */
@@ -427,6 +427,8 @@ static int opt_map(void *optctx, const char *opt, const char *arg)
            for (i = 0; i < o->nb_stream_maps; i++) {
                m = &o->stream_maps[i];
                if (file_idx == m->file_index &&
+                    m->stream_index >= 0 &&
+                    m->stream_index < input_files[m->file_index]->nb_streams &&
                    check_stream_specifier(input_files[m->file_index]->ctx,
                                           input_files[m->file_index]->ctx->streams[m->stream_index],
                                           *p == ':' ? p + 1 : p) > 0)
@@ -1015,6 +1017,12 @@ static int opt_preset(void *optctx, const char *opt, const char *arg)
    char filename[1000], line[1000], tmp_line[1000];
    const char *codec_name = NULL;
    int ret = 0;
+    int depth = o->depth;
+
+    if (depth > 2) {
+        av_log(NULL, AV_LOG_ERROR, "too deep recursion\n");
+        return AVERROR(EINVAL);
+    }

    tmp_line[0] = *opt;
    tmp_line[1] = 0;
@@ -1028,6 +1036,7 @@ static int opt_preset(void *optctx, const char *opt, const char *arg)
        return AVERROR(ENOENT);
    }

+    o->depth ++;
    while (fgets(line, sizeof(line), f)) {
        char *key = tmp_line, *value, *endptr;

@@ -1055,6 +1064,7 @@ static int opt_preset(void *optctx, const char *opt, const char *arg)
    }

 fail:
+    o->depth = depth;
    fclose(f);

    return ret;
@@ -1999,6 +1999,8 @@ static int configure_audio_filters(VideoState *is, const char *afilters, int for
        goto end;

    if (force_output_format) {
+        av_bprint_clear(&bp);
+        av_channel_layout_describe_bprint(&is->audio_tgt.ch_layout, &bp);
        sample_rates   [0] = is->audio_tgt.freq;
        if ((ret = av_opt_set_int(filt_asink, "all_channel_counts", 0, AV_OPT_SEARCH_CHILDREN)) < 0)
            goto end;
@@ -2351,12 +2353,13 @@ static int audio_decode_frame(VideoState *is)
        av_channel_layout_compare(&af->frame->ch_layout, &is->audio_src.ch_layout) ||
        af->frame->sample_rate   != is->audio_src.freq           ||
        (wanted_nb_samples       != af->frame->nb_samples && !is->swr_ctx)) {
+        int ret;
        swr_free(&is->swr_ctx);
-        swr_alloc_set_opts2(&is->swr_ctx,
+        ret = swr_alloc_set_opts2(&is->swr_ctx,
                            &is->audio_tgt.ch_layout, is->audio_tgt.fmt, is->audio_tgt.freq,
                            &af->frame->ch_layout, af->frame->format, af->frame->sample_rate,
                            0, NULL);
-        if (!is->swr_ctx || swr_init(is->swr_ctx) < 0) {
+        if (ret < 0 || swr_init(is->swr_ctx) < 0) {
            av_log(NULL, AV_LOG_ERROR,
                   "Cannot create sample rate converter for conversion of %d Hz %s %d channels to %d Hz %s %d channels!\n",
                    af->frame->sample_rate, av_get_sample_fmt_name(af->frame->format), af->frame->ch_layout.nb_channels,
@@ -724,10 +724,13 @@ int show_codecs(void *optctx, const char *opt, const char *arg)
    return 0;
 }

-static void print_codecs(int encoder)
+static int print_codecs(int encoder)
 {
    const AVCodecDescriptor **codecs;
-    unsigned i, nb_codecs = get_codecs_sorted(&codecs);
+    int i, nb_codecs = get_codecs_sorted(&codecs);
+
+    if (nb_codecs < 0)
+        return nb_codecs;

    printf("%s:\n"
           " V..... = Video\n"
@@ -762,18 +765,17 @@ static void print_codecs(int encoder)
        }
    }
    av_free(codecs);
+    return 0;
 }

 int show_decoders(void *optctx, const char *opt, const char *arg)
 {
-    print_codecs(0);
-    return 0;
+    return print_codecs(0);
 }

 int show_encoders(void *optctx, const char *opt, const char *arg)
 {
-    print_codecs(1);
-    return 0;
+    return print_codecs(1);
 }

 int show_bsfs(void *optctx, const char *opt, const char *arg)
@@ -887,6 +887,8 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *picture,
        }

        if (i >= CFRAME_BUFFER_COUNT) {
+            if (free_index < 0)
+                return AVERROR_INVALIDDATA;
            i             = free_index;
            f->cfrm[i].id = id;
        }
@@ -61,7 +61,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
    unsigned int planes = c->planes;
    int ret;

-    if (buf_size < planes * height * 2)
+    if (buf_size < planes * height * (2 + 2*((avctx->width+128)/129)))
        return AVERROR_INVALIDDATA;

    if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
@@ -993,7 +993,7 @@ OBJS-$(CONFIG_AV1_DXVA2_HWACCEL)          += dxva2_av1.o
 OBJS-$(CONFIG_AV1_NVDEC_HWACCEL)          += nvdec_av1.o
 OBJS-$(CONFIG_AV1_VAAPI_HWACCEL)          += vaapi_av1.o
 OBJS-$(CONFIG_AV1_VDPAU_HWACCEL)          += vdpau_av1.o
-OBJS-$(CONFIG_AV1_VULKAN_HWACCEL)         += vulkan_av1.o
+OBJS-$(CONFIG_AV1_VULKAN_HWACCEL)         += vulkan_decode.o vulkan_av1.o
 OBJS-$(CONFIG_H263_VAAPI_HWACCEL)         += vaapi_mpeg4.o
 OBJS-$(CONFIG_H263_VIDEOTOOLBOX_HWACCEL)  += videotoolbox.o
 OBJS-$(CONFIG_H264_D3D11VA_HWACCEL)       += dxva2_h264.o
@@ -1284,7 +1284,7 @@ SKIPHEADERS                            += %_tablegen.h                  \
                                          aacenc_quantization.h         \
                                          aacenc_quantization_misc.h    \
                                          bitstream_template.h          \
-                                          vulkan_video_codec_av1std.h   \
+                                          vulkan_video_codec_av1std_mesa.h \
                                          $(ARCH)/vpx_arith.h          \

 SKIPHEADERS-$(CONFIG_AMF)              += amfenc.h
@@ -1306,7 +1306,7 @@ SKIPHEADERS-$(CONFIG_XVMC)             += xvmc.h
 SKIPHEADERS-$(CONFIG_VAAPI)            += vaapi_decode.h vaapi_hevc.h vaapi_encode.h
 SKIPHEADERS-$(CONFIG_VDPAU)            += vdpau.h vdpau_internal.h
 SKIPHEADERS-$(CONFIG_VIDEOTOOLBOX)     += videotoolbox.h vt_internal.h
-SKIPHEADERS-$(CONFIG_VULKAN)           += vulkan.h vulkan_video.h vulkan_decode.h vulkan_video_codec_av1std_decode.h
+SKIPHEADERS-$(CONFIG_VULKAN)           += vulkan.h vulkan_video.h vulkan_decode.h vulkan_video_codec_av1std_decode_mesa.h
 SKIPHEADERS-$(CONFIG_V4L2_M2M)         += v4l2_buffers.h v4l2_context.h v4l2_m2m.h
 SKIPHEADERS-$(CONFIG_ZLIB)             += zlib_wrapper.h

@@ -454,6 +454,9 @@ static int output_configure(AACContext *ac,
    uint8_t id_map[TYPE_END][MAX_ELEM_ID] = {{ 0 }};
    uint8_t type_counts[TYPE_END] = { 0 };

+    if (get_new_frame && !ac->frame)
+        return AVERROR_INVALIDDATA;
+
    if (ac->oc[1].layout_map != layout_map) {
        memcpy(ac->oc[1].layout_map, layout_map, tags * sizeof(layout_map[0]));
        ac->oc[1].layout_map_tags = tags;
@@ -3313,6 +3316,12 @@ static int aac_decode_frame_int(AVCodecContext *avctx, AVFrame *frame,
        ac->oc[1].status = OC_LOCKED;
    }

+    if (samples && avctx->sample_rate <= 0) {
+        av_log(avctx, AV_LOG_ERROR,
+               "Cannot output a frame without a valid sample rate\n");
+        return AVERROR_INVALIDDATA;
+    }
+
    if (!ac->frame->data[0] && samples) {
        av_log(avctx, AV_LOG_ERROR, "no frame data found\n");
        err = AVERROR_INVALIDDATA;
@@ -172,6 +172,7 @@ void ff_aac_search_for_tns(AACEncContext *s, SingleChannelElement *sce)
                      sce->ics.window_sequence[0] == LONG_START_SEQUENCE ? 0 : 2;
    const int sfb_len = sfb_end - sfb_start;
    const int coef_len = sce->ics.swb_offset[sfb_end] - sce->ics.swb_offset[sfb_start];
+    const int n_filt = is8 ? 1 : order != TNS_MAX_ORDER ? 2 : 3;

    if (coef_len <= 0 || sfb_len <= 0) {
        sce->tns.present = 0;
@@ -179,16 +180,30 @@ void ff_aac_search_for_tns(AACEncContext *s, SingleChannelElement *sce)
    }

    for (w = 0; w < sce->ics.num_windows; w++) {
-        float en[2] = {0.0f, 0.0f};
-        int oc_start = 0, os_start = 0;
+        float en[4] = {0.0f, 0.0f, 0.0f, 0.0f};
+        int oc_start = 0;
        int coef_start = sce->ics.swb_offset[sfb_start];

-        for (g = sfb_start; g < sce->ics.num_swb && g <= sfb_end; g++) {
-            FFPsyBand *band = &s->psy.ch[s->cur_channel].psy_bands[w*16+g];
-            if (g > sfb_start + (sfb_len/2))
-                en[1] += band->energy;
-            else
-                en[0] += band->energy;
+        if (n_filt == 2) {
+            for (g = sfb_start; g < sce->ics.num_swb && g <= sfb_end; g++) {
+                FFPsyBand *band = &s->psy.ch[s->cur_channel].psy_bands[w*16+g];
+                    if (g > sfb_start + (sfb_len/2))
+                        en[1] += band->energy; /* End */
+                    else
+                        en[0] += band->energy; /* Start */
+            }
+            en[2] = en[0];
+        } else {
+            for (g = sfb_start; g < sce->ics.num_swb && g <= sfb_end; g++) {
+                FFPsyBand *band = &s->psy.ch[s->cur_channel].psy_bands[w*16+g];
+                    if (g > sfb_start + (sfb_len/2) + (sfb_len/4))
+                        en[2] += band->energy; /* End */
+                    else if (g > sfb_start + (sfb_len/2) - (sfb_len/4))
+                        en[1] += band->energy; /* Middle */
+                    else
+                        en[0] += band->energy; /* Start */
+            }
+            en[3] = en[0];
        }

        /* LPC */
@@ -198,15 +213,14 @@ void ff_aac_search_for_tns(AACEncContext *s, SingleChannelElement *sce)
        if (!order || !isfinite(gain) || gain < TNS_GAIN_THRESHOLD_LOW || gain > TNS_GAIN_THRESHOLD_HIGH)
            continue;

-        tns->n_filt[w] = is8 ? 1 : order != TNS_MAX_ORDER ? 2 : 3;
+        tns->n_filt[w] = n_filt;
        for (g = 0; g < tns->n_filt[w]; g++) {
-            tns->direction[w][g] = slant != 2 ? slant : en[g] < en[!g];
-            tns->order[w][g] = g < tns->n_filt[w] ? order/tns->n_filt[w] : order - oc_start;
-            tns->length[w][g] = g < tns->n_filt[w] ? sfb_len/tns->n_filt[w] : sfb_len - os_start;
+            tns->direction[w][g] = slant != 2 ? slant : en[g] < en[g + 1];
+            tns->order[w][g] = order/tns->n_filt[w];
+            tns->length[w][g] = sfb_len/tns->n_filt[w];
            quantize_coefs(&coefs[oc_start], tns->coef_idx[w][g], tns->coef[w][g],
                            tns->order[w][g], c_bits);
            oc_start += tns->order[w][g];
-            os_start += tns->length[w][g];
        }
        count++;
    }
@@ -607,6 +607,7 @@ static int sbr_make_f_derived(AACContext *ac, SpectralBandReplication *sbr)

    if (sbr->n_q > 5) {
        av_log(ac->avctx, AV_LOG_ERROR, "Too many noise floor scale factors: %d\n", sbr->n_q);
+        sbr->n_q = 1;
        return -1;
    }

@@ -1452,6 +1453,9 @@ static void sbr_env_estimate(AAC_FLOAT (*e_curr)[48], INTFLOAT X_high[64][40][2]
            int ilb = ch_data->t_env[e]     * 2 + ENVELOPE_ADJUSTMENT_OFFSET;
            int iub = ch_data->t_env[e + 1] * 2 + ENVELOPE_ADJUSTMENT_OFFSET;

+            if (ilb >= 40)
+                return;
+
            for (m = 0; m < sbr->m[1]; m++) {
                AAC_FLOAT sum = sbr->dsp.sum_square(X_high[m+kx1] + ilb, iub - ilb);
 #if USE_FIXED
@@ -1470,6 +1474,9 @@ static void sbr_env_estimate(AAC_FLOAT (*e_curr)[48], INTFLOAT X_high[64][40][2]
            int iub = ch_data->t_env[e + 1] * 2 + ENVELOPE_ADJUSTMENT_OFFSET;
            const uint16_t *table = ch_data->bs_freq_res[e + 1] ? sbr->f_tablehigh : sbr->f_tablelow;

+            if (ilb >= 40)
+                return;
+
            for (p = 0; p < sbr->n[ch_data->bs_freq_res[e + 1]]; p++) {
 #if USE_FIXED
                SoftFloat sum = FLOAT_0;
@@ -489,10 +489,10 @@ function ff_pred16x16_plane_neon_10, export=1
        mul             v2.8h,  v2.8h,  v0.8h
        mul             v3.8h,  v3.8h,  v0.8h
        addp            v2.8h,  v2.8h,  v3.8h
-        addp            v2.8h,  v2.8h,  v2.8h
-        addp            v2.4h,  v2.4h,  v2.4h
-        sshll           v3.4s,  v2.4h,  #2
-        saddw           v2.4s,  v3.4s,  v2.4h
+        saddlp          v2.4s,  v2.8h
+        addp            v2.4s,  v2.4s,  v2.4s
+        shl             v3.4s,  v2.4s,  #2
+        add             v2.4s,  v3.4s,  v2.4s
        rshrn           v4.4h,  v2.4s,  #6
        trn2            v5.4h,  v4.4h,  v4.4h
        add             v2.4h,  v4.4h,  v5.4h
@@ -502,28 +502,26 @@ function ff_pred16x16_plane_neon_10, export=1
        add             v7.4h,  v7.4h,  v0.4h
        shl             v2.4h,  v7.4h,  #4
        ssubl           v2.4s,  v2.4h,  v3.4h
-        shl             v3.4h,  v4.4h,  #4
        ext             v0.16b, v0.16b, v0.16b, #14
-        ssubl           v6.4s,  v5.4h,  v3.4h
+        sxtl            v6.4s,  v5.4h          // c

        mov             v0.h[0],  wzr
-        mul             v0.8h,  v0.8h,  v4.h[0]
        dup             v16.4s, v2.s[0]
        dup             v17.4s, v2.s[0]
-        dup             v2.8h,  v4.h[0]
-        dup             v3.4s,  v6.s[0]
-        shl             v2.8h,  v2.8h,  #3
-        saddw           v16.4s, v16.4s, v0.4h
-        saddw2          v17.4s, v17.4s, v0.8h
-        saddw           v3.4s,  v3.4s,  v2.4h
+        dup             v2.8h,  v4.h[0]        // b
+        dup             v3.4s,  v6.s[0]        // c
+        sshll           v2.4s,  v2.4h,  #3     // b * 8
+        smlal           v16.4s, v0.4h, v4.h[0]
+        smlal2          v17.4s, v0.8h, v4.h[0]
+        sub             v3.4s,  v3.4s,  v2.4s

        mov             w3,      #16
        mvni            v4.8h,   #0xFC, lsl #8 // 1023 for clipping
 1:
        sqshrun         v0.4h,  v16.4s, #5
        sqshrun2        v0.8h,  v17.4s, #5
-        saddw           v16.4s, v16.4s, v2.4h
-        saddw           v17.4s, v17.4s, v2.4h
+        add             v16.4s, v16.4s, v2.4s
+        add             v17.4s, v17.4s, v2.4s
        sqshrun         v1.4h,  v16.4s, #5
        sqshrun2        v1.8h,  v17.4s, #5
        add             v16.4s, v16.4s, v3.4s
@@ -595,12 +593,11 @@ function ff_pred8x8_plane_neon_10, export=1
        ssubl           v2.4s,  v2.4h,  v3.4h
        ext             v0.16b, v0.16b, v0.16b, #14
        mov             v0.h[0],  wzr
-        mul             v0.8h,  v0.8h,  v5.h[0]
        dup             v1.4s,  v2.s[0]
        dup             v2.4s,  v2.s[0]
        dup             v3.8h,  v5.h[1]
-        saddw           v1.4s,  v1.4s,  v0.4h
-        saddw2          v2.4s,  v2.4s,  v0.8h
+        smlal           v1.4s,  v0.4h,  v5.h[0]
+        smlal2          v2.4s,  v0.8h,  v5.h[0]
        mov             w3,  #8
        mvni            v4.8h,  #0xFC,  lsl #8 // 1023 for clipping
 1:
@@ -2290,7 +2290,7 @@ function ff_hevc_put_hevc_epel_uni_w_v24_8_neon, export=1
        subs            w4, w4, #1
        add             x2, x2, x3
        EPEL_UNI_W_V16_CALC v4, v5, v16, v18, v20, v22, v24, v25, v26, v27
-        EPEL_UNI_W_V8_CALC  v6, v17, v19, v21, v23, v24, v25
+        EPEL_UNI_W_V8_CALC v6, v17, v19, v21, v23, v24, v25
        str             q4, [x0]
        str             d6, [x0, #16]
        add             x0, x0, x1
@@ -2299,7 +2299,7 @@ function ff_hevc_put_hevc_epel_uni_w_v24_8_neon, export=1
        subs            w4, w4, #1
        add             x2, x2, x3
        EPEL_UNI_W_V16_CALC v4, v5, v18, v20, v22, v16, v24, v25, v26, v27
-        EPEL_UNI_W_V8_CALC  v6, v19, v21, v23, v17, v24, v25
+        EPEL_UNI_W_V8_CALC v6, v19, v21, v23, v17, v24, v25
        str             q4, [x0]
        str             d6, [x0, #16]
        add             x0, x0, x1
@@ -2308,7 +2308,7 @@ function ff_hevc_put_hevc_epel_uni_w_v24_8_neon, export=1
        subs            w4, w4, #1
        add             x2, x2, x3
        EPEL_UNI_W_V16_CALC v4, v5, v20, v22, v16, v18,  v24, v25, v26, v27
-        EPEL_UNI_W_V8_CALC  v6, v21, v23, v17, v19, v24, v25
+        EPEL_UNI_W_V8_CALC v6, v21, v23, v17, v19, v24, v25
        str             q4, [x0]
        str             d6, [x0, #16]
        add             x0, x0, x1
@@ -2317,7 +2317,7 @@ function ff_hevc_put_hevc_epel_uni_w_v24_8_neon, export=1
        subs            w4, w4, #1
        add             x2, x2, x3
        EPEL_UNI_W_V16_CALC v4, v5, v22, v16, v18, v20, v24, v25, v26, v27
-        EPEL_UNI_W_V8_CALC  v6, v23, v17, v19, v21, v24, v25
+        EPEL_UNI_W_V8_CALC v6, v23, v17, v19, v21, v24, v25
        str             q4, [x0]
        str             d6, [x0, #16]
        add             x0, x0, x1
@@ -117,41 +117,41 @@ endconst
        // void put_hevc_qpel_h(int16_t *dst,
        //                      uint8_t *_src, ptrdiff_t _srcstride,
        //                      int height, intptr_t mx, intptr_t my, int width)
-        dst        .req x0
-        dststride  .req x7
-        src        .req x1
-        srcstride  .req x2
-        height     .req x3
-        heightw    .req w3
-        mx         .req x4
-        width      .req w6
+        dst             .req x0
+        dststride       .req x7
+        src             .req x1
+        srcstride       .req x2
+        height          .req x3
+        heightw         .req w3
+        mx              .req x4
+        width           .req w6
 .endif
 .ifc \type, qpel_uni
        // void put_hevc_qpel_uni_h(uint8_t *_dst,  ptrdiff_t _dststride,
        //                          uint8_t *_src, ptrdiff_t _srcstride,
        //                          int height, intptr_t mx, intptr_t my, int width)
-        dst        .req x0
-        dststride  .req x1
-        src        .req x2
-        srcstride  .req x3
-        height     .req x4
-        heightw    .req w4
-        mx         .req x5
-        width      .req w7
+        dst             .req x0
+        dststride       .req x1
+        src             .req x2
+        srcstride       .req x3
+        height          .req x4
+        heightw         .req w4
+        mx              .req x5
+        width           .req w7
 .endif
 .ifc \type, qpel_bi
        // void put_hevc_qpel_bi_h(uint8_t *_dst, ptrdiff_t _dststride,
        //                         uint8_t *_src, ptrdiff_t _srcstride,
        //                         int16_t *src2, int height, intptr_t mx,
        //                         intptr_t my, int width)
-        dst        .req x0
-        dststride  .req x1
-        src        .req x2
-        srcstride  .req x3
-        height     .req x5
-        heightw    .req w5
-        mx         .req x6
-        width      .req w8
+        dst             .req x0
+        dststride       .req x1
+        src             .req x2
+        srcstride       .req x3
+        height          .req x5
+        heightw         .req w5
+        mx              .req x6
+        width           .req w8
 .endif

 .ifc \type, qpel
@@ -706,7 +706,7 @@ function ff_hevc_put_hevc_qpel_uni_v4_8_neon, export=1
 .endm
 1:      calc_all
 .purgem calc
-2: ret
+2:      ret
 endfunc

 function ff_hevc_put_hevc_qpel_uni_v6_8_neon, export=1
@@ -735,7 +735,7 @@ function ff_hevc_put_hevc_qpel_uni_v6_8_neon, export=1
 .endm
 1:      calc_all
 .purgem calc
-2: ret
+2:      ret
 endfunc

 function ff_hevc_put_hevc_qpel_uni_v8_8_neon, export=1
@@ -762,7 +762,7 @@ function ff_hevc_put_hevc_qpel_uni_v8_8_neon, export=1
 .endm
 1:      calc_all
 .purgem calc
-2: ret
+2:      ret
 endfunc

 function ff_hevc_put_hevc_qpel_uni_v12_8_neon, export=1
@@ -2011,7 +2011,7 @@ function ff_hevc_put_hevc_qpel_uni_w_h8_8_neon_i8mm, export=1
        zip1            v2.2d, v2.2d, v3.2d
        zip1            v4.2d, v4.2d, v5.2d
        zip1            v6.2d, v6.2d, v7.2d
-        QPEL_UNI_W_H_CALC  v0, v2, v4, v6,  v18, v19, v20, v21
+        QPEL_UNI_W_H_CALC v0, v2, v4, v6,  v18, v19, v20, v21
        sqxtn           v18.4h, v18.4s
        sqxtn2          v18.8h, v20.4s
        sqxtun          v18.8b, v18.8h
@@ -2040,7 +2040,7 @@ function ff_hevc_put_hevc_qpel_uni_w_h12_8_neon_i8mm, export=1
        zip1            v21.2d, v6.2d, v7.2d
        zip2            v22.2d, v16.2d, v1.2d
        zip2            v23.2d, v2.2d, v3.2d
-        QPEL_UNI_W_H_CALC  v18, v19, v20, v21, v0, v2, v4, v6
+        QPEL_UNI_W_H_CALC v18, v19, v20, v21, v0, v2, v4, v6
        QPEL_UNI_W_H_CALC_HALF v22, v23, v24, v25
        sqxtn           v0.4h, v0.4s
        sqxtn2          v0.8h, v4.4s
@@ -2068,8 +2068,8 @@ function ff_hevc_put_hevc_qpel_uni_w_h16_8_neon_i8mm, export=1
        ext             v5.16b, v16.16b, v17.16b, #5
        ext             v6.16b, v16.16b, v17.16b, #6
        ext             v7.16b, v16.16b, v17.16b, #7
-        QPEL_UNI_W_H_CALC  v16, v2, v1, v3, v18, v19, v20, v21   // v18: 0, 8, 2, 10 v20: 1, 9, 3, 11
-        QPEL_UNI_W_H_CALC  v4, v6, v5, v7, v22, v23, v24, v25    // v22: 4, 12, 6, 14 v24: 5, 13, 7, 15
+        QPEL_UNI_W_H_CALC v16, v2, v1, v3, v18, v19, v20, v21   // v18: 0, 8, 2, 10 v20: 1, 9, 3, 11
+        QPEL_UNI_W_H_CALC v4, v6, v5, v7, v22, v23, v24, v25    // v22: 4, 12, 6, 14 v24: 5, 13, 7, 15
        sqxtn           v0.4h, v18.4s
        sqxtn2          v0.8h, v22.4s
        sqxtn           v1.4h, v20.4s
@@ -2096,8 +2096,8 @@ function ff_hevc_put_hevc_qpel_uni_w_h24_8_neon_i8mm, export=1
        ext             v5.16b, v16.16b, v17.16b, #5
        ext             v6.16b, v16.16b, v17.16b, #6
        ext             v7.16b, v16.16b, v17.16b, #7
-        QPEL_UNI_W_H_CALC  v16, v2, v1, v3, v18, v19, v20, v21
-        QPEL_UNI_W_H_CALC  v4, v6, v5, v7, v22, v23, v24, v25
+        QPEL_UNI_W_H_CALC v16, v2, v1, v3, v18, v19, v20, v21
+        QPEL_UNI_W_H_CALC v4, v6, v5, v7, v22, v23, v24, v25
        sqxtn           v18.4h, v18.4s
        sqxtn2          v18.8h, v22.4s
        sqxtn           v19.4h, v20.4s
@@ -2117,7 +2117,7 @@ function ff_hevc_put_hevc_qpel_uni_w_h24_8_neon_i8mm, export=1
        zip1            v2.2d, v2.2d, v3.2d
        zip1            v4.2d, v4.2d, v5.2d
        zip1            v6.2d, v6.2d, v7.2d
-        QPEL_UNI_W_H_CALC  v0, v2, v4, v6, v18, v19, v20, v21
+        QPEL_UNI_W_H_CALC v0, v2, v4, v6, v18, v19, v20, v21
        sqxtn           v18.4h, v18.4s
        sqxtn2          v18.8h, v20.4s
        sqxtun          v27.8b, v18.8h
@@ -2141,8 +2141,8 @@ function ff_hevc_put_hevc_qpel_uni_w_h32_8_neon_i8mm, export=1
        ext             v5.16b, v16.16b, v17.16b, #5
        ext             v6.16b, v16.16b, v17.16b, #6
        ext             v7.16b, v16.16b, v17.16b, #7
-        QPEL_UNI_W_H_CALC  v16, v2, v1, v3, v0, v19, v20, v21
-        QPEL_UNI_W_H_CALC  v4, v6, v5, v7, v22, v23, v24, v25
+        QPEL_UNI_W_H_CALC v16, v2, v1, v3, v0, v19, v20, v21
+        QPEL_UNI_W_H_CALC v4, v6, v5, v7, v22, v23, v24, v25
        sqxtn           v0.4h, v0.4s
        sqxtn2          v0.8h, v22.4s
        sqxtn           v19.4h, v20.4s
@@ -2158,8 +2158,8 @@ function ff_hevc_put_hevc_qpel_uni_w_h32_8_neon_i8mm, export=1
        ext             v5.16b, v17.16b, v18.16b, #5
        ext             v6.16b, v17.16b, v18.16b, #6
        ext             v7.16b, v17.16b, v18.16b, #7
-        QPEL_UNI_W_H_CALC  v17, v2, v1, v3, v0, v19, v20, v21
-        QPEL_UNI_W_H_CALC  v4, v6, v5, v7, v22, v23, v24, v25
+        QPEL_UNI_W_H_CALC v17, v2, v1, v3, v0, v19, v20, v21
+        QPEL_UNI_W_H_CALC v4, v6, v5, v7, v22, v23, v24, v25
        sqxtn           v0.4h, v0.4s
        sqxtn2          v0.8h, v22.4s
        sqxtn           v19.4h, v20.4s
@@ -2185,8 +2185,8 @@ function ff_hevc_put_hevc_qpel_uni_w_h48_8_neon_i8mm, export=1
        ext             v5.16b, v16.16b, v17.16b, #5
        ext             v6.16b, v16.16b, v17.16b, #6
        ext             v7.16b, v16.16b, v17.16b, #7
-        QPEL_UNI_W_H_CALC  v16, v2, v1, v3, v20, v24, v21, v0
-        QPEL_UNI_W_H_CALC  v4, v6, v5, v7, v22, v24, v23, v0
+        QPEL_UNI_W_H_CALC v16, v2, v1, v3, v20, v24, v21, v0
+        QPEL_UNI_W_H_CALC v4, v6, v5, v7, v22, v24, v23, v0
        sqxtn           v20.4h, v20.4s
        sqxtn2          v20.8h, v22.4s
        sqxtn           v21.4h, v21.4s
@@ -2202,8 +2202,8 @@ function ff_hevc_put_hevc_qpel_uni_w_h48_8_neon_i8mm, export=1
        ext             v5.16b, v17.16b, v18.16b, #5
        ext             v6.16b, v17.16b, v18.16b, #6
        ext             v7.16b, v17.16b, v18.16b, #7
-        QPEL_UNI_W_H_CALC  v17, v2, v1, v3, v20, v24, v21, v0
-        QPEL_UNI_W_H_CALC  v4, v6, v5, v7, v22, v24, v23, v0
+        QPEL_UNI_W_H_CALC v17, v2, v1, v3, v20, v24, v21, v0
+        QPEL_UNI_W_H_CALC v4, v6, v5, v7, v22, v24, v23, v0
        sqxtn           v20.4h, v20.4s
        sqxtn2          v20.8h, v22.4s
        sqxtn           v21.4h, v21.4s
@@ -2219,8 +2219,8 @@ function ff_hevc_put_hevc_qpel_uni_w_h48_8_neon_i8mm, export=1
        ext             v5.16b, v18.16b, v19.16b, #5
        ext             v6.16b, v18.16b, v19.16b, #6
        ext             v7.16b, v18.16b, v19.16b, #7
-        QPEL_UNI_W_H_CALC  v18, v2, v1, v3, v20, v24, v21, v0
-        QPEL_UNI_W_H_CALC  v4, v6, v5, v7, v22, v24, v23, v0
+        QPEL_UNI_W_H_CALC v18, v2, v1, v3, v20, v24, v21, v0
+        QPEL_UNI_W_H_CALC v4, v6, v5, v7, v22, v24, v23, v0
        sqxtn           v20.4h, v20.4s
        sqxtn2          v20.8h, v22.4s
        sqxtn           v21.4h, v21.4s
@@ -2249,8 +2249,8 @@ function ff_hevc_put_hevc_qpel_uni_w_h64_8_neon_i8mm, export=1
        ext             v5.16b, v16.16b, v17.16b, #5
        ext             v6.16b, v16.16b, v17.16b, #6
        ext             v7.16b, v16.16b, v17.16b, #7
-        QPEL_UNI_W_H_CALC  v16, v2, v1, v3, v20, v24, v21, v0
-        QPEL_UNI_W_H_CALC  v4, v6, v5, v7, v22, v24, v23, v0
+        QPEL_UNI_W_H_CALC v16, v2, v1, v3, v20, v24, v21, v0
+        QPEL_UNI_W_H_CALC v4, v6, v5, v7, v22, v24, v23, v0
        sqxtn           v20.4h, v20.4s
        sqxtn2          v20.8h, v22.4s
        sqxtn           v21.4h, v21.4s
@@ -2266,8 +2266,8 @@ function ff_hevc_put_hevc_qpel_uni_w_h64_8_neon_i8mm, export=1
        ext             v5.16b, v17.16b, v18.16b, #5
        ext             v6.16b, v17.16b, v18.16b, #6
        ext             v7.16b, v17.16b, v18.16b, #7
-        QPEL_UNI_W_H_CALC  v17, v2, v1, v3, v20, v24, v21, v0
-        QPEL_UNI_W_H_CALC  v4, v6, v5, v7, v22, v24, v23, v0
+        QPEL_UNI_W_H_CALC v17, v2, v1, v3, v20, v24, v21, v0
+        QPEL_UNI_W_H_CALC v4, v6, v5, v7, v22, v24, v23, v0
        sqxtn           v20.4h, v20.4s
        sqxtn2          v20.8h, v22.4s
        sqxtn           v21.4h, v21.4s
@@ -2283,8 +2283,8 @@ function ff_hevc_put_hevc_qpel_uni_w_h64_8_neon_i8mm, export=1
        ext             v5.16b, v18.16b, v19.16b, #5
        ext             v6.16b, v18.16b, v19.16b, #6
        ext             v7.16b, v18.16b, v19.16b, #7
-        QPEL_UNI_W_H_CALC  v18, v2, v1, v3, v20, v24, v21, v0
-        QPEL_UNI_W_H_CALC  v4, v6, v5, v7, v22, v24, v23, v0
+        QPEL_UNI_W_H_CALC v18, v2, v1, v3, v20, v24, v21, v0
+        QPEL_UNI_W_H_CALC v4, v6, v5, v7, v22, v24, v23, v0
        ld1             {v0.16b}, [x2], x3
        sqxtn           v20.4h, v20.4s
        sqxtn2          v20.8h, v22.4s
@@ -2301,8 +2301,8 @@ function ff_hevc_put_hevc_qpel_uni_w_h64_8_neon_i8mm, export=1
        ext             v5.16b, v19.16b, v0.16b, #5
        ext             v6.16b, v19.16b, v0.16b, #6
        ext             v7.16b, v19.16b, v0.16b, #7
-        QPEL_UNI_W_H_CALC  v19, v2, v1, v3, v20, v24, v21, v0
-        QPEL_UNI_W_H_CALC  v4, v6, v5, v7, v22, v24, v23, v0
+        QPEL_UNI_W_H_CALC v19, v2, v1, v3, v20, v24, v21, v0
+        QPEL_UNI_W_H_CALC v4, v6, v5, v7, v22, v24, v23, v0
        sqxtn           v20.4h, v20.4s
        sqxtn2          v20.8h, v22.4s
        sqxtn           v21.4h, v21.4s
@@ -50,12 +50,13 @@
 .endm

 .macro  pixels16_x2     rnd=1, avg=0
-1:      ld1             {v0.16b, v1.16b}, [x1], x2
-        ld1             {v2.16b, v3.16b}, [x1], x2
+1:
+        ldur            q1, [x1, #1]
+        ld1             {v0.16b}, [x1], x2
        subs            w3,  w3,  #2
-        ext             v1.16b,  v0.16b,  v1.16b,  #1
+        ldur            q3, [x1, #1]
+        ld1             {v2.16b}, [x1], x2
        avg             v0.16b,  v0.16b,  v1.16b
-        ext             v3.16b,  v2.16b,  v3.16b,  #1
        avg             v2.16b,  v2.16b,  v3.16b
  .if \avg
        ld1             {v1.16b}, [x0], x2
@@ -108,20 +109,20 @@

 .macro  pixels16_xy2    rnd=1, avg=0
        sub             w3,  w3,  #2
-        ld1             {v0.16b, v1.16b}, [x1], x2
-        ld1             {v4.16b, v5.16b}, [x1], x2
+        ldur            q1, [x1, #1]
+        ld1             {v0.16b}, [x1], x2
 NRND    movi            v26.8H, #1
-        ext             v1.16b,  v0.16b,  v1.16b,  #1
-        ext             v5.16b,  v4.16b,  v5.16b,  #1
+        ldur            q5, [x1, #1]
+        ld1             {v4.16b}, [x1], x2
        uaddl           v16.8h,  v0.8b,   v1.8b
        uaddl2          v20.8h,  v0.16b,  v1.16b
        uaddl           v18.8h,  v4.8b,   v5.8b
        uaddl2          v22.8h,  v4.16b,  v5.16b
 1:      subs            w3,  w3,  #2
-        ld1             {v0.16b, v1.16b}, [x1], x2
+        ldur            q30, [x1, #1]
+        ld1             {v0.16b}, [x1], x2
        add             v24.8h,  v16.8h,  v18.8h
 NRND    add             v24.8H,  v24.8H,  v26.8H
-        ext             v30.16b, v0.16b,  v1.16b,  #1
        add             v1.8h,   v20.8h,  v22.8h
        mshrn           v28.8b,  v24.8h,  #2
 NRND    add             v1.8H,   v1.8H,   v26.8H
@@ -131,12 +132,12 @@ NRND    add             v1.8H,   v1.8H,   v26.8H
        urhadd          v28.16b, v28.16b, v16.16b
  .endif
        uaddl           v16.8h,  v0.8b,   v30.8b
-        ld1             {v2.16b, v3.16b}, [x1], x2
+        ldur            q3, [x1, #1]
+        ld1             {v2.16b}, [x1], x2
        uaddl2          v20.8h,  v0.16b,  v30.16b
        st1             {v28.16b},        [x0], x2
        add             v24.8h,  v16.8h,  v18.8h
 NRND    add             v24.8H,  v24.8H,  v26.8H
-        ext             v3.16b,  v2.16b,  v3.16b,  #1
        add             v0.8h,   v20.8h,  v22.8h
        mshrn           v30.8b,  v24.8h,  #2
 NRND    add             v0.8H,   v0.8H,   v26.8H
@@ -150,10 +151,10 @@ NRND    add             v0.8H,   v0.8H,   v26.8H
        st1             {v30.16b},        [x0], x2
        b.gt            1b

-        ld1             {v0.16b, v1.16b}, [x1], x2
+        ldur            q30, [x1, #1]
+        ld1             {v0.16b}, [x1], x2
        add             v24.8h,  v16.8h,  v18.8h
 NRND    add             v24.8H,  v24.8H,  v26.8H
-        ext             v30.16b, v0.16b,  v1.16b,  #1
        add             v1.8h,   v20.8h,  v22.8h
        mshrn           v28.8b,  v24.8h,  #2
 NRND    add             v1.8H,   v1.8H,   v26.8H
@@ -206,10 +207,11 @@ NRND    add             v0.8H,   v0.8H,   v26.8H
 .endm

 .macro  pixels8_x2      rnd=1, avg=0
-1:      ld1             {v0.8b, v1.8b}, [x1], x2
-        ext             v1.8b,  v0.8b,  v1.8b,  #1
-        ld1             {v2.8b, v3.8b}, [x1], x2
-        ext             v3.8b,  v2.8b,  v3.8b,  #1
+1:
+        ldur            d1, [x1, #1]
+        ld1             {v0.8b}, [x1], x2
+        ldur            d3, [x1, #1]
+        ld1             {v2.8b}, [x1], x2
        subs            w3,  w3,  #2
        avg             v0.8b,   v0.8b,   v1.8b
        avg             v2.8b,   v2.8b,   v3.8b
@@ -263,22 +265,23 @@ NRND    add             v0.8H,   v0.8H,   v26.8H
 .endm

 .macro  pixels8_xy2     rnd=1, avg=0
+        ldur            d4, [x1, #1]
        sub             w3,  w3,  #2
-        ld1             {v0.16b},     [x1], x2
-        ld1             {v1.16b},     [x1], x2
+        ld1             {v0.8b}, [x1], x2
 NRND    movi            v19.8H, #1
-        ext             v4.16b,  v0.16b,  v4.16b,  #1
-        ext             v6.16b,  v1.16b,  v6.16b,  #1
+        ldur            d6, [x1, #1]
+        ld1             {v1.8b}, [x1], x2
        uaddl           v16.8h,  v0.8b,  v4.8b
        uaddl           v17.8h,  v1.8b,  v6.8b
 1:      subs            w3,  w3,  #2
-        ld1             {v0.16b},     [x1], x2
+        ldur            d4, [x1, #1]
+        ld1             {v0.8b}, [x1], x2
        add             v18.8h, v16.8h,  v17.8h
-        ext             v4.16b,  v0.16b,  v4.16b,  #1
 NRND    add             v18.8H, v18.8H, v19.8H
        uaddl           v16.8h,  v0.8b,  v4.8b
        mshrn           v5.8b,  v18.8h, #2
-        ld1             {v1.16b},     [x1], x2
+        ldur            d6, [x1, #1]
+        ld1             {v1.8b}, [x1], x2
        add             v18.8h, v16.8h,  v17.8h
  .if \avg
        ld1             {v7.8b},     [x0]
@@ -291,14 +294,13 @@ NRND    add             v18.8H, v18.8H, v19.8H
        ld1             {v5.8b},     [x0]
        urhadd          v7.8b,  v7.8b,  v5.8b
  .endif
-        ext             v6.16b,  v1.16b,  v6.16b,  #1
        uaddl           v17.8h,  v1.8b,   v6.8b
        st1             {v7.8b},     [x0], x2
        b.gt            1b

-        ld1             {v0.16b},     [x1], x2
+        ldur            d4, [x1, #1]
+        ld1             {v0.8b}, [x1], x2
        add             v18.8h, v16.8h, v17.8h
-        ext             v4.16b, v0.16b, v4.16b,  #1
 NRND    add             v18.8H, v18.8H, v19.8H
        uaddl           v16.8h,  v0.8b, v4.8b
        mshrn           v5.8b,  v18.8h, #2
@@ -230,6 +230,9 @@ function \type\()_8tap_\size\()h_\idx1\idx2
        // reduced dst stride
 .if \size >= 16
        sub             x1,  x1,  x5
+.elseif \size == 4
+        add             x12, x2,  #8
+        add             x13, x7,  #8
 .endif
        // size >= 16 loads two qwords and increments x2,
        // for size 4/8 it's enough with one qword and no
@@ -248,9 +251,14 @@ function \type\()_8tap_\size\()h_\idx1\idx2
 .if \size >= 16
        ld1             {v4.8b,  v5.8b,  v6.8b},  [x2], #24
        ld1             {v16.8b, v17.8b, v18.8b}, [x7], #24
-.else
+.elseif \size == 8
        ld1             {v4.8b,  v5.8b},  [x2]
        ld1             {v16.8b, v17.8b}, [x7]
+.else // \size == 4
+        ld1             {v4.8b},  [x2]
+        ld1             {v16.8b}, [x7]
+        ld1             {v5.s}[0],  [x12], x3
+        ld1             {v17.s}[0], [x13], x3
 .endif
        uxtl            v4.8h,  v4.8b
        uxtl            v5.8h,  v5.8b
@@ -204,7 +204,9 @@ int av_ac3_parse_header(const uint8_t *buf, size_t size,
    AC3HeaderInfo hdr;
    int err;

-    init_get_bits8(&gb, buf, size);
+    err = init_get_bits8(&gb, buf, size);
+    if (err < 0)
+        return AVERROR_INVALIDDATA;
    err = ff_ac3_parse_header(&gb, &hdr);
    if (err < 0)
        return AVERROR_INVALIDDATA;
@@ -858,6 +858,8 @@ static int get_nb_samples(AVCodecContext *avctx, GetByteContext *gb,

    if(ch <= 0)
        return 0;
+    if (buf_size > INT_MAX / 14)
+        return 0;

    switch (avctx->codec->id) {
    /* constant, only check buf_size */
@@ -407,12 +407,14 @@ static int decode_inter_plane(AGMContext *s, GetBitContext *gb, int size,
                int map = s->map[x];

                if (orig_mv_x >= -32) {
-                    if (y * 8 + mv_y < 0 || y * 8 + mv_y + 8 > h ||
-                        x * 8 + mv_x < 0 || x * 8 + mv_x + 8 > w)
+                    int src_y = (s->blocks_h - 1 - y) * 8 - mv_y;
+                    int src_x = x * 8 + mv_x;
+                    if (src_y < 0 || src_y + 8 > h ||
+                        src_x < 0 || src_x + 8 > w)
                        return AVERROR_INVALIDDATA;

                    copy_block8(frame->data[plane] + (s->blocks_h - 1 - y) * 8 * frame->linesize[plane] + x * 8,
-                                prev->data[plane] + ((s->blocks_h - 1 - y) * 8 - mv_y) * prev->linesize[plane] + (x * 8 + mv_x),
+                                prev->data[plane] + src_y * prev->linesize[plane] + src_x,
                                frame->linesize[plane], prev->linesize[plane], 8);
                    if (map) {
                        s->idsp.idct(s->wblocks + x * 64);
@@ -444,12 +446,14 @@ static int decode_inter_plane(AGMContext *s, GetBitContext *gb, int size,
                    return ret;

                if (orig_mv_x >= -32) {
-                    if (y * 8 + mv_y < 0 || y * 8 + mv_y + 8 > h ||
-                        x * 8 + mv_x < 0 || x * 8 + mv_x + 8 > w)
+                    int src_y = (s->blocks_h - 1 - y) * 8 - mv_y;
+                    int src_x = x * 8 + mv_x;
+                    if (src_y < 0 || src_y + 8 > h ||
+                        src_x < 0 || src_x + 8 > w)
                        return AVERROR_INVALIDDATA;

                    copy_block8(frame->data[plane] + (s->blocks_h - 1 - y) * 8 * frame->linesize[plane] + x * 8,
-                                prev->data[plane] + ((s->blocks_h - 1 - y) * 8 - mv_y) * prev->linesize[plane] + (x * 8 + mv_x),
+                                prev->data[plane] + src_y * prev->linesize[plane] + src_x,
                                frame->linesize[plane], prev->linesize[plane], 8);
                    if (map) {
                        s->idsp.idct(s->block);
@@ -466,8 +466,7 @@ static av_cold int aic_decode_init(AVCodecContext *avctx)
        }
    }

-    ctx->slice_data = av_malloc_array(ctx->slice_width, AIC_BAND_COEFFS
-                                * sizeof(*ctx->slice_data));
+    ctx->slice_data = av_calloc(ctx->slice_width, AIC_BAND_COEFFS * sizeof(*ctx->slice_data));
    if (!ctx->slice_data) {
        av_log(avctx, AV_LOG_ERROR, "Error allocating slice buffer\n");

@@ -1540,8 +1540,12 @@ static int read_diff_float_data(ALSDecContext *ctx, unsigned int ra_frame) {
                    return AVERROR_INVALIDDATA;
                }

+                j = 0;
                for (i = 0; i < frame_length; ++i) {
-                    ctx->raw_mantissa[c][i] = AV_RB32(larray);
+                    if (ctx->raw_samples[c][i] == 0) {
+                        ctx->raw_mantissa[c][i] = AV_RB32(larray + j);
+                        j += 4;
+                    }
                }
            }
        }
@@ -1552,7 +1556,10 @@ static int read_diff_float_data(ALSDecContext *ctx, unsigned int ra_frame) {
                if (ctx->raw_samples[c][i] != 0) {
                    //The following logic is taken from Tabel 14.45 and 14.46 from the ISO spec
                    if (av_cmp_sf_ieee754(acf[c], FLOAT_1)) {
-                        nbits[i] = 23 - av_log2(abs(ctx->raw_samples[c][i]));
+                        int nbit = av_log2(FFABSU(ctx->raw_samples[c][i]));
+                        if (nbit > 23)
+                            return AVERROR_INVALIDDATA;
+                        nbits[i] = 23 - nbit;
                    } else {
                        nbits[i] = 23;
                    }
@@ -1626,7 +1633,7 @@ static int read_diff_float_data(ALSDecContext *ctx, unsigned int ra_frame) {
                tmp_32 = (sign << 31) | ((e + EXP_BIAS) << 23) | (mantissa);
                ctx->raw_samples[c][i] = tmp_32;
            } else {
-                ctx->raw_samples[c][i] = raw_mantissa[c][i] & 0x007fffffUL;
+                ctx->raw_samples[c][i] = raw_mantissa[c][i];
            }
        }
        align_get_bits(gb);
@@ -1782,7 +1789,9 @@ static int read_frame_data(ALSDecContext *ctx, unsigned int ra_frame)
    }

    if (sconf->floating) {
-        read_diff_float_data(ctx, ra_frame);
+        ret = read_diff_float_data(ctx, ra_frame);
+        if (ret < 0)
+            return ret;
    }

    if (get_bits_left(gb) < 0) {
@@ -2110,17 +2119,17 @@ static av_cold int decode_init(AVCodecContext *avctx)

    if (sconf->floating) {
        ctx->acf               = av_malloc_array(channels, sizeof(*ctx->acf));
-        ctx->shift_value       = av_malloc_array(channels, sizeof(*ctx->shift_value));
-        ctx->last_shift_value  = av_malloc_array(channels, sizeof(*ctx->last_shift_value));
-        ctx->last_acf_mantissa = av_malloc_array(channels, sizeof(*ctx->last_acf_mantissa));
+        ctx->shift_value       = av_calloc(channels, sizeof(*ctx->shift_value));
+        ctx->last_shift_value  = av_calloc(channels, sizeof(*ctx->last_shift_value));
+        ctx->last_acf_mantissa = av_calloc(channels, sizeof(*ctx->last_acf_mantissa));
        ctx->raw_mantissa      = av_calloc(channels, sizeof(*ctx->raw_mantissa));

        ctx->larray = av_malloc_array(ctx->cur_frame_length * 4, sizeof(*ctx->larray));
        ctx->nbits  = av_malloc_array(ctx->cur_frame_length, sizeof(*ctx->nbits));
        ctx->mlz    = av_mallocz(sizeof(*ctx->mlz));

-        if (!ctx->mlz || !ctx->acf || !ctx->shift_value || !ctx->last_shift_value
-            || !ctx->last_acf_mantissa || !ctx->raw_mantissa) {
+        if (!ctx->larray || !ctx->nbits || !ctx->mlz || !ctx->acf || !ctx->shift_value
+            || !ctx->last_shift_value || !ctx->last_acf_mantissa || !ctx->raw_mantissa) {
            av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed.\n");
            return AVERROR(ENOMEM);
        }
@@ -2132,6 +2141,10 @@ static av_cold int decode_init(AVCodecContext *avctx)

        for (c = 0; c < channels; ++c) {
            ctx->raw_mantissa[c] = av_calloc(ctx->cur_frame_length, sizeof(**ctx->raw_mantissa));
+            if (!ctx->raw_mantissa[c]) {
+                av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed.\n");
+                return AVERROR(ENOMEM);
+            }
        }
    }

@@ -26,6 +26,7 @@

 #include "config.h"

+#include "libavutil/avassert.h"
 #include "libavutil/channel_layout.h"
 #include "libavutil/common.h"
 #include "libavutil/lfg.h"
@@ -554,6 +555,8 @@ static void decode_fixed_vector(float *fixed_vector, const uint16_t *pulse_hi,
            decode_6p_track(sig_pos[i], (int) pulse_lo[i] +
                           ((int) pulse_hi[i] << 11), 4, 1);
        break;
+    default:
+        av_assert2(0);
    }

    memset(fixed_vector, 0, sizeof(float) * AMRWB_SFR_SIZE);
@@ -130,7 +130,7 @@ static int apac_decode(AVCodecContext *avctx, AVFrame *frame,
    APACContext *s = avctx->priv_data;
    GetBitContext *gb = &s->gb;
    int ret, n, buf_size, input_buf_size;
-    const uint8_t *buf;
+    uint8_t *buf;
    int nb_samples;

    if (!pkt->size && s->bitstream_size <= 0) {
@@ -160,6 +160,7 @@ static int apac_decode(AVCodecContext *avctx, AVFrame *frame,
    buf                = &s->bitstream[s->bitstream_index];
    buf_size          += s->bitstream_size;
    s->bitstream_size  = buf_size;
+    memset(buf + buf_size, 0, AV_INPUT_BUFFER_PADDING_SIZE);

    frame->nb_samples = s->bitstream_size * 16 * 8;
    if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
@@ -1284,9 +1284,9 @@ static void predictor_decode_stereo_3950(APEContext *ctx, int count)
            *decoded1++ = a1;
            if (num_passes > 1) {
                int32_t left  = a1 - (unsigned)(a0 / 2);
-                int32_t right = left + a0;
+                int32_t right = left + (unsigned)a0;

-                if (FFMAX(FFABS(left), FFABS(right)) > (1<<23)) {
+                if (FFMIN(FFNABS(left), FFNABS(right)) < -(1<<23)) {
                    ctx->interim_mode = !interim_mode;
                    av_log(ctx->avctx, AV_LOG_VERBOSE, "Interim mode: %d\n", ctx->interim_mode);
                    break;
@@ -48,4 +48,3 @@ function ff_scalarproduct_int16_neon, export=1
        vmov.32         r0,  d3[0]
        bx              lr
 endfunc
-
@@ -229,7 +229,7 @@ A .endif
  .endif

        // Begin loop
-01:
+1:
  .if TOTAL_TAPS == 0
        // Things simplify a lot in this case
        // In fact this could be pipelined further if it's worth it...
@@ -241,7 +241,7 @@ A .endif
        str     ST0, [PST, #-4]!
        str     ST0, [PST, #4 * (MAX_BLOCKSIZE + MAX_FIR_ORDER)]
        str     ST0, [PSAMP], #4 * MAX_CHANNELS
-        bne     01b
+        bne     1b
  .else
    .if \fir_taps & 1
      .set LOAD_REG, 1
@@ -333,7 +333,7 @@ T       orr     AC0, AC0, AC1
        str     ST3, [PST, #-4]!
        str     ST2, [PST, #4 * (MAX_BLOCKSIZE + MAX_FIR_ORDER)]
        str     ST3, [PSAMP], #4 * MAX_CHANNELS
-        bne     01b
+        bne     1b
  .endif
        b       99f

@@ -279,11 +279,13 @@ function \type\()_8tap_\size\()h_\idx1\idx2
        sub             r1,  r1,  r5
 .endif
        @ size >= 16 loads two qwords and increments r2,
-        @ for size 4/8 it's enough with one qword and no
-        @ postincrement
+        @ size 4 loads 1 d word, increments r2 and loads 1 32-bit lane
+        @ for size 8 it's enough with one qword and no postincrement
 .if \size >= 16
        sub             r3,  r3,  r5
        sub             r3,  r3,  #8
+.elseif \size == 4
+        sub             r3,  r3,  #8
 .endif
        @ Load the filter vector
        vld1.16         {q0},  [r12,:128]
@@ -295,9 +297,14 @@ function \type\()_8tap_\size\()h_\idx1\idx2
 .if \size >= 16
        vld1.8          {d18, d19, d20}, [r2]!
        vld1.8          {d24, d25, d26}, [r7]!
-.else
+.elseif \size == 8
        vld1.8          {q9},  [r2]
        vld1.8          {q12}, [r7]
+.else @ size == 4
+        vld1.8          {d18}, [r2]!
+        vld1.8          {d24}, [r7]!
+        vld1.32         {d19[0]}, [r2]
+        vld1.32         {d25[0]}, [r7]
 .endif
        vmovl.u8        q8,  d18
        vmovl.u8        q9,  d19
@@ -801,7 +801,9 @@ static int atrac9_decode_frame(AVCodecContext *avctx, AVFrame *frame,
    if (ret < 0)
        return ret;

-    init_get_bits8(&gb, avpkt->data, avpkt->size);
+    ret = init_get_bits8(&gb, avpkt->data, avpkt->size);
+    if (ret < 0)
+        return ret;

    for (int i = 0; i < frames; i++) {
        for (int j = 0; j < s->block_config->count; j++) {
@@ -923,7 +925,9 @@ static av_cold int atrac9_decode_init(AVCodecContext *avctx)
        return AVERROR_INVALIDDATA;
    }

-    init_get_bits8(&gb, avctx->extradata + 4, avctx->extradata_size);
+    err = init_get_bits8(&gb, avctx->extradata + 4, avctx->extradata_size);
+    if (err < 0)
+        return err;

    if (get_bits(&gb, 8) != 0xFE) {
        av_log(avctx, AV_LOG_ERROR, "Incorrect magic byte!\n");
@@ -96,12 +96,11 @@ static int32_t decode_signed_subexp_with_ref(uint32_t sub_exp, int low,

 static void read_global_param(AV1DecContext *s, int type, int ref, int idx)
 {
-    uint8_t primary_frame, prev_frame;
+    int primary_frame;
    uint32_t abs_bits, prec_bits, round, prec_diff, sub, mx;
    int32_t r, prev_gm_param;

    primary_frame = s->raw_frame_header->primary_ref_frame;
-    prev_frame = s->raw_frame_header->ref_frame_idx[primary_frame];
    abs_bits = AV1_GM_ABS_ALPHA_BITS;
    prec_bits = AV1_GM_ALPHA_PREC_BITS;

@@ -111,8 +110,10 @@ static void read_global_param(AV1DecContext *s, int type, int ref, int idx)
     */
    if (s->raw_frame_header->primary_ref_frame == AV1_PRIMARY_REF_NONE)
        prev_gm_param = s->cur_frame.gm_params[ref][idx];
-    else
+    else {
+        int prev_frame = s->raw_frame_header->ref_frame_idx[primary_frame];
        prev_gm_param = s->ref[prev_frame].gm_params[ref][idx];
+    }

    if (idx < 2) {
        if (type == AV1_WARP_MODEL_TRANSLATION) {
@@ -177,7 +178,7 @@ static uint8_t get_shear_params_valid(AV1DecContext *s, int idx)
    int16_t alpha, beta, gamma, delta, divf, divs;
    int64_t v, w;
    int32_t *param = &s->cur_frame.gm_params[idx][0];
-    if (param[2] < 0)
+    if (param[2] <= 0)
        return 0;

    alpha = av_clip_int16(param[2] - (1 << AV1_WARPEDMODEL_PREC_BITS));
@@ -279,6 +280,8 @@ static void skip_mode_params(AV1DecContext *s)
    forward_idx  = -1;
    backward_idx = -1;
    for (i = 0; i < AV1_REFS_PER_FRAME; i++) {
+        if (!s->ref[header->ref_frame_idx[i]].raw_frame_header)
+            return;
        ref_hint = s->ref[header->ref_frame_idx[i]].raw_frame_header->order_hint;
        dist = get_relative_dist(seq, ref_hint, header->order_hint);
        if (dist < 0) {
@@ -443,7 +446,7 @@ static int get_tiles_info(AVCodecContext *avctx, const AV1RawTileGroup *tile_gro
 static enum AVPixelFormat get_sw_pixel_format(void *logctx,
                                              const AV1RawSequenceHeader *seq)
 {
-    uint8_t bit_depth;
+    int bit_depth;
    enum AVPixelFormat pix_fmt = AV_PIX_FMT_NONE;

    if (seq->seq_profile == 2 && seq->color_config.high_bitdepth)
@@ -467,7 +470,7 @@ static enum AVPixelFormat get_sw_pixel_format(void *logctx,
            else if (bit_depth == 12)
                pix_fmt = AV_PIX_FMT_YUV444P12;
            else
-                av_log(logctx, AV_LOG_WARNING, "Unknown AV1 pixel format.\n");
+                av_assert0(0);
        } else if (seq->color_config.subsampling_x == 1 &&
                   seq->color_config.subsampling_y == 0) {
            if (bit_depth == 8)
@@ -477,7 +480,7 @@ static enum AVPixelFormat get_sw_pixel_format(void *logctx,
            else if (bit_depth == 12)
                pix_fmt = AV_PIX_FMT_YUV422P12;
            else
-                av_log(logctx, AV_LOG_WARNING, "Unknown AV1 pixel format.\n");
+                av_assert0(0);
        } else if (seq->color_config.subsampling_x == 1 &&
                   seq->color_config.subsampling_y == 1) {
            if (bit_depth == 8)
@@ -487,7 +490,7 @@ static enum AVPixelFormat get_sw_pixel_format(void *logctx,
            else if (bit_depth == 12)
                pix_fmt = AV_PIX_FMT_YUV420P12;
            else
-                av_log(logctx, AV_LOG_WARNING, "Unknown AV1 pixel format.\n");
+                av_assert0(0);
        }
    } else {
        if (bit_depth == 8)
@@ -497,7 +500,7 @@ static enum AVPixelFormat get_sw_pixel_format(void *logctx,
        else if (bit_depth == 12)
            pix_fmt = AV_PIX_FMT_GRAY12;
        else
-            av_log(logctx, AV_LOG_WARNING, "Unknown AV1 pixel format.\n");
+            av_assert0(0);
    }

    return pix_fmt;
@@ -736,7 +739,7 @@ static int set_context_with_sequence(AVCodecContext *avctx,
    avctx->color_range =
        seq->color_config.color_range ? AVCOL_RANGE_JPEG : AVCOL_RANGE_MPEG;
    avctx->color_primaries = seq->color_config.color_primaries;
-    avctx->colorspace = seq->color_config.color_primaries;
+    avctx->colorspace = seq->color_config.matrix_coefficients;
    avctx->color_trc = seq->color_config.transfer_characteristics;

    switch (seq->color_config.chroma_sample_position) {
@@ -1204,6 +1207,8 @@ static int av1_receive_frame_internal(AVCodecContext *avctx, AVFrame *frame)
            ff_refstruct_replace(&s->seq_ref, unit->content_ref);

            s->raw_seq = &obu->obu.sequence_header;
+            s->raw_frame_header = NULL;
+            raw_tile_group      = NULL;

            ret = set_context_with_sequence(avctx, s->raw_seq);
            if (ret < 0) {
@@ -1248,6 +1253,8 @@ static int av1_receive_frame_internal(AVCodecContext *avctx, AVFrame *frame)

            ff_refstruct_replace(&s->header_ref, unit->content_ref);

+            raw_tile_group      = NULL;
+
            if (unit->type == AV1_OBU_FRAME)
                s->raw_frame_header = &obu->obu.frame.header;
            else
@@ -1326,8 +1333,11 @@ static int av1_receive_frame_internal(AVCodecContext *avctx, AVFrame *frame)
                }
            }
            break;
-        case AV1_OBU_TILE_LIST:
        case AV1_OBU_TEMPORAL_DELIMITER:
+            s->raw_frame_header = NULL;
+            raw_tile_group      = NULL;
+        // fall-through
+        case AV1_OBU_TILE_LIST:
        case AV1_OBU_PADDING:
            break;
        case AV1_OBU_METADATA:
@@ -1190,6 +1190,10 @@ typedef struct AVCodecContext {
     *   this callback and filled with the extra buffers if there are more
     *   buffers than buf[] can hold. extended_buf will be freed in
     *   av_frame_unref().
+     *   Decoders will generally initialize the whole buffer before it is output
+     *   but it can in rare error conditions happen that uninitialized data is passed
+     *   through. \important The buffers returned by get_buffer* should thus not contain sensitive
+     *   data.
     *
     * If AV_CODEC_CAP_DR1 is not set then get_buffer2() must call
     * avcodec_default_get_buffer2() instead of providing buffers allocated by
@@ -46,7 +46,7 @@ FFTContext *av_fft_init(int nbits, int inverse)
 {
    int ret;
    float scale = 1.0f;
-    AVTXWrapper *s = av_malloc(sizeof(*s));
+    AVTXWrapper *s = av_mallocz(sizeof(*s));
    if (!s)
        return NULL;

@@ -85,7 +85,7 @@ FFTContext *av_mdct_init(int nbits, int inverse, double scale)
 {
    int ret;
    float scale_f = scale;
-    AVTXWrapper *s = av_malloc(sizeof(*s));
+    AVTXWrapper *s = av_mallocz(sizeof(*s));
    if (!s)
        return NULL;

@@ -130,6 +130,7 @@ av_cold void av_mdct_end(FFTContext *s)
 {
    if (s) {
        AVTXWrapper *w = (AVTXWrapper *)s;
+        av_tx_uninit(&w->ctx2);
        av_tx_uninit(&w->ctx);
        av_free(w);
    }
@@ -146,12 +147,12 @@ RDFTContext *av_rdft_init(int nbits, enum RDFTransformType trans)
    if (trans != IDFT_C2R && trans != DFT_R2C)
        return NULL;

-    s = av_malloc(sizeof(*s));
+    s = av_mallocz(sizeof(*s));
    if (!s)
        return NULL;

    ret = av_tx_init(&s->ctx, &s->fn, AV_TX_FLOAT_RDFT, trans == IDFT_C2R,
-                     1 << nbits, &scale, AV_TX_INPLACE);
+                     1 << nbits, &scale, 0x0);
    if (ret < 0) {
        av_free(s);
        return NULL;
@@ -161,17 +162,35 @@ RDFTContext *av_rdft_init(int nbits, enum RDFTransformType trans)
    s->len = 1 << nbits;
    s->inv = trans == IDFT_C2R;

+    s->tmp = av_malloc((s->len + 2)*sizeof(float));
+    if (!s->tmp) {
+        av_tx_uninit(&s->ctx);
+        av_free(s);
+        return NULL;
+    }
+
    return (RDFTContext *)s;
 }

 void av_rdft_calc(RDFTContext *s, FFTSample *data)
 {
    AVTXWrapper *w = (AVTXWrapper *)s;
-    if (w->inv)
-        FFSWAP(float, data[1], data[w->len]);
-    w->fn(w->ctx, data, (void *)data, w->stride);
-    if (!w->inv)
-        FFSWAP(float, data[1], data[w->len]);
+    float *src = w->inv ? w->tmp : (float *)data;
+    float *dst = w->inv ? (float *)data : w->tmp;
+
+    if (w->inv) {
+        memcpy(src, data, w->len*sizeof(float));
+
+        src[w->len] = src[1];
+        src[1] = 0.0f;
+    }
+
+    w->fn(w->ctx, dst, (void *)src, w->stride);
+
+    if (!w->inv) {
+        dst[1] = dst[w->len];
+        memcpy(data, dst, w->len*sizeof(float));
+    }
 }

 av_cold void av_rdft_end(RDFTContext *s)
@@ -179,6 +198,7 @@ av_cold void av_rdft_end(RDFTContext *s)
    if (s) {
        AVTXWrapper *w = (AVTXWrapper *)s;
        av_tx_uninit(&w->ctx);
+        av_free(w->tmp);
        av_free(w);
    }
 }
@@ -199,7 +219,7 @@ DCTContext *av_dct_init(int nbits, enum DCTTransformType inverse)
        [DST_I] = AV_TX_FLOAT_DST_I,
    };

-    AVTXWrapper *s = av_malloc(sizeof(*s));
+    AVTXWrapper *s = av_mallocz(sizeof(*s));
    if (!s)
        return NULL;

@@ -72,13 +72,15 @@ static void parse_avs2_seq_header(AVCodecParserContext *s, const uint8_t *buf,
    unsigned aspect_ratio;
    unsigned frame_rate_code;
    int low_delay;
+    av_unused int ret;
    // update buf_size_min if parse more deeper
    const int buf_size_min = 15;

    if (buf_size < buf_size_min)
        return;

-    init_get_bits8(&gb, buf, buf_size_min);
+    ret = init_get_bits8(&gb, buf, buf_size_min);
+    av_assert1(ret >= 0);

    s->key_frame = 1;
    s->pict_type = AV_PICTURE_TYPE_I;
@@ -73,7 +73,8 @@ static void parse_avs3_nal_units(AVCodecParserContext *s, const uint8_t *buf,
            GetBitContext gb;
            int profile, ratecode, low_delay;

-            init_get_bits8(&gb, buf + 4, buf_size - 4);
+            av_unused int ret = init_get_bits(&gb, buf + 4, 100);
+            av_assert1(ret >= 0);

            s->key_frame = 1;
            s->pict_type = AV_PICTURE_TYPE_I;
@@ -129,7 +129,7 @@ static int bmp_decode_frame(AVCodecContext *avctx, AVFrame *p,
        rgb[1] = bytestream_get_le32(&buf);
        rgb[2] = bytestream_get_le32(&buf);
        if (ihsize > 40)
-        alpha = bytestream_get_le32(&buf);
+            alpha = bytestream_get_le32(&buf);
    }

    ret = ff_set_dimensions(avctx, width, height > 0 ? height : -(unsigned)height);
@@ -36,7 +36,7 @@ static int cbs_av1_read_uvlc(CodedBitstreamContext *ctx, GetBitContext *gbc,
    CBS_TRACE_READ_START();

    zeroes = 0;
-    while (1) {
+    while (zeroes < 32) {
        if (get_bits_left(gbc) < 1) {
            av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid uvlc code at "
                   "%s: bitstream ended.\n", name);
@@ -49,10 +49,18 @@ static int cbs_av1_read_uvlc(CodedBitstreamContext *ctx, GetBitContext *gbc,
    }

    if (zeroes >= 32) {
-        // Note that the spec allows an arbitrarily large number of
-        // zero bits followed by a one bit in this case, but the
-        // libaom implementation does not support it.
-        value = MAX_UINT_BITS(32);
+        // The spec allows at least thirty-two zero bits followed by a
+        // one to mean 2^32-1, with no constraint on the number of
+        // zeroes.  The libaom reference decoder does not match this,
+        // instead reading thirty-two zeroes but not the following one
+        // to mean 2^32-1.  These two interpretations are incompatible
+        // and other implementations may follow one or the other.
+        // Therefore we reject thirty-two zeroes because the intended
+        // behaviour is not clear.
+        av_log(ctx->log_ctx, AV_LOG_ERROR, "Thirty-two zero bits in "
+               "%s uvlc code: considered invalid due to conflicting "
+               "standard and reference decoder behaviour.\n", name);
+        return AVERROR_INVALIDDATA;
    } else {
        if (get_bits_left(gbc) < zeroes) {
            av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid uvlc code at "
@@ -301,7 +309,7 @@ static int cbs_av1_write_increment(CodedBitstreamContext *ctx, PutBitContext *pb
        return AVERROR(ENOSPC);

    if (len > 0)
-        put_bits(pbc, len, (1 << len) - 1 - (value != range_max));
+        put_bits(pbc, len, (1U << len) - 1 - (value != range_max));

    CBS_TRACE_WRITE_END_NO_SUBSCRIPTS();

@@ -186,10 +186,13 @@ static int FUNC(decoder_model_info)(CodedBitstreamContext *ctx, RWContext *rw,
 static int FUNC(sequence_header_obu)(CodedBitstreamContext *ctx, RWContext *rw,
                                     AV1RawSequenceHeader *current)
 {
+    CodedBitstreamAV1Context *priv = ctx->priv_data;
    int i, err;

    HEADER("Sequence Header");

+    priv->seen_frame_header = 0;
+
    fc(3, seq_profile, AV_PROFILE_AV1_MAIN,
                       AV_PROFILE_AV1_PROFESSIONAL);
    flag(still_picture);
@@ -235,6 +235,16 @@ static int cbs_h265_payload_extension_present(GetBitContext *gbc, uint32_t paylo
 #define FUNC_H266(name) FUNC_NAME1(READWRITE, h266, name)
 #define FUNC_SEI(name)  FUNC_NAME1(READWRITE, sei,  name)

+#define SEI_FUNC(name, args) \
+static int FUNC(name) args;  \
+static int FUNC(name ## _internal)(CodedBitstreamContext *ctx, \
+                                   RWContext *rw, void *cur,   \
+                                   SEIMessageState *state)     \
+{ \
+    return FUNC(name)(ctx, rw, cur, state); \
+} \
+static int FUNC(name) args
+
 #define SUBSCRIPTS(subs, ...) (subs > 0 ? ((int[subs + 1]){ subs, __VA_ARGS__ }) : NULL)

 #define u(width, name, range_min, range_max) \
@@ -698,7 +708,11 @@ static int cbs_h2645_split_fragment(CodedBitstreamContext *ctx,

            start = bytestream2_tell(&gbc);
            for(i = 0; i < num_nalus; i++) {
+                if (bytestream2_get_bytes_left(&gbc) < 2)
+                    return AVERROR_INVALIDDATA;
                size = bytestream2_get_be16(&gbc);
+                if (bytestream2_get_bytes_left(&gbc) < size)
+                    return AVERROR_INVALIDDATA;
                bytestream2_skip(&gbc, size);
            }
            end = bytestream2_tell(&gbc);
@@ -1989,7 +2003,17 @@ static const CodedBitstreamUnitTypeDescriptor cbs_h266_unit_types[] = {
    CBS_UNIT_TYPE_INTERNAL_REF(VVC_DCI_NUT, H266RawDCI, extension_data.data),
    CBS_UNIT_TYPE_INTERNAL_REF(VVC_OPI_NUT, H266RawOPI, extension_data.data),
    CBS_UNIT_TYPE_INTERNAL_REF(VVC_VPS_NUT, H266RawVPS, extension_data.data),
-    CBS_UNIT_TYPE_INTERNAL_REF(VVC_SPS_NUT, H266RawSPS, extension_data.data),
+    {
+        .nb_unit_types     = 1,
+        .unit_type.list[0] = VVC_SPS_NUT,
+        .content_type      = CBS_CONTENT_TYPE_INTERNAL_REFS,
+        .content_size      = sizeof(H266RawSPS),
+        .type.ref          = {
+            .nb_offsets = 2,
+            .offsets    = { offsetof(H266RawSPS, extension_data.data),
+                            offsetof(H266RawSPS, vui.extension_data.data) }
+        },
+    },
    CBS_UNIT_TYPE_INTERNAL_REF(VVC_PPS_NUT, H266RawPPS, extension_data.data),
    CBS_UNIT_TYPE_INTERNAL_REF(VVC_PREFIX_APS_NUT, H266RawAPS, extension_data.data),
    CBS_UNIT_TYPE_INTERNAL_REF(VVC_SUFFIX_APS_NUT, H266RawAPS, extension_data.data),
@@ -2059,6 +2083,11 @@ const CodedBitstreamType ff_cbs_type_h266 = {
    .close             = &cbs_h266_close,
 };

+// Macro for the read/write pair.
+#define SEI_MESSAGE_RW(codec, name) \
+    .read  = cbs_ ## codec ## _read_  ## name ## _internal, \
+    .write = cbs_ ## codec ## _write_ ## name ## _internal
+
 static const SEIMessageTypeDescriptor cbs_sei_common_types[] = {
    {
        SEI_TYPE_FILLER_PAYLOAD,
@@ -510,9 +510,9 @@ static int FUNC(pps)(CodedBitstreamContext *ctx, RWContext *rw,
    return 0;
 }

-static int FUNC(sei_buffering_period)(CodedBitstreamContext *ctx, RWContext *rw,
-                                      H264RawSEIBufferingPeriod *current,
-                                      SEIMessageState *sei)
+SEI_FUNC(sei_buffering_period, (CodedBitstreamContext *ctx, RWContext *rw,
+                                H264RawSEIBufferingPeriod *current,
+                                SEIMessageState *sei))
 {
    CodedBitstreamH264Context *h264 = ctx->priv_data;
    const H264RawSPS *sps;
@@ -604,9 +604,8 @@ static int FUNC(sei_pic_timestamp)(CodedBitstreamContext *ctx, RWContext *rw,
    return 0;
 }

-static int FUNC(sei_pic_timing)(CodedBitstreamContext *ctx, RWContext *rw,
-                                H264RawSEIPicTiming *current,
-                                SEIMessageState *sei)
+SEI_FUNC(sei_pic_timing, (CodedBitstreamContext *ctx, RWContext *rw,
+                          H264RawSEIPicTiming *current, SEIMessageState *sei))
 {
    CodedBitstreamH264Context *h264 = ctx->priv_data;
    const H264RawSPS *sps;
@@ -676,9 +675,9 @@ static int FUNC(sei_pic_timing)(CodedBitstreamContext *ctx, RWContext *rw,
    return 0;
 }

-static int FUNC(sei_pan_scan_rect)(CodedBitstreamContext *ctx, RWContext *rw,
-                                   H264RawSEIPanScanRect *current,
-                                   SEIMessageState *sei)
+SEI_FUNC(sei_pan_scan_rect, (CodedBitstreamContext *ctx, RWContext *rw,
+                             H264RawSEIPanScanRect *current,
+                             SEIMessageState *sei))
 {
    int err, i;

@@ -703,9 +702,9 @@ static int FUNC(sei_pan_scan_rect)(CodedBitstreamContext *ctx, RWContext *rw,
    return 0;
 }

-static int FUNC(sei_recovery_point)(CodedBitstreamContext *ctx, RWContext *rw,
-                                    H264RawSEIRecoveryPoint *current,
-                                    SEIMessageState *sei)
+SEI_FUNC(sei_recovery_point, (CodedBitstreamContext *ctx, RWContext *rw,
+                              H264RawSEIRecoveryPoint *current,
+                              SEIMessageState *sei))
 {
    int err;

@@ -719,9 +718,9 @@ static int FUNC(sei_recovery_point)(CodedBitstreamContext *ctx, RWContext *rw,
    return 0;
 }

-static int FUNC(film_grain_characteristics)(CodedBitstreamContext *ctx, RWContext *rw,
-                                            H264RawFilmGrainCharacteristics *current,
-                                            SEIMessageState *state)
+SEI_FUNC(film_grain_characteristics, (CodedBitstreamContext *ctx, RWContext *rw,
+                                      H264RawFilmGrainCharacteristics *current,
+                                      SEIMessageState *state))
 {
    CodedBitstreamH264Context *h264 = ctx->priv_data;
    const H264RawSPS *sps;
@@ -802,9 +801,9 @@ static int FUNC(film_grain_characteristics)(CodedBitstreamContext *ctx, RWContex
    return 0;
 }

-static int FUNC(sei_display_orientation)(CodedBitstreamContext *ctx, RWContext *rw,
-                                         H264RawSEIDisplayOrientation *current,
-                                         SEIMessageState *sei)
+SEI_FUNC(sei_display_orientation, (CodedBitstreamContext *ctx, RWContext *rw,
+                                   H264RawSEIDisplayOrientation *current,
+                                   SEIMessageState *sei))
 {
    int err;

@@ -1618,9 +1618,9 @@ static int FUNC(slice_segment_header)(CodedBitstreamContext *ctx, RWContext *rw,
    return 0;
 }

-static int FUNC(sei_buffering_period)
-    (CodedBitstreamContext *ctx, RWContext *rw,
-     H265RawSEIBufferingPeriod *current, SEIMessageState *sei)
+SEI_FUNC(sei_buffering_period, (CodedBitstreamContext *ctx, RWContext *rw,
+                                H265RawSEIBufferingPeriod *current,
+                                SEIMessageState *sei))
 {
    CodedBitstreamH265Context *h265 = ctx->priv_data;
    const H265RawSPS *sps;
@@ -1728,9 +1728,8 @@ static int FUNC(sei_buffering_period)
    return 0;
 }

-static int FUNC(sei_pic_timing)
-    (CodedBitstreamContext *ctx, RWContext *rw,
-     H265RawSEIPicTiming *current, SEIMessageState *sei)
+SEI_FUNC(sei_pic_timing, (CodedBitstreamContext *ctx, RWContext *rw,
+                          H265RawSEIPicTiming *current, SEIMessageState *sei))
 {
    CodedBitstreamH265Context *h265 = ctx->priv_data;
    const H265RawSPS *sps;
@@ -1804,9 +1803,9 @@ static int FUNC(sei_pic_timing)
    return 0;
 }

-static int FUNC(sei_pan_scan_rect)
-    (CodedBitstreamContext *ctx, RWContext *rw,
-     H265RawSEIPanScanRect *current, SEIMessageState *sei)
+SEI_FUNC(sei_pan_scan_rect, (CodedBitstreamContext *ctx, RWContext *rw,
+                             H265RawSEIPanScanRect *current,
+                             SEIMessageState *sei))
 {
    int err, i;

@@ -1831,9 +1830,9 @@ static int FUNC(sei_pan_scan_rect)
    return 0;
 }

-static int FUNC(sei_recovery_point)
-    (CodedBitstreamContext *ctx, RWContext *rw,
-     H265RawSEIRecoveryPoint *current, SEIMessageState *sei)
+SEI_FUNC(sei_recovery_point, (CodedBitstreamContext *ctx, RWContext *rw,
+                              H265RawSEIRecoveryPoint *current,
+                              SEIMessageState *sei))
 {
    int err;

@@ -1847,9 +1846,9 @@ static int FUNC(sei_recovery_point)
    return 0;
 }

-static int FUNC(film_grain_characteristics)(CodedBitstreamContext *ctx, RWContext *rw,
-                                            H265RawFilmGrainCharacteristics *current,
-                                            SEIMessageState *state)
+SEI_FUNC(film_grain_characteristics, (CodedBitstreamContext *ctx, RWContext *rw,
+                                      H265RawFilmGrainCharacteristics *current,
+                                      SEIMessageState *state))
 {
    CodedBitstreamH265Context *h265 = ctx->priv_data;
    const H265RawSPS *sps = h265->active_sps;
@@ -1912,9 +1911,9 @@ static int FUNC(film_grain_characteristics)(CodedBitstreamContext *ctx, RWContex
    return 0;
 }

-static int FUNC(sei_display_orientation)
-    (CodedBitstreamContext *ctx, RWContext *rw,
-     H265RawSEIDisplayOrientation *current, SEIMessageState *sei)
+SEI_FUNC(sei_display_orientation, (CodedBitstreamContext *ctx, RWContext *rw,
+                                   H265RawSEIDisplayOrientation *current,
+                                   SEIMessageState *sei))
 {
    int err;

@@ -1931,9 +1930,9 @@ static int FUNC(sei_display_orientation)
    return 0;
 }

-static int FUNC(sei_active_parameter_sets)
-    (CodedBitstreamContext *ctx, RWContext *rw,
-     H265RawSEIActiveParameterSets *current, SEIMessageState *sei)
+SEI_FUNC(sei_active_parameter_sets, (CodedBitstreamContext *ctx, RWContext *rw,
+                                     H265RawSEIActiveParameterSets *current,
+                                     SEIMessageState *sei))
 {
    CodedBitstreamH265Context *h265 = ctx->priv_data;
    const H265RawVPS *vps;
@@ -1968,9 +1967,9 @@ static int FUNC(sei_active_parameter_sets)
    return 0;
 }

-static int FUNC(sei_decoded_picture_hash)
-    (CodedBitstreamContext *ctx, RWContext *rw,
-     H265RawSEIDecodedPictureHash *current, SEIMessageState *sei)
+SEI_FUNC(sei_decoded_picture_hash, (CodedBitstreamContext *ctx, RWContext *rw,
+                                    H265RawSEIDecodedPictureHash *current,
+                                    SEIMessageState *sei))
 {
    CodedBitstreamH265Context *h265 = ctx->priv_data;
    const H265RawSPS *sps = h265->active_sps;
@@ -2000,9 +1999,8 @@ static int FUNC(sei_decoded_picture_hash)
    return 0;
 }

-static int FUNC(sei_time_code)
-    (CodedBitstreamContext *ctx, RWContext *rw,
-     H265RawSEITimeCode *current, SEIMessageState *sei)
+SEI_FUNC(sei_time_code, (CodedBitstreamContext *ctx, RWContext *rw,
+                         H265RawSEITimeCode *current, SEIMessageState *sei))
 {
    int err, i;

@@ -2051,9 +2049,9 @@ static int FUNC(sei_time_code)
    return 0;
 }

-static int FUNC(sei_alpha_channel_info)
-    (CodedBitstreamContext *ctx, RWContext *rw,
-     H265RawSEIAlphaChannelInfo *current, SEIMessageState *sei)
+SEI_FUNC(sei_alpha_channel_info, (CodedBitstreamContext *ctx, RWContext *rw,
+                                  H265RawSEIAlphaChannelInfo *current,
+                                  SEIMessageState *sei))
 {
    int err, length;

@@ -902,16 +902,17 @@ static int FUNC(vps) (CodedBitstreamContext *ctx, RWContext *rw,
                       current->vps_ols_mode_idc == 1) {
                num_layers_in_ols = i + 1;
            } else if (current->vps_ols_mode_idc == 2) {
-                for (k = 0, j = 0; k <= current->vps_max_layers_minus1; k++) {
+                for (k = 0, j = 0; k <= current->vps_max_layers_minus1; k++)
                    if (layer_included_in_ols_flag[i][k])
                        j++;
-                    num_layers_in_ols = j;
-                }
+                num_layers_in_ols = j;
            }
            if (num_layers_in_ols > 1) {
                num_multi_layer_olss++;
            }
        }
+        if (!current->vps_each_layer_is_an_ols_flag && num_multi_layer_olss == 0)
+            return AVERROR_INVALIDDATA;
    }

    for (i = 0; i <= current->vps_num_ptls_minus1; i++) {
@@ -1127,9 +1128,9 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw,
    tmp_height_val = AV_CEIL_RSHIFT(current->sps_pic_height_max_in_luma_samples,
                    ctb_log2_size_y);

-    flag(sps_subpic_info_present_flag);
+    u(1, sps_subpic_info_present_flag, 0, !current->sps_res_change_in_clvs_allowed_flag);
    if (current->sps_subpic_info_present_flag) {
-        ue(sps_num_subpics_minus1, 1, VVC_MAX_SLICES - 1);
+        ue(sps_num_subpics_minus1, 0, VVC_MAX_SLICES - 1);
        if (current->sps_num_subpics_minus1 > 0) {
            flag(sps_independent_subpics_flag);
            flag(sps_subpic_same_size_flag);
@@ -1188,7 +1189,7 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw,
                    int num_subpic_cols = tmp_width_val /
                                     (current->sps_subpic_width_minus1[0] + 1);
                    if (tmp_width_val % (current->sps_subpic_width_minus1[0] + 1) ||
-                        tmp_height_val % (current->sps_subpic_width_minus1[0] + 1) ||
+                        tmp_height_val % (current->sps_subpic_height_minus1[0] + 1) ||
                        current->sps_num_subpics_minus1 !=
                        (num_subpic_cols * tmp_height_val /
                         (current->sps_subpic_height_minus1[0] + 1) - 1))
@@ -1212,30 +1213,30 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw,
                    infer(sps_loop_filter_across_subpic_enabled_flag[i], 0);
                }
            }
-            ue(sps_subpic_id_len_minus1, 0, 15);
-            if ((1 << (current->sps_subpic_id_len_minus1 + 1)) <
-                current->sps_num_subpics_minus1 + 1) {
-                av_log(ctx->log_ctx, AV_LOG_ERROR,
-                       "sps_subpic_id_len_minus1(%d) is too small\n",
-                       current->sps_subpic_id_len_minus1);
-                return AVERROR_INVALIDDATA;
-            }
-            flag(sps_subpic_id_mapping_explicitly_signalled_flag);
-            if (current->sps_subpic_id_mapping_explicitly_signalled_flag) {
-                flag(sps_subpic_id_mapping_present_flag);
-                if (current->sps_subpic_id_mapping_present_flag) {
-                    for (i = 0; i <= current->sps_num_subpics_minus1; i++) {
-                        ubs(current->sps_subpic_id_len_minus1 + 1,
-                            sps_subpic_id[i], 1, i);
-                    }
-                }
-            }
        } else {
            infer(sps_subpic_ctu_top_left_x[0], 0);
            infer(sps_subpic_ctu_top_left_y[0], 0);
            infer(sps_subpic_width_minus1[0], tmp_width_val - 1);
            infer(sps_subpic_height_minus1[0], tmp_height_val - 1);
        }
+        ue(sps_subpic_id_len_minus1, 0, 15);
+        if ((1 << (current->sps_subpic_id_len_minus1 + 1)) <
+            current->sps_num_subpics_minus1 + 1) {
+            av_log(ctx->log_ctx, AV_LOG_ERROR,
+                   "sps_subpic_id_len_minus1(%d) is too small\n",
+                   current->sps_subpic_id_len_minus1);
+            return AVERROR_INVALIDDATA;
+        }
+        flag(sps_subpic_id_mapping_explicitly_signalled_flag);
+        if (current->sps_subpic_id_mapping_explicitly_signalled_flag) {
+            flag(sps_subpic_id_mapping_present_flag);
+            if (current->sps_subpic_id_mapping_present_flag) {
+                for (i = 0; i <= current->sps_num_subpics_minus1; i++) {
+                    ubs(current->sps_subpic_id_len_minus1 + 1,
+                        sps_subpic_id[i], 1, i);
+                }
+            }
+        }
    } else {
        infer(sps_num_subpics_minus1, 0);
        infer(sps_independent_subpics_flag, 1);
@@ -1615,6 +1616,8 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw,
        ub(7, sps_extension_7bits);

        if (current->sps_range_extension_flag) {
+            if (current->sps_bitdepth_minus8 <= 10 - 8)
+                return AVERROR_INVALIDDATA;
            CHECK(FUNC(sps_range_extension)(ctx, rw, current));
        } else {
            infer(sps_extended_precision_flag, 0);
@@ -1867,10 +1870,10 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw,
        }
        unified_size = current->pps_tile_column_width_minus1[i - 1] + 1;
        while (remaining_size > 0) {
-            if (current->num_tile_columns > VVC_MAX_TILE_COLUMNS) {
+            if (i == VVC_MAX_TILE_COLUMNS) {
                av_log(ctx->log_ctx, AV_LOG_ERROR,
-                       "NumTileColumns(%d) > than VVC_MAX_TILE_COLUMNS(%d)\n",
-                       current->num_tile_columns, VVC_MAX_TILE_COLUMNS);
+                       "Exceeded maximum tile columns (%d) (remaining size: %u)\n",
+                       VVC_MAX_TILE_COLUMNS, remaining_size);
                return AVERROR_INVALIDDATA;
            }
            unified_size = FFMIN(remaining_size, unified_size);
@@ -1879,12 +1882,6 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw,
            i++;
        }
        current->num_tile_columns = i;
-        if (current->num_tile_columns > VVC_MAX_TILE_COLUMNS) {
-            av_log(ctx->log_ctx, AV_LOG_ERROR,
-                   "NumTileColumns(%d) > than VVC_MAX_TILE_COLUMNS(%d)\n",
-                   current->num_tile_columns, VVC_MAX_TILE_COLUMNS);
-            return AVERROR_INVALIDDATA;
-        }

        remaining_size = pic_height_in_ctbs_y;
        for (i = 0; i <= current->pps_num_exp_tile_rows_minus1; i++) {
@@ -1899,18 +1896,18 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw,
        unified_size = current->pps_tile_row_height_minus1[i - 1] + 1;

        while (remaining_size > 0) {
+            if (i == VVC_MAX_TILE_ROWS) {
+                av_log(ctx->log_ctx, AV_LOG_ERROR,
+                       "Exceeded maximum tile rows (%d) (remaining size: %u)\n",
+                       VVC_MAX_TILE_ROWS, remaining_size);
+                return AVERROR_INVALIDDATA;
+            }
            unified_size = FFMIN(remaining_size, unified_size);
            current->row_height_val[i] = unified_size;
            remaining_size -= unified_size;
            i++;
        }
        current->num_tile_rows=i;
-        if (current->num_tile_rows > VVC_MAX_TILE_ROWS) {
-            av_log(ctx->log_ctx, AV_LOG_ERROR,
-                   "NumTileRows(%d) > than VVC_MAX_TILE_ROWS(%d)\n",
-                   current->num_tile_rows, VVC_MAX_TILE_ROWS);
-            return AVERROR_INVALIDDATA;
-        }

        current->num_tiles_in_pic = current->num_tile_columns *
                                    current->num_tile_rows;
@@ -1946,16 +1943,18 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw,
            for (i = 0; i < current->pps_num_slices_in_pic_minus1; i++) {
                tile_x = tile_idx % current->num_tile_columns;
                tile_y = tile_idx / current->num_tile_columns;
+                if (tile_y >= current->num_tile_rows)
+                    return AVERROR_INVALIDDATA;
                if (tile_x != current->num_tile_columns - 1) {
                    ues(pps_slice_width_in_tiles_minus1[i],
-                        0, current->num_tile_columns - 1, 1, i);
+                        0, current->num_tile_columns - 1 - tile_x, 1, i);
                } else {
                    infer(pps_slice_width_in_tiles_minus1[i], 0);
                }
                if (tile_y != current->num_tile_rows - 1 &&
                    (current->pps_tile_idx_delta_present_flag || tile_x == 0)) {
                    ues(pps_slice_height_in_tiles_minus1[i],
-                        0, current->num_tile_rows - 1, 1, i);
+                        0, current->num_tile_rows - 1 - tile_y, 1, i);
                } else {
                    if (tile_y == current->num_tile_rows - 1)
                        infer(pps_slice_height_in_tiles_minus1[i], 0);
@@ -1987,10 +1986,16 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw,
                        slice_top_left_ctu_y[i] = ctu_y;
                    } else {
                        uint16_t slice_height_in_ctus;
+                        int num_uniform_slices;
+
+                        if (i + current->pps_num_exp_slices_in_tile[i] >
+                            current->pps_num_slices_in_pic_minus1 + 1)
+                            return AVERROR_INVALIDDATA;
+
                        for (j = 0; j < current->pps_num_exp_slices_in_tile[i];
                             j++) {
                            ues(pps_exp_slice_height_in_ctus_minus1[i][j], 0,
-                                current->row_height_val[tile_y] - 1, 2,
+                                remaining_height_in_ctbs_y - (current->pps_num_exp_slices_in_tile[i] - j), 2,
                                i, j);
                            slice_height_in_ctus =
                                current->
@@ -2007,6 +2012,13 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw,
                        uniform_slice_height = 1 +
                            (j == 0 ? current->row_height_val[tile_y] - 1:
                            current->pps_exp_slice_height_in_ctus_minus1[i][j-1]);
+
+                        num_uniform_slices = (remaining_height_in_ctbs_y + uniform_slice_height - 1)
+                                           / uniform_slice_height;
+                        if (i + current->pps_num_exp_slices_in_tile[i] + num_uniform_slices >
+                            current->pps_num_slices_in_pic_minus1 + 1)
+                            return AVERROR_INVALIDDATA;
+
                        while (remaining_height_in_ctbs_y > uniform_slice_height) {
                            current->slice_height_in_ctus[i + j] =
                                                          uniform_slice_height;
@@ -2043,9 +2055,12 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw,
                }
                if (i < current->pps_num_slices_in_pic_minus1) {
                    if (current->pps_tile_idx_delta_present_flag) {
+                        // Two conditions must be met:
+                        // 1. −NumTilesInPic + 1 <= pps_tile_idx_delta_val[i] <= NumTilesInPic − 1
+                        // 2. 0 <= tile_idx + pps_tile_idx_delta_val[i] <= NumTilesInPic − 1
+                        // Combining these conditions yields: -tile_idx <= pps_tile_idx_delta_val[i] <= NumTilesInPic - 1 - tile_idx
                        ses(pps_tile_idx_delta_val[i],
-                            -current->num_tiles_in_pic + 1,
-                            current->num_tiles_in_pic - 1, 1, i);
+                            -tile_idx, current->num_tiles_in_pic - 1 - tile_idx, 1, i);
                        if (current->pps_tile_idx_delta_val[i] == 0) {
                            av_log(ctx->log_ctx, AV_LOG_ERROR,
                                   "pps_tile_idx_delta_val[i] shall not be equal to 0.\n");
@@ -2068,6 +2083,8 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw,

                tile_x = tile_idx % current->num_tile_columns;
                tile_y = tile_idx / current->num_tile_columns;
+                if (tile_y >= current->num_tile_rows)
+                    return AVERROR_INVALIDDATA;

                ctu_x = 0, ctu_y = 0;
                for (j = 0; j < tile_x; j++) {
@@ -2452,6 +2469,7 @@ static int FUNC(scaling_list_data)(CodedBitstreamContext *ctx, RWContext *rw,
 static int FUNC(aps)(CodedBitstreamContext *ctx, RWContext *rw,
                     H266RawAPS *current, int prefix)
 {
+    int aps_id_max = MAX_UINT_BITS(5);
    int err;

    if (prefix)
@@ -2464,7 +2482,12 @@ static int FUNC(aps)(CodedBitstreamContext *ctx, RWContext *rw,
                                       : VVC_SUFFIX_APS_NUT));

    ub(3, aps_params_type);
-    ub(5, aps_adaptation_parameter_set_id);
+    if (current->aps_params_type == VVC_ASP_TYPE_ALF ||
+        current->aps_params_type == VVC_ASP_TYPE_SCALING)
+        aps_id_max = 7;
+    else if (current->aps_params_type == VVC_ASP_TYPE_LMCS)
+        aps_id_max = 3;
+    u(5, aps_adaptation_parameter_set_id, 0, aps_id_max);
    flag(aps_chroma_present_flag);
    if (current->aps_params_type == VVC_ASP_TYPE_ALF)
        CHECK(FUNC(alf_data)(ctx, rw, current));
@@ -3082,7 +3105,7 @@ static int FUNC(slice_header) (CodedBitstreamContext *ctx, RWContext *rw,

    if (!pps->pps_rect_slice_flag &&
        pps->num_tiles_in_pic - current->sh_slice_address > 1)
-        ue(sh_num_tiles_in_slice_minus1, 0, pps->num_tiles_in_pic - 1);
+        ue(sh_num_tiles_in_slice_minus1, 0, pps->num_tiles_in_pic - 1 - current->sh_slice_address);
    else
        infer(sh_num_tiles_in_slice_minus1, 0);

@@ -3394,7 +3417,7 @@ static int FUNC(slice_header) (CodedBitstreamContext *ctx, RWContext *rw,
                 tile_idx <=
                 current->sh_slice_address +
                 current->sh_num_tiles_in_slice_minus1; tile_idx++) {
-                tile_y = tile_idx / pps->num_tile_rows;
+                tile_y = tile_idx / pps->num_tile_columns;
                height = pps->row_height_val[tile_y];
                current->num_entry_points += (entropy_sync ? height : 1);
            }
@@ -3418,10 +3441,10 @@ static int FUNC(slice_header) (CodedBitstreamContext *ctx, RWContext *rw,
    return 0;
 }

-static int FUNC(sei_decoded_picture_hash) (CodedBitstreamContext *ctx,
-                                           RWContext *rw,
-                                           H266RawSEIDecodedPictureHash *
-                                           current)
+SEI_FUNC(sei_decoded_picture_hash, (CodedBitstreamContext *ctx,
+                                    RWContext *rw,
+                                    H266RawSEIDecodedPictureHash *current,
+                                    SEIMessageState *unused))
 {
    int err, c_idx, i;

@@ -145,13 +145,13 @@ static int cbs_jpeg_split_fragment(CodedBitstreamContext *ctx,
            }
        } else {
            i = start;
-            if (i + 2 > frag->data_size) {
+            if (i > frag->data_size - 2) {
                av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid JPEG image: "
                       "truncated at %02x marker.\n", marker);
                return AVERROR_INVALIDDATA;
            }
            length = AV_RB16(frag->data + i);
-            if (i + length > frag->data_size) {
+            if (length > frag->data_size - i) {
                av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid JPEG image: "
                       "truncated at %02x marker segment.\n", marker);
                return AVERROR_INVALIDDATA;
@@ -40,7 +40,6 @@ int ff_cbs_sei_alloc_message_payload(SEIRawMessage *message,
                                     const SEIMessageTypeDescriptor *desc)
 {
    void (*free_func)(FFRefStructOpaque, void*);
-    unsigned flags = 0;

    av_assert0(message->payload     == NULL &&
               message->payload_ref == NULL);
@@ -52,10 +51,9 @@ int ff_cbs_sei_alloc_message_payload(SEIRawMessage *message,
        free_func = &cbs_free_user_data_unregistered;
    else {
        free_func = NULL;
-        flags = FF_REFSTRUCT_FLAG_NO_ZEROING;
    }

-    message->payload_ref = ff_refstruct_alloc_ext(desc->size, flags,
+    message->payload_ref = ff_refstruct_alloc_ext(desc->size, 0,
                                                  NULL, free_func);
    if (!message->payload_ref)
        return AVERROR(ENOMEM);
@@ -126,13 +126,6 @@ typedef struct SEIMessageTypeDescriptor {
    SEIMessageWriteFunction write;
 } SEIMessageTypeDescriptor;

-// Macro for the read/write pair.  The clumsy cast is needed because the
-// current pointer is typed in all of the read/write functions but has to
-// be void here to fit all cases.
-#define SEI_MESSAGE_RW(codec, name) \
-    .read  = (SEIMessageReadFunction) cbs_ ## codec ## _read_  ## name, \
-    .write = (SEIMessageWriteFunction)cbs_ ## codec ## _write_ ## name
-
 // End-of-list sentinel element.
 #define SEI_MESSAGE_TYPE_END { .type = -1 }

@@ -16,9 +16,9 @@
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

-static int FUNC(filler_payload)
-    (CodedBitstreamContext *ctx, RWContext *rw,
-     SEIRawFillerPayload *current, SEIMessageState *state)
+SEI_FUNC(filler_payload, (CodedBitstreamContext *ctx, RWContext *rw,
+                          SEIRawFillerPayload *current,
+                          SEIMessageState *state))
 {
    int err, i;

@@ -34,9 +34,9 @@ static int FUNC(filler_payload)
    return 0;
 }

-static int FUNC(user_data_registered)
-    (CodedBitstreamContext *ctx, RWContext *rw,
-     SEIRawUserDataRegistered *current, SEIMessageState *state)
+SEI_FUNC(user_data_registered, (CodedBitstreamContext *ctx, RWContext *rw,
+                                SEIRawUserDataRegistered *current,
+                                SEIMessageState *state))
 {
    int err, i, j;

@@ -66,9 +66,9 @@ static int FUNC(user_data_registered)
    return 0;
 }

-static int FUNC(user_data_unregistered)
-    (CodedBitstreamContext *ctx, RWContext *rw,
-     SEIRawUserDataUnregistered *current, SEIMessageState *state)
+SEI_FUNC(user_data_unregistered, (CodedBitstreamContext *ctx, RWContext *rw,
+                                  SEIRawUserDataUnregistered *current,
+                                  SEIMessageState *state))
 {
    int err, i;

@@ -94,9 +94,10 @@ static int FUNC(user_data_unregistered)
    return 0;
 }

-static int FUNC(mastering_display_colour_volume)
-    (CodedBitstreamContext *ctx, RWContext *rw,
-     SEIRawMasteringDisplayColourVolume *current, SEIMessageState *state)
+SEI_FUNC(mastering_display_colour_volume,
+         (CodedBitstreamContext *ctx, RWContext *rw,
+          SEIRawMasteringDisplayColourVolume *current,
+          SEIMessageState *state))
 {
    int err, c;

@@ -116,9 +117,9 @@ static int FUNC(mastering_display_colour_volume)
    return 0;
 }

-static int FUNC(content_light_level_info)
-    (CodedBitstreamContext *ctx, RWContext *rw,
-     SEIRawContentLightLevelInfo *current, SEIMessageState *state)
+SEI_FUNC(content_light_level_info, (CodedBitstreamContext *ctx, RWContext *rw,
+                                    SEIRawContentLightLevelInfo *current,
+                                    SEIMessageState *state))
 {
    int err;

@@ -130,10 +131,10 @@ static int FUNC(content_light_level_info)
    return 0;
 }

-static int FUNC(alternative_transfer_characteristics)
-    (CodedBitstreamContext *ctx, RWContext *rw,
-     SEIRawAlternativeTransferCharacteristics *current,
-     SEIMessageState *state)
+SEI_FUNC(alternative_transfer_characteristics,
+         (CodedBitstreamContext *ctx, RWContext *rw,
+          SEIRawAlternativeTransferCharacteristics *current,
+          SEIMessageState *state))
 {
    int err;

@@ -144,10 +145,10 @@ static int FUNC(alternative_transfer_characteristics)
    return 0;
 }

-static int FUNC(ambient_viewing_environment)
-    (CodedBitstreamContext *ctx, RWContext *rw,
-     SEIRawAmbientViewingEnvironment *current,
-     SEIMessageState *state)
+SEI_FUNC(ambient_viewing_environment,
+         (CodedBitstreamContext *ctx, RWContext *rw,
+          SEIRawAmbientViewingEnvironment *current,
+          SEIMessageState *state))
 {
    static const uint16_t max_ambient_light_value = 50000;
    int err;
@@ -375,7 +375,7 @@ static int cbs_vp9_split_fragment(CodedBitstreamContext *ctx,
    superframe_header = frag->data[frag->data_size - 1];

    if ((superframe_header & 0xe0) == 0xc0) {
-        VP9RawSuperframeIndex sfi;
+        VP9RawSuperframeIndex sfi = {0};
        GetBitContext gbc;
        size_t index_size, pos;
        int i;
@@ -26,6 +26,7 @@
 #include "libavutil/attributes.h"
 #include "libavutil/buffer.h"
 #include "libavutil/common.h"
+#include "libavutil/imgutils.h"
 #include "libavutil/intreadwrite.h"
 #include "libavutil/pixdesc.h"

@@ -275,6 +276,9 @@ static int alloc_buffers(AVCodecContext *avctx)
        int height = (i || bayer) ? s->coded_height >> chroma_y_shift : s->coded_height;
        ptrdiff_t stride = (FFALIGN(width  / 8, 8) + 64) * 8;

+        if ((ret = av_image_check_size2(stride, height, avctx->max_pixels, s->coded_format, 0, avctx)) < 0)
+            return ret;
+
        if (chroma_y_shift && !bayer)
            height = FFALIGN(height / 8, 2) * 8;
        s->plane[i].width  = width;
@@ -635,7 +639,7 @@ static int cfhd_decode(AVCodecContext *avctx, AVFrame *pic,
        } else
            av_log(avctx, AV_LOG_DEBUG,  "Unknown tag %i data %x\n", tag, data);

-        if (tag == BitstreamMarker && data == 0xf0f &&
+        if (tag == BitstreamMarker && data == CoefficientSegment &&
            s->coded_format != AV_PIX_FMT_NONE) {
            int lowpass_height = s->plane[s->channel_num].band[0][0].height;
            int lowpass_width  = s->plane[s->channel_num].band[0][0].width;
@@ -702,10 +706,15 @@ static int cfhd_decode(AVCodecContext *avctx, AVFrame *pic,

        if (s->subband_num_actual == 255)
            goto finish;
+
+        if (tag == BitstreamMarker && data == CoefficientSegment || tag == BandHeader || tag == BandSecondPass || s->peak.level)
+            if (s->transform_type != s->a_transform_type)
+                return AVERROR_PATCHWELCOME;
+
        coeff_data = s->plane[s->channel_num].subband[s->subband_num_actual];

        /* Lowpass coefficients */
-        if (tag == BitstreamMarker && data == 0xf0f) {
+        if (tag == BitstreamMarker && data == CoefficientSegment) {
            int lowpass_height, lowpass_width, lowpass_a_height, lowpass_a_width;

            if (!s->a_width || !s->a_height) {
@@ -92,6 +92,15 @@ enum CFHDParam {
    ChannelHeight    = 105,
 };

+enum CFHDSegment {
+    LowPassSegment      = 0x1a4a,
+    LowPassEndSegment   = 0x1b4b,
+    HighPassSegment     = 0x0d0d,
+    BandSegment         = 0x0e0e,
+    HighPassEndSegment  = 0x0c0c,
+    CoefficientSegment  = 0x0f0f,
+};
+
 #define VLC_BITS       9
 #define SUBBAND_COUNT 10
 #define SUBBAND_COUNT_3D 17
@@ -258,8 +258,8 @@ static av_cold int cfhd_encode_init(AVCodecContext *avctx)
    if (ret < 0)
        return ret;

-    if (avctx->height < 4) {
-        av_log(avctx, AV_LOG_ERROR, "Height must be >= 4.\n");
+    if (avctx->height < 32) {
+        av_log(avctx, AV_LOG_ERROR, "Height must be >= 32.\n");
        return AVERROR_INVALIDDATA;
    }

@@ -286,7 +286,7 @@ static av_cold int cfhd_encode_init(AVCodecContext *avctx)
        s->plane[i].dwt_buf =
            av_calloc(h8 * 8 * w8 * 8, sizeof(*s->plane[i].dwt_buf));
        s->plane[i].dwt_tmp =
-            av_malloc_array(h8 * 8 * w8 * 8, sizeof(*s->plane[i].dwt_tmp));
+            av_calloc(h8 * 8 * w8 * 8, sizeof(*s->plane[i].dwt_tmp));
        if (!s->plane[i].dwt_buf || !s->plane[i].dwt_tmp)
            return AVERROR(ENOMEM);

@@ -553,7 +553,7 @@ static int cfhd_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
                         width, height * 2);
    }

-    ret = ff_alloc_packet(avctx, pkt, 256LL + s->planes * (2LL * avctx->width * (avctx->height + 15) + 2048LL));
+    ret = ff_alloc_packet(avctx, pkt, 256LL + s->planes * (4LL * avctx->width * (avctx->height + 15) + 2048LL));
    if (ret < 0)
        return ret;

@@ -628,7 +628,7 @@ static int cfhd_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
        }

        bytestream2_put_be16(pby, BitstreamMarker);
-        bytestream2_put_be16(pby, 0x1a4a);
+        bytestream2_put_be16(pby, LowPassSegment);

        pos = bytestream2_tell_p(pby);

@@ -654,7 +654,7 @@ static int cfhd_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
        bytestream2_put_be16(pby, 16);

        bytestream2_put_be16(pby, BitstreamMarker);
-        bytestream2_put_be16(pby, 0x0f0f);
+        bytestream2_put_be16(pby, CoefficientSegment);

        for (int i = 0; i < height; i++) {
            for (int j = 0; j < width; j++)
@@ -663,7 +663,7 @@ static int cfhd_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
        }

        bytestream2_put_be16(pby, BitstreamMarker);
-        bytestream2_put_be16(pby, 0x1b4b);
+        bytestream2_put_be16(pby, LowPassEndSegment);

        for (int l = 0; l < 3; l++) {
            for (int i = 0; i < 3; i++) {
@@ -678,7 +678,7 @@ static int cfhd_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
            int height = s->plane[p].band[l][0].height;

            bytestream2_put_be16(pby, BitstreamMarker);
-            bytestream2_put_be16(pby, 0x0d0d);
+            bytestream2_put_be16(pby, HighPassSegment);

            bytestream2_put_be16(pby, WaveletType);
            bytestream2_put_be16(pby, 3 + 2 * (l == 2));
@@ -715,7 +715,7 @@ static int cfhd_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
                int count = 0, padd = 0;

                bytestream2_put_be16(pby, BitstreamMarker);
-                bytestream2_put_be16(pby, 0x0e0e);
+                bytestream2_put_be16(pby, BandSegment);

                bytestream2_put_be16(pby, SubbandNumber);
                bytestream2_put_be16(pby, i + 1);
@@ -761,7 +761,6 @@ static int cfhd_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
                        } else if (count > 0) {
                            count = put_runcode(pb, count, rb);
                        }
-
                        put_bits(pb, cb[index].size, cb[index].bits);
                    }

@@ -785,7 +784,7 @@ static int cfhd_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
            }

            bytestream2_put_be16(pby, BitstreamMarker);
-            bytestream2_put_be16(pby, 0x0c0c);
+            bytestream2_put_be16(pby, HighPassEndSegment);
        }

        s->plane[p].size = bytestream2_tell_p(pby) - pos;
@@ -90,4 +90,3 @@ const FFCodec ff_cljr_decoder = {
    FF_CODEC_DECODE_CB(decode_frame),
    .p.capabilities = AV_CODEC_CAP_DR1,
 };
-
@@ -1079,6 +1079,7 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)
    int s = 0;
    unsigned int channel_mask = 0;
    int samples_per_frame = 0;
+    int total_channels = 0;
    int ret;
    int channels = avctx->ch_layout.nb_channels;

@@ -1236,10 +1237,12 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)
        q->subpacket[s].gains2.now      = q->subpacket[s].gain_3;
        q->subpacket[s].gains2.previous = q->subpacket[s].gain_4;

-        if (q->num_subpackets + q->subpacket[s].num_channels > channels) {
-            av_log(avctx, AV_LOG_ERROR, "Too many subpackets %d for channels %d\n", q->num_subpackets, channels);
+        if (total_channels + q->subpacket[s].num_channels > channels) {
+            av_log(avctx, AV_LOG_ERROR, "Too many subpacket channels %d for channels %d\n",
+                   total_channels + q->subpacket[s].num_channels, channels);
            return AVERROR_INVALIDDATA;
        }
+        total_channels += q->subpacket[s].num_channels;

        q->num_subpackets++;
        s++;
@@ -221,10 +221,12 @@ static int cri_decode_frame(AVCodecContext *avctx, AVFrame *p,
            if (bytestream2_get_le32(gb) != 0)
                return AVERROR_INVALIDDATA;
            break;
-        case 102:
-            bytestream2_get_buffer(gb, codec_name, FFMIN(length, sizeof(codec_name) - 1));
-            length -= FFMIN(length, sizeof(codec_name) - 1);
-            if (strncmp(codec_name, "cintel_craw", FFMIN(length, sizeof(codec_name) - 1)))
+        case 102:;
+            int read_len = FFMIN(length, sizeof(codec_name) - 1);
+            if (read_len != bytestream2_get_buffer(gb, codec_name, read_len))
+                return AVERROR_INVALIDDATA;
+            length -= read_len;
+            if (strncmp(codec_name, "cintel_craw", read_len))
                return AVERROR_INVALIDDATA;
            compressed = 1;
            goto skip;
@@ -235,10 +237,14 @@ static int cri_decode_frame(AVCodecContext *avctx, AVFrame *p,
            s->data_size = length;
            goto skip;
        case 105:
+            if (length <= 0)
+                return AVERROR_INVALIDDATA;
            hflip = bytestream2_get_byte(gb) != 0;
            length--;
            goto skip;
        case 106:
+            if (length <= 0)
+                return AVERROR_INVALIDDATA;
            vflip = bytestream2_get_byte(gb) != 0;
            length--;
            goto skip;
@@ -63,12 +63,16 @@ static void get_linear_array(GetBitContext *gb, int32_t *array, int size, int n)
        array[i] = get_linear(gb, n);
 }

-static void get_rice_array(GetBitContext *gb, int32_t *array, int size, int k)
+static int get_rice_array(GetBitContext *gb, int32_t *array, int size, int k)
 {
    int i;

-    for (i = 0; i < size; i++)
+    for (i = 0; i < size && get_bits_left(gb) > k; i++)
        array[i] = get_rice(gb, k);
+
+    if (i < size)
+        return AVERROR_INVALIDDATA;
+    return 0;
 }

 static int parse_dmix_coeffs(DCAXllDecoder *s, DCAXllChSet *c)
@@ -528,8 +532,10 @@ static int chs_parse_band_data(DCAXllDecoder *s, DCAXllChSet *c, int band, int s
        } else {
            // Rice codes
            // Unpack all residuals of part A of segment 0
-            get_rice_array(&s->gb, part_a, c->nsamples_part_a[k],
-                           c->bitalloc_part_a[k]);
+            int ret = get_rice_array(&s->gb, part_a, c->nsamples_part_a[k],
+                                     c->bitalloc_part_a[k]);
+            if (ret < 0)
+                return ret;

            if (c->bitalloc_hybrid_linear[k]) {
                // Hybrid Rice codes
@@ -559,7 +565,9 @@ static int chs_parse_band_data(DCAXllDecoder *s, DCAXllChSet *c, int band, int s
            } else {
                // Rice codes
                // Unpack all residuals of part B of segment 0 and others
-                get_rice_array(&s->gb, part_b, nsamples_part_b, c->bitalloc_part_b[k]);
+                ret = get_rice_array(&s->gb, part_b, nsamples_part_b, c->bitalloc_part_b[k]);
+                if (ret < 0)
+                    return ret;
            }
        }
    }
@@ -1093,6 +1101,7 @@ static int copy_to_pbr(DCAXllDecoder *s, const uint8_t *data, int size, int dela
        return AVERROR(ENOMEM);

    memcpy(s->pbr_buffer, data, size);
+    memset(s->pbr_buffer + size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
    s->pbr_length = size;
    s->pbr_delay = delay;
    return 0;
@@ -1147,6 +1156,7 @@ static int parse_frame_pbr(DCAXllDecoder *s, const uint8_t *data, int size, DCAE

    memcpy(s->pbr_buffer + s->pbr_length, data, size);
    s->pbr_length += size;
+    memset(s->pbr_buffer + s->pbr_length, 0, AV_INPUT_BUFFER_PADDING_SIZE);

    // Respect decoding delay after synchronization error
    if (s->pbr_delay > 0 && --s->pbr_delay)
@@ -449,7 +449,8 @@ FF_ENABLE_DEPRECATION_WARNINGS
    } else if (avctx->codec->type == AVMEDIA_TYPE_AUDIO) {
        ret =  !got_frame ? AVERROR(EAGAIN)
                          : discard_samples(avctx, frame, discarded_samples);
-    }
+    } else
+        av_assert0(0);

    if (ret == AVERROR(EAGAIN))
        av_frame_unref(frame);
@@ -1838,17 +1839,26 @@ int ff_copy_palette(void *dst, const AVPacket *src, void *logctx)
 int ff_hwaccel_frame_priv_alloc(AVCodecContext *avctx, void **hwaccel_picture_private)
 {
    const FFHWAccel *hwaccel = ffhwaccel(avctx->hwaccel);
-    AVHWFramesContext *frames_ctx;

    if (!hwaccel || !hwaccel->frame_priv_data_size)
        return 0;

    av_assert0(!*hwaccel_picture_private);

-    frames_ctx = (AVHWFramesContext *)avctx->hw_frames_ctx->data;
-    *hwaccel_picture_private = ff_refstruct_alloc_ext(hwaccel->frame_priv_data_size, 0,
-                                                      frames_ctx->device_ctx,
-                                                      hwaccel->free_frame_priv);
+    if (hwaccel->free_frame_priv) {
+        AVHWFramesContext *frames_ctx;
+
+        if (!avctx->hw_frames_ctx)
+            return AVERROR(EINVAL);
+
+        frames_ctx = (AVHWFramesContext *) avctx->hw_frames_ctx->data;
+        *hwaccel_picture_private = ff_refstruct_alloc_ext(hwaccel->frame_priv_data_size, 0,
+                                                          frames_ctx->device_ctx,
+                                                          hwaccel->free_frame_priv);
+    } else {
+        *hwaccel_picture_private = ff_refstruct_allocz(hwaccel->frame_priv_data_size);
+    }
+
    if (!*hwaccel_picture_private)
        return AVERROR(ENOMEM);

@@ -93,9 +93,13 @@ int ff_attach_decode_data(AVFrame *frame);
 */
 int ff_copy_palette(void *dst, const AVPacket *src, void *logctx);

-/**
- * Check that the provided frame dimensions are valid and set them on the codec
- * context.
+/*
+ * Validate and set video frame dimensions on AVCodecContext.
+ *
+ * Dimensions accepted here satisfy FFmpeg's generic image-size validation
+ * (see av_image_check_size2()). Decoder code normally should not duplicate
+ * generic width/height overflow checks before ff_get_buffer(); add local
+ * checks only for codec-specific derived sizes or complexity bounds.
 */
 int ff_set_dimensions(AVCodecContext *s, int width, int height);

@@ -101,15 +101,16 @@ static int dfpwm_dec_frame(struct AVCodecContext *ctx, AVFrame *frame,
 {
    DFPWMState *state = ctx->priv_data;
    int ret;
+    uint64_t nb_samples = packet->size * 8LL / ctx->ch_layout.nb_channels;

    if (packet->size * 8LL % ctx->ch_layout.nb_channels)
        return AVERROR_PATCHWELCOME;

-    frame->nb_samples = packet->size * 8LL / ctx->ch_layout.nb_channels;
-    if (frame->nb_samples <= 0) {
+    if (nb_samples > INT_MAX || !nb_samples) {
        av_log(ctx, AV_LOG_ERROR, "invalid number of samples in packet\n");
        return AVERROR_INVALIDDATA;
    }
+    frame->nb_samples = nb_samples;

    if ((ret = ff_get_buffer(ctx, frame, 0)) < 0)
        return ret;
@@ -337,9 +337,9 @@ static int alloc_buffers(DiracContext *s, int stride)
    av_freep(&s->mctmp);
    av_freep(&s->mcscratch);

-    s->edge_emu_buffer_base = av_malloc_array(stride, MAX_BLOCKSIZE);
+    s->edge_emu_buffer_base = av_malloc_array(stride, 4 * MAX_BLOCKSIZE);

-    s->mctmp     = av_malloc_array((stride+MAX_BLOCKSIZE), (h+MAX_BLOCKSIZE) * sizeof(*s->mctmp));
+    s->mctmp     = av_malloc_array((stride+MAX_BLOCKSIZE), (h + 5*MAX_BLOCKSIZE) * sizeof(*s->mctmp));
    s->mcscratch = av_malloc_array(stride, MAX_BLOCKSIZE);

    if (!s->edge_emu_buffer_base || !s->mctmp || !s->mcscratch)
@@ -1894,7 +1894,7 @@ static int dirac_decode_frame_internal(DiracContext *s)

        /* FIXME: small resolutions */
        for (i = 0; i < 4; i++)
-            s->edge_emu_buffer[i] = s->edge_emu_buffer_base + i*FFALIGN(p->width, 16);
+            s->edge_emu_buffer[i] = s->edge_emu_buffer_base + i*s->buffer_stride*MAX_BLOCKSIZE;

        if (!s->zero_res && !s->low_delay)
        {
@@ -1943,7 +1943,7 @@ static int dirac_decode_frame_internal(DiracContext *s)
                    h = p->height - start;
                else
                    h = p->ybsep - (start - dsty);
-                if (h < 0)
+                if (h <= 0)
                    break;

                memset(mctmp+2*p->yoffset*p->stride, 0, 2*rowheight);
@@ -149,7 +149,7 @@ static inline uint64_t get_ue_coef(GetBitContext *gb, const AVDOVIRpuDataHeader

    case RPU_COEFF_FLOAT:
        fpart.u32 = get_bits_long(gb, 32);
-        return fpart.f32 * (1 << hdr->coef_log2_denom);
+        return fpart.f32 * (1LL << hdr->coef_log2_denom);
    }

    return 0; /* unreachable */
@@ -168,7 +168,7 @@ static inline int64_t get_se_coef(GetBitContext *gb, const AVDOVIRpuDataHeader *

    case RPU_COEFF_FLOAT:
        fpart.u32 = get_bits_long(gb, 32);
-        return fpart.f32 * (1 << hdr->coef_log2_denom);
+        return fpart.f32 * (1LL << hdr->coef_log2_denom);
    }

    return 0; /* unreachable */
@@ -337,4 +337,3 @@ const AVDVProfile *av_dv_codec_profile2(int width, int height,

    return p;
 }
-
@@ -59,7 +59,7 @@ static int dvdsub_parse(AVCodecParserContext *s,
        pc->packet = av_malloc(pc->packet_len + AV_INPUT_BUFFER_PADDING_SIZE);
    }
    if (pc->packet) {
-        if (pc->packet_index + buf_size <= pc->packet_len) {
+        if (buf_size <= pc->packet_len - pc->packet_index) {
            memcpy(pc->packet + pc->packet_index, buf, buf_size);
            pc->packet_index += buf_size;
            if (pc->packet_index >= pc->packet_len) {
@@ -376,7 +376,8 @@ static int encode_dvd_subtitles(AVCodecContext *avctx,
    x2 = vrect.x + vrect.w - 1;
    y2 = vrect.y + vrect.h - 1;

-    if (x2 > avctx->width || y2 > avctx->height) {
+    if ((avctx->width  > 0 && x2 > avctx->width) ||
+        (avctx->height > 0 && y2 > avctx->height)) {
        av_log(avctx, AV_LOG_ERROR, "canvas_size(%d:%d) is too small(%d:%d) for render\n",
               avctx->width, avctx->height, x2, y2);
        ret = AVERROR(EINVAL);
@@ -440,7 +440,7 @@ static int get_opcodes(GetByteContext *gb, uint32_t *table, uint8_t *dst, int op

    size_in_bits = bytestream2_get_le32(gb);
    endoffset = ((size_in_bits + 7) >> 3) - 4;
-    if (endoffset <= 0 || bytestream2_get_bytes_left(gb) < endoffset)
+    if ((int)endoffset <= 0 || bytestream2_get_bytes_left(gb) < endoffset)
        return AVERROR_INVALIDDATA;

    offset = endoffset;
@@ -474,7 +474,9 @@ static int dxv_decompress_opcodes(GetByteContext *gb, void *dstp, size_t op_size

    if ((flag & 3) == 0) {
        bytestream2_skip(gb, 1);
-        bytestream2_get_buffer(gb, dstp, op_size);
+        int read_size = bytestream2_get_buffer(gb, dstp, op_size);
+        if (read_size != op_size)
+            return AVERROR_INVALIDDATA;
    } else if ((flag & 3) == 1) {
        bytestream2_skip(gb, 1);
        memset(dstp, bytestream2_get_byte(gb), op_size);
@@ -1145,6 +1147,8 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame *frame,
        ctx->tex_rat = 1;
        break;
    }
+    if (avctx->coded_height / 2 / TEXTURE_BLOCK_H < 1)
+        return AVERROR_INVALIDDATA;

    ctx->slice_count = av_clip(avctx->thread_count, 1,
                               avctx->coded_height / FFMAX(ctx->texture_block_h,
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .1.git
 .1.6