Merge commit 'c5ec1908597824e93bbe20137ac9662f84f3cb07' into release/0.10

* commit 'c5ec1908597824e93bbe20137ac9662f84f3cb07':
  indeo: check for invalid motion vectors
  indeo: clear allocated band buffers
  indeo: track tile macroblock size
  factor out common decoding code for Indeo 4 and Indeo 5
  indeo: check custom Huffman tables for errors
  dfa: improve boundary checks in decode_dds1()
  dfa: use more meaningful return codes
  dfa: add some checks to ensure that decoder won't write past frame end
  dfa: convert to bytestream2 API
  dfa: check that the caller set width/height properly.
  avsdec: Set dimensions instead of relying on the demuxer.
  ac3dec: ensure get_buffer() gets a buffer for the correct number of channels

Conflicts:
	libavcodec/avs.c
	libavcodec/dfa.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

libavcodec/ac3dec.c

@@ -1408,6 +1408,7 @@ static int ac3_decode_frame(AVCodecContext * avctx, void *data,
         avctx->audio_service_type = AV_AUDIO_SERVICE_TYPE_KARAOKE;
 
     /* get output buffer */
+    avctx->channels = s->out_channels;
     s->frame.nb_samples = s->num_blocks * 256;
     if ((ret = avctx->get_buffer(avctx, &s->frame)) < 0) {
         av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");

libavcodec/avs.c

@@ -162,6 +162,7 @@ static av_cold int avs_decode_init(AVCodecContext * avctx)
     AvsContext *const avs = avctx->priv_data;
     avctx->pix_fmt = PIX_FMT_PAL8;
     avcodec_get_frame_defaults(&avs->picture);
+    avcodec_set_dimensions(avctx, 318, 198);
     return 0;
 }
 

libavcodec/dfa.c

@@ -21,8 +21,9 @@
  */
 
 #include "avcodec.h"
-#include "libavutil/intreadwrite.h"
 #include "bytestream.h"
+
+#include "libavutil/imgutils.h"
 #include "libavutil/lzo.h" // for av_memcpy_backptr
 
 typedef struct DfaContext {
@@ -35,9 +36,13 @@ typedef struct DfaContext {
 static av_cold int dfa_decode_init(AVCodecContext *avctx)
 {
     DfaContext *s = avctx->priv_data;
+    int ret;
 
     avctx->pix_fmt = PIX_FMT_PAL8;
 
+    if ((ret = av_image_check_size(avctx->width, avctx->height, 0, avctx)) < 0)
+        return ret;
+
     s->frame_buf = av_mallocz(avctx->width * avctx->height + AV_LZO_OUTPUT_PADDING);
     if (!s->frame_buf)
         return AVERROR(ENOMEM);
@@ -45,19 +50,16 @@ static av_cold int dfa_decode_init(AVCodecContext *avctx)
     return 0;
 }
 
-static int decode_copy(uint8_t *frame, int width, int height,
+static int decode_copy(GetByteContext *gb, uint8_t *frame, int width, int height)
-                       const uint8_t *src, const uint8_t *src_end)
 {
     const int size = width * height;
 
-    if (src_end - src < size)
+    if (bytestream2_get_buffer(gb, frame, size) != size)
-        return -1;
+        return AVERROR_INVALIDDATA;
-    bytestream_get_buffer(&src, frame, size);
     return 0;
 }
 
-static int decode_tsw1(uint8_t *frame, int width, int height,
+static int decode_tsw1(GetByteContext *gb, uint8_t *frame, int width, int height)
-                       const uint8_t *src, const uint8_t *src_end)
 {
     const uint8_t *frame_start = frame;
     const uint8_t *frame_end   = frame + width * height;
@@ -65,31 +67,31 @@ static int decode_tsw1(uint8_t *frame, int width, int height,
     int v, count, segments;
     unsigned offset;
 
-    segments = bytestream_get_le32(&src);
+    segments = bytestream2_get_le32(gb);
-    offset   = bytestream_get_le32(&src);
+    offset   = bytestream2_get_le32(gb);
     if (frame_end - frame <= offset)
-        return -1;
+        return AVERROR_INVALIDDATA;
     frame += offset;
     while (segments--) {
+        if (bytestream2_get_bytes_left(gb) < 2)
+            return AVERROR_INVALIDDATA;
         if (mask == 0x10000) {
-            if (src >= src_end)
+            bitbuf = bytestream2_get_le16u(gb);
-                return -1;
-            bitbuf = bytestream_get_le16(&src);
             mask = 1;
         }
-        if (src_end - src < 2 || frame_end - frame < 2)
+        if (frame_end - frame < 2)
-            return -1;
+            return AVERROR_INVALIDDATA;
         if (bitbuf & mask) {
-            v = bytestream_get_le16(&src);
+            v = bytestream2_get_le16(gb);
             offset = (v & 0x1FFF) << 1;
             count = ((v >> 13) + 2) << 1;
             if (frame - frame_start < offset || frame_end - frame < count)
-                return -1;
+                return AVERROR_INVALIDDATA;
             av_memcpy_backptr(frame, offset, count);
             frame += count;
         } else {
-            *frame++ = *src++;
+            *frame++ = bytestream2_get_byte(gb);
-            *frame++ = *src++;
+            *frame++ = bytestream2_get_byte(gb);
         }
         mask <<= 1;
     }
@@ -97,39 +99,38 @@ static int decode_tsw1(uint8_t *frame, int width, int height,
     return 0;
 }
 
-static int decode_dsw1(uint8_t *frame, int width, int height,
+static int decode_dsw1(GetByteContext *gb, uint8_t *frame, int width, int height)
-                       const uint8_t *src, const uint8_t *src_end)
 {
     const uint8_t *frame_start = frame;
     const uint8_t *frame_end   = frame + width * height;
     int mask = 0x10000, bitbuf = 0;
     int v, offset, count, segments;
 
-    segments = bytestream_get_le16(&src);
+    segments = bytestream2_get_le16(gb);
     while (segments--) {
+        if (bytestream2_get_bytes_left(gb) < 2)
+            return AVERROR_INVALIDDATA;
         if (mask == 0x10000) {
-            if (src >= src_end)
+            bitbuf = bytestream2_get_le16u(gb);
-                return -1;
-            bitbuf = bytestream_get_le16(&src);
             mask = 1;
         }
-        if (src_end - src < 2 || frame_end - frame < 2)
+        if (frame_end - frame < 2)
-            return -1;
+            return AVERROR_INVALIDDATA;
         if (bitbuf & mask) {
-            v = bytestream_get_le16(&src);
+            v = bytestream2_get_le16(gb);
             offset = (v & 0x1FFF) << 1;
             count = ((v >> 13) + 2) << 1;
             if (frame - frame_start < offset || frame_end - frame < count)
-                return -1;
+                return AVERROR_INVALIDDATA;
             // can't use av_memcpy_backptr() since it can overwrite following pixels
             for (v = 0; v < count; v++)
                 frame[v] = frame[v - offset];
             frame += count;
         } else if (bitbuf & (mask << 1)) {
-            frame += bytestream_get_le16(&src);
+            frame += bytestream2_get_le16(gb);
         } else {
-            *frame++ = *src++;
+            *frame++ = bytestream2_get_byte(gb);
-            *frame++ = *src++;
+            *frame++ = bytestream2_get_byte(gb);
         }
         mask <<= 2;
     }
@@ -137,30 +138,28 @@ static int decode_dsw1(uint8_t *frame, int width, int height,
     return 0;
 }
 
-static int decode_dds1(uint8_t *frame, int width, int height,
+static int decode_dds1(GetByteContext *gb, uint8_t *frame, int width, int height)
-                       const uint8_t *src, const uint8_t *src_end)
 {
     const uint8_t *frame_start = frame;
     const uint8_t *frame_end   = frame + width * height;
     int mask = 0x10000, bitbuf = 0;
     int i, v, offset, count, segments;
 
-    segments = bytestream_get_le16(&src);
+    segments = bytestream2_get_le16(gb);
     while (segments--) {
+        if (bytestream2_get_bytes_left(gb) < 2)
+            return AVERROR_INVALIDDATA;
         if (mask == 0x10000) {
-            if (src >= src_end)
+            bitbuf = bytestream2_get_le16u(gb);
-                return -1;
-            bitbuf = bytestream_get_le16(&src);
             mask = 1;
         }
-        if (src_end - src < 2 || frame_end - frame < 2)
+
-            return -1;
         if (bitbuf & mask) {
-            v = bytestream_get_le16(&src);
+            v = bytestream2_get_le16(gb);
             offset = (v & 0x1FFF) << 2;
             count = ((v >> 13) + 2) << 1;
             if (frame - frame_start < offset || frame_end - frame < count*2 + width)
-                return -1;
+                return AVERROR_INVALIDDATA;
             for (i = 0; i < count; i++) {
                 frame[0] = frame[1] =
                 frame[width] = frame[width + 1] = frame[-offset];
@@ -168,13 +167,18 @@ static int decode_dds1(uint8_t *frame, int width, int height,
                 frame += 2;
             }
         } else if (bitbuf & (mask << 1)) {
-            frame += bytestream_get_le16(&src) * 2;
+            v = bytestream2_get_le16(gb)*2;
+            if (frame - frame_end < v)
+                return AVERROR_INVALIDDATA;
+            frame += v;
         } else {
+            if (frame_end - frame < width + 3)
+                return AVERROR_INVALIDDATA;
             frame[0] = frame[1] =
-            frame[width] = frame[width + 1] =  *src++;
+            frame[width] = frame[width + 1] =  bytestream2_get_byte(gb);
             frame += 2;
             frame[0] = frame[1] =
-            frame[width] = frame[width + 1] =  *src++;
+            frame[width] = frame[width + 1] =  bytestream2_get_byte(gb);
             frame += 2;
         }
         mask <<= 2;
@@ -183,40 +187,40 @@ static int decode_dds1(uint8_t *frame, int width, int height,
     return 0;
 }
 
-static int decode_bdlt(uint8_t *frame, int width, int height,
+static int decode_bdlt(GetByteContext *gb, uint8_t *frame, int width, int height)
-                       const uint8_t *src, const uint8_t *src_end)
 {
     uint8_t *line_ptr;
     int count, lines, segments;
 
-    count = bytestream_get_le16(&src);
+    count = bytestream2_get_le16(gb);
     if (count >= height)
-        return -1;
+        return AVERROR_INVALIDDATA;
     frame += width * count;
-    lines = bytestream_get_le16(&src);
+    lines = bytestream2_get_le16(gb);
-    if (count + lines > height || src >= src_end)
+    if (count + lines > height)
-        return -1;
+        return AVERROR_INVALIDDATA;
 
     while (lines--) {
+        if (bytestream2_get_bytes_left(gb) < 1)
+            return AVERROR_INVALIDDATA;
         line_ptr = frame;
         frame += width;
-        segments = *src++;
+        segments = bytestream2_get_byteu(gb);
         while (segments--) {
-            if (src_end - src < 3)
+            if (frame - line_ptr <= bytestream2_peek_byte(gb))
-                return -1;
+                return AVERROR_INVALIDDATA;
-            if (frame - line_ptr <= *src)
+            line_ptr += bytestream2_get_byte(gb);
-                return -1;
+            count = (int8_t)bytestream2_get_byte(gb);
-            line_ptr += *src++;
-            count = (int8_t)*src++;
             if (count >= 0) {
-                if (frame - line_ptr < count || src_end - src < count)
+                if (frame - line_ptr < count)
-                    return -1;
+                    return AVERROR_INVALIDDATA;
-                bytestream_get_buffer(&src, line_ptr, count);
+                if (bytestream2_get_buffer(gb, line_ptr, count) != count)
+                    return AVERROR_INVALIDDATA;
             } else {
                 count = -count;
-                if (frame - line_ptr < count || src >= src_end)
+                if (frame - line_ptr < count)
-                    return -1;
+                    return AVERROR_INVALIDDATA;
-                memset(line_ptr, *src++, count);
+                memset(line_ptr, bytestream2_get_byte(gb), count);
             }
             line_ptr += count;
         }
@@ -225,49 +229,53 @@ static int decode_bdlt(uint8_t *frame, int width, int height,
     return 0;
 }
 
-static int decode_wdlt(uint8_t *frame, int width, int height,
+static int decode_wdlt(GetByteContext *gb, uint8_t *frame, int width, int height)
-                       const uint8_t *src, const uint8_t *src_end)
 {
     const uint8_t *frame_end   = frame + width * height;
     uint8_t *line_ptr;
     int count, i, v, lines, segments;
+    int y = 0;
 
-    lines = bytestream_get_le16(&src);
+    lines = bytestream2_get_le16(gb);
-    if (lines > height || src >= src_end)
+    if (lines > height)
-        return -1;
+        return AVERROR_INVALIDDATA;
 
     while (lines--) {
-        segments = bytestream_get_le16(&src);
+        if (bytestream2_get_bytes_left(gb) < 2)
+            return AVERROR_INVALIDDATA;
+        segments = bytestream2_get_le16u(gb);
         while ((segments & 0xC000) == 0xC000) {
+            unsigned skip_lines = -(int16_t)segments;
             unsigned delta = -((int16_t)segments * width);
-            if (frame_end - frame <= delta)
+            if (frame_end - frame <= delta || y + lines + skip_lines > height)
-                return -1;
+                return AVERROR_INVALIDDATA;
             frame    += delta;
-            segments = bytestream_get_le16(&src);
+            y        += skip_lines;
+            segments = bytestream2_get_le16(gb);
         }
         if (segments & 0x8000) {
             frame[width - 1] = segments & 0xFF;
-            segments = bytestream_get_le16(&src);
+            segments = bytestream2_get_le16(gb);
         }
         line_ptr = frame;
         frame += width;
+        y++;
         while (segments--) {
-            if (src_end - src < 2)
+            if (frame - line_ptr <= bytestream2_peek_byte(gb))
-                return -1;
+                return AVERROR_INVALIDDATA;
-            if (frame - line_ptr <= *src)
+            line_ptr += bytestream2_get_byte(gb);
-                return -1;
+            count = (int8_t)bytestream2_get_byte(gb);
-            line_ptr += *src++;
-            count = (int8_t)*src++;
             if (count >= 0) {
-                if (frame - line_ptr < count*2 || src_end - src < count*2)
+                if (frame - line_ptr < count * 2)
-                    return -1;
+                    return AVERROR_INVALIDDATA;
-                bytestream_get_buffer(&src, line_ptr, count*2);
+                if (bytestream2_get_buffer(gb, line_ptr, count * 2) != count * 2)
+                    return AVERROR_INVALIDDATA;
                 line_ptr += count * 2;
             } else {
                 count = -count;
-                if (frame - line_ptr < count*2 || src_end - src < 2)
+                if (frame - line_ptr < count * 2)
-                    return -1;
+                    return AVERROR_INVALIDDATA;
-                v = bytestream_get_le16(&src);
+                v = bytestream2_get_le16(gb);
                 for (i = 0; i < count; i++)
                     bytestream_put_le16(&line_ptr, v);
             }
@@ -277,22 +285,19 @@ static int decode_wdlt(uint8_t *frame, int width, int height,
     return 0;
 }
 
-static int decode_unk6(uint8_t *frame, int width, int height,
+static int decode_unk6(GetByteContext *gb, uint8_t *frame, int width, int height)
-                       const uint8_t *src, const uint8_t *src_end)
 {
-    return -1;
+    return AVERROR_PATCHWELCOME;
 }
 
-static int decode_blck(uint8_t *frame, int width, int height,
+static int decode_blck(GetByteContext *gb, uint8_t *frame, int width, int height)
-                       const uint8_t *src, const uint8_t *src_end)
 {
     memset(frame, 0, width * height);
     return 0;
 }
 
 
-typedef int (*chunk_decoder)(uint8_t *frame, int width, int height,
+typedef int (*chunk_decoder)(GetByteContext *gb, uint8_t *frame, int width, int height);
-                             const uint8_t *src, const uint8_t *src_end);
 
 static const chunk_decoder decoder[8] = {
     decode_copy, decode_tsw1, decode_bdlt, decode_wdlt,
@@ -308,9 +313,8 @@ static int dfa_decode_frame(AVCodecContext *avctx,
                             AVPacket *avpkt)
 {
     DfaContext *s = avctx->priv_data;
+    GetByteContext gb;
     const uint8_t *buf = avpkt->data;
-    const uint8_t *buf_end = avpkt->data + avpkt->size;
-    const uint8_t *tmp_buf;
     uint32_t chunk_type, chunk_size;
     uint8_t *dst;
     int ret;
@@ -324,30 +328,25 @@ static int dfa_decode_frame(AVCodecContext *avctx,
         return ret;
     }
 
-    while (buf < buf_end) {
+    bytestream2_init(&gb, avpkt->data, avpkt->size);
-        chunk_size = AV_RL32(buf + 4);
+    while (bytestream2_get_bytes_left(&gb) > 0) {
-        chunk_type = AV_RL32(buf + 8);
+        bytestream2_skip(&gb, 4);
-        buf += 12;
+        chunk_size = bytestream2_get_le32(&gb);
-        if (buf_end - buf < chunk_size) {
+        chunk_type = bytestream2_get_le32(&gb);
-            av_log(avctx, AV_LOG_ERROR, "Chunk size is too big (%d bytes)\n", chunk_size);
-            return -1;
-        }
         if (!chunk_type)
             break;
         if (chunk_type == 1) {
             pal_elems = FFMIN(chunk_size / 3, 256);
-            tmp_buf = buf;
             for (i = 0; i < pal_elems; i++) {
-                s->pal[i] = bytestream_get_be24(&tmp_buf) << 2;
+                s->pal[i] = bytestream2_get_be24(&gb) << 2;
                 s->pal[i] |= 0xFF << 24 | (s->pal[i] >> 6) & 0x30303;
             }
             s->pic.palette_has_changed = 1;
         } else if (chunk_type <= 9) {
-            if (decoder[chunk_type - 2](s->frame_buf, avctx->width, avctx->height,
+            if (decoder[chunk_type - 2](&gb, s->frame_buf, avctx->width, avctx->height)) {
-                                        buf, buf + chunk_size)) {
                 av_log(avctx, AV_LOG_ERROR, "Error decoding %s chunk\n",
                        chunk_name[chunk_type - 2]);
-                return -1;
+                return AVERROR_INVALIDDATA;
             }
         } else {
             av_log(avctx, AV_LOG_WARNING, "Ignoring unknown chunk type %d\n",

libavcodec/indeo4.c

@@ -35,9 +35,6 @@
 #include "ivi_common.h"
 #include "indeo4data.h"
 
-#define IVI4_STREAM_ANALYSER    0
-#define IVI4_DEBUG_CHECKSUM     0
-
 /**
  *  Indeo 4 frame types.
  */
@@ -54,46 +51,6 @@ enum {
 #define IVI4_PIC_SIZE_ESC   7
 
 
-typedef struct {
-    GetBitContext   gb;
-    AVFrame         frame;
-    RVMapDesc       rvmap_tabs[9];   ///< local corrected copy of the static rvmap tables
-
-    uint32_t        frame_num;
-    int             frame_type;
-    int             prev_frame_type; ///< frame type of the previous frame
-    uint32_t        data_size;       ///< size of the frame data in bytes from picture header
-    int             is_scalable;
-    int             transp_status;   ///< transparency mode status: 1 - enabled
-
-    IVIPicConfig    pic_conf;
-    IVIPlaneDesc    planes[3];       ///< color planes
-
-    int             buf_switch;      ///< used to switch between three buffers
-    int             dst_buf;         ///< buffer index for the currently decoded frame
-    int             ref_buf;         ///< inter frame reference buffer index
-
-    IVIHuffTab      mb_vlc;          ///< current macroblock table descriptor
-    IVIHuffTab      blk_vlc;         ///< current block table descriptor
-
-    uint16_t        checksum;        ///< frame checksum
-
-    uint8_t         rvmap_sel;
-    uint8_t         in_imf;
-    uint8_t         in_q;            ///< flag for explicitly stored quantiser delta
-    uint8_t         pic_glob_quant;
-    uint8_t         unknown1;
-
-#if IVI4_STREAM_ANALYSER
-    uint8_t         has_b_frames;
-    uint8_t         has_transp;
-    uint8_t         uses_tiling;
-    uint8_t         uses_haar;
-    uint8_t         uses_fullpel;
-#endif
-} IVI4DecContext;
-
-
 static const struct {
     InvTransformPtr *inv_trans;
     DCTransformPtr  *dc_trans;
@@ -158,7 +115,7 @@ static inline int scale_tile_size(int def_size, int size_factor)
  *  @param[in]     avctx     pointer to the AVCodecContext
  *  @return        result code: 0 = OK, negative number = error
  */
-static int decode_pic_hdr(IVI4DecContext *ctx, AVCodecContext *avctx)
+static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx)
 {
     int             pic_size_indx, i, p;
     IVIPicConfig    pic_conf;
@@ -322,7 +279,7 @@ static int decode_pic_hdr(IVI4DecContext *ctx, AVCodecContext *avctx)
  *  @param[in]     avctx     pointer to the AVCodecContext
  *  @return        result code: 0 = OK, negative number = error
  */
-static int decode_band_hdr(IVI4DecContext *ctx, IVIBandDesc *band,
+static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band,
                            AVCodecContext *avctx)
 {
     int plane, band_num, indx, transform_id, scan_indx;
@@ -458,7 +415,7 @@ static int decode_band_hdr(IVI4DecContext *ctx, IVIBandDesc *band,
  *  @param[in]     avctx     pointer to the AVCodecContext
  *  @return        result code: 0 = OK, negative number = error
  */
-static int decode_mb_info(IVI4DecContext *ctx, IVIBandDesc *band,
+static int decode_mb_info(IVI45DecContext *ctx, IVIBandDesc *band,
                           IVITile *tile, AVCodecContext *avctx)
 {
     int         x, y, mv_x, mv_y, mv_delta, offs, mb_offset, blks_per_mb,
@@ -578,126 +535,12 @@ static int decode_mb_info(IVI4DecContext *ctx, IVIBandDesc *band,
 }
 
 
-/**
- *  Decode an Indeo 4 band.
- *
- *  @param[in,out] ctx       pointer to the decoder context
- *  @param[in,out] band      pointer to the band descriptor
- *  @param[in]     avctx     pointer to the AVCodecContext
- *  @return        result code: 0 = OK, negative number = error
- */
-static int decode_band(IVI4DecContext *ctx, int plane_num,
-                       IVIBandDesc *band, AVCodecContext *avctx)
-{
-    int         result, i, t, pos, idx1, idx2;
-    IVITile     *tile;
-
-    band->buf     = band->bufs[ctx->dst_buf];
-    band->ref_buf = band->bufs[ctx->ref_buf];
-
-    result = decode_band_hdr(ctx, band, avctx);
-    if (result) {
-        av_log(avctx, AV_LOG_ERROR, "Error decoding band header\n");
-        return result;
-    }
-
-    if (band->is_empty) {
-        av_log(avctx, AV_LOG_ERROR, "Empty band encountered!\n");
-        return AVERROR_INVALIDDATA;
-    }
-
-    band->rv_map = &ctx->rvmap_tabs[band->rvmap_sel];
-
-    /* apply corrections to the selected rvmap table if present */
-    for (i = 0; i < band->num_corr; i++) {
-        idx1 = band->corr[i * 2];
-        idx2 = band->corr[i * 2 + 1];
-        FFSWAP(uint8_t, band->rv_map->runtab[idx1], band->rv_map->runtab[idx2]);
-        FFSWAP(int16_t, band->rv_map->valtab[idx1], band->rv_map->valtab[idx2]);
-    }
-
-    pos = get_bits_count(&ctx->gb);
-
-    for (t = 0; t < band->num_tiles; t++) {
-        tile = &band->tiles[t];
-
-        tile->is_empty = get_bits1(&ctx->gb);
-        if (tile->is_empty) {
-            ff_ivi_process_empty_tile(avctx, band, tile,
-                                      (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3));
-            av_dlog(avctx, "Empty tile encountered!\n");
-        } else {
-            tile->data_size = ff_ivi_dec_tile_data_size(&ctx->gb);
-            if (!tile->data_size) {
-                av_log(avctx, AV_LOG_ERROR, "Tile data size is zero!\n");
-                return AVERROR_INVALIDDATA;
-            }
-
-            result = decode_mb_info(ctx, band, tile, avctx);
-            if (result < 0)
-                break;
-
-            result = ff_ivi_decode_blocks(&ctx->gb, band, tile);
-            if (result < 0 || ((get_bits_count(&ctx->gb) - pos) >> 3) != tile->data_size) {
-                av_log(avctx, AV_LOG_ERROR, "Corrupted tile data encountered!\n");
-                break;
-            }
-
-            pos += tile->data_size << 3; // skip to next tile
-        }
-    }
-
-    /* restore the selected rvmap table by applying its corrections in reverse order */
-    for (i = band->num_corr - 1; i >= 0; i--) {
-        idx1 = band->corr[i * 2];
-        idx2 = band->corr[i * 2 + 1];
-        FFSWAP(uint8_t, band->rv_map->runtab[idx1], band->rv_map->runtab[idx2]);
-        FFSWAP(int16_t, band->rv_map->valtab[idx1], band->rv_map->valtab[idx2]);
-    }
-
-#if defined(DEBUG) && IVI4_DEBUG_CHECKSUM
-    if (band->checksum_present) {
-        uint16_t chksum = ivi_calc_band_checksum(band);
-        if (chksum != band->checksum) {
-            av_log(avctx, AV_LOG_ERROR,
-                   "Band checksum mismatch! Plane %d, band %d, received: %x, calculated: %x\n",
-                   band->plane, band->band_num, band->checksum, chksum);
-        }
-    }
-#endif
-
-    align_get_bits(&ctx->gb);
-
-    return 0;
-}
-
-
-static av_cold int decode_init(AVCodecContext *avctx)
-{
-    IVI4DecContext *ctx = avctx->priv_data;
-
-    ff_ivi_init_static_vlc();
-
-    /* copy rvmap tables in our context so we can apply changes to them */
-    memcpy(ctx->rvmap_tabs, ff_ivi_rvmap_tabs, sizeof(ff_ivi_rvmap_tabs));
-
-    /* Force allocation of the internal buffers */
-    /* during picture header decoding.          */
-    ctx->pic_conf.pic_width  = 0;
-    ctx->pic_conf.pic_height = 0;
-
-    avctx->pix_fmt = PIX_FMT_YUV410P;
-
-    return 0;
-}
-
-
 /**
  *  Rearrange decoding and reference buffers.
  *
  *  @param[in,out] ctx       pointer to the decoder context
  */
-static void switch_buffers(IVI4DecContext *ctx)
+static void switch_buffers(IVI45DecContext *ctx)
 {
     switch (ctx->prev_frame_type) {
     case FRAMETYPE_INTRA:
@@ -726,95 +569,33 @@ static void switch_buffers(IVI4DecContext *ctx)
 }
 
 
-static int decode_frame(AVCodecContext *avctx, void *data, int *data_size,
+static int is_nonnull_frame(IVI45DecContext *ctx)
-                        AVPacket *avpkt)
 {
-    IVI4DecContext  *ctx = avctx->priv_data;
+    return ctx->frame_type < FRAMETYPE_NULL_FIRST;
-    const uint8_t   *buf = avpkt->data;
-    int             buf_size = avpkt->size;
-    int             result, p, b;
-
-    init_get_bits(&ctx->gb, buf, buf_size * 8);
-
-    result = decode_pic_hdr(ctx, avctx);
-    if (result) {
-        av_log(avctx, AV_LOG_ERROR, "Error decoding picture header\n");
-        return result;
-    }
-
-    switch_buffers(ctx);
-
-    if (ctx->frame_type < FRAMETYPE_NULL_FIRST) {
-        for (p = 0; p < 3; p++) {
-            for (b = 0; b < ctx->planes[p].num_bands; b++) {
-                result = decode_band(ctx, p, &ctx->planes[p].bands[b], avctx);
-                if (result) {
-                    av_log(avctx, AV_LOG_ERROR,
-                           "Error decoding band: %d, plane: %d\n", b, p);
-                    return result;
-                }
-            }
-        }
-    }
-
-    /* If the bidirectional mode is enabled, next I and the following P frame will */
-    /* be sent together. Unfortunately the approach below seems to be the only way */
-    /* to handle the B-frames mode. That's exactly the same Intel decoders do.     */
-    if (ctx->frame_type == FRAMETYPE_INTRA) {
-        while (get_bits(&ctx->gb, 8)); // skip version string
-        skip_bits_long(&ctx->gb, 64);  // skip padding, TODO: implement correct 8-bytes alignment
-        if (get_bits_left(&ctx->gb) > 18 && show_bits(&ctx->gb, 18) == 0x3FFF8)
-            av_log(avctx, AV_LOG_ERROR, "Buffer contains IP frames!\n");
-    }
-
-    if (ctx->frame.data[0])
-        avctx->release_buffer(avctx, &ctx->frame);
-
-    ctx->frame.reference = 0;
-    if ((result = avctx->get_buffer(avctx, &ctx->frame)) < 0) {
-        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
-        return result;
-    }
-
-    if (ctx->is_scalable) {
-        ff_ivi_recompose_haar(&ctx->planes[0], ctx->frame.data[0], ctx->frame.linesize[0], 4);
-    } else {
-        ff_ivi_output_plane(&ctx->planes[0], ctx->frame.data[0], ctx->frame.linesize[0]);
-    }
-
-    ff_ivi_output_plane(&ctx->planes[2], ctx->frame.data[1], ctx->frame.linesize[1]);
-    ff_ivi_output_plane(&ctx->planes[1], ctx->frame.data[2], ctx->frame.linesize[2]);
-
-    *data_size = sizeof(AVFrame);
-    *(AVFrame*)data = ctx->frame;
-
-    return buf_size;
 }
 
 
-static av_cold int decode_close(AVCodecContext *avctx)
+static av_cold int decode_init(AVCodecContext *avctx)
 {
-    IVI4DecContext *ctx = avctx->priv_data;
+    IVI45DecContext *ctx = avctx->priv_data;
 
-    ff_ivi_free_buffers(&ctx->planes[0]);
+    ff_ivi_init_static_vlc();
 
-    if (ctx->frame.data[0])
+    /* copy rvmap tables in our context so we can apply changes to them */
-        avctx->release_buffer(avctx, &ctx->frame);
+    memcpy(ctx->rvmap_tabs, ff_ivi_rvmap_tabs, sizeof(ff_ivi_rvmap_tabs));
 
-#if IVI4_STREAM_ANALYSER
+    /* Force allocation of the internal buffers */
-    if (ctx->is_scalable)
+    /* during picture header decoding.          */
-        av_log(avctx, AV_LOG_ERROR, "This video uses scalability mode!\n");
+    ctx->pic_conf.pic_width  = 0;
-    if (ctx->uses_tiling)
+    ctx->pic_conf.pic_height = 0;
-        av_log(avctx, AV_LOG_ERROR, "This video uses local decoding!\n");
+
-    if (ctx->has_b_frames)
+    avctx->pix_fmt = PIX_FMT_YUV410P;
-        av_log(avctx, AV_LOG_ERROR, "This video contains B-frames!\n");
+
-    if (ctx->has_transp)
+    ctx->decode_pic_hdr   = decode_pic_hdr;
-        av_log(avctx, AV_LOG_ERROR, "Transparency mode is enabled!\n");
+    ctx->decode_band_hdr  = decode_band_hdr;
-    if (ctx->uses_haar)
+    ctx->decode_mb_info   = decode_mb_info;
-        av_log(avctx, AV_LOG_ERROR, "This video uses Haar transform!\n");
+    ctx->switch_buffers   = switch_buffers;
-    if (ctx->uses_fullpel)
+    ctx->is_nonnull_frame = is_nonnull_frame;
-        av_log(avctx, AV_LOG_ERROR, "This video uses fullpel motion vectors!\n");
-#endif
 
     return 0;
 }
@@ -824,9 +605,9 @@ AVCodec ff_indeo4_decoder = {
     .name           = "indeo4",
     .type           = AVMEDIA_TYPE_VIDEO,
     .id             = CODEC_ID_INDEO4,
-    .priv_data_size = sizeof(IVI4DecContext),
+    .priv_data_size = sizeof(IVI45DecContext),
     .init           = decode_init,
-    .close          = decode_close,
+    .close          = ff_ivi_decode_close,
-    .decode         = decode_frame,
+    .decode         = ff_ivi_decode_frame,
     .long_name      = NULL_IF_CONFIG_SMALL("Intel Indeo Video Interactive 4"),
 };

libavcodec/indeo5.c

@@ -48,37 +48,6 @@ enum {
 
 #define IVI5_PIC_SIZE_ESC       15
 
-#define IVI5_IS_PROTECTED       0x20
-
-typedef struct {
-    GetBitContext   gb;
-    AVFrame         frame;
-    RVMapDesc       rvmap_tabs[9];   ///< local corrected copy of the static rvmap tables
-    IVIPlaneDesc    planes[3];       ///< color planes
-    const uint8_t   *frame_data;     ///< input frame data pointer
-    int             buf_switch;      ///< used to switch between three buffers
-    int             inter_scal;      ///< signals a sequence of scalable inter frames
-    int             dst_buf;         ///< buffer index for the currently decoded frame
-    int             ref_buf;         ///< inter frame reference buffer index
-    int             ref2_buf;        ///< temporal storage for switching buffers
-    uint32_t        frame_size;      ///< frame size in bytes
-    int             frame_type;
-    int             prev_frame_type; ///< frame type of the previous frame
-    int             frame_num;
-    uint32_t        pic_hdr_size;    ///< picture header size in bytes
-    uint8_t         frame_flags;
-    uint16_t        checksum;        ///< frame checksum
-
-    IVIHuffTab      mb_vlc;          ///< vlc table for decoding macroblock data
-
-    uint16_t        gop_hdr_size;
-    uint8_t         gop_flags;
-    int             is_scalable;
-    uint32_t        lock_word;
-    IVIPicConfig    pic_conf;
-} IVI5DecContext;
-
-
 /**
  *  Decode Indeo5 GOP (Group of pictures) header.
  *  This header is present in key frames only.
@@ -88,7 +57,7 @@ typedef struct {
  *  @param[in]     avctx  ptr to the AVCodecContext
  *  @return         result code: 0 = OK, -1 = error
  */
-static int decode_gop_header(IVI5DecContext *ctx, AVCodecContext *avctx)
+static int decode_gop_header(IVI45DecContext *ctx, AVCodecContext *avctx)
 {
     int             result, i, p, tile_size, pic_size_indx, mb_size, blk_size, is_scalable;
     int             quant_mat, blk_size_changed = 0;
@@ -323,7 +292,7 @@ static inline void skip_hdr_extension(GetBitContext *gb)
  *  @param[in]      avctx  ptr to the AVCodecContext
  *  @return         result code: 0 = OK, -1 = error
  */
-static int decode_pic_hdr(IVI5DecContext *ctx, AVCodecContext *avctx)
+static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx)
 {
     if (get_bits(&ctx->gb, 5) != 0x1F) {
         av_log(avctx, AV_LOG_ERROR, "Invalid picture start code!\n");
@@ -376,7 +345,7 @@ static int decode_pic_hdr(IVI5DecContext *ctx, AVCodecContext *avctx)
  *  @param[in]      avctx  ptr to the AVCodecContext
  *  @return         result code: 0 = OK, -1 = error
  */
-static int decode_band_hdr(IVI5DecContext *ctx, IVIBandDesc *band,
+static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band,
                            AVCodecContext *avctx)
 {
     int         i;
@@ -446,7 +415,7 @@ static int decode_band_hdr(IVI5DecContext *ctx, IVIBandDesc *band,
  *  @param[in]      avctx  ptr to the AVCodecContext
  *  @return         result code: 0 = OK, -1 = error
  */
-static int decode_mb_info(IVI5DecContext *ctx, IVIBandDesc *band,
+static int decode_mb_info(IVI45DecContext *ctx, IVIBandDesc *band,
                           IVITile *tile, AVCodecContext *avctx)
 {
     int         x, y, mv_x, mv_y, mv_delta, offs, mb_offset,
@@ -565,102 +534,12 @@ static int decode_mb_info(IVI5DecContext *ctx, IVIBandDesc *band,
 }
 
 
-/**
- *  Decode an Indeo5 band.
- *
- *  @param[in,out]  ctx    ptr to the decoder context
- *  @param[in,out]  band   ptr to the band descriptor
- *  @param[in]      avctx  ptr to the AVCodecContext
- *  @return         result code: 0 = OK, -1 = error
- */
-static int decode_band(IVI5DecContext *ctx, int plane_num,
-                       IVIBandDesc *band, AVCodecContext *avctx)
-{
-    int         result, i, t, idx1, idx2, pos;
-    IVITile     *tile;
-
-    band->buf     = band->bufs[ctx->dst_buf];
-    band->ref_buf = band->bufs[ctx->ref_buf];
-    band->data_ptr = ctx->frame_data + (get_bits_count(&ctx->gb) >> 3);
-
-    result = decode_band_hdr(ctx, band, avctx);
-    if (result) {
-        av_log(avctx, AV_LOG_ERROR, "Error while decoding band header: %d\n",
-               result);
-        return -1;
-    }
-
-    if (band->is_empty) {
-        av_log(avctx, AV_LOG_ERROR, "Empty band encountered!\n");
-        return -1;
-    }
-
-    band->rv_map = &ctx->rvmap_tabs[band->rvmap_sel];
-
-    /* apply corrections to the selected rvmap table if present */
-    for (i = 0; i < band->num_corr; i++) {
-        idx1 = band->corr[i*2];
-        idx2 = band->corr[i*2+1];
-        FFSWAP(uint8_t, band->rv_map->runtab[idx1], band->rv_map->runtab[idx2]);
-        FFSWAP(int16_t, band->rv_map->valtab[idx1], band->rv_map->valtab[idx2]);
-    }
-
-    pos = get_bits_count(&ctx->gb);
-
-    for (t = 0; t < band->num_tiles; t++) {
-        tile = &band->tiles[t];
-
-        tile->is_empty = get_bits1(&ctx->gb);
-        if (tile->is_empty) {
-            ff_ivi_process_empty_tile(avctx, band, tile,
-                                      (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3));
-        } else {
-            tile->data_size = ff_ivi_dec_tile_data_size(&ctx->gb);
-
-            result = decode_mb_info(ctx, band, tile, avctx);
-            if (result < 0)
-                break;
-
-            result = ff_ivi_decode_blocks(&ctx->gb, band, tile);
-            if (result < 0 || (get_bits_count(&ctx->gb) - pos) >> 3 != tile->data_size) {
-                av_log(avctx, AV_LOG_ERROR, "Corrupted tile data encountered!\n");
-                break;
-            }
-            pos += tile->data_size << 3; // skip to next tile
-        }
-    }
-
-    /* restore the selected rvmap table by applying its corrections in reverse order */
-    for (i = band->num_corr-1; i >= 0; i--) {
-        idx1 = band->corr[i*2];
-        idx2 = band->corr[i*2+1];
-        FFSWAP(uint8_t, band->rv_map->runtab[idx1], band->rv_map->runtab[idx2]);
-        FFSWAP(int16_t, band->rv_map->valtab[idx1], band->rv_map->valtab[idx2]);
-    }
-
-#ifdef DEBUG
-    if (band->checksum_present) {
-        uint16_t chksum = ivi_calc_band_checksum(band);
-        if (chksum != band->checksum) {
-            av_log(avctx, AV_LOG_ERROR,
-                   "Band checksum mismatch! Plane %d, band %d, received: %x, calculated: %x\n",
-                   band->plane, band->band_num, band->checksum, chksum);
-        }
-    }
-#endif
-
-    align_get_bits(&ctx->gb);
-
-    return result;
-}
-
-
 /**
  *  Switch buffers.
  *
  *  @param[in,out] ctx  ptr to the decoder context
  */
-static void switch_buffers(IVI5DecContext *ctx)
+static void switch_buffers(IVI45DecContext *ctx)
 {
     switch (ctx->prev_frame_type) {
     case FRAMETYPE_INTRA:
@@ -698,12 +577,18 @@ static void switch_buffers(IVI5DecContext *ctx)
 }
 
 
+static int is_nonnull_frame(IVI45DecContext *ctx)
+{
+    return ctx->frame_type != FRAMETYPE_NULL;
+}
+
+
 /**
  *  Initialize Indeo5 decoder.
  */
 static av_cold int decode_init(AVCodecContext *avctx)
 {
-    IVI5DecContext  *ctx = avctx->priv_data;
+    IVI45DecContext  *ctx = avctx->priv_data;
     int             result;
 
     ff_ivi_init_static_vlc();
@@ -733,109 +618,25 @@ static av_cold int decode_init(AVCodecContext *avctx)
     ctx->buf_switch = 0;
     ctx->inter_scal = 0;
 
+    ctx->decode_pic_hdr   = decode_pic_hdr;
+    ctx->decode_band_hdr  = decode_band_hdr;
+    ctx->decode_mb_info   = decode_mb_info;
+    ctx->switch_buffers   = switch_buffers;
+    ctx->is_nonnull_frame = is_nonnull_frame;
+
     avctx->pix_fmt = PIX_FMT_YUV410P;
 
     return 0;
 }
 
 
-/**
- *  main decoder function
- */
-static int decode_frame(AVCodecContext *avctx, void *data, int *data_size,
-                        AVPacket *avpkt)
-{
-    IVI5DecContext  *ctx = avctx->priv_data;
-    const uint8_t   *buf = avpkt->data;
-    int             buf_size = avpkt->size;
-    int             result, p, b;
-
-    init_get_bits(&ctx->gb, buf, buf_size * 8);
-    ctx->frame_data = buf;
-    ctx->frame_size = buf_size;
-
-    result = decode_pic_hdr(ctx, avctx);
-    if (result) {
-        av_log(avctx, AV_LOG_ERROR,
-               "Error while decoding picture header: %d\n", result);
-        return -1;
-    }
-
-    if (ctx->gop_flags & IVI5_IS_PROTECTED) {
-        av_log(avctx, AV_LOG_ERROR, "Password-protected clip!\n");
-        return -1;
-    }
-
-    switch_buffers(ctx);
-
-    //{ START_TIMER;
-
-    if (ctx->frame_type != FRAMETYPE_NULL) {
-        for (p = 0; p < 3; p++) {
-            for (b = 0; b < ctx->planes[p].num_bands; b++) {
-                result = decode_band(ctx, p, &ctx->planes[p].bands[b], avctx);
-                if (result) {
-                    av_log(avctx, AV_LOG_ERROR,
-                           "Error while decoding band: %d, plane: %d\n", b, p);
-                    return -1;
-                }
-            }
-        }
-    }
-
-    //STOP_TIMER("decode_planes"); }
-
-    if (ctx->frame.data[0])
-        avctx->release_buffer(avctx, &ctx->frame);
-
-    ctx->frame.reference = 0;
-    if (avctx->get_buffer(avctx, &ctx->frame) < 0) {
-        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
-        return -1;
-    }
-
-    if (ctx->is_scalable) {
-        ff_ivi_recompose53 (&ctx->planes[0], ctx->frame.data[0], ctx->frame.linesize[0], 4);
-    } else {
-        ff_ivi_output_plane(&ctx->planes[0], ctx->frame.data[0], ctx->frame.linesize[0]);
-    }
-
-    ff_ivi_output_plane(&ctx->planes[2], ctx->frame.data[1], ctx->frame.linesize[1]);
-    ff_ivi_output_plane(&ctx->planes[1], ctx->frame.data[2], ctx->frame.linesize[2]);
-
-    *data_size = sizeof(AVFrame);
-    *(AVFrame*)data = ctx->frame;
-
-    return buf_size;
-}
-
-
-/**
- *  Close Indeo5 decoder and clean up its context.
- */
-static av_cold int decode_close(AVCodecContext *avctx)
-{
-    IVI5DecContext *ctx = avctx->priv_data;
-
-    ff_ivi_free_buffers(&ctx->planes[0]);
-
-    if (ctx->mb_vlc.cust_tab.table)
-        ff_free_vlc(&ctx->mb_vlc.cust_tab);
-
-    if (ctx->frame.data[0])
-        avctx->release_buffer(avctx, &ctx->frame);
-
-    return 0;
-}
-
-
 AVCodec ff_indeo5_decoder = {
     .name           = "indeo5",
     .type           = AVMEDIA_TYPE_VIDEO,
     .id             = CODEC_ID_INDEO5,
-    .priv_data_size = sizeof(IVI5DecContext),
+    .priv_data_size = sizeof(IVI45DecContext),
     .init           = decode_init,
-    .close          = decode_close,
+    .close          = ff_ivi_decode_close,
-    .decode         = decode_frame,
+    .decode         = ff_ivi_decode_frame,
     .long_name      = NULL_IF_CONFIG_SMALL("Intel Indeo Video Interactive 5"),
 };

libavcodec/ivi_common.c

@@ -123,6 +123,10 @@ int ff_ivi_dec_huff_desc(GetBitContext *gb, int desc_coded, int which_tab,
         if (huff_tab->tab_sel == 7) {
             /* custom huffman table (explicitly encoded) */
             new_huff.num_rows = get_bits(gb, 4);
+            if (!new_huff.num_rows) {
+                av_log(avctx, AV_LOG_ERROR, "Empty custom Huffman table!\n");
+                return AVERROR_INVALIDDATA;
+            }
 
             for (i = 0; i < new_huff.num_rows; i++)
                 new_huff.xbits[i] = get_bits(gb, 4);
@@ -136,9 +140,10 @@ int ff_ivi_dec_huff_desc(GetBitContext *gb, int desc_coded, int which_tab,
                 result = ff_ivi_create_huff_from_desc(&huff_tab->cust_desc,
                         &huff_tab->cust_tab, 0);
                 if (result) {
+                    huff_tab->cust_desc.num_rows = 0; // reset faulty description
                     av_log(avctx, AV_LOG_ERROR,
                            "Error while initializing custom vlc table!\n");
-                    return -1;
+                    return result;
                 }
             }
             huff_tab->tab = &huff_tab->cust_tab;
@@ -207,14 +212,15 @@ int av_cold ff_ivi_init_planes(IVIPlaneDesc *planes, const IVIPicConfig *cfg)
             band->width    = b_width;
             band->height   = b_height;
             band->pitch    = width_aligned;
-            band->bufs[0]  = av_malloc(buf_size);
+            band->aheight  = height_aligned;
-            band->bufs[1]  = av_malloc(buf_size);
+            band->bufs[0]  = av_mallocz(buf_size);
+            band->bufs[1]  = av_mallocz(buf_size);
             if (!band->bufs[0] || !band->bufs[1])
                 return AVERROR(ENOMEM);
 
             /* allocate the 3rd band buffer for scalability mode */
             if (cfg->luma_bands > 1) {
-                band->bufs[2] = av_malloc(buf_size);
+                band->bufs[2] = av_mallocz(buf_size);
                 if (!band->bufs[2])
                     return AVERROR(ENOMEM);
             }
@@ -284,6 +290,7 @@ int av_cold ff_ivi_init_tiles(IVIPlaneDesc *planes, int tile_width, int tile_hei
                 for (x = 0; x < band->width; x += t_width) {
                     tile->xpos     = x;
                     tile->ypos     = y;
+                    tile->mb_size  = band->mb_size;
                     tile->width    = FFMIN(band->width - x,  t_width);
                     tile->height   = FFMIN(band->height - y, t_height);
                     tile->is_empty = tile->data_size = 0;
@@ -379,6 +386,21 @@ int ff_ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, IVITile *tile)
                 mv_x >>= 1;
                 mv_y >>= 1; /* convert halfpel vectors into fullpel ones */
             }
+            if (mb->type) {
+                int dmv_x, dmv_y, cx, cy;
+
+                dmv_x = mb->mv_x >> band->is_halfpel;
+                dmv_y = mb->mv_y >> band->is_halfpel;
+                cx    = mb->mv_x &  band->is_halfpel;
+                cy    = mb->mv_y &  band->is_halfpel;
+
+                if (   mb->xpos + dmv_x < 0
+                    || mb->xpos + dmv_x + band->mb_size + cx > band->pitch
+                    || mb->ypos + dmv_y < 0
+                    || mb->ypos + dmv_y + band->mb_size + cy > band->aheight) {
+                    return AVERROR_INVALIDDATA;
+                }
+            }
         }
 
         for (blk = 0; blk < num_blocks; blk++) {
@@ -624,6 +646,221 @@ void ff_ivi_output_plane(IVIPlaneDesc *plane, uint8_t *dst, int dst_pitch)
     }
 }
 
+/**
+ *  Decode an Indeo 4 or 5 band.
+ *
+ *  @param[in,out]  ctx    ptr to the decoder context
+ *  @param[in,out]  band   ptr to the band descriptor
+ *  @param[in]      avctx  ptr to the AVCodecContext
+ *  @return         result code: 0 = OK, -1 = error
+ */
+static int decode_band(IVI45DecContext *ctx, int plane_num,
+                       IVIBandDesc *band, AVCodecContext *avctx)
+{
+    int         result, i, t, idx1, idx2, pos;
+    IVITile     *tile;
+
+    band->buf     = band->bufs[ctx->dst_buf];
+    band->ref_buf = band->bufs[ctx->ref_buf];
+    band->data_ptr = ctx->frame_data + (get_bits_count(&ctx->gb) >> 3);
+
+    result = ctx->decode_band_hdr(ctx, band, avctx);
+    if (result) {
+        av_log(avctx, AV_LOG_ERROR, "Error while decoding band header: %d\n",
+               result);
+        return result;
+    }
+
+    if (band->is_empty) {
+        av_log(avctx, AV_LOG_ERROR, "Empty band encountered!\n");
+        return AVERROR_INVALIDDATA;
+    }
+
+    band->rv_map = &ctx->rvmap_tabs[band->rvmap_sel];
+
+    /* apply corrections to the selected rvmap table if present */
+    for (i = 0; i < band->num_corr; i++) {
+        idx1 = band->corr[i * 2];
+        idx2 = band->corr[i * 2 + 1];
+        FFSWAP(uint8_t, band->rv_map->runtab[idx1], band->rv_map->runtab[idx2]);
+        FFSWAP(int16_t, band->rv_map->valtab[idx1], band->rv_map->valtab[idx2]);
+    }
+
+    pos = get_bits_count(&ctx->gb);
+
+    for (t = 0; t < band->num_tiles; t++) {
+        tile = &band->tiles[t];
+
+        if (tile->mb_size != band->mb_size) {
+            av_log(avctx, AV_LOG_ERROR, "MB sizes mismatch: %d vs. %d\n",
+                   band->mb_size, tile->mb_size);
+            return AVERROR_INVALIDDATA;
+        }
+        tile->is_empty = get_bits1(&ctx->gb);
+        if (tile->is_empty) {
+            ff_ivi_process_empty_tile(avctx, band, tile,
+                                      (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3));
+            av_dlog(avctx, "Empty tile encountered!\n");
+        } else {
+            tile->data_size = ff_ivi_dec_tile_data_size(&ctx->gb);
+            if (!tile->data_size) {
+                av_log(avctx, AV_LOG_ERROR, "Tile data size is zero!\n");
+                return AVERROR_INVALIDDATA;
+            }
+
+            result = ctx->decode_mb_info(ctx, band, tile, avctx);
+            if (result < 0)
+                break;
+
+            result = ff_ivi_decode_blocks(&ctx->gb, band, tile);
+            if (result < 0 || ((get_bits_count(&ctx->gb) - pos) >> 3) != tile->data_size) {
+                av_log(avctx, AV_LOG_ERROR, "Corrupted tile data encountered!\n");
+                break;
+            }
+
+            pos += tile->data_size << 3; // skip to next tile
+        }
+    }
+
+    /* restore the selected rvmap table by applying its corrections in reverse order */
+    for (i = band->num_corr-1; i >= 0; i--) {
+        idx1 = band->corr[i*2];
+        idx2 = band->corr[i*2+1];
+        FFSWAP(uint8_t, band->rv_map->runtab[idx1], band->rv_map->runtab[idx2]);
+        FFSWAP(int16_t, band->rv_map->valtab[idx1], band->rv_map->valtab[idx2]);
+    }
+
+#ifdef DEBUG
+    if (band->checksum_present) {
+        uint16_t chksum = ivi_calc_band_checksum(band);
+        if (chksum != band->checksum) {
+            av_log(avctx, AV_LOG_ERROR,
+                   "Band checksum mismatch! Plane %d, band %d, received: %x, calculated: %x\n",
+                   band->plane, band->band_num, band->checksum, chksum);
+        }
+    }
+#endif
+
+    align_get_bits(&ctx->gb);
+
+    return result;
+}
+
+int ff_ivi_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
+                        AVPacket *avpkt)
+{
+    IVI45DecContext *ctx = avctx->priv_data;
+    const uint8_t   *buf = avpkt->data;
+    int             buf_size = avpkt->size;
+    int             result, p, b;
+
+    init_get_bits(&ctx->gb, buf, buf_size * 8);
+    ctx->frame_data = buf;
+    ctx->frame_size = buf_size;
+
+    result = ctx->decode_pic_hdr(ctx, avctx);
+    if (result) {
+        av_log(avctx, AV_LOG_ERROR,
+               "Error while decoding picture header: %d\n", result);
+        return -1;
+    }
+
+    if (ctx->gop_flags & IVI5_IS_PROTECTED) {
+        av_log(avctx, AV_LOG_ERROR, "Password-protected clip!\n");
+        return -1;
+    }
+
+    ctx->switch_buffers(ctx);
+
+    //{ START_TIMER;
+
+    if (ctx->is_nonnull_frame(ctx)) {
+        for (p = 0; p < 3; p++) {
+            for (b = 0; b < ctx->planes[p].num_bands; b++) {
+                result = decode_band(ctx, p, &ctx->planes[p].bands[b], avctx);
+                if (result) {
+                    av_log(avctx, AV_LOG_ERROR,
+                           "Error while decoding band: %d, plane: %d\n", b, p);
+                    return -1;
+                }
+            }
+        }
+    }
+
+    //STOP_TIMER("decode_planes"); }
+
+    /* If the bidirectional mode is enabled, next I and the following P frame will */
+    /* be sent together. Unfortunately the approach below seems to be the only way */
+    /* to handle the B-frames mode. That's exactly the same Intel decoders do.     */
+    if (avctx->codec_id == CODEC_ID_INDEO4 && ctx->frame_type == 0/*FRAMETYPE_INTRA*/) {
+        while (get_bits(&ctx->gb, 8)); // skip version string
+        skip_bits_long(&ctx->gb, 64);  // skip padding, TODO: implement correct 8-bytes alignment
+        if (get_bits_left(&ctx->gb) > 18 && show_bits(&ctx->gb, 18) == 0x3FFF8)
+            av_log(avctx, AV_LOG_ERROR, "Buffer contains IP frames!\n");
+    }
+
+    if (ctx->frame.data[0])
+        avctx->release_buffer(avctx, &ctx->frame);
+
+    ctx->frame.reference = 0;
+    if ((result = avctx->get_buffer(avctx, &ctx->frame)) < 0) {
+        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
+        return result;
+    }
+
+    if (ctx->is_scalable) {
+        if (avctx->codec_id == CODEC_ID_INDEO4)
+            ff_ivi_recompose_haar(&ctx->planes[0], ctx->frame.data[0], ctx->frame.linesize[0], 4);
+        else
+            ff_ivi_recompose53   (&ctx->planes[0], ctx->frame.data[0], ctx->frame.linesize[0], 4);
+    } else {
+        ff_ivi_output_plane(&ctx->planes[0], ctx->frame.data[0], ctx->frame.linesize[0]);
+    }
+
+    ff_ivi_output_plane(&ctx->planes[2], ctx->frame.data[1], ctx->frame.linesize[1]);
+    ff_ivi_output_plane(&ctx->planes[1], ctx->frame.data[2], ctx->frame.linesize[2]);
+
+    *data_size = sizeof(AVFrame);
+    *(AVFrame*)data = ctx->frame;
+
+    return buf_size;
+}
+
+/**
+ *  Close Indeo5 decoder and clean up its context.
+ */
+av_cold int ff_ivi_decode_close(AVCodecContext *avctx)
+{
+    IVI45DecContext *ctx = avctx->priv_data;
+
+    ff_ivi_free_buffers(&ctx->planes[0]);
+
+    if (ctx->mb_vlc.cust_tab.table)
+        ff_free_vlc(&ctx->mb_vlc.cust_tab);
+
+    if (ctx->frame.data[0])
+        avctx->release_buffer(avctx, &ctx->frame);
+
+#if IVI4_STREAM_ANALYSER
+    if (avctx->codec_id == CODEC_ID_INDEO4) {
+    if (ctx->is_scalable)
+        av_log(avctx, AV_LOG_ERROR, "This video uses scalability mode!\n");
+    if (ctx->uses_tiling)
+        av_log(avctx, AV_LOG_ERROR, "This video uses local decoding!\n");
+    if (ctx->has_b_frames)
+        av_log(avctx, AV_LOG_ERROR, "This video contains B-frames!\n");
+    if (ctx->has_transp)
+        av_log(avctx, AV_LOG_ERROR, "Transparency mode is enabled!\n");
+    if (ctx->uses_haar)
+        av_log(avctx, AV_LOG_ERROR, "This video uses Haar transform!\n");
+    if (ctx->uses_fullpel)
+        av_log(avctx, AV_LOG_ERROR, "This video uses fullpel motion vectors!\n");
+    }
+#endif
+
+    return 0;
+}
+
 
 /**
  * These are 2x8 predefined Huffman codebooks for coding macroblock/block

libavcodec/ivi_common.h

@@ -34,6 +34,8 @@
 #include <stdint.h>
 
 #define IVI_VLC_BITS 13 ///< max number of bits of the ivi's huffman codes
+#define IVI4_STREAM_ANALYSER    0
+#define IVI5_IS_PROTECTED       0x20
 
 /**
  *  huffman codebook descriptor
@@ -116,6 +118,7 @@ typedef struct {
     int         ypos;
     int         width;
     int         height;
+    int         mb_size;
     int         is_empty;  ///< = 1 if this tile doesn't contain any data
     int         data_size; ///< size of the data in bytes
     int         num_MBs;   ///< number of macroblocks in this tile
@@ -132,6 +135,7 @@ typedef struct {
     int             band_num;       ///< band number
     int             width;
     int             height;
+    int             aheight;        ///< aligned band height
     const uint8_t   *data_ptr;      ///< ptr to the first byte of the band data
     int             data_size;      ///< size of the band data
     int16_t         *buf;           ///< pointer to the output buffer for this band
@@ -192,6 +196,60 @@ typedef struct {
     uint8_t     chroma_bands;
 } IVIPicConfig;
 
+typedef struct IVI45DecContext {
+    GetBitContext   gb;
+    AVFrame         frame;
+    RVMapDesc       rvmap_tabs[9];   ///< local corrected copy of the static rvmap tables
+
+    uint32_t        frame_num;
+    int             frame_type;
+    int             prev_frame_type; ///< frame type of the previous frame
+    uint32_t        data_size;       ///< size of the frame data in bytes from picture header
+    int             is_scalable;
+    int             transp_status;   ///< transparency mode status: 1 - enabled
+    const uint8_t   *frame_data;     ///< input frame data pointer
+    int             inter_scal;      ///< signals a sequence of scalable inter frames
+    uint32_t        frame_size;      ///< frame size in bytes
+    uint32_t        pic_hdr_size;    ///< picture header size in bytes
+    uint8_t         frame_flags;
+    uint16_t        checksum;        ///< frame checksum
+
+    IVIPicConfig    pic_conf;
+    IVIPlaneDesc    planes[3];       ///< color planes
+
+    int             buf_switch;      ///< used to switch between three buffers
+    int             dst_buf;         ///< buffer index for the currently decoded frame
+    int             ref_buf;         ///< inter frame reference buffer index
+    int             ref2_buf;        ///< temporal storage for switching buffers
+
+    IVIHuffTab      mb_vlc;          ///< current macroblock table descriptor
+    IVIHuffTab      blk_vlc;         ///< current block table descriptor
+
+    uint8_t         rvmap_sel;
+    uint8_t         in_imf;
+    uint8_t         in_q;            ///< flag for explicitly stored quantiser delta
+    uint8_t         pic_glob_quant;
+    uint8_t         unknown1;
+
+    uint16_t        gop_hdr_size;
+    uint8_t         gop_flags;
+    uint32_t        lock_word;
+
+#if IVI4_STREAM_ANALYSER
+    uint8_t         has_b_frames;
+    uint8_t         has_transp;
+    uint8_t         uses_tiling;
+    uint8_t         uses_haar;
+    uint8_t         uses_fullpel;
+#endif
+
+    int             (*decode_pic_hdr)  (struct IVI45DecContext *ctx, AVCodecContext *avctx);
+    int             (*decode_band_hdr) (struct IVI45DecContext *ctx, IVIBandDesc *band, AVCodecContext *avctx);
+    int             (*decode_mb_info)  (struct IVI45DecContext *ctx, IVIBandDesc *band, IVITile *tile, AVCodecContext *avctx);
+    void            (*switch_buffers)  (struct IVI45DecContext *ctx);
+    int             (*is_nonnull_frame)(struct IVI45DecContext *ctx);
+} IVI45DecContext;
+
 /** compare some properties of two pictures */
 static inline int ivi_pic_config_cmp(IVIPicConfig *str1, IVIPicConfig *str2)
 {
@@ -348,4 +406,8 @@ uint16_t ivi_calc_band_checksum (IVIBandDesc *band);
  */
 int ivi_check_band (IVIBandDesc *band, const uint8_t *ref, int pitch);
 
+int ff_ivi_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
+                        AVPacket *avpkt);
+av_cold int ff_ivi_decode_close(AVCodecContext *avctx);
+
 #endif /* AVCODEC_IVI_COMMON_H */