indeo4: check that num_mbs matches

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d3db8988d5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Doxyfile

@@ -31,7 +31,7 @@ PROJECT_NAME           = FFmpeg
 # This could be handy for archiving the generated documentation or
 # if some version control system is used.
 
-PROJECT_NUMBER         = 0.9.1
+PROJECT_NUMBER         = 0.9.2
 
 # The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute)
 # base path where the generated documentation will be put.

RELEASE

@@ -1 +1 @@
-0.9.1
+0.9.2

VERSION

@@ -1 +1 @@
-0.9.1
+0.9.2

libavcodec/h264_refs.c

@@ -655,6 +655,8 @@ int ff_h264_execute_ref_pic_marking(H264Context *h, MMCO *mmco, int mmco_count){
 
     if(err >= 0 && h->long_ref_count==0 && h->short_ref_count<=2 && h->pps.ref_count[0]<=1 + (s->picture_structure != PICT_FRAME) && s->current_picture_ptr->f.pict_type == AV_PICTURE_TYPE_I){
         s->current_picture_ptr->sync |= 1;
+        if(!h->s.avctx->has_b_frames)
+            h->sync = 2;
     }
 
     return (h->s.avctx->err_recognition & AV_EF_EXPLODE) ? err : 0;

libavcodec/indeo4.c

@@ -27,7 +27,7 @@
  * Known FOURCCs: 'IV41'
  */
 
-#define BITSTREAM_READER_LE
+#define ALT_BITSTREAM_READER_LE
 #include "avcodec.h"
 #include "get_bits.h"
 #include "dsputil.h"
@@ -473,6 +473,11 @@ static int decode_mb_info(IVI4DecContext *ctx, IVIBandDesc *band,
     mv_scale = (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3);
     mv_x = mv_y = 0;
 
+    if (((tile->width + band->mb_size-1)/band->mb_size) * ((tile->height + band->mb_size-1)/band->mb_size) != tile->num_MBs) {
+        av_log(avctx, AV_LOG_ERROR, "num_MBs mismatch %d %d %d %d\n", tile->width, tile->height, band->mb_size, tile->num_MBs);
+        return -1;
+    }
+
     for (y = tile->ypos; y < tile->ypos + tile->height; y += band->mb_size) {
         mb_offset = offs;
 

libavcodec/qpeg.c

@@ -203,6 +203,8 @@ static void qpeg_decode_inter(const uint8_t *src, uint8_t *dst, int size,
                     filled = 0;
                     dst -= stride;
                     height--;
+                    if(height < 0)
+                        break;
                 }
             }
         } else if(code >= 0xC0) { /* copy code: 0xC0..0xDF */
@@ -214,6 +216,8 @@ static void qpeg_decode_inter(const uint8_t *src, uint8_t *dst, int size,
                     filled = 0;
                     dst -= stride;
                     height--;
+                    if(height < 0)
+                        break;
                 }
             }
             size -= code + 1;

libavcodec/smacker.c

@@ -659,7 +659,7 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data,
     }
     if(bits) { //decode 16-bit data
         for(i = stereo; i >= 0; i--)
-            pred[i] = av_bswap16(get_bits(&gb, 16));
+            pred[i] = sign_extend(av_bswap16(get_bits(&gb, 16)), 16);
         for(i = 0; i <= stereo; i++)
             *samples++ = pred[i];
         for(; i < unp_size / 2; i++) {

libavcodec/sonic.c

@@ -44,6 +44,7 @@
 #define RIGHT_SIDE 2
 
 typedef struct SonicContext {
+    AVFrame frame;
     int lossless, decorrelation;
 
     int num_taps, downsampling;
@@ -757,6 +758,9 @@ static av_cold int sonic_decode_init(AVCodecContext *avctx)
     s->channels = avctx->channels;
     s->samplerate = avctx->sample_rate;
 
+    avcodec_get_frame_defaults(&s->frame);
+    avctx->coded_frame = &s->frame;
+
     if (!avctx->extradata)
     {
         av_log(avctx, AV_LOG_ERROR, "No mandatory headers present\n");
@@ -848,18 +852,25 @@ static av_cold int sonic_decode_close(AVCodecContext *avctx)
 }
 
 static int sonic_decode_frame(AVCodecContext *avctx,
-                            void *data, int *data_size,
+                            void *data, int *got_frame_ptr,
                             AVPacket *avpkt)
 {
     const uint8_t *buf = avpkt->data;
     int buf_size = avpkt->size;
     SonicContext *s = avctx->priv_data;
     GetBitContext gb;
-    int i, quant, ch, j;
-    short *samples = data;
+    int i, quant, ch, j, ret;
+    short *samples;
 
     if (buf_size == 0) return 0;
 
+    s->frame.nb_samples = s->frame_size;
+    if ((ret = avctx->get_buffer(avctx, &s->frame)) < 0) {
+        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
+        return ret;
+    }
+    samples = s->frame.data[0];
+
 //    av_log(NULL, AV_LOG_INFO, "buf_size: %d\n", buf_size);
 
     init_get_bits(&gb, buf, buf_size*8);
@@ -930,20 +941,21 @@ static int sonic_decode_frame(AVCodecContext *avctx,
 
     align_get_bits(&gb);
 
-    *data_size = s->frame_size * 2;
+    *got_frame_ptr = 1;
+    *(AVFrame*)data = s->frame;
 
     return (get_bits_count(&gb)+7)/8;
 }
 
 AVCodec ff_sonic_decoder = {
-    "sonic",
-    AVMEDIA_TYPE_AUDIO,
-    CODEC_ID_SONIC,
-    sizeof(SonicContext),
-    sonic_decode_init,
-    NULL,
-    sonic_decode_close,
-    sonic_decode_frame,
+    .name           = "sonic",
+    .type           = AVMEDIA_TYPE_AUDIO,
+    .id             = CODEC_ID_SONIC,
+    .priv_data_size = sizeof(SonicContext),
+    .init           = sonic_decode_init,
+    .close          = sonic_decode_close,
+    .decode         = sonic_decode_frame,
+    .capabilities   = CODEC_CAP_DR1,
     .long_name = NULL_IF_CONFIG_SMALL("Sonic"),
 };
 #endif /* CONFIG_SONIC_DECODER */

libavcodec/srtdec.c

@@ -110,7 +110,7 @@ static const char *srt_to_ass(AVCodecContext *avctx, char *out, char *out_end,
                                     for (j=sptr-2; j>=0; j--)
                                         if (stack[j].param[i][0]) {
                                             out += snprintf(out, out_end-out,
-                                                            stack[j].param[i]);
+                                                            "%s", stack[j].param[i]);
                                             break;
                                         }
                         } else {
@@ -146,7 +146,7 @@ static const char *srt_to_ass(AVCodecContext *avctx, char *out, char *out_end,
                             for (i=0; i<PARAM_NUMBER; i++)
                                 if (stack[sptr].param[i][0])
                                     out += snprintf(out, out_end-out,
-                                                    stack[sptr].param[i]);
+                                                    "%s", stack[sptr].param[i]);
                         }
                     } else if (!buffer[1] && strspn(buffer, "bisu") == 1) {
                         out += snprintf(out, out_end-out,

libavcodec/vqavideo.c

@@ -164,6 +164,11 @@ static av_cold int vqa_decode_init(AVCodecContext *avctx)
     s->codebook = av_malloc(s->codebook_size);
     s->next_codebook_buffer = av_malloc(s->codebook_size);
 
+    if (s->width % s->vector_width || s->height % s->vector_height) {
+        av_log(avctx, AV_LOG_ERROR, "Picture dimensions are not a multiple of the vector size\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     /* initialize the solid-color vectors */
     if (s->vector_height == 4) {
         codebook_index = 0xFF00 * 16;

libavcodec/x86/dsputil_yasm.asm

@@ -475,7 +475,7 @@ cglobal scalarproduct_float_sse, 3,3,2, v1, v2, offset
     shufps  xmm0, xmm0, 1
     addss   xmm0, xmm1
 %ifndef ARCH_X86_64
-    movd    r0m,  xmm0
+    movss   r0m,  xmm0
     fld     dword r0m
 %endif
     RET

libavcodec/x86/dsputilenc_mmx.c

@@ -823,6 +823,7 @@ static int vsad16_mmx2(void *v, uint8_t * pix1, uint8_t * pix2, int line_size, i
 
 static void diff_bytes_mmx(uint8_t *dst, uint8_t *src1, uint8_t *src2, int w){
     x86_reg i=0;
+    if(w>=16)
     __asm__ volatile(
         "1:                             \n\t"
         "movq  (%2, %0), %%mm0          \n\t"

libavcodec/x86/imdct36_sse.asm

@@ -357,5 +357,7 @@ DEFINE_IMDCT ssse3
 %define BUILDINVHIGHLOW BUILDINVHIGHLOW_AVX
 %define PSHUFD PSHUFD_SSE_AVX
 
+%ifdef HAVE_AVX
 INIT_AVX
 DEFINE_IMDCT avx
+%endif

libavcodec/x86/proresdsp.asm

@@ -306,7 +306,9 @@ INIT_XMM
 idct_put_fn sse2, 16
 INIT_XMM
 idct_put_fn sse4, 16
+%ifdef HAVE_AVX
 INIT_AVX
 idct_put_fn avx,  16
+%endif
 
 %endif

libavcodec/x86/v210-init.c

@@ -34,14 +34,14 @@ av_cold void v210_x86_init(V210DecContext *s)
         if (cpu_flags & AV_CPU_FLAG_SSSE3)
             s->unpack_frame = ff_v210_planar_unpack_aligned_ssse3;
 
-        if (cpu_flags & AV_CPU_FLAG_AVX)
+        if (HAVE_AVX && cpu_flags & AV_CPU_FLAG_AVX)
             s->unpack_frame = ff_v210_planar_unpack_aligned_avx;
     }
     else {
         if (cpu_flags & AV_CPU_FLAG_SSSE3)
             s->unpack_frame = ff_v210_planar_unpack_unaligned_ssse3;
 
-        if (cpu_flags & AV_CPU_FLAG_AVX)
+        if (HAVE_AVX && cpu_flags & AV_CPU_FLAG_AVX)
             s->unpack_frame = ff_v210_planar_unpack_unaligned_avx;
     }
 #endif

libavcodec/x86/v210.asm

@@ -76,10 +76,14 @@ cglobal v210_planar_unpack_%1_%2, 5, 5
 
 INIT_XMM
 v210_planar_unpack unaligned, ssse3
+%ifdef HAVE_AVX
 INIT_AVX
 v210_planar_unpack unaligned, avx
+%endif
 
 INIT_XMM
 v210_planar_unpack aligned, ssse3
+%ifdef HAVE_AVX
 INIT_AVX
 v210_planar_unpack aligned, avx
+%endif

libavfilter/vf_fade.c

@@ -191,9 +191,9 @@ static int config_props(AVFilterLink *inlink)
     fade->alpha = fade->alpha ? ff_fmt_is_in(inlink->format, alpha_pix_fmts) : 0;
     fade->is_packed_rgb = ff_fill_rgba_map(fade->rgba_map, inlink->format) >= 0;
 
-    /* CCIR601/709 black level unless input is RGB or has alpha */
+    /* use CCIR601/709 black level for studio-level pixel non-alpha components */
     fade->black_level =
-            ff_fmt_is_in(inlink->format, studio_level_pix_fmts) || fade->alpha ? 0 : 16;
+            ff_fmt_is_in(inlink->format, studio_level_pix_fmts) && !fade->alpha ? 16 : 0;
     /* 32768 = 1 << 15, it is an integer representation
      * of 0.5 and is for rounding. */
     fade->black_level_scaled = (fade->black_level << 16) + 32768;

libavformat/electronicarts.c

@@ -440,6 +440,11 @@ static int ea_read_header(AVFormatContext *s,
             ea->audio_codec = 0;
             return 1;
         }
+        if (ea->bytes <= 0) {
+            av_log(s, AV_LOG_ERROR, "Invalid number of bytes per sample: %d\n", ea->bytes);
+            ea->audio_codec = CODEC_ID_NONE;
+            return 1;
+        }
 
         /* initialize the audio decoder stream */
         st = avformat_new_stream(s, NULL);

libavformat/mxfdec.c

@@ -1662,6 +1662,9 @@ static int mxf_read_header(AVFormatContext *s, AVFormatParameters *ap)
             /* next partition pack - keep going, seek to previous partition or stop */
             if(mxf_parse_handle_partition_or_eof(mxf) <= 0)
                 break;
+            else if (mxf->parsing_backward)
+                continue;
+            /* we're still parsing forward. proceed to parsing this partition pack */
         }
 
         for (metadata = mxf_metadata_read_table; metadata->read; metadata++) {

libswscale/x86/scale.asm

@@ -667,10 +667,12 @@ yuv2planeX_fn sse4,  9,  7, 5
 yuv2planeX_fn sse4, 10,  7, 5
 yuv2planeX_fn sse4, 16,  8, 5
 
+%ifdef HAVE_AVX
 INIT_AVX
 yuv2planeX_fn avx,   8, 10, 7
 yuv2planeX_fn avx,   9,  7, 5
 yuv2planeX_fn avx,  10,  7, 5
+%endif
 
 ; %1=outout-bpc, %2=alignment (u/a)
 %macro yuv2plane1_mainloop 2
@@ -804,8 +806,10 @@ yuv2plane1_fn 16, 6, 3
 INIT_XMM sse4
 yuv2plane1_fn 16, 5, 3
 
+%ifdef HAVE_AVX
 INIT_XMM avx
 yuv2plane1_fn  8, 5, 5
 yuv2plane1_fn  9, 5, 3
 yuv2plane1_fn 10, 5, 3
 yuv2plane1_fn 16, 5, 3
+%endif

libswscale/x86/swscale_mmx.c

@@ -397,7 +397,7 @@ switch(c->dstBpc){ \
             c->yuv2plane1 = ff_yuv2plane1_16_sse4;
     }
 
-    if (cpu_flags & AV_CPU_FLAG_AVX) {
+    if (HAVE_AVX && cpu_flags & AV_CPU_FLAG_AVX) {
         ASSIGN_VSCALEX_FUNC(c->yuv2planeX, avx, avx, 1,);
         ASSIGN_VSCALE_FUNC(c->yuv2plane1, avx, avx, 1);
     }