Update for FFmpeg 7.0.1 release

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
lavc/flacdsp: do not assume maximum R-V VL
2026-06-16 04:32:47 +02:00 · 2024-05-25 22:08:34 +02:00 · 2024-05-25 10:34:08 +03:00 · 2024-05-25 01:46:13 +02:00 · 2024-05-25 01:45:33 +02:00 · 2024-05-25 01:44:01 +02:00
120 changed files with 1179 additions and 760 deletions
@@ -1,6 +1,102 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.

+version 7.0.1:
+ lavc/flacdsp: do not assume maximum R-V VL
+ avformat/flacdec: Reorder allocations to avoid leak on error
+ avcodec/adts_parser: Don't presume buffer to be padded
+ avformat/movenc: Check av_malloc()
+ avcodec/vp8: Return error on error
+ avformat/mov: store sample_sizes as unsigned ints
+ avformat/vvc: fix parsing sps_subpic_id
+ avformat/vvc: initialize some ptl flags
+ avcodec/mscc & mwsc: Check loop counts before use
+ avcodec/mpegvideo_enc: Fix potential overflow in RD
+ avcodec/mpeg4videodec: assert impossible wrap points
+ avcodec/mpeg12dec: Use 64bit in bit computation
+ avcodec/vqcdec: Check init_get_bits8() for failure
+ avcodec/vvc/dec: Check init_get_bits8() for failure
+ avcodec/vble: Check av_image_get_buffer_size() for failure
+ avcodec/vp3: Replace check by assert
+ avcodec/vp8: Forward return of ff_vpx_init_range_decoder()
+ avcodec/jpeg2000dec: remove ST=3 case
+ avcodec/qsvdec: Check av_image_get_buffer_size() for failure
+ avcodec/exr: Fix preview overflow
+ avcodec/decode: decode_simple_internal() only implements audio and video
+ avcodec/fmvc: remove dead assignment
+ avcodec/h2645_sei: Remove dead checks
+ avcodec/h264_slice: Remove dead sps check
+ avcodec/lpc: copy levenson coeffs only when they have been computed
+ avutil/tests/base64: Check with too short output array
+ libavutil/base64: Try not to write over the array end
+ avcodec/cbs_av1: Avoid shift overflow
+ fftools/ffplay: Check return of swr_alloc_set_opts2()
+ tools/opt_common: Check for malloc failure
+ doc/examples/demux_decode: Simplify loop
+ avformat/concatdec: Check file
+ avcodec/mpegvideo_enc: Fix 1 line and one column images
+ avcodec/amrwbdec: assert mode to be valid in decode_fixed_vector()
+ avcodec/wavarc: fix integer overflow in decode_5elp() block type 2
+ swscale/output: Fix integer overflow in yuv2rgba64_full_1_c_template()
+ swscale/output: Fix integer overflow in yuv2rgba64_1_c_template
+ avcodec/av1dec: Change bit_depth to int
+ avcodec/av1dec: bit_depth cannot be another values than 8,10,12
+ avcodec/avs3_parser: assert the return value of init_get_bits()
+ avcodec/avs2_parser: Assert init_get_bits8() success with const size 15
+ avfilter/avfiltergraph: return value of ff_request_frame() is unused
+ avformat/mxfdec: Check body_offset
+ avformat/kvag: Check sample_rate
+ avcodec/atrac9dec: Check init_get_bits8() for failure
+ avcodec/ac3_parser: Check init_get_bits8() for failure
+ avcodec/pngdec: Check last AVFrame before deref
+ avcodec/hevcdec: Check ref frame
+ doc/examples/qsv_transcode: Initialize pointer before free
+ doc/examples/qsv_transcode: Simplify str_to_dict() loop
+ doc/examples/vaapi_transcode: Simplify loop
+ doc/examples/qsv_transcode: Simplify loop
+ avcodec/cbs_h2645: Check NAL space
+ avfilter/vf_thumbnail_cuda: Set ret before checking it
+ avfilter/signature_lookup: Dont copy uninitialized stuff around
+ avfilter/signature_lookup: Fix 2 differences to the refernce SW
+ avcodec/x86/vp3dsp_init: Set correct function pointer, fix crash
+ avformat/mp3dec: change bogus error message if read_header encounters EOF
+ avformat/mp3dec: simplify inner frame size check in mp3_read_header
+ avformat/mp3dec: only call ffio_ensure_seekback once
+ avcodec/cbs_h266: read vps_ptl_max_tid before using it
+ avcodec/cbs_h266: fix sh_collocated_from_l0_flag and sh_collocated_ref_idx infer
+ avformat/vvc: fix parsing some early VPS bitstream values
+ avformat/vvc: fix writing general_constraint_info bytes
+ avutil/ppc/cpu: Also use the machdep.altivec sysctl on NetBSD
+ lavd/v4l2: Use proper field type for second parameter of ioctl() with BSD's
+ vulkan_av1: Fix force_integer_mv value
+ vaapi_av1: Fix force_integer_mv value
+ av1dec: Add force_integer_mv derived field for decoder use
+ avutil/iamf: fix offsets for mix_gain options
+ avformat/iamfdec: check nb_streams in header read
+ avformat/mov: free the infe allocated item data on failure
+ avformat/iamf_writer: reject duplicated stream ids in a stream group
+ avformat/mov: don't read key_size bytes twice in the keys atom
+ avformat/mov: take into account the first eight bytes in the keys atom
+ avformat/mov: fix the check for the heif item parsing loop
+ avutil/iamf: fix mix_gain_class name
+ av1dec: Fix RefFrameSignBias calculation
+ avcodec/codec_par: always clear extradata_size in avcodec_parameters_to_context()
+ avcodec/mediacodecenc: Fix return empty packet when bsf is used
+ avcodec/hevcdec: Fix precedence, bogus film grain warning
+ avcodec/hevcdec: fix segfault on invalid film grain metadata
+ lavc/vvc: Skip enhancement layer NAL units
+ avformat/mov: ignore old infe box versions
+ vulkan_av1: add workaround for NVIDIA drivers tested on broken CTS
+ lavc/vulkan_av1: Use av1dec reference order hint information
+ lavc/av1: Record reference ordering information for each frame
+ doc/encoders: add missing libxvid option
+ doc/encoders: remove non-existent flag
+ fate/ffmpeg: Avoid dependency on samples
+ avcodec/wavpack: Remove always-false check
+ avcodec/wavpack: Fix leak and segfault on reallocation error
+ avcodec/lossless_videoencdsp: Don't presume alignment in diff_bytes
+ avcodec/ppc/h264dsp: Fix left shifts of negative numbers
+
 version 7.0:
 - DXV DXT1 encoder
 - LEAD MCMP decoder
@@ -17,7 +113,7 @@ version 7.0:
 - qrencode filter and qrencodesrc source
 - quirc filter
 - lavu/eval: introduce randomi() function in expressions
- VVC decoder
+- VVC decoder (experimental)
 - fsync filter
 - Raw Captions with Time (RCWT) closed caption muxer
 - ffmpeg CLI -bsf option may now be used for input as well as output
@@ -38,6 +134,15 @@ version 7.0:
 - ffplay with hwaccel decoding support (depends on vulkan renderer via libplacebo)
 - dnn filter libtorch backend
 - Android content URIs protocol
+- AOMedia Film Grain Synthesis 1 (AFGS1)
+- RISC-V optimizations for AAC, FLAC, JPEG-2000, LPC, RV4.0, SVQ, VC1, VP8, and more
+- Loongarch optimizations for HEVC decoding
+- Important AArch64 optimizations for HEVC
+- IAMF support inside MP4/ISOBMFF
+- Support for HEIF/AVIF still images and tiled still images
+- Dolby Vision profile 10 support in AV1
+- Support for Ambient Viewing Environment metadata in MP4/ISOBMFF
+- HDR10 metadata passthrough when encoding with libx264, libx265, and libsvtav1


 version 6.1:
@@ -1 +1 @@
-5.1.git
+7.0.1
@@ -0,0 +1,15 @@
+
+            ┌─────────────────────────────────────────┐
+            │ RELEASE NOTES for FFmpeg 7.0 "Dijkstra" │
+            └─────────────────────────────────────────┘
+
+   The FFmpeg Project proudly presents FFmpeg 7.0 "Dijkstra", about 6
+   months after the release of FFmpeg 6.1.
+
+   A complete Changelog is available at the root of the project, and the
+   complete Git history on https://git.ffmpeg.org/gitweb/ffmpeg.git
+
+   We hope you will like this release as much as we enjoyed working on it, and
+   as usual, if you have any questions about it, or any FFmpeg related topic,
+   feel free to join us on the #ffmpeg IRC channel (on irc.libera.chat) or ask
+   on the mailing-lists.
@@ -2851,6 +2851,7 @@ h264_sei_select="atsc_a53 golomb"
 hevcparse_select="golomb"
 hevc_sei_select="atsc_a53 golomb"
 frame_thread_encoder_deps="encoders threads"
+iamfdec_select="iso_media mpeg4audio"
 inflate_wrapper_deps="zlib"
 intrax8_select="blockdsp wmv2dsp"
 iso_media_select="mpeg4audio"
@@ -2894,7 +2895,7 @@ asv1_encoder_select="aandcttables bswapdsp fdctdsp pixblockdsp"
 asv2_decoder_select="blockdsp bswapdsp idctdsp"
 asv2_encoder_select="aandcttables bswapdsp fdctdsp pixblockdsp"
 atrac1_decoder_select="sinewin"
-av1_decoder_select="cbs_av1 atsc_a53"
+av1_decoder_select="atsc_a53 cbs_av1 dovi_rpu"
 bink_decoder_select="blockdsp hpeldsp"
 binkaudio_dct_decoder_select="wma_freqs"
 binkaudio_rdft_decoder_select="wma_freqs"
@@ -3483,7 +3484,7 @@ libcelt_decoder_deps="libcelt"
 libcodec2_decoder_deps="libcodec2"
 libcodec2_encoder_deps="libcodec2"
 libdav1d_decoder_deps="libdav1d"
-libdav1d_decoder_select="atsc_a53"
+libdav1d_decoder_select="atsc_a53 dovi_rpu"
 libdavs2_decoder_deps="libdavs2"
 libdavs2_decoder_select="avs2_parser"
 libfdk_aac_decoder_deps="libfdk_aac"
@@ -38,7 +38,7 @@ PROJECT_NAME           = FFmpeg
 # could be handy for archiving the generated documentation or if some version
 # control system is used.

-PROJECT_NUMBER         =
+PROJECT_NUMBER         = 7.0.1

 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
@@ -390,6 +390,10 @@ If you apply a patch, send an
 answer to ffmpeg-devel (or wherever you got the patch from) saying that
 you applied the patch.

+@subheading Credit any researchers
+If a commit/patch fixes an issues found by some researcher, always credit the
+researcher in the commit message for finding/reporting the issue.
+
@subheading Always wait long enough before pushing changes
 Do NOT commit to code actively maintained by others without permission.
 Send a patch to ffmpeg-devel. If no one answers within a reasonable
@@ -3045,9 +3045,6 @@ Enable high quality AC prediction.
@item gray
 Only encode grayscale.

-@item gmc
-Enable the use of global motion compensation (GMC).
-
@item qpel
 Enable quarter-pixel motion compensation.

@@ -3059,7 +3056,9 @@ Place global headers in extradata instead of every keyframe.

@end table

-@item trellis
+@item gmc
+Enable the use of global motion compensation (GMC).  Default is 0
+(disabled).

@item me_quality
 Set motion estimation quality level. Possible values in decreasing order of
@@ -3114,6 +3113,9 @@ be better than any of the two specified individually. In other
 words, the resulting quality will be the worse one of the two
 effects.

+@item trellis
+Set rate-distortion optimal quantization.
+
@item ssim
 Set structural similarity (SSIM) displaying method. Possible values:

@@ -138,11 +138,9 @@ static int decode_packet(AVCodecContext *dec, const AVPacket *pkt)
            ret = output_audio_frame(frame);

        av_frame_unref(frame);
-        if (ret < 0)
-            return ret;
    }

-    return 0;
+    return ret;
 }

 static int open_codec_context(int *stream_idx,
@@ -75,8 +75,7 @@ static int str_to_dict(char* optstr, AVDictionary **opt)
        if (value == NULL)
            return AVERROR(EINVAL);
        av_dict_set(opt, key, value, 0);
-    } while(key != NULL);
-    return 0;
+    } while(1);
 }

 static int dynamic_set_parameter(AVCodecContext *avctx)
@@ -334,17 +333,15 @@ static int dec_enc(AVPacket *pkt, const AVCodec *enc_codec, char *optstr)

 fail:
        av_frame_free(&frame);
-        if (ret < 0)
-            return ret;
    }
-    return 0;
+    return ret;
 }

 int main(int argc, char **argv)
 {
    const AVCodec *enc_codec;
    int ret = 0;
-    AVPacket *dec_pkt;
+    AVPacket *dec_pkt = NULL;

    if (argc < 5 || (argc - 5) % 2) {
        av_log(NULL, AV_LOG_ERROR, "Usage: %s <input file> <encoder> <output file>"
@@ -215,10 +215,8 @@ static int dec_enc(AVPacket *pkt, const AVCodec *enc_codec)

 fail:
        av_frame_free(&frame);
-        if (ret < 0)
-            return ret;
    }
-    return 0;
+    return ret;
 }

 int main(int argc, char **argv)
@@ -260,6 +260,12 @@ typedef struct SchFilterGraph {
    int                 task_exited;
 } SchFilterGraph;

+enum SchedulerState {
+    SCH_STATE_UNINIT,
+    SCH_STATE_STARTED,
+    SCH_STATE_STOPPED,
+};
+
 struct Scheduler {
    const AVClass      *class;

@@ -292,7 +298,7 @@ struct Scheduler {
    char               *sdp_filename;
    int                 sdp_auto;

-    int                 transcode_started;
+    enum SchedulerState state;
    atomic_int          terminate;
    atomic_int          task_failed;

@@ -399,22 +405,6 @@ static int queue_alloc(ThreadQueue **ptq, unsigned nb_streams, unsigned queue_si

 static void *task_wrapper(void *arg);

-static int task_stop(SchTask *task)
-{
-    int ret;
-    void *thread_ret;
-
-    if (!task->thread_running)
-        return 0;
-
-    ret = pthread_join(task->thread, &thread_ret);
-    av_assert0(ret == 0);
-
-    task->thread_running = 0;
-
-    return (intptr_t)thread_ret;
-}
-
 static int task_start(SchTask *task)
 {
    int ret;
@@ -468,59 +458,6 @@ static int64_t trailing_dts(const Scheduler *sch, int count_finished)
    return min_dts == INT64_MAX ? AV_NOPTS_VALUE : min_dts;
 }

-int sch_stop(Scheduler *sch, int64_t *finish_ts)
-{
-    int ret = 0, err;
-
-    atomic_store(&sch->terminate, 1);
-
-    for (unsigned type = 0; type < 2; type++)
-        for (unsigned i = 0; i < (type ? sch->nb_demux : sch->nb_filters); i++) {
-            SchWaiter *w = type ? &sch->demux[i].waiter : &sch->filters[i].waiter;
-            waiter_set(w, 1);
-        }
-
-    for (unsigned i = 0; i < sch->nb_demux; i++) {
-        SchDemux *d = &sch->demux[i];
-
-        err = task_stop(&d->task);
-        ret = err_merge(ret, err);
-    }
-
-    for (unsigned i = 0; i < sch->nb_dec; i++) {
-        SchDec *dec = &sch->dec[i];
-
-        err = task_stop(&dec->task);
-        ret = err_merge(ret, err);
-    }
-
-    for (unsigned i = 0; i < sch->nb_filters; i++) {
-        SchFilterGraph *fg = &sch->filters[i];
-
-        err = task_stop(&fg->task);
-        ret = err_merge(ret, err);
-    }
-
-    for (unsigned i = 0; i < sch->nb_enc; i++) {
-        SchEnc *enc = &sch->enc[i];
-
-        err = task_stop(&enc->task);
-        ret = err_merge(ret, err);
-    }
-
-    for (unsigned i = 0; i < sch->nb_mux; i++) {
-        SchMux *mux = &sch->mux[i];
-
-        err = task_stop(&mux->task);
-        ret = err_merge(ret, err);
-    }
-
-    if (finish_ts)
-        *finish_ts = trailing_dts(sch, 1);
-
-    return ret;
-}
-
 void sch_free(Scheduler **psch)
 {
    Scheduler *sch = *psch;
@@ -1213,7 +1150,8 @@ int sch_mux_stream_ready(Scheduler *sch, unsigned mux_idx, unsigned stream_idx)

    // this may be called during initialization - do not start
    // threads before sch_start() is called
-    if (++mux->nb_streams_ready == mux->nb_streams && sch->transcode_started)
+    if (++mux->nb_streams_ready == mux->nb_streams &&
+        sch->state >= SCH_STATE_STARTED)
        ret = mux_init(sch, mux);

    pthread_mutex_unlock(&sch->mux_ready_lock);
@@ -1583,7 +1521,8 @@ int sch_start(Scheduler *sch)
    if (ret < 0)
        return ret;

-    sch->transcode_started = 1;
+    av_assert0(sch->state == SCH_STATE_UNINIT);
+    sch->state = SCH_STATE_STARTED;

    for (unsigned i = 0; i < sch->nb_mux; i++) {
        SchMux *mux = &sch->mux[i];
@@ -1591,7 +1530,7 @@ int sch_start(Scheduler *sch)
        if (mux->nb_streams_ready == mux->nb_streams) {
            ret = mux_init(sch, mux);
            if (ret < 0)
-                return ret;
+                goto fail;
        }
    }

@@ -1600,7 +1539,7 @@ int sch_start(Scheduler *sch)

        ret = task_start(&enc->task);
        if (ret < 0)
-            return ret;
+            goto fail;
    }

    for (unsigned i = 0; i < sch->nb_filters; i++) {
@@ -1608,7 +1547,7 @@ int sch_start(Scheduler *sch)

        ret = task_start(&fg->task);
        if (ret < 0)
-            return ret;
+            goto fail;
    }

    for (unsigned i = 0; i < sch->nb_dec; i++) {
@@ -1616,7 +1555,7 @@ int sch_start(Scheduler *sch)

        ret = task_start(&dec->task);
        if (ret < 0)
-            return ret;
+            goto fail;
    }

    for (unsigned i = 0; i < sch->nb_demux; i++) {
@@ -1627,7 +1566,7 @@ int sch_start(Scheduler *sch)

        ret = task_start(&d->task);
        if (ret < 0)
-            return ret;
+            goto fail;
    }

    pthread_mutex_lock(&sch->schedule_lock);
@@ -1635,6 +1574,9 @@ int sch_start(Scheduler *sch)
    pthread_mutex_unlock(&sch->schedule_lock);

    return 0;
+fail:
+    sch_stop(sch, NULL);
+    return ret;
 }

 int sch_wait(Scheduler *sch, uint64_t timeout_us, int64_t *transcode_ts)
@@ -2483,6 +2425,18 @@ int sch_filter_command(Scheduler *sch, unsigned fg_idx, AVFrame *frame)
    return send_to_filter(sch, fg, fg->nb_inputs, frame);
 }

+static int task_cleanup(Scheduler *sch, SchedulerNode node)
+{
+    switch (node.type) {
+    case SCH_NODE_TYPE_DEMUX:       return demux_done (sch, node.idx);
+    case SCH_NODE_TYPE_MUX:         return mux_done   (sch, node.idx);
+    case SCH_NODE_TYPE_DEC:         return dec_done   (sch, node.idx);
+    case SCH_NODE_TYPE_ENC:         return enc_done   (sch, node.idx);
+    case SCH_NODE_TYPE_FILTER_IN:   return filter_done(sch, node.idx);
+    default: av_assert0(0);
+    }
+}
+
 static void *task_wrapper(void *arg)
 {
    SchTask  *task = arg;
@@ -2495,15 +2449,7 @@ static void *task_wrapper(void *arg)
        av_log(task->func_arg, AV_LOG_ERROR,
               "Task finished with error code: %d (%s)\n", ret, av_err2str(ret));

-    switch (task->node.type) {
-    case SCH_NODE_TYPE_DEMUX:       err = demux_done (sch, task->node.idx); break;
-    case SCH_NODE_TYPE_MUX:         err = mux_done   (sch, task->node.idx); break;
-    case SCH_NODE_TYPE_DEC:         err = dec_done   (sch, task->node.idx); break;
-    case SCH_NODE_TYPE_ENC:         err = enc_done   (sch, task->node.idx); break;
-    case SCH_NODE_TYPE_FILTER_IN:   err = filter_done(sch, task->node.idx); break;
-    default: av_assert0(0);
-    }
-
+    err = task_cleanup(sch, task->node);
    ret = err_merge(ret, err);

    // EOF is considered normal termination
@@ -2518,3 +2464,77 @@ static void *task_wrapper(void *arg)

    return (void*)(intptr_t)ret;
 }
+
+static int task_stop(Scheduler *sch, SchTask *task)
+{
+    int ret;
+    void *thread_ret;
+
+    if (!task->thread_running)
+        return task_cleanup(sch, task->node);
+
+    ret = pthread_join(task->thread, &thread_ret);
+    av_assert0(ret == 0);
+
+    task->thread_running = 0;
+
+    return (intptr_t)thread_ret;
+}
+
+int sch_stop(Scheduler *sch, int64_t *finish_ts)
+{
+    int ret = 0, err;
+
+    if (sch->state != SCH_STATE_STARTED)
+        return 0;
+
+    atomic_store(&sch->terminate, 1);
+
+    for (unsigned type = 0; type < 2; type++)
+        for (unsigned i = 0; i < (type ? sch->nb_demux : sch->nb_filters); i++) {
+            SchWaiter *w = type ? &sch->demux[i].waiter : &sch->filters[i].waiter;
+            waiter_set(w, 1);
+        }
+
+    for (unsigned i = 0; i < sch->nb_demux; i++) {
+        SchDemux *d = &sch->demux[i];
+
+        err = task_stop(sch, &d->task);
+        ret = err_merge(ret, err);
+    }
+
+    for (unsigned i = 0; i < sch->nb_dec; i++) {
+        SchDec *dec = &sch->dec[i];
+
+        err = task_stop(sch, &dec->task);
+        ret = err_merge(ret, err);
+    }
+
+    for (unsigned i = 0; i < sch->nb_filters; i++) {
+        SchFilterGraph *fg = &sch->filters[i];
+
+        err = task_stop(sch, &fg->task);
+        ret = err_merge(ret, err);
+    }
+
+    for (unsigned i = 0; i < sch->nb_enc; i++) {
+        SchEnc *enc = &sch->enc[i];
+
+        err = task_stop(sch, &enc->task);
+        ret = err_merge(ret, err);
+    }
+
+    for (unsigned i = 0; i < sch->nb_mux; i++) {
+        SchMux *mux = &sch->mux[i];
+
+        err = task_stop(sch, &mux->task);
+        ret = err_merge(ret, err);
+    }
+
+    if (finish_ts)
+        *finish_ts = trailing_dts(sch, 1);
+
+    sch->state = SCH_STATE_STOPPED;
+
+    return ret;
+}
@@ -2394,12 +2394,13 @@ static int audio_decode_frame(VideoState *is)
        av_channel_layout_compare(&af->frame->ch_layout, &is->audio_src.ch_layout) ||
        af->frame->sample_rate   != is->audio_src.freq           ||
        (wanted_nb_samples       != af->frame->nb_samples && !is->swr_ctx)) {
+        int ret;
        swr_free(&is->swr_ctx);
-        swr_alloc_set_opts2(&is->swr_ctx,
+        ret = swr_alloc_set_opts2(&is->swr_ctx,
                            &is->audio_tgt.ch_layout, is->audio_tgt.fmt, is->audio_tgt.freq,
                            &af->frame->ch_layout, af->frame->format, af->frame->sample_rate,
                            0, NULL);
-        if (!is->swr_ctx || swr_init(is->swr_ctx) < 0) {
+        if (ret < 0 || swr_init(is->swr_ctx) < 0) {
            av_log(NULL, AV_LOG_ERROR,
                   "Cannot create sample rate converter for conversion of %d Hz %s %d channels to %d Hz %s %d channels!\n",
                    af->frame->sample_rate, av_get_sample_fmt_name(af->frame->format), af->frame->ch_layout.nb_channels,
@@ -724,10 +724,13 @@ int show_codecs(void *optctx, const char *opt, const char *arg)
    return 0;
 }

-static void print_codecs(int encoder)
+static int print_codecs(int encoder)
 {
    const AVCodecDescriptor **codecs;
-    unsigned i, nb_codecs = get_codecs_sorted(&codecs);
+    int i, nb_codecs = get_codecs_sorted(&codecs);
+
+    if (nb_codecs < 0)
+        return nb_codecs;

    printf("%s:\n"
           " V..... = Video\n"
@@ -762,18 +765,17 @@ static void print_codecs(int encoder)
        }
    }
    av_free(codecs);
+    return 0;
 }

 int show_decoders(void *optctx, const char *opt, const char *arg)
 {
-    print_codecs(0);
-    return 0;
+    return print_codecs(0);
 }

 int show_encoders(void *optctx, const char *opt, const char *arg)
 {
-    print_codecs(1);
-    return 0;
+    return print_codecs(1);
 }

 int show_bsfs(void *optctx, const char *opt, const char *arg)
@@ -1068,6 +1068,7 @@ STLIBOBJS-$(CONFIG_ISO_MEDIA)          += mpegaudiotabs.o
 STLIBOBJS-$(CONFIG_FLV_MUXER)          += mpeg4audio_sample_rates.o
 STLIBOBJS-$(CONFIG_HLS_DEMUXER)        += ac3_channel_layout_tab.o
 STLIBOBJS-$(CONFIG_IMAGE_JPEGXL_PIPE_DEMUXER) += jpegxl_parse.o
+STLIBOBJS-$(CONFIG_JNI)                += ffjni.o
 STLIBOBJS-$(CONFIG_JPEGXL_ANIM_DEMUXER)       += jpegxl_parse.o
 STLIBOBJS-$(CONFIG_MATROSKA_DEMUXER)   += mpeg4audio_sample_rates.o
 STLIBOBJS-$(CONFIG_MOV_DEMUXER)        += ac3_channel_layout_tab.o
@@ -204,7 +204,9 @@ int av_ac3_parse_header(const uint8_t *buf, size_t size,
    AC3HeaderInfo hdr;
    int err;

-    init_get_bits8(&gb, buf, size);
+    err = init_get_bits8(&gb, buf, size);
+    if (err < 0)
+        return AVERROR_INVALIDDATA;
    err = ff_ac3_parse_header(&gb, &hdr);
    if (err < 0)
        return AVERROR_INVALIDDATA;
@@ -27,9 +27,14 @@
 int av_adts_header_parse(const uint8_t *buf, uint32_t *samples, uint8_t *frames)
 {
 #if CONFIG_ADTS_HEADER
+    uint8_t tmpbuf[AV_AAC_ADTS_HEADER_SIZE + AV_INPUT_BUFFER_PADDING_SIZE];
    GetBitContext gb;
    AACADTSHeaderInfo hdr;
-    int err = init_get_bits8(&gb, buf, AV_AAC_ADTS_HEADER_SIZE);
+    int err;
+    if (!buf)
+        return AVERROR(EINVAL);
+    memcpy(tmpbuf, buf, AV_AAC_ADTS_HEADER_SIZE);
+    err = init_get_bits8(&gb, tmpbuf, AV_AAC_ADTS_HEADER_SIZE);
    if (err < 0)
        return err;
    err = ff_adts_header_parse(&gb, &hdr);
@@ -26,6 +26,7 @@

 #include "config.h"

+#include "libavutil/avassert.h"
 #include "libavutil/channel_layout.h"
 #include "libavutil/common.h"
 #include "libavutil/lfg.h"
@@ -554,6 +555,8 @@ static void decode_fixed_vector(float *fixed_vector, const uint16_t *pulse_hi,
            decode_6p_track(sig_pos[i], (int) pulse_lo[i] +
                           ((int) pulse_hi[i] << 11), 4, 1);
        break;
+    default:
+        av_assert2(0);
    }

    memset(fixed_vector, 0, sizeof(float) * AMRWB_SFR_SIZE);
@@ -1286,7 +1286,7 @@ static void predictor_decode_stereo_3950(APEContext *ctx, int count)
                int32_t left  = a1 - (unsigned)(a0 / 2);
                int32_t right = left + (unsigned)a0;

-                if (FFMAX(FFABS(left), FFABS(right)) > (1<<23)) {
+                if (FFMIN(FFNABS(left), FFNABS(right)) < -(1<<23)) {
                    ctx->interim_mode = !interim_mode;
                    av_log(ctx->avctx, AV_LOG_VERBOSE, "Interim mode: %d\n", ctx->interim_mode);
                    break;
@@ -801,7 +801,9 @@ static int atrac9_decode_frame(AVCodecContext *avctx, AVFrame *frame,
    if (ret < 0)
        return ret;

-    init_get_bits8(&gb, avpkt->data, avpkt->size);
+    ret = init_get_bits8(&gb, avpkt->data, avpkt->size);
+    if (ret < 0)
+        return ret;

    for (int i = 0; i < frames; i++) {
        for (int j = 0; j < s->block_config->count; j++) {
@@ -921,7 +923,9 @@ static av_cold int atrac9_decode_init(AVCodecContext *avctx)
        return AVERROR_INVALIDDATA;
    }

-    init_get_bits8(&gb, avctx->extradata + 4, avctx->extradata_size);
+    err = init_get_bits8(&gb, avctx->extradata + 4, avctx->extradata_size);
+    if (err < 0)
+        return err;

    if (get_bits(&gb, 8) != 0xFE) {
        av_log(avctx, AV_LOG_ERROR, "Incorrect magic byte!\n");
@@ -358,6 +358,30 @@ static void coded_lossless_param(AV1DecContext *s)
    }
 }

+static void order_hint_info(AV1DecContext *s)
+{
+    const AV1RawFrameHeader *header = s->raw_frame_header;
+    const AV1RawSequenceHeader *seq = s->raw_seq;
+    AV1Frame *frame = &s->cur_frame;
+
+    frame->order_hint = header->order_hint;
+
+    for (int i = 0; i < AV1_REFS_PER_FRAME; i++) {
+        int ref_name = i + AV1_REF_FRAME_LAST;
+        int ref_slot = header->ref_frame_idx[i];
+        int ref_order_hint = s->ref[ref_slot].order_hint;
+
+        frame->order_hints[ref_name] = ref_order_hint;
+        if (!seq->enable_order_hint) {
+            frame->ref_frame_sign_bias[ref_name] = 0;
+        } else {
+            frame->ref_frame_sign_bias[ref_name] =
+                get_relative_dist(seq, ref_order_hint,
+                                  frame->order_hint) > 0;
+        }
+    }
+}
+
 static void load_grain_params(AV1DecContext *s)
 {
    const AV1RawFrameHeader *header = s->raw_frame_header;
@@ -444,7 +468,7 @@ static int get_tiles_info(AVCodecContext *avctx, const AV1RawTileGroup *tile_gro
 static enum AVPixelFormat get_sw_pixel_format(void *logctx,
                                              const AV1RawSequenceHeader *seq)
 {
-    uint8_t bit_depth;
+    int bit_depth;
    enum AVPixelFormat pix_fmt = AV_PIX_FMT_NONE;

    if (seq->seq_profile == 2 && seq->color_config.high_bitdepth)
@@ -468,7 +492,7 @@ static enum AVPixelFormat get_sw_pixel_format(void *logctx,
            else if (bit_depth == 12)
                pix_fmt = AV_PIX_FMT_YUV444P12;
            else
-                av_log(logctx, AV_LOG_WARNING, "Unknown AV1 pixel format.\n");
+                av_assert0(0);
        } else if (seq->color_config.subsampling_x == 1 &&
                   seq->color_config.subsampling_y == 0) {
            if (bit_depth == 8)
@@ -478,7 +502,7 @@ static enum AVPixelFormat get_sw_pixel_format(void *logctx,
            else if (bit_depth == 12)
                pix_fmt = AV_PIX_FMT_YUV422P12;
            else
-                av_log(logctx, AV_LOG_WARNING, "Unknown AV1 pixel format.\n");
+                av_assert0(0);
        } else if (seq->color_config.subsampling_x == 1 &&
                   seq->color_config.subsampling_y == 1) {
            if (bit_depth == 8)
@@ -488,7 +512,7 @@ static enum AVPixelFormat get_sw_pixel_format(void *logctx,
            else if (bit_depth == 12)
                pix_fmt = AV_PIX_FMT_YUV420P12;
            else
-                av_log(logctx, AV_LOG_WARNING, "Unknown AV1 pixel format.\n");
+                av_assert0(0);
        }
    } else {
        if (bit_depth == 8)
@@ -498,7 +522,7 @@ static enum AVPixelFormat get_sw_pixel_format(void *logctx,
        else if (bit_depth == 12)
            pix_fmt = AV_PIX_FMT_GRAY12;
        else
-            av_log(logctx, AV_LOG_WARNING, "Unknown AV1 pixel format.\n");
+            av_assert0(0);
    }

    return pix_fmt;
@@ -700,6 +724,14 @@ static int av1_frame_ref(AVCodecContext *avctx, AV1Frame *dst, const AV1Frame *s
           sizeof(dst->film_grain));
    dst->coded_lossless = src->coded_lossless;

+    dst->order_hint = src->order_hint;
+    memcpy(dst->ref_frame_sign_bias, src->ref_frame_sign_bias,
+           sizeof(dst->ref_frame_sign_bias));
+    memcpy(dst->order_hints, src->order_hints,
+           sizeof(dst->order_hints));
+
+    dst->force_integer_mv = src->force_integer_mv;
+
    return 0;

 fail:
@@ -1255,8 +1287,14 @@ static int get_current_frame(AVCodecContext *avctx)
    global_motion_params(s);
    skip_mode_params(s);
    coded_lossless_param(s);
+    order_hint_info(s);
    load_grain_params(s);

+    s->cur_frame.force_integer_mv =
+        s->raw_frame_header->force_integer_mv ||
+        s->raw_frame_header->frame_type == AV1_FRAME_KEY ||
+        s->raw_frame_header->frame_type == AV1_FRAME_INTRA_ONLY;
+
    return ret;
 }

@@ -53,6 +53,20 @@ typedef struct AV1Frame {
    AV1RawFilmGrainParams film_grain;

    uint8_t coded_lossless;
+
+    // OrderHint for this frame.
+    uint8_t order_hint;
+    // RefFrameSignBias[] used when decoding this frame.
+    uint8_t ref_frame_sign_bias[AV1_TOTAL_REFS_PER_FRAME];
+    // OrderHints[] when this is the current frame, otherwise
+    // SavedOrderHints[s][] when is the reference frame in slot s.
+    uint8_t order_hints[AV1_TOTAL_REFS_PER_FRAME];
+
+    // force_integer_mv value at the end of the frame header parsing.
+    // This is not the same as the syntax element value in
+    // raw_frame_header because the specification parsing tables
+    // override the value on intra frames.
+    uint8_t force_integer_mv;
 } AV1Frame;

 typedef struct TileGroupInfo {
@@ -72,13 +72,15 @@ static void parse_avs2_seq_header(AVCodecParserContext *s, const uint8_t *buf,
    unsigned aspect_ratio;
    unsigned frame_rate_code;
    int low_delay;
+    av_unused int ret;
    // update buf_size_min if parse more deeper
    const int buf_size_min = 15;

    if (buf_size < buf_size_min)
        return;

-    init_get_bits8(&gb, buf, buf_size_min);
+    ret = init_get_bits8(&gb, buf, buf_size_min);
+    av_assert1(ret >= 0);

    s->key_frame = 1;
    s->pict_type = AV_PICTURE_TYPE_I;
@@ -73,7 +73,8 @@ static void parse_avs3_nal_units(AVCodecParserContext *s, const uint8_t *buf,
            GetBitContext gb;
            int profile, ratecode, low_delay;

-            init_get_bits8(&gb, buf + 4, buf_size - 4);
+            av_unused int ret = init_get_bits(&gb, buf + 4, 100);
+            av_assert1(ret >= 0);

            s->key_frame = 1;
            s->pict_type = AV_PICTURE_TYPE_I;
@@ -536,7 +536,8 @@ static inline int BS_FUNC(read_vlc)(BSCTX *bc, const VLCElem *table,
 static inline int BS_FUNC(read_vlc_multi)(BSCTX *bc, uint8_t dst[8],
                                          const VLC_MULTI_ELEM *const Jtable,
                                          const VLCElem *const table,
-                                          const int bits, const int max_depth)
+                                          const int bits, const int max_depth,
+                                          const int symbols_size)
 {
    unsigned idx = BS_FUNC(peek)(bc, bits);
    int ret, nb_bits, code, n = Jtable[idx].len;
@@ -554,7 +555,10 @@ static inline int BS_FUNC(read_vlc_multi)(BSCTX *bc, uint8_t dst[8],
                code = BS_FUNC(priv_set_idx)(bc, code, &n, &nb_bits, table);
            }
        }
-        AV_WN16(dst, code);
+        if (symbols_size == 1)
+            *dst = code;
+        else
+            AV_WN16(dst, code);
        ret = n > 0;
    }
    BS_FUNC(priv_skip_remaining)(bc, n);
@@ -208,6 +208,49 @@ static int h264_mp4toannexb_save_ps(uint8_t **dst, int *dst_size,
    return 0;
 }

+static int h264_mp4toannexb_filter_ps(H264BSFContext *s,
+                                      const uint8_t *buf,
+                                      const uint8_t *buf_end)
+{
+    int sps_count = 0;
+    int pps_count = 0;
+    uint8_t unit_type;
+
+    do {
+        uint32_t nal_size = 0;
+
+        /* possible overread ok due to padding */
+        for (int i = 0; i < s->length_size; i++)
+            nal_size = (nal_size << 8) | buf[i];
+
+        buf += s->length_size;
+
+        /* This check requires the cast as the right side might
+         * otherwise be promoted to an unsigned value. */
+        if ((int64_t)nal_size > buf_end - buf)
+            return AVERROR_INVALIDDATA;
+
+        if (!nal_size)
+            continue;
+
+        unit_type = *buf & 0x1f;
+
+        if (unit_type == H264_NAL_SPS) {
+            h264_mp4toannexb_save_ps(&s->sps, &s->sps_size, &s->sps_buf_size, buf,
+                                   nal_size, !sps_count);
+            sps_count++;
+        } else if (unit_type == H264_NAL_PPS) {
+            h264_mp4toannexb_save_ps(&s->pps, &s->pps_size, &s->pps_buf_size, buf,
+                                   nal_size, !pps_count);
+            pps_count++;
+        }
+
+        buf += nal_size;
+    } while (buf < buf_end);
+
+    return 0;
+}
+
 static int h264_mp4toannexb_init(AVBSFContext *ctx)
 {
    int extra_size = ctx->par_in->extradata_size;
@@ -263,14 +306,14 @@ static int h264_mp4toannexb_filter(AVBSFContext *ctx, AVPacket *opkt)
    }

    buf_end  = in->data + in->size;
+    ret = h264_mp4toannexb_filter_ps(s, in->data, buf_end);
+    if (ret < 0)
+        goto fail;

 #define LOG_ONCE(...) \
    if (j) \
        av_log(__VA_ARGS__)
    for (int j = 0; j < 2; j++) {
-        int sps_count = 0;
-        int pps_count = 0;
-
        buf      = in->data;
        new_idr  = s->new_idr;
        sps_seen = s->idr_sps_seen;
@@ -301,18 +344,8 @@ static int h264_mp4toannexb_filter(AVBSFContext *ctx, AVPacket *opkt)

            if (unit_type == H264_NAL_SPS) {
                sps_seen = new_idr = 1;
-                if (!j) {
-                    h264_mp4toannexb_save_ps(&s->sps, &s->sps_size, &s->sps_buf_size,
-                                             buf, nal_size, !sps_count);
-                    sps_count++;
-                }
            } else if (unit_type == H264_NAL_PPS) {
                pps_seen = new_idr = 1;
-                if (!j) {
-                    h264_mp4toannexb_save_ps(&s->pps, &s->pps_size, &s->pps_buf_size,
-                                             buf, nal_size, !pps_count);
-                    pps_count++;
-                }
                /* if SPS has not been seen yet, prepend the AVCC one to PPS */
                if (!sps_seen) {
                    if (!s->sps_size) {
@@ -301,7 +301,7 @@ static int cbs_av1_write_increment(CodedBitstreamContext *ctx, PutBitContext *pb
        return AVERROR(ENOSPC);

    if (len > 0)
-        put_bits(pbc, len, (1 << len) - 1 - (value != range_max));
+        put_bits(pbc, len, (1U << len) - 1 - (value != range_max));

    CBS_TRACE_WRITE_END_NO_SUBSCRIPTS();

@@ -708,7 +708,11 @@ static int cbs_h2645_split_fragment(CodedBitstreamContext *ctx,

            start = bytestream2_tell(&gbc);
            for(i = 0; i < num_nalus; i++) {
+                if (bytestream2_get_bytes_left(&gbc) < 2)
+                    return AVERROR_INVALIDDATA;
                size = bytestream2_get_be16(&gbc);
+                if (bytestream2_get_bytes_left(&gbc) < size)
+                    return AVERROR_INVALIDDATA;
                bytestream2_skip(&gbc, size);
            }
            end = bytestream2_tell(&gbc);
@@ -790,6 +790,21 @@ static int FUNC(vps) (CodedBitstreamContext *ctx, RWContext *rw,
        infer(vps_each_layer_is_an_ols_flag, 1);
        infer(vps_num_ptls_minus1, 0);
    }
+
+    for (i = 0; i <= current->vps_num_ptls_minus1; i++) {
+        if (i > 0)
+            flags(vps_pt_present_flag[i], 1, i);
+        else
+            infer(vps_pt_present_flag[i], 1);
+
+        if (!current->vps_default_ptl_dpb_hrd_max_tid_flag)
+            us(3, vps_ptl_max_tid[i], 0, current->vps_max_sublayers_minus1, 1, i);
+        else
+            infer(vps_ptl_max_tid[i], current->vps_max_sublayers_minus1);
+    }
+    while (byte_alignment(rw) != 0)
+        fixed(1, vps_ptl_alignment_zero_bit, 0);
+
    {
        //calc NumMultiLayerOlss
        int m;
@@ -915,19 +930,6 @@ static int FUNC(vps) (CodedBitstreamContext *ctx, RWContext *rw,
            return AVERROR_INVALIDDATA;
    }

-    for (i = 0; i <= current->vps_num_ptls_minus1; i++) {
-        if (i > 0)
-            flags(vps_pt_present_flag[i], 1, i);
-        else
-            infer(vps_pt_present_flag[i], 1);
-
-        if (!current->vps_default_ptl_dpb_hrd_max_tid_flag)
-            us(3, vps_ptl_max_tid[i], 0, current->vps_max_sublayers_minus1, 1, i);
-        else
-            infer(vps_ptl_max_tid[i], current->vps_max_sublayers_minus1);
-    }
-    while (byte_alignment(rw) != 0)
-        fixed(1, vps_ptl_alignment_zero_bit, 0);
    for (i = 0; i <= current->vps_num_ptls_minus1; i++) {
        CHECK(FUNC(profile_tier_level) (ctx, rw,
                                        current->vps_profile_tier_level + i,
@@ -3221,19 +3223,27 @@ static int FUNC(slice_header) (CodedBitstreamContext *ctx, RWContext *rw,
            flag(sh_cabac_init_flag);
        else
            infer(sh_cabac_init_flag, 0);
-        if (ph->ph_temporal_mvp_enabled_flag && !pps->pps_rpl_info_in_ph_flag) {
-            if (current->sh_slice_type == VVC_SLICE_TYPE_B)
-                flag(sh_collocated_from_l0_flag);
-            else
-                infer(sh_collocated_from_l0_flag, 1);
-            if ((current->sh_collocated_from_l0_flag &&
-                 current->num_ref_idx_active[0] > 1) ||
-                (!current->sh_collocated_from_l0_flag &&
-                 current->num_ref_idx_active[1] > 1)) {
-                unsigned int idx = current->sh_collocated_from_l0_flag ? 0 : 1;
-                ue(sh_collocated_ref_idx, 0, current->num_ref_idx_active[idx] - 1);
+        if (ph->ph_temporal_mvp_enabled_flag) {
+            if (!pps->pps_rpl_info_in_ph_flag) {
+                if (current->sh_slice_type == VVC_SLICE_TYPE_B)
+                    flag(sh_collocated_from_l0_flag);
+                else
+                    infer(sh_collocated_from_l0_flag, 1);
+                if ((current->sh_collocated_from_l0_flag &&
+                    current->num_ref_idx_active[0] > 1) ||
+                    (!current->sh_collocated_from_l0_flag &&
+                    current->num_ref_idx_active[1] > 1)) {
+                    unsigned int idx = current->sh_collocated_from_l0_flag ? 0 : 1;
+                    ue(sh_collocated_ref_idx, 0, current->num_ref_idx_active[idx] - 1);
+                } else {
+                    infer(sh_collocated_ref_idx, 0);
+                }
            } else {
-                infer(sh_collocated_ref_idx, 0);
+                if (current->sh_slice_type == VVC_SLICE_TYPE_B)
+                    infer(sh_collocated_from_l0_flag, ph->ph_collocated_from_l0_flag);
+                else
+                    infer(sh_collocated_from_l0_flag, 1);
+                infer(sh_collocated_ref_idx, ph->ph_collocated_ref_idx);
            }
        }
        if (!pps->pps_wp_info_in_ph_flag &&
@@ -250,6 +250,7 @@ int avcodec_parameters_to_context(AVCodecContext *codec,
    }

    av_freep(&codec->extradata);
+    codec->extradata_size = 0;
    if (par->extradata) {
        codec->extradata = av_mallocz(par->extradata_size + AV_INPUT_BUFFER_PADDING_SIZE);
        if (!codec->extradata)
@@ -428,7 +428,8 @@ FF_ENABLE_DEPRECATION_WARNINGS
    } else if (avctx->codec->type == AVMEDIA_TYPE_AUDIO) {
        ret =  !got_frame ? AVERROR(EAGAIN)
                          : discard_samples(avctx, frame, discarded_samples);
-    }
+    } else
+        av_assert0(0);

    if (ret == AVERROR(EAGAIN))
        av_frame_unref(frame);
@@ -334,7 +334,10 @@ static int huf_unpack_enc_table(GetByteContext *gb,
        return ret;

    for (; im <= iM; im++) {
-        uint64_t l = freq[im] = get_bits(&gbit, 6);
+        int l;
+        if (get_bits_left(&gbit) < 6)
+            return AVERROR_INVALIDDATA;
+        l = freq[im] = get_bits(&gbit, 6);

        if (l == LONG_ZEROCODE_RUN) {
            int zerun = get_bits(&gbit, 8) + SHORTEST_LONG_RUN;
@@ -1939,7 +1942,7 @@ static int decode_header(EXRContext *s, AVFrame *frame)
                                                     "preview", 16)) >= 0) {
            uint32_t pw = bytestream2_get_le32(gb);
            uint32_t ph = bytestream2_get_le32(gb);
-            uint64_t psize = pw * ph;
+            uint64_t psize = pw * (uint64_t)ph;
            if (psize > INT64_MAX / 4) {
                ret = AVERROR_INVALIDDATA;
                goto fail;
@@ -100,7 +100,6 @@ static int decode_type2(GetByteContext *gb, PutByteContext *pb)
                            continue;
                        }
                    }
-                    repeat = 0;
                }
                repeat = 1;
            }
@@ -667,7 +667,8 @@ static av_always_inline int get_vlc2(GetBitContext *s, const VLCElem *table,
 static inline int get_vlc_multi(GetBitContext *s, uint8_t *dst,
                                const VLC_MULTI_ELEM *const Jtable,
                                const VLCElem *const table,
-                                const int bits, const int max_depth)
+                                const int bits, const int max_depth,
+                                const int symbols_size)
 {
    dst[0] = get_vlc2(s, table, bits, max_depth);
    return 1;
@@ -621,8 +621,7 @@ int ff_h2645_sei_to_frame(AVFrame *frame, H2645SEI *sei,
        if (!sd)
            av_buffer_unref(&a53->buf_ref);
        a53->buf_ref = NULL;
-        if (avctx)
-            avctx->properties |= FF_CODEC_PROPERTY_CLOSED_CAPTIONS;
+        avctx->properties |= FF_CODEC_PROPERTY_CLOSED_CAPTIONS;
    }

    for (unsigned i = 0; i < sei->unregistered.nb_buf_ref; i++) {
@@ -718,8 +717,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
        else
            fgc->present = fgc->persistence_flag;

-        if (avctx)
-            avctx->properties |= FF_CODEC_PROPERTY_FILM_GRAIN;
+        avctx->properties |= FF_CODEC_PROPERTY_FILM_GRAIN;
    }

 #if CONFIG_HEVC_SEI
@@ -1396,7 +1396,7 @@ static int h264_field_start(H264Context *h, const H264SliceContext *sl,

    sps = h->ps.sps;

-    if (sps && sps->bitstream_restriction_flag &&
+    if (sps->bitstream_restriction_flag &&
        h->avctx->has_b_frames < sps->num_reorder_frames) {
        h->avctx->has_b_frames = sps->num_reorder_frames;
    }
@@ -449,6 +449,15 @@ static void uninit_vps(FFRefStructOpaque opaque, void *obj)
    av_freep(&vps->hdr);
 }

+static int compare_vps(const HEVCVPS *vps1, const HEVCVPS *vps2)
+{
+    if (!memcmp(vps1, vps2, offsetof(HEVCVPS, hdr)))
+        return !vps1->vps_num_hrd_parameters ||
+               !memcmp(vps1->hdr, vps2->hdr, vps1->vps_num_hrd_parameters * sizeof(*vps1->hdr));
+
+    return 0;
+}
+
 int ff_hevc_decode_nal_vps(GetBitContext *gb, AVCodecContext *avctx,
                           HEVCParamSets *ps)
 {
@@ -545,9 +554,11 @@ int ff_hevc_decode_nal_vps(GetBitContext *gb, AVCodecContext *avctx,
            goto err;
        }

-        vps->hdr = av_calloc(vps->vps_num_hrd_parameters, sizeof(*vps->hdr));
-        if (!vps->hdr)
-            goto err;
+        if (vps->vps_num_hrd_parameters) {
+            vps->hdr = av_calloc(vps->vps_num_hrd_parameters, sizeof(*vps->hdr));
+            if (!vps->hdr)
+                goto err;
+        }

        for (i = 0; i < vps->vps_num_hrd_parameters; i++) {
            int common_inf_present = 1;
@@ -569,7 +580,7 @@ int ff_hevc_decode_nal_vps(GetBitContext *gb, AVCodecContext *avctx,
    }

    if (ps->vps_list[vps_id] &&
-        !memcmp(ps->vps_list[vps_id], vps, sizeof(*vps))) {
+        compare_vps(ps->vps_list[vps_id], vps)) {
        ff_refstruct_unref(&vps);
    } else {
        remove_vps(ps, vps_id);
@@ -153,7 +153,6 @@ typedef struct PTL {

 typedef struct HEVCVPS {
    unsigned int vps_id;
-    HEVCHdrParams *hdr;

    uint8_t vps_temporal_id_nesting_flag;
    int vps_max_layers;
@@ -175,6 +174,9 @@ typedef struct HEVCVPS {

    uint8_t data[4096];
    int data_size;
+    /* Put this at the end of the structure to make it easier to calculate the
+     * size before this pointer, which is used for memcmp */
+    HEVCHdrParams *hdr;
 } HEVCVPS;

 typedef struct ScalingList {
@@ -1968,13 +1968,13 @@ static void hls_prediction_unit(HEVCLocalContext *lc, int x0, int y0,

    if (current_mv.pred_flag & PF_L0) {
        ref0 = refPicList[0].ref[current_mv.ref_idx[0]];
-        if (!ref0 || !ref0->frame->data[0])
+        if (!ref0 || !ref0->frame)
            return;
        hevc_await_progress(s, ref0, &current_mv.mv[0], y0, nPbH);
    }
    if (current_mv.pred_flag & PF_L1) {
        ref1 = refPicList[1].ref[current_mv.ref_idx[1]];
-        if (!ref1 || !ref1->frame->data[0])
+        if (!ref1 || !ref1->frame)
            return;
        hevc_await_progress(s, ref1, &current_mv.mv[1], y0, nPbH);
    }
@@ -2892,10 +2892,15 @@ static int hevc_frame_start(HEVCContext *s)
        !(s->avctx->export_side_data & AV_CODEC_EXPORT_DATA_FILM_GRAIN) &&
        !s->avctx->hwaccel;

+    ret = set_side_data(s);
+    if (ret < 0)
+        goto fail;
+
    if (s->ref->needs_fg &&
-        s->sei.common.film_grain_characteristics.present &&
-        !ff_h274_film_grain_params_supported(s->sei.common.film_grain_characteristics.model_id,
-                                             s->ref->frame->format)) {
+        (s->sei.common.film_grain_characteristics.present &&
+         !ff_h274_film_grain_params_supported(s->sei.common.film_grain_characteristics.model_id,
+                                              s->ref->frame->format)
+         || !av_film_grain_params_select(s->ref->frame))) {
        av_log_once(s->avctx, AV_LOG_WARNING, AV_LOG_DEBUG, &s->film_grain_warning_shown,
                    "Unsupported film grain parameters. Ignoring film grain.\n");
        s->ref->needs_fg = 0;
@@ -2909,10 +2914,6 @@ static int hevc_frame_start(HEVCContext *s)
            goto fail;
    }

-    ret = set_side_data(s);
-    if (ret < 0)
-        goto fail;
-
    s->frame->pict_type = 3 - s->sh.slice_type;

    if (!IS_IRAP(s))
@@ -834,9 +834,6 @@ static int get_tlm(Jpeg2000DecoderContext *s, int n)
        case 2:
            bytestream2_get_be16(&s->g);
            break;
-        case 3:
-            bytestream2_get_be32(&s->g);
-            break;
        }
        if (SP == 0) {
            bytestream2_get_be16(&s->g);
@@ -1885,7 +1882,7 @@ static inline void roi_scale_cblk(Jpeg2000Cblk *cblk,
    }
 }

-static inline void tile_codeblocks(const Jpeg2000DecoderContext *s, Jpeg2000Tile *tile)
+static inline int tile_codeblocks(const Jpeg2000DecoderContext *s, Jpeg2000Tile *tile)
 {
    Jpeg2000T1Context t1;

@@ -1910,6 +1907,8 @@ static inline void tile_codeblocks(const Jpeg2000DecoderContext *s, Jpeg2000Tile
                int nb_precincts, precno;
                Jpeg2000Band *band = rlevel->band + bandno;
                int cblkno = 0, bandpos;
+                /* See Rec. ITU-T T.800, Equation E-2 */
+                int magp = quantsty->expn[subbandno] + quantsty->nguardbits - 1;

                bandpos = bandno + (reslevelno > 0);

@@ -1917,6 +1916,11 @@ static inline void tile_codeblocks(const Jpeg2000DecoderContext *s, Jpeg2000Tile
                    band->coord[1][0] == band->coord[1][1])
                    continue;

+                if ((codsty->cblk_style & JPEG2000_CTSY_HTJ2K_F) && magp >= 31) {
+                    avpriv_request_sample(s->avctx, "JPEG2000_CTSY_HTJ2K_F and magp >= 31");
+                    return AVERROR_PATCHWELCOME;
+                }
+
                nb_precincts = rlevel->num_precincts_x * rlevel->num_precincts_y;
                /* Loop on precincts */
                for (precno = 0; precno < nb_precincts; precno++) {
@@ -1927,8 +1931,6 @@ static inline void tile_codeblocks(const Jpeg2000DecoderContext *s, Jpeg2000Tile
                         cblkno < prec->nb_codeblocks_width * prec->nb_codeblocks_height;
                         cblkno++) {
                        int x, y, ret;
-                        /* See Rec. ITU-T T.800, Equation E-2 */
-                        int magp = quantsty->expn[subbandno] + quantsty->nguardbits - 1;

                        Jpeg2000Cblk *cblk = prec->cblk + cblkno;

@@ -1968,6 +1970,7 @@ static inline void tile_codeblocks(const Jpeg2000DecoderContext *s, Jpeg2000Tile
            ff_dwt_decode(&comp->dwt, codsty->transform == FF_DWT97 ? (void*)comp->f_data : (void*)comp->i_data);

    } /*end comp */
+    return 0;
 }

 #define WRITE_FRAME(D, PIXEL)                                                                     \
@@ -2044,7 +2047,9 @@ static int jpeg2000_decode_tile(AVCodecContext *avctx, void *td,
    AVFrame *picture = td;
    Jpeg2000Tile *tile = s->tile + jobnr;

-    tile_codeblocks(s, tile);
+    int ret = tile_codeblocks(s, tile);
+    if (ret < 0)
+        return ret;

    /* inverse MCT transformation */
    if (tile->codsty[0].mct)
@@ -1198,6 +1198,9 @@ ff_jpeg2000_decode_htj2k(const Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c
    av_assert0(width * height <= 4096);
    av_assert0(width * height > 0);

+    if (roi_shift)
+        avpriv_report_missing_feature(s->avctx, "ROI shift");
+
    memset(t1->data, 0, t1->stride * height * sizeof(*t1->data));
    memset(t1->flags, 0, t1->stride * (height + 2) * sizeof(*t1->flags));

@@ -25,13 +25,11 @@
 #if HAVE_FAST_64BIT
 typedef uint64_t uint_native;
 #define READ   AV_RN64
-#define READA  AV_RN64A
-#define WRITEA AV_WN64A
+#define WRITE  AV_WN64
 #else
 typedef uint32_t uint_native;
 #define READ   AV_RN32
-#define READA  AV_RN32A
-#define WRITEA AV_WN32A
+#define WRITE  AV_WN32
 #endif
 // 0x7f7f7f7f or 0x7f7f7f7f7f7f7f7f or whatever, depending on the cpu's native arithmetic size
 #define pb_7f (~(uint_native)0 / 255 * 0x7f)
@@ -56,9 +54,9 @@ static void diff_bytes_c(uint8_t *dst, const uint8_t *src1, const uint8_t *src2,
    } else
 #endif
    for (i = 0; i <= w - (int) sizeof(uint_native); i += sizeof(uint_native)) {
-        uint_native a = READA(src1 + i);
+        uint_native a = READ(src1 + i);
        uint_native b = READ(src2 + i);
-        WRITEA(dst + i, ((a | pb_80) - (b & pb_7f)) ^ ((a ^ b ^ pb_80) & pb_80));
+        WRITE(dst + i, ((a | pb_80) - (b & pb_7f)) ^ ((a ^ b ^ pb_80) & pb_80));
    }
    for (; i < w; i++)
        dst[i + 0] = src1[i + 0] - src2[i + 0];
@@ -23,8 +23,8 @@
 #include <stdint.h>

 typedef struct LLVidEncDSPContext {
-    void (*diff_bytes)(uint8_t *dst /* align 16 */,
-                       const uint8_t *src1 /* align 16 */,
+    void (*diff_bytes)(uint8_t *dst /* align 1 */,
+                       const uint8_t *src1 /* align 1 */,
                       const uint8_t *src2 /* align 1 */,
                       intptr_t w);
    /**
@@ -281,8 +281,10 @@ int ff_lpc_calc_coefs(LPCContext *s,
        double av_uninit(weight);
        memset(var, 0, FFALIGN(MAX_LPC_ORDER+1,4)*sizeof(*var));

-        for(j=0; j<max_order; j++)
-            m[0].coeff[max_order-1][j] = -lpc[max_order-1][j];
+        /* Avoids initializing with an unused value when lpc_passes == 1 */
+        if (lpc_passes > 1)
+            for(j=0; j<max_order; j++)
+                m[0].coeff[max_order-1][j] = -lpc[max_order-1][j];

        for(; pass<lpc_passes; pass++){
            avpriv_init_lls(&m[pass&1], max_order);
@@ -124,7 +124,7 @@ static void magicyuv_median_pred16(uint16_t *dst, const uint16_t *src1,
    x = 0; \
    for (; CACHED_BITSTREAM_READER && x < width-c && get_bits_left(&gb) > 0;) {\
        ret = get_vlc_multi(&gb, (uint8_t *)dst + x * b, multi, \
-                            vlc, vlc_bits, 3); \
+                            vlc, vlc_bits, 3, b); \
        if (ret <= 0) \
            return AVERROR_INVALIDDATA; \
        x += ret; \
@@ -533,7 +533,7 @@ static int mediacodec_encode(AVCodecContext *avctx, AVPacket *pkt)
                return 0;
        }

-        if (ret != AVERROR(EAGAIN))
+        if (ret < 0 && ret != AVERROR(EAGAIN))
            return ret;

        if (!s->frame->buf[0]) {
@@ -2733,7 +2733,7 @@ static int ipu_decode_frame(AVCodecContext *avctx, AVFrame *frame,
    int ret;

    // Check for minimal intra MB size (considering mb header, luma & chroma dc VLC, ac EOB VLC)
-    if (avpkt->size*8LL < (avctx->width+15)/16 * ((avctx->height+15)/16) * (2 + 3*4 + 2*2 + 2*6))
+    if (avpkt->size*8LL < (avctx->width+15)/16 * ((avctx->height+15)/16) * (2LL + 3*4 + 2*2 + 2*6))
        return AVERROR_INVALIDDATA;

    ret = ff_get_buffer(avctx, frame, 0);
@@ -597,6 +597,8 @@ static int mpeg4_decode_sprite_trajectory(Mpeg4DecContext *ctx, GetBitContext *g
        ctx->sprite_shift[0]  = alpha + beta + rho - min_ab;
        ctx->sprite_shift[1]  = alpha + beta + rho - min_ab + 2;
        break;
+    default:
+        av_assert0(0);
    }
    /* try to simplify the situation */
    if (sprite_delta[0][0] == a << ctx->sprite_shift[0] &&
@@ -1198,8 +1198,8 @@ static int load_input_picture(MpegEncContext *s, const AVFrame *pic_arg)
                ptrdiff_t dst_stride = i ? s->uvlinesize : s->linesize;
                int h_shift = i ? s->chroma_x_shift : 0;
                int v_shift = i ? s->chroma_y_shift : 0;
-                int w = s->width  >> h_shift;
-                int h = s->height >> v_shift;
+                int w = AV_CEIL_RSHIFT(s->width , h_shift);
+                int h = AV_CEIL_RSHIFT(s->height, v_shift);
                const uint8_t *src = pic_arg->data[i];
                uint8_t *dst = pic->f->data[i];
                int vpad = 16;
@@ -1433,7 +1433,7 @@ static int estimate_best_b_count(MpegEncContext *s)
                goto fail;
            }

-            rd += (out_size * lambda2) >> (FF_LAMBDA_SHIFT - 3);
+            rd += (out_size * (uint64_t)lambda2) >> (FF_LAMBDA_SHIFT - 3);
        }

        /* get the delayed frames */
@@ -1442,7 +1442,7 @@ static int estimate_best_b_count(MpegEncContext *s)
            ret = out_size;
            goto fail;
        }
-        rd += (out_size * lambda2) >> (FF_LAMBDA_SHIFT - 3);
+        rd += (out_size * (uint64_t)lambda2) >> (FF_LAMBDA_SHIFT - 3);

        rd += c->error[0] + c->error[1] + c->error[2];

@@ -53,6 +53,9 @@ static int rle_uncompress(AVCodecContext *avctx, GetByteContext *gb, PutByteCont
        unsigned run = bytestream2_get_byte(gb);

        if (run) {
+            if (bytestream2_get_bytes_left_p(pb) < run * s->bpp)
+                return AVERROR_INVALIDDATA;
+
            switch (avctx->bits_per_coded_sample) {
            case 8:
                fill = bytestream2_get_byte(gb);
@@ -101,6 +104,9 @@ static int rle_uncompress(AVCodecContext *avctx, GetByteContext *gb, PutByteCont

                bytestream2_seek_p(pb, y * avctx->width * s->bpp + x * s->bpp, SEEK_SET);
            } else {
+                if (bytestream2_get_bytes_left_p(pb) < copy * s->bpp)
+                    return AVERROR_INVALIDDATA;
+
                for (j = 0; j < copy; j++) {
                    switch (avctx->bits_per_coded_sample) {
                    case 8:
@@ -50,6 +50,10 @@ static int rle_uncompress(GetByteContext *gb, PutByteContext *pb, GetByteContext

        if (run == 0) {
            run = bytestream2_get_le32(gb);
+
+            if (bytestream2_tell_p(pb) + width - w < run)
+                return AVERROR_INVALIDDATA;
+
            for (int j = 0; j < run; j++, w++) {
                if (w == width) {
                    w = 0;
@@ -61,6 +65,10 @@ static int rle_uncompress(GetByteContext *gb, PutByteContext *pb, GetByteContext
            int pos = bytestream2_tell_p(pb);

            bytestream2_seek(gbp, pos, SEEK_SET);
+
+            if (pos + width - w < fill)
+                return AVERROR_INVALIDDATA;
+
            for (int j = 0; j < fill; j++, w++) {
                if (w == width) {
                    w = 0;
@@ -72,6 +80,9 @@ static int rle_uncompress(GetByteContext *gb, PutByteContext *pb, GetByteContext

            intra = 0;
        } else {
+            if (bytestream2_tell_p(pb) + width - w < run)
+                return AVERROR_INVALIDDATA;
+
            for (int j = 0; j < run; j++, w++) {
                if (w == width) {
                    w = 0;
@@ -664,6 +664,8 @@ int ff_nvdec_simple_end_frame(AVCodecContext *avctx)
    NVDECContext *ctx = avctx->internal->hwaccel_priv_data;
    int ret = ff_nvdec_end_frame(avctx);
    ctx->bitstream = NULL;
+    ctx->bitstream_len = 0;
+    ctx->nb_slices = 0;
    return ret;
 }

@@ -1255,6 +1255,11 @@ static av_cold int nvenc_setup_h264_config(AVCodecContext *avctx)

    h264->level = ctx->level;

+#ifdef NVENC_HAVE_NEW_BIT_DEPTH_API
+    h264->inputBitDepth = h264->outputBitDepth =
+        IS_10BIT(ctx->data_pix_fmt) ? NV_ENC_BIT_DEPTH_10 : NV_ENC_BIT_DEPTH_8;
+#endif
+
    if (ctx->coder >= 0)
        h264->entropyCodingMode = ctx->coder;

@@ -1370,7 +1375,12 @@ static av_cold int nvenc_setup_hevc_config(AVCodecContext *avctx)

    hevc->chromaFormatIDC = IS_YUV444(ctx->data_pix_fmt) ? 3 : 1;

+#ifdef NVENC_HAVE_NEW_BIT_DEPTH_API
+    hevc->inputBitDepth = hevc->outputBitDepth =
+        IS_10BIT(ctx->data_pix_fmt) ? NV_ENC_BIT_DEPTH_10 : NV_ENC_BIT_DEPTH_8;
+#else
    hevc->pixelBitDepthMinus8 = IS_10BIT(ctx->data_pix_fmt) ? 2 : 0;
+#endif

    hevc->level = ctx->level;

@@ -1455,8 +1465,13 @@ static av_cold int nvenc_setup_av1_config(AVCodecContext *avctx)

    av1->chromaFormatIDC = IS_YUV444(ctx->data_pix_fmt) ? 3 : 1;

+#ifdef NVENC_HAVE_NEW_BIT_DEPTH_API
+    av1->inputBitDepth = IS_10BIT(ctx->data_pix_fmt) ? NV_ENC_BIT_DEPTH_10 : NV_ENC_BIT_DEPTH_8;
+    av1->outputBitDepth = (IS_10BIT(ctx->data_pix_fmt) || ctx->highbitdepth) ? NV_ENC_BIT_DEPTH_10 : NV_ENC_BIT_DEPTH_8;
+#else
    av1->inputPixelBitDepthMinus8 = IS_10BIT(ctx->data_pix_fmt) ? 2 : 0;
    av1->pixelBitDepthMinus8 = (IS_10BIT(ctx->data_pix_fmt) || ctx->highbitdepth) ? 2 : 0;
+#endif

    if (ctx->b_ref_mode >= 0)
        av1->useBFramesAsRef = ctx->b_ref_mode;
@@ -1689,15 +1704,15 @@ static NV_ENC_BUFFER_FORMAT nvenc_map_buffer_format(enum AVPixelFormat pix_fmt)
 {
    switch (pix_fmt) {
    case AV_PIX_FMT_YUV420P:
-        return NV_ENC_BUFFER_FORMAT_YV12_PL;
+        return NV_ENC_BUFFER_FORMAT_YV12;
    case AV_PIX_FMT_NV12:
-        return NV_ENC_BUFFER_FORMAT_NV12_PL;
+        return NV_ENC_BUFFER_FORMAT_NV12;
    case AV_PIX_FMT_P010:
    case AV_PIX_FMT_P016:
        return NV_ENC_BUFFER_FORMAT_YUV420_10BIT;
    case AV_PIX_FMT_GBRP:
    case AV_PIX_FMT_YUV444P:
-        return NV_ENC_BUFFER_FORMAT_YUV444_PL;
+        return NV_ENC_BUFFER_FORMAT_YUV444;
    case AV_PIX_FMT_GBRP16:
    case AV_PIX_FMT_YUV444P16:
        return NV_ENC_BUFFER_FORMAT_YUV444_10BIT;
@@ -83,6 +83,11 @@ typedef void ID3D11Device;
 #define NVENC_NO_DEPRECATED_RC
 #endif

+// SDK 12.2 compile time feature checks
+#if NVENCAPI_CHECK_VERSION(12, 2)
+#define NVENC_HAVE_NEW_BIT_DEPTH_API
+#endif
+
 typedef struct NvencSurface
 {
    NV_ENC_INPUT_PTR input_surface;
@@ -1216,7 +1216,7 @@ static int decode_fctl_chunk(AVCodecContext *avctx, PNGDecContext *s,
        return AVERROR_INVALIDDATA;
    }

-    if ((sequence_number == 0 || !s->last_picture.f->data[0]) &&
+    if ((sequence_number == 0 || !s->last_picture.f) &&
        dispose_op == APNG_DISPOSE_OP_PREVIOUS) {
        // No previous frame to revert to for the first frame
        // Spec says to just treat it as a APNG_DISPOSE_OP_BACKGROUND
@@ -663,7 +663,7 @@ void weight_h264_W_altivec(uint8_t *block, int stride, int height,
    DECLARE_ALIGNED(16, int32_t, temp)[4];
    LOAD_ZERO;

-    offset <<= log2_denom;
+    offset *= 1 << log2_denom;
    if(log2_denom) offset += 1<<(log2_denom-1);
    temp[0] = log2_denom;
    temp[1] = weight;
@@ -712,7 +712,7 @@ void biweight_h264_W_altivec(uint8_t *dst, uint8_t *src, int stride, int height,
    DECLARE_ALIGNED(16, int32_t, temp)[4];
    LOAD_ZERO;

-    offset = ((offset + 1) | 1) << log2_denom;
+    offset = ((offset + 1) | 1) * (1 << log2_denom);
    temp[0] = log2_denom+1;
    temp[1] = weights;
    temp[2] = weightd;
@@ -378,9 +378,12 @@ static int qsv_decode_init_context(AVCodecContext *avctx, QSVContext *q, mfxVide

    q->frame_info = param->mfx.FrameInfo;

-    if (!avctx->hw_frames_ctx)
-        q->pool = av_buffer_pool_init(av_image_get_buffer_size(avctx->pix_fmt,
-                    FFALIGN(avctx->width, 128), FFALIGN(avctx->height, 64), 1), av_buffer_allocz);
+    if (!avctx->hw_frames_ctx) {
+        ret = av_image_get_buffer_size(avctx->pix_fmt, FFALIGN(avctx->width, 128), FFALIGN(avctx->height, 64), 1);
+        if (ret < 0)
+            return ret;
+        q->pool = av_buffer_pool_init(ret, av_buffer_allocz);
+    }
    return 0;
 }

@@ -55,11 +55,11 @@ func ff_flac_lpc32_rvv, zve32x
        vle32.v v16, (a0)
        sh2add  a0, a2, a0
 1:
-        vsetvli zero, a2, e32, m4, ta, ma
+        vsetvli t1, zero, e32, m4, ta, ma
        vwmul.vv v24, v8, v16
        vsetvli zero, t2, e32, m4, tu, ma
        vwmacc.vv v24, v12, v20
-        vsetvli zero, a2, e64, m8, ta, ma
+        vsetvli t1, zero, e64, m8, ta, ma
        vredsum.vs v24, v24, v0
        lw      t0, (a0)
        addi    a4, a4, -1
@@ -120,7 +120,7 @@ static int build_huff(UtvideoContext *c, const uint8_t *src, VLC *vlc,
    i = 0; \
    for (; CACHED_BITSTREAM_READER && i < width-end && get_bits_left(&gb) > 0;) {\
        ret = get_vlc_multi(&gb, (uint8_t *)buf + i * b, multi.table, \
-                            vlc.table, VLC_BITS, 3); \
+                            vlc.table, VLC_BITS, 3, b); \
        if (ret > 0) \
            i += ret; \
        if (ret <= 0) \
@@ -220,7 +220,7 @@ static int vaapi_av1_start_frame(AVCodecContext *avctx,
            .error_resilient_mode         = frame_header->error_resilient_mode,
            .disable_cdf_update           = frame_header->disable_cdf_update,
            .allow_screen_content_tools   = frame_header->allow_screen_content_tools,
-            .force_integer_mv             = frame_header->force_integer_mv,
+            .force_integer_mv             = s->cur_frame.force_integer_mv,
            .allow_intrabc                = frame_header->allow_intrabc,
            .use_superres                 = frame_header->use_superres,
            .allow_high_precision_mv      = frame_header->allow_high_precision_mv,
@@ -1805,9 +1805,17 @@ static av_cold int vaapi_encode_init_rate_control(AVCodecContext *avctx)
        int i, first = 1, res;

        supported_va_rc_modes = rc_attr.value;
-        if (ctx->blbrc && !(supported_va_rc_modes & VA_RC_MB)) {
+        if (ctx->blbrc) {
+#if VA_CHECK_VERSION(0, 39, 2)
+            if (!(supported_va_rc_modes & VA_RC_MB)) {
+                ctx->blbrc = 0;
+                av_log(avctx, AV_LOG_WARNING, "Driver does not support BLBRC.\n");
+            }
+#else
            ctx->blbrc = 0;
-            av_log(avctx, AV_LOG_WARNING, "Driver does not support BLBRC.\n");
+            av_log(avctx, AV_LOG_WARNING, "Please consider to update to VAAPI 0.39.2 "
+                   "or above, which can support BLBRC.\n");
+#endif
        }

        for (i = 0; i < FF_ARRAY_ELEMS(vaapi_encode_rc_modes); i++) {
@@ -1961,7 +1969,10 @@ rc_mode_found:
        if (ctx->explicit_qp) {
            rc_quality = ctx->explicit_qp;
        } else if (avctx->global_quality > 0) {
-            rc_quality = avctx->global_quality;
+            if (avctx->flags & AV_CODEC_FLAG_QSCALE)
+                rc_quality = avctx->global_quality / FF_QP2LAMBDA;
+            else
+                rc_quality = avctx->global_quality;
        } else {
            rc_quality = ctx->codec->default_quality;
            av_log(avctx, AV_LOG_WARNING, "No quality level set; "
@@ -2032,7 +2043,11 @@ rc_mode_found:
        ctx->config_attributes[ctx->nb_config_attributes++] =
            (VAConfigAttrib) {
            .type  = VAConfigAttribRateControl,
+#if VA_CHECK_VERSION(0, 39, 2)
            .value = ctx->blbrc ? ctx->va_rc_mode | VA_RC_MB : ctx->va_rc_mode,
+#else
+            .value = ctx->va_rc_mode,
+#endif
        };
    }

@@ -2061,10 +2076,12 @@ rc_mode_found:
 #if VA_CHECK_VERSION(1, 1, 0)
            .ICQ_quality_factor = av_clip(rc_quality, 1, 51),
            .max_qp             = (avctx->qmax > 0 ? avctx->qmax : 0),
-            .rc_flags.bits.mb_rate_control = ctx->blbrc ? 1 : 2,
 #endif
 #if VA_CHECK_VERSION(1, 3, 0)
            .quality_factor     = rc_quality,
+#endif
+#if VA_CHECK_VERSION(0, 39, 2)
+            .rc_flags.bits.mb_rate_control = ctx->blbrc ? 1 : 2,
 #endif
        };
        vaapi_encode_add_global_param(avctx,
@@ -191,6 +191,9 @@ static av_cold int vble_decode_init(AVCodecContext *avctx)
    ctx->size = av_image_get_buffer_size(avctx->pix_fmt,
                                         avctx->width, avctx->height, 1);

+    if (ctx->size < 0)
+        return ctx->size;
+
    ctx->val = av_malloc_array(ctx->size, sizeof(*ctx->val));

    if (!ctx->val) {
@@ -499,7 +499,10 @@ static int vlc_multi_gen(VLC_MULTI_ELEM *table, const VLC *single,
    for (int j = 0; j < 1<<numbits; j++) {
        table[j].len = single->table[j].len;
        table[j].num = single->table[j].len > 0 ? 1 : 0;
-        AV_WN16(table[j].val, single->table[j].sym);
+        if (is16bit)
+            AV_WN16(table[j].val, single->table[j].sym);
+        else
+            table[j].val[0] = single->table[j].sym;
    }

    add_level(table, is16bit, nb_codes, numbits, buf,
@@ -2007,8 +2007,7 @@ static int vp4_mc_loop_filter(Vp3DecodeContext *s, int plane, int motion_x, int
        x_offset = (-(x + 2) & 7) + 2;
        y_offset = (-(y + 2) & 7) + 2;

-        if (x_offset > 8 + x_subpel && y_offset > 8 + y_subpel)
-            return 0;
+        av_assert1(!(x_offset > 8 + x_subpel && y_offset > 8 + y_subpel));

        s->vdsp.emulated_edge_mc(loop, motion_source - stride - 1,
             loop_stride, stride,
@@ -106,8 +106,11 @@ static int vp8_alloc_frame(VP8Context *s, VP8Frame *f, int ref)
    if ((ret = ff_thread_get_ext_buffer(s->avctx, &f->tf,
                                        ref ? AV_GET_BUFFER_FLAG_REF : 0)) < 0)
        return ret;
-    if (!(f->seg_map = ff_refstruct_allocz(s->mb_width * s->mb_height)))
+    f->seg_map = ff_refstruct_allocz(s->mb_width * s->mb_height);
+    if (!f->seg_map) {
+        ret = AVERROR(ENOMEM);
        goto fail;
+    }
    ret = ff_hwaccel_frame_priv_alloc(s->avctx, &f->hwaccel_picture_private);
    if (ret < 0)
        goto fail;
@@ -354,9 +357,8 @@ static int setup_partitions(VP8Context *s, const uint8_t *buf, int buf_size)
    }

    s->coeff_partition_size[i] = buf_size;
-    ff_vpx_init_range_decoder(&s->coeff_partition[i], buf, buf_size);

-    return 0;
+    return ff_vpx_init_range_decoder(&s->coeff_partition[i], buf, buf_size);
 }

 static void vp7_get_quants(VP8Context *s)
@@ -146,10 +146,13 @@ static int decode_vectors(VqcContext * s, const uint8_t * buf, int size, int wid
    GetBitContext gb;
    uint8_t * vectors = s->vectors;
    uint8_t * vectors_end = s->vectors + (width * height * 3) / 2;
+    int ret;

    memset(vectors, 0, 3 * width * height / 2);

-    init_get_bits8(&gb, buf, size);
+    ret = init_get_bits8(&gb, buf, size);
+    if (ret < 0)
+        return ret;

    for (int i = 0; i < 3 * width * height / 2 / 32; i++) {
        uint8_t * dst = vectors;
@@ -76,7 +76,7 @@ static int vk_av1_fill_pict(AVCodecContext *avctx, const AV1Frame **ref_src,
                            StdVideoDecodeAV1ReferenceInfo *vkav1_std_ref,
                            VkVideoDecodeAV1DpbSlotInfoKHR *vkav1_ref, /* Goes in ^ */
                            const AV1Frame *pic, int is_current, int has_grain,
-                            int *saved_order_hints)
+                            const uint8_t *saved_order_hints)
 {
    FFVulkanDecodeContext *dec = avctx->internal->hwaccel_priv_data;
    AV1VulkanDecodePicture *hp = pic->hwaccel_picture_private;
@@ -97,9 +97,14 @@ static int vk_av1_fill_pict(AVCodecContext *avctx, const AV1Frame **ref_src,
        .RefFrameSignBias = hp->ref_frame_sign_bias_mask,
    };

-    if (saved_order_hints)
-        for (int i = 0; i < AV1_TOTAL_REFS_PER_FRAME; i++)
-            vkav1_std_ref->SavedOrderHints[i] = saved_order_hints[i];
+    if (saved_order_hints) {
+        if (dec->quirk_av1_offset)
+            for (int i = 1; i < STD_VIDEO_AV1_TOTAL_REFS_PER_FRAME; i++)
+                vkav1_std_ref->SavedOrderHints[i - 1] = saved_order_hints[i];
+        else
+            for (int i = 0; i < STD_VIDEO_AV1_TOTAL_REFS_PER_FRAME; i++)
+                vkav1_std_ref->SavedOrderHints[i] = saved_order_hints[i];
+    }

    *vkav1_ref = (VkVideoDecodeAV1DpbSlotInfoKHR) {
        .sType = VK_STRUCTURE_TYPE_VIDEO_DECODE_AV1_DPB_SLOT_INFO_KHR,
@@ -242,7 +247,6 @@ static int vk_av1_start_frame(AVCodecContext          *avctx,

    const AV1RawFrameHeader *frame_header = s->raw_frame_header;
    const AV1RawFilmGrainParams *film_grain = &s->cur_frame.film_grain;
-    CodedBitstreamAV1Context *cbs_ctx = (CodedBitstreamAV1Context *)(s->cbc->priv_data);

    const int apply_grain = !(avctx->export_side_data & AV_CODEC_EXPORT_DATA_FILM_GRAIN) &&
                            film_grain->apply_grain;
@@ -272,7 +276,7 @@ static int vk_av1_start_frame(AVCodecContext          *avctx,

    ap->ref_frame_sign_bias_mask = 0x0;
    for (int i = 0; i < STD_VIDEO_AV1_TOTAL_REFS_PER_FRAME; i++)
-        ap->ref_frame_sign_bias_mask |= cbs_ctx->ref_frame_sign_bias[i] << i;
+        ap->ref_frame_sign_bias_mask |= pic->ref_frame_sign_bias[i] << i;

    for (int i = 0; i < STD_VIDEO_AV1_REFS_PER_FRAME; i++) {
        const int idx = pic->raw_frame_header->ref_frame_idx[i];
@@ -294,7 +298,7 @@ static int vk_av1_start_frame(AVCodecContext          *avctx,

        err = vk_av1_fill_pict(avctx, &ap->ref_src[ref_count], &vp->ref_slots[ref_count],
                               &vp->refs[ref_count], &ap->std_refs[ref_count], &ap->vkav1_refs[ref_count],
-                               ref_frame, 0, 0, cbs_ctx->ref[idx].saved_order_hints);
+                               ref_frame, 0, 0, ref_frame->order_hints);
        if (err < 0)
            return err;

@@ -431,7 +435,7 @@ static int vk_av1_start_frame(AVCodecContext          *avctx,
            .render_and_frame_size_different = frame_header->render_and_frame_size_different,
            .allow_screen_content_tools = frame_header->allow_screen_content_tools,
            .is_filter_switchable = frame_header->is_filter_switchable,
-            .force_integer_mv = frame_header->force_integer_mv,
+            .force_integer_mv = pic->force_integer_mv,
            .frame_size_override_flag = frame_header->frame_size_override_flag,
            .buffer_removal_time_present_flag = frame_header->buffer_removal_time_present_flag,
            .allow_intrabc = frame_header->allow_intrabc,
@@ -491,8 +495,20 @@ static int vk_av1_start_frame(AVCodecContext          *avctx,
        }
    }

-    for (int i = 0; i < STD_VIDEO_AV1_TOTAL_REFS_PER_FRAME; i++)
+    if (dec->quirk_av1_offset)
+        for (int i = 1; i < STD_VIDEO_AV1_TOTAL_REFS_PER_FRAME; i++)
+            ap->std_pic_info.OrderHints[i - 1] = pic->order_hints[i];
+    else
+        for (int i = 0; i < STD_VIDEO_AV1_TOTAL_REFS_PER_FRAME; i++)
+            ap->std_pic_info.OrderHints[i] = pic->order_hints[i];
+
+    for (int i = 0; i < STD_VIDEO_AV1_TOTAL_REFS_PER_FRAME; i++) {
        ap->loop_filter.loop_filter_ref_deltas[i] = frame_header->loop_filter_ref_deltas[i];
+        ap->global_motion.GmType[i] = s->cur_frame.gm_type[i];
+        for (int j = 0; j < STD_VIDEO_AV1_GLOBAL_MOTION_PARAMS; j++) {
+            ap->global_motion.gm_params[i][j] = s->cur_frame.gm_params[i][j];
+        }
+    }

    for (int i = 0; i < STD_VIDEO_AV1_MAX_CDEF_FILTER_STRENGTHS; i++) {
        ap->cdef.cdef_y_pri_strength[i] = frame_header->cdef_y_pri_strength[i];
@@ -501,14 +517,6 @@ static int vk_av1_start_frame(AVCodecContext          *avctx,
        ap->cdef.cdef_uv_sec_strength[i] = frame_header->cdef_uv_sec_strength[i];
    }

-    for (int i = 0; i < STD_VIDEO_AV1_NUM_REF_FRAMES; i++) {
-        ap->std_pic_info.OrderHints[i] = frame_header->ref_order_hint[i];
-        ap->global_motion.GmType[i] = s->cur_frame.gm_type[i];
-        for (int j = 0; j < STD_VIDEO_AV1_GLOBAL_MOTION_PARAMS; j++) {
-            ap->global_motion.gm_params[i][j] = s->cur_frame.gm_params[i][j];
-        }
-    }
-
    if (apply_grain) {
        for (int i = 0; i < STD_VIDEO_AV1_MAX_NUM_Y_POINTS; i++) {
            ap->film_grain.point_y_value[i] = film_grain->point_y_value[i];
@@ -1114,6 +1114,7 @@ int ff_vk_decode_init(AVCodecContext *avctx)
    FFVulkanFunctions *vk;
    const VkVideoProfileInfoKHR *profile;
    const FFVulkanDecodeDescriptor *vk_desc;
+    const VkPhysicalDeviceDriverProperties *driver_props;

    VkVideoDecodeH264SessionParametersCreateInfoKHR h264_params = {
        .sType = VK_STRUCTURE_TYPE_VIDEO_DECODE_H264_SESSION_PARAMETERS_CREATE_INFO_KHR,
@@ -1275,6 +1276,14 @@ int ff_vk_decode_init(AVCodecContext *avctx)
        return AVERROR_EXTERNAL;
    }

+    driver_props = &dec->shared_ctx->s.driver_props;
+    if (driver_props->driverID == VK_DRIVER_ID_NVIDIA_PROPRIETARY &&
+        driver_props->conformanceVersion.major == 1 &&
+        driver_props->conformanceVersion.minor == 3 &&
+        driver_props->conformanceVersion.subminor == 8 &&
+        driver_props->conformanceVersion.patch < 3)
+        dec->quirk_av1_offset = 1;
+
    ff_vk_decode_flush(avctx);

    av_log(avctx, AV_LOG_VERBOSE, "Vulkan decoder initialization sucessful\n");
@@ -72,6 +72,10 @@ typedef struct FFVulkanDecodeContext {
    int external_fg;   /* Oddity  #2 - hardware can't apply film grain */
    uint32_t frame_id_alloc_mask; /* For AV1 only */

+    /* Workaround for NVIDIA drivers tested with CTS version 1.3.8 for AV1.
+     * The tests were incorrect as the OrderHints were offset by 1. */
+    int quirk_av1_offset;
+
    /* Thread-local state below */
    struct HEVCHeaderSet *hevc_headers;
    size_t hevc_headers_size;
@@ -454,7 +454,8 @@ int ff_vvc_slice_rpl(VVCContext *s, VVCFrameContext *fc, SliceContext *sc)
                if (ret < 0)
                    return ret;
            } else {
-                avpriv_request_sample(fc->log_ctx, "Inter layer ref");
+                // OPI_B_3.bit and VPS_A_3.bit should cover this
+                avpriv_report_missing_feature(fc->log_ctx, "Inter layer ref");
                ret = AVERROR_PATCHWELCOME;
                return ret;
            }
@@ -511,6 +511,7 @@ static int slice_init_entry_points(SliceContext *sc,
    int nb_eps                = sh->r->num_entry_points + 1;
    int ctu_addr              = 0;
    GetBitContext gb;
+    int ret;

    if (sc->nb_eps != nb_eps) {
        eps_free(sc);
@@ -520,7 +521,9 @@ static int slice_init_entry_points(SliceContext *sc,
        sc->nb_eps = nb_eps;
    }

-    init_get_bits8(&gb, slice->data, slice->data_size);
+    ret = init_get_bits8(&gb, slice->data, slice->data_size);
+    if (ret < 0)
+        return ret;
    for (int i = 0; i < sc->nb_eps; i++)
    {
        EntryPoint *ep = sc->eps + i;
@@ -782,6 +785,12 @@ static int decode_nal_unit(VVCContext *s, VVCFrameContext *fc, const H2645NAL *n

    s->temporal_id = nal->temporal_id;

+    if (nal->nuh_layer_id > 0) {
+        avpriv_report_missing_feature(fc->log_ctx,
+                "Decoding of multilayer bitstreams");
+        return AVERROR_PATCHWELCOME;
+    }
+
    switch (unit->type) {
    case VVC_VPS_NUT:
    case VVC_SPS_NUT:
@@ -939,6 +948,9 @@ static int vvc_decode_frame(AVCodecContext *avctx, AVFrame *output,
    if (ret < 0)
        return ret;

+    if (!fc->ft)
+        return avpkt->size;
+
    ret = submit_frame(s, fc, output, got_output);
    if (ret < 0)
        return ret;
@@ -648,7 +648,7 @@ static int decode_5elp(AVCodecContext *avctx,
                for (int o = 0; o < order; o++)
                    sum += s->filter[ch][o] * (unsigned)samples[n + 70 - o - 1];

-                samples[n + 70] += ac_out[n] + (sum >> 4);
+                samples[n + 70] += ac_out[n] + (unsigned)(sum >> 4);
            }

            for (int n = 0; n < 70; n++)
@@ -690,7 +690,7 @@ static int decode_5elp(AVCodecContext *avctx,
                for (int o = 0; o < order; o++)
                    sum += s->filter[ch][o] * (unsigned)samples[n + 70 - o - 1];

-                samples[n + 70] += ac_out[n] + (sum >> 4);
+                samples[n + 70] += ac_out[n] + (unsigned)(sum >> 4);
            }

            for (int n = 0; n < 70; n++)
@@ -973,9 +973,11 @@ static inline int wv_unpack_mono(WavpackFrameContext *s, GetBitContext *gb,

 static av_cold int wv_alloc_frame_context(WavpackContext *c)
 {
-    c->fdec = av_realloc_f(c->fdec, c->fdec_num + 1, sizeof(*c->fdec));
-    if (!c->fdec)
+    WavpackFrameContext **fdec = av_realloc_array(c->fdec, c->fdec_num + 1, sizeof(*c->fdec));
+
+    if (!fdec)
        return -1;
+    c->fdec = fdec;

    c->fdec[c->fdec_num] = av_mallocz(sizeof(**c->fdec));
    if (!c->fdec[c->fdec_num])
@@ -1095,11 +1097,6 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
    }

    s = wc->fdec[block_no];
-    if (!s) {
-        av_log(avctx, AV_LOG_ERROR, "Context for block %d is not present\n",
-               block_no);
-        return AVERROR_INVALIDDATA;
-    }

    memset(s->decorr, 0, MAX_TERMS * sizeof(Decorr));
    memset(s->ch, 0, sizeof(s->ch));
@@ -53,7 +53,7 @@ av_cold void ff_vp3dsp_init_x86(VP3DSPContext *c, int flags)

        if (!(flags & AV_CODEC_FLAG_BITEXACT)) {
            c->v_loop_filter = c->v_loop_filter_unaligned = ff_vp3_v_loop_filter_mmxext;
-            c->h_loop_filter = c->v_loop_filter_unaligned = ff_vp3_h_loop_filter_mmxext;
+            c->h_loop_filter = c->h_loop_filter_unaligned = ff_vp3_h_loop_filter_mmxext;
        }
    }

@@ -107,10 +107,10 @@ struct video_data {
    int (*open_f)(const char *file, int oflag, ...);
    int (*close_f)(int fd);
    int (*dup_f)(int fd);
-#ifdef __GLIBC__
-    int (*ioctl_f)(int fd, unsigned long int request, ...);
-#else
+#if defined(__sun) || defined(__BIONIC__) || defined(__musl__) /* POSIX-like */
    int (*ioctl_f)(int fd, int request, ...);
+#else
+    int (*ioctl_f)(int fd, unsigned long int request, ...);
 #endif
    ssize_t (*read_f)(int fd, void *buffer, size_t n);
    void *(*mmap_f)(void *start, size_t length, int prot, int flags, int fd, int64_t offset);
@@ -794,6 +794,10 @@ static int reduce_formats_on_filter(AVFilterContext *filter)
                   nb_formats, ff_add_format);
    REDUCE_FORMATS(int,      AVFilterFormats,        samplerates,     formats,
                   nb_formats, ff_add_format);
+    REDUCE_FORMATS(int,      AVFilterFormats,        color_spaces,    formats,
+                   nb_formats, ff_add_format);
+    REDUCE_FORMATS(int,      AVFilterFormats,        color_ranges,    formats,
+                   nb_formats, ff_add_format);

    /* reduce channel layouts */
    for (i = 0; i < filter->nb_inputs; i++) {
@@ -906,82 +910,6 @@ static void swap_samplerates(AVFilterGraph *graph)
        swap_samplerates_on_filter(graph->filters[i]);
 }

-static void swap_color_spaces_on_filter(AVFilterContext *filter)
-{
-    AVFilterLink *link = NULL;
-    enum AVColorSpace csp;
-    int i;
-
-    for (i = 0; i < filter->nb_inputs; i++) {
-        link = filter->inputs[i];
-        if (link->type == AVMEDIA_TYPE_VIDEO &&
-            link->outcfg.color_spaces->nb_formats == 1)
-            break;
-    }
-    if (i == filter->nb_inputs)
-        return;
-
-    csp = link->outcfg.color_spaces->formats[0];
-
-    for (i = 0; i < filter->nb_outputs; i++) {
-        AVFilterLink *outlink = filter->outputs[i];
-        if (outlink->type != AVMEDIA_TYPE_VIDEO)
-            continue;
-        /* there is no meaningful 'score' between different yuv matrices,
-         * so just prioritize an exact match if it exists */
-        for (int j = 0; j < outlink->incfg.color_spaces->nb_formats; j++) {
-            if (csp == outlink->incfg.color_spaces->formats[j]) {
-                FFSWAP(int, outlink->incfg.color_spaces->formats[0],
-                       outlink->incfg.color_spaces->formats[j]);
-                break;
-            }
-        }
-    }
-}
-
-static void swap_color_spaces(AVFilterGraph *graph)
-{
-    for (int i = 0; i < graph->nb_filters; i++)
-        swap_color_spaces_on_filter(graph->filters[i]);
-}
-
-static void swap_color_ranges_on_filter(AVFilterContext *filter)
-{
-    AVFilterLink *link = NULL;
-    enum AVColorRange range;
-    int i;
-
-    for (i = 0; i < filter->nb_inputs; i++) {
-        link = filter->inputs[i];
-        if (link->type == AVMEDIA_TYPE_VIDEO &&
-            link->outcfg.color_ranges->nb_formats == 1)
-            break;
-    }
-    if (i == filter->nb_inputs)
-        return;
-
-    range = link->outcfg.color_ranges->formats[0];
-
-    for (i = 0; i < filter->nb_outputs; i++) {
-        AVFilterLink *outlink = filter->outputs[i];
-        if (outlink->type != AVMEDIA_TYPE_VIDEO)
-            continue;
-        for (int j = 0; j < outlink->incfg.color_ranges->nb_formats; j++) {
-            if (range == outlink->incfg.color_ranges->formats[j]) {
-                FFSWAP(int, outlink->incfg.color_ranges->formats[0],
-                       outlink->incfg.color_ranges->formats[j]);
-                break;
-            }
-        }
-    }
-}
-
-static void swap_color_ranges(AVFilterGraph *graph)
-{
-    for (int i = 0; i < graph->nb_filters; i++)
-        swap_color_ranges_on_filter(graph->filters[i]);
-}
-
 #define CH_CENTER_PAIR (AV_CH_FRONT_LEFT_OF_CENTER | AV_CH_FRONT_RIGHT_OF_CENTER)
 #define CH_FRONT_PAIR  (AV_CH_FRONT_LEFT           | AV_CH_FRONT_RIGHT)
 #define CH_STEREO_PAIR (AV_CH_STEREO_LEFT          | AV_CH_STEREO_RIGHT)
@@ -1258,10 +1186,6 @@ static int graph_config_formats(AVFilterGraph *graph, void *log_ctx)
    if ((ret = reduce_formats(graph)) < 0)
        return ret;

-    /* for video filters, ensure that the best colorspace metadata is selected */
-    swap_color_spaces(graph);
-    swap_color_ranges(graph);
-
    /* for audio filters, ensure the best format, sample rate and channel layout
     * is selected */
    swap_sample_fmts(graph);
@@ -1486,7 +1410,7 @@ int avfilter_graph_request_oldest(AVFilterGraph *graph)
        if (r == AVERROR(EAGAIN) &&
            !oldest->frame_wanted_out && !oldesti->frame_blocked_in &&
            !oldesti->status_in)
-            ff_request_frame(oldest);
+            (void)ff_request_frame(oldest);
        else if (r < 0)
            return r;
    }
@@ -507,7 +507,7 @@ static int config_props(AVFilterLink *link)
        }
        break;
    case AVMEDIA_TYPE_AUDIO:
-        if (!c->ch_layout.nb_channels) {
+        if (!c->ch_layout.nb_channels || c->ch_layout.order == AV_CHANNEL_ORDER_UNSPEC) {
            int ret = av_channel_layout_copy(&c->ch_layout, &link->ch_layout);
            if (ret < 0)
                return ret;
@@ -150,6 +150,13 @@ static int config_input(AVFilterLink *inlink)
    return 0;
 }

+static int config_output_video(AVFilterLink *outlink)
+{
+    outlink->frame_rate = (AVRational){ 1, 0 };
+
+    return 0;
+}
+
 #define BUF_SIZE 64

 static inline char *double2int64str(char *buf, double v)
@@ -198,6 +205,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *frame)

    d = eval_pts(setpts, inlink, frame, frame->pts);
    frame->pts = D2TS(d);
+    frame->duration = 0;

    av_log(inlink->dst, AV_LOG_TRACE,
            "N:%"PRId64" PTS:%s T:%f",
@@ -322,6 +330,14 @@ static const AVFilterPad avfilter_vf_setpts_inputs[] = {
    },
 };

+static const AVFilterPad outputs_video[] = {
+    {
+        .name         = "default",
+        .type         = AVMEDIA_TYPE_VIDEO,
+        .config_props = config_output_video,
+    },
+};
+
 const AVFilter ff_vf_setpts = {
    .name            = "setpts",
    .description     = NULL_IF_CONFIG_SMALL("Set PTS for the output video frame."),
@@ -335,7 +351,7 @@ const AVFilter ff_vf_setpts = {
    .priv_class = &setpts_class,

    FILTER_INPUTS(avfilter_vf_setpts_inputs),
-    FILTER_OUTPUTS(ff_video_default_filterpad),
+    FILTER_OUTPUTS(outputs_video),
 };
 #endif /* CONFIG_SETPTS_FILTER */

@@ -447,14 +447,14 @@ static MatchingInfo evaluate_parameters(AVFilterContext *ctx, SignatureContext *
                }

                if (tolerancecount > 2) {
-                    a = aprev;
-                    b = bprev;
                    if (dir == DIR_NEXT) {
                        /* turn around */
                        a = infos->first;
                        b = infos->second;
                        dir = DIR_PREV;
                    } else {
+                        a = aprev;
+                        b = bprev;
                        break;
                    }
                }
@@ -495,10 +495,10 @@ static MatchingInfo evaluate_parameters(AVFilterContext *ctx, SignatureContext *
            continue; /* matching sequence is too short */
        if ((double) goodfcount / (double) fcount < sc->thit)
            continue;
-        if ((double) goodfcount*0.5 < FFMAX(gooda, goodb))
+        if ((double) goodfcount*0.5 <= FFMAX(gooda, goodb))
            continue;

-        meandist = (double) goodfcount / (double) distsum;
+        meandist = (double) distsum / (double) goodfcount;

        if (meandist < minmeandist ||
                status == (STATUS_END_REACHED | STATUS_BEGIN_REACHED) ||
@@ -379,6 +379,9 @@ static int xml_export(AVFilterContext *ctx, StreamContext *sc, const char* filen
    FILE* f;
    unsigned int pot3[5] = { 3*3*3*3, 3*3*3, 3*3, 3, 1 };

+    if (!sc->coarseend->last)
+        return AVERROR(EINVAL); // No frames ?
+
    f = avpriv_fopen_utf8(filename, "w");
    if (!f) {
        int err = AVERROR(EINVAL);
@@ -290,7 +290,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *frame)
            hist[i] = 4 * hist[i];
    }

-    CHECK_CU(cu->cuCtxPopCurrent(&dummy));
+    ret = CHECK_CU(cu->cuCtxPopCurrent(&dummy));
    if (ret < 0)
        return ret;

@@ -723,11 +723,12 @@ OBJS-$(CONFIG_LIBSSH_PROTOCOL)           += libssh.o
 OBJS-$(CONFIG_LIBZMQ_PROTOCOL)           += libzmq.o

 # Objects duplicated from other libraries for shared builds
-SHLIBOBJS                                += log2_tab.o to_upper4.o
+SHLIBOBJS                                += log2_tab.o to_upper4.o bitstream.o
 SHLIBOBJS-$(CONFIG_ISO_MEDIA)            += mpegaudiotabs.o
 SHLIBOBJS-$(CONFIG_FLV_MUXER)            += mpeg4audio_sample_rates.o
 SHLIBOBJS-$(CONFIG_HLS_DEMUXER)          += ac3_channel_layout_tab.o
 SHLIBOBJS-$(CONFIG_IMAGE_JPEGXL_PIPE_DEMUXER)    += jpegxl_parse.o
+SHLIBOBJS-$(CONFIG_JNI)                  += ffjni.o
 SHLIBOBJS-$(CONFIG_JPEGXL_ANIM_DEMUXER)  += jpegxl_parse.o
 SHLIBOBJS-$(CONFIG_MATROSKA_DEMUXER)     += mpeg4audio_sample_rates.o
 SHLIBOBJS-$(CONFIG_MOV_DEMUXER)          += ac3_channel_layout_tab.o
@@ -106,6 +106,8 @@ static int get_aiff_header(AVFormatContext *s, int64_t size,
        size++;
    par->codec_type = AVMEDIA_TYPE_AUDIO;
    channels = avio_rb16(pb);
+    if (par->ch_layout.nb_channels && par->ch_layout.nb_channels != channels)
+        return AVERROR_INVALIDDATA;
    par->ch_layout.nb_channels = channels;
    num_frames = avio_rb32(pb);
    par->bits_per_coded_sample = avio_rb16(pb);
@@ -0,0 +1 @@
+#include "libavcodec/bitstream.c"
@@ -638,6 +638,11 @@ static int concat_parse_script(AVFormatContext *avf)
        }
    }

+    if (!file) {
+        ret = AVERROR_INVALIDDATA;
+        goto fail;
+    }
+
    if (file->inpoint != AV_NOPTS_VALUE && file->outpoint != AV_NOPTS_VALUE) {
        if (file->inpoint  > file->outpoint ||
            file->outpoint - (uint64_t)file->inpoint > INT64_MAX)
@@ -0,0 +1,23 @@
+/*
+ * JNI utility functions - included stub
+ *
+ * Copyright (c) 2024 Leo Izen <leo.izen@gmail.com>
+ *
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include "libavcodec/ffjni.c"
@@ -527,8 +527,8 @@ const URLProtocol ff_fd_protocol = {

 #if CONFIG_ANDROID_CONTENT_PROTOCOL
 #include <jni.h>
+#include "libavcodec/ffjni.h"
 #include "libavcodec/jni.h"
-#include "libavcodec/ffjni.c"

 typedef struct JFields {
    jclass uri_class;
@@ -282,12 +282,6 @@ static av_unused int64_t flac_read_timestamp(AVFormatContext *s, int stream_inde
    if (avio_seek(s->pb, *ppos, SEEK_SET) < 0)
        return AV_NOPTS_VALUE;

-    parser = av_parser_init(st->codecpar->codec_id);
-    if (!parser){
-        return AV_NOPTS_VALUE;
-    }
-    parser->flags |= PARSER_FLAG_USE_CODEC_TS;
-
    if (!flac->parser_dec) {
        flac->parser_dec = avcodec_alloc_context3(NULL);
        if (!flac->parser_dec)
@@ -298,6 +292,11 @@ static av_unused int64_t flac_read_timestamp(AVFormatContext *s, int stream_inde
            return ret;
    }

+    parser = av_parser_init(st->codecpar->codec_id);
+    if (!parser)
+        return AV_NOPTS_VALUE;
+    parser->flags |= PARSER_FLAG_USE_CODEC_TS;
+
    for (;;){
        uint8_t *data;
        int size;
@@ -933,6 +933,10 @@ static int mix_presentation_obu(void *s, IAMFContext *c, AVIOContext *pb, int le
            if (submix_layout->layout_type == 2) {
                int sound_system;
                sound_system = (byte >> 2) & 0xF;
+                if (sound_system >= FF_ARRAY_ELEMS(ff_iamf_sound_system_map)) {
+                    ret = AVERROR_INVALIDDATA;
+                    goto fail;
+                }
                av_channel_layout_copy(&submix_layout->sound_system, &ff_iamf_sound_system_map[sound_system].layout);
            }

@@ -283,9 +283,9 @@ int ff_iamf_read_packet(AVFormatContext *s, IAMFDemuxContext *c,

        len = ff_iamf_parse_obu_header(header, size, &obu_size, &start_pos, &type,
                                       &skip_samples, &discard_padding);
-        if (len < 0 || obu_size > max_size) {
+        if (len < 0 || obu_size > max_size || len > INT_MAX - read) {
            av_log(s, AV_LOG_ERROR, "Failed to read obu\n");
-            return len;
+            return len < 0 ? len : AVERROR_INVALIDDATA;
        }
        avio_seek(pb, -(size - start_pos), SEEK_CUR);

@@ -275,6 +275,17 @@ int ff_iamf_add_audio_element(IAMFContext *iamf, const AVStreamGroup *stg, void
        }
    }

+    for (int i = 0; i < audio_element->nb_substreams; i++) {
+        for (int j = i + 1; j < audio_element->nb_substreams; j++)
+            if (audio_element->substreams[i].audio_substream_id ==
+                audio_element->substreams[j].audio_substream_id) {
+                av_log(log_ctx, AV_LOG_ERROR, "Duplicate id %u in streams %u and %u from stream group %u\n",
+                       audio_element->substreams[i].audio_substream_id, i, j, stg->index);
+                ret = AVERROR(EINVAL);
+                goto fail;
+            }
+    }
+
    if (iamf_audio_element->demixing_info) {
        AVIAMFParamDefinition *param = iamf_audio_element->demixing_info;
        const IAMFParamDefinition *param_definition = ff_iamf_get_param_definition(iamf, param->parameter_id);
@@ -154,6 +154,9 @@ static int iamf_read_header(AVFormatContext *s)
        }
    }

+    if (!s->nb_streams)
+        return AVERROR_INVALIDDATA;
+
    return 0;
 }

@@ -359,6 +359,7 @@ int ff_mp4_read_dec_config_descr(AVFormatContext *fc, AVStream *st, AVIOContext
                                                st->codecpar->extradata_size, 1, fc);
            if (ret < 0)
                return ret;
+            av_channel_layout_uninit(&st->codecpar->ch_layout);
            st->codecpar->ch_layout.order = AV_CHANNEL_ORDER_UNSPEC;
            st->codecpar->ch_layout.nb_channels = cfg.channels;
            if (cfg.object_type == 29 && cfg.sampling_index < 3) // old mp3on4
@@ -193,7 +193,7 @@ typedef struct MOVStreamContext {
    unsigned int sample_size; ///< may contain value calculated from stsd or value from stsz atom
    unsigned int stsz_sample_size; ///< always contains sample size from stsz atom
    unsigned int sample_count;
-    int *sample_sizes;
+    unsigned int *sample_sizes;
    int keyframe_absent;
    unsigned int keyframe_count;
    int *keyframes;
@@ -38,7 +38,7 @@
 typedef struct KVAGHeader {
    uint32_t    magic;
    uint32_t    data_size;
-    uint32_t    sample_rate;
+    int    sample_rate;
    uint16_t    stereo;
 } KVAGHeader;

@@ -70,6 +70,9 @@ static int kvag_read_header(AVFormatContext *s)
    hdr.sample_rate             = AV_RL32(buf +  8);
    hdr.stereo                  = AV_RL16(buf + 12);

+    if (hdr.sample_rate <= 0)
+        return AVERROR_INVALIDDATA;
+
    par                         = st->codecpar;
    par->codec_type             = AVMEDIA_TYPE_AUDIO;
    par->codec_id               = AV_CODEC_ID_ADPCM_IMA_SSI;
@@ -3305,9 +3305,9 @@ static int mov_read_stsz(MOVContext *c, AVIOContext *pb, MOVAtom atom)

    for (i = 0; i < entries; i++) {
        sc->sample_sizes[i] = get_bits_long(&gb, field_size);
-        if (sc->sample_sizes[i] < 0) {
+        if (sc->sample_sizes[i] > INT64_MAX - sc->data_size) {
            av_free(buf);
-            av_log(c->fc, AV_LOG_ERROR, "Invalid sample size %d\n", sc->sample_sizes[i]);
+            av_log(c->fc, AV_LOG_ERROR, "Sample size overflow in STSZ\n");
            return AVERROR_INVALIDDATA;
        }
        sc->data_size += sc->sample_sizes[i];
@@ -4860,25 +4860,6 @@ static int mov_read_trak(MOVContext *c, AVIOContext *pb, MOVAtom atom)
    MOVStreamContext *sc;
    int ret;

-    if (c->found_iinf) {
-        // * For animated heif, if the iinf box showed up before the moov
-        //   box, we need to clear all the streams read in the former.
-        for (int i = c->nb_heif_item - 1; i >= 0; i--) {
-            HEIFItem *item = &c->heif_item[i];
-
-            av_freep(&item->name);
-
-            if (!item->st)
-                continue;
-
-            mov_free_stream_context(c->fc, item->st);
-            ff_remove_stream(c->fc, item->st);
-        }
-        av_freep(&c->heif_item);
-        c->nb_heif_item = 0;
-        c->found_iinf = c->found_iloc = 0;
-    }
-
    st = avformat_new_stream(c->fc, NULL);
    if (!st) return AVERROR(ENOMEM);
    st->id = -1;
@@ -5043,6 +5024,7 @@ static int mov_read_keys(MOVContext *c, AVIOContext *pb, MOVAtom atom)

    avio_skip(pb, 4);
    count = avio_rb32(pb);
+    atom.size -= 8;
    if (count > UINT_MAX / sizeof(*c->meta_keys) - 1) {
        av_log(c->fc, AV_LOG_ERROR,
               "The 'keys' atom with the invalid key count: %"PRIu32"\n", count);
@@ -5057,15 +5039,17 @@ static int mov_read_keys(MOVContext *c, AVIOContext *pb, MOVAtom atom)
    for (i = 1; i <= count; ++i) {
        uint32_t key_size = avio_rb32(pb);
        uint32_t type = avio_rl32(pb);
-        if (key_size < 8) {
+        if (key_size < 8 || key_size > atom.size) {
            av_log(c->fc, AV_LOG_ERROR,
                   "The key# %"PRIu32" in meta has invalid size:"
                   "%"PRIu32"\n", i, key_size);
            return AVERROR_INVALIDDATA;
        }
+        atom.size -= key_size;
        key_size -= 8;
        if (type != MKTAG('m','d','t','a')) {
            avio_skip(pb, key_size);
+            continue;
        }
        c->meta_keys[i] = av_mallocz(key_size + 1);
        if (!c->meta_keys[i])
@@ -6140,8 +6124,10 @@ static int mov_read_smdm(MOVContext *c, AVIOContext *pb, MOVAtom atom)
        av_log(c->fc, AV_LOG_WARNING, "Unsupported Mastering Display Metadata box version %d\n", version);
        return 0;
    }
-    if (sc->mastering)
-        return AVERROR_INVALIDDATA;
+    if (sc->mastering) {
+        av_log(c->fc, AV_LOG_WARNING, "Ignoring duplicate Mastering Display Metadata\n");
+        return 0;
+    }

    avio_skip(pb, 3); /* flags */

@@ -6178,11 +6164,16 @@ static int mov_read_mdcv(MOVContext *c, AVIOContext *pb, MOVAtom atom)

    sc = c->fc->streams[c->fc->nb_streams - 1]->priv_data;

-    if (atom.size < 24 || sc->mastering) {
+    if (atom.size < 24) {
        av_log(c->fc, AV_LOG_ERROR, "Invalid Mastering Display Color Volume box\n");
        return AVERROR_INVALIDDATA;
    }

+    if (sc->mastering) {
+        av_log(c->fc, AV_LOG_WARNING, "Ignoring duplicate Mastering Display Color Volume\n");
+        return 0;
+    }
+
    sc->mastering = av_mastering_display_metadata_alloc();
    if (!sc->mastering)
        return AVERROR(ENOMEM);
@@ -8058,9 +8049,8 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom)
    int64_t base_offset, extent_offset, extent_length;
    uint8_t value;

-    if (c->found_moov) {
-        // * For animated heif, we don't care about the iloc box as all the
-        //   necessary information can be found in the moov box.
+    if (c->found_iloc) {
+        av_log(c->fc, AV_LOG_INFO, "Duplicate iloc box found\n");
        return 0;
    }

@@ -8141,8 +8131,9 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx)
    size -= 4;

    if (version < 2) {
-        av_log(c->fc, AV_LOG_ERROR, "infe: version < 2 not supported\n");
-        return AVERROR_PATCHWELCOME;
+        avpriv_report_missing_feature(c->fc, "infe version < 2");
+        avio_skip(pb, size);
+        return 1;
    }

    item_id = version > 2 ? avio_rb32(pb) : avio_rb16(pb);
@@ -8185,17 +8176,12 @@ static int mov_read_iinf(MOVContext *c, AVIOContext *pb, MOVAtom atom)
 {
    HEIFItem *heif_item;
    int entry_count;
-    int version, ret;
+    int version, got_stream = 0, ret, i;

    if (c->found_iinf) {
        av_log(c->fc, AV_LOG_WARNING, "Duplicate iinf box found\n");
        return 0;
    }
-    if (c->found_moov) {
-        // * For animated heif, we don't care about the iinf box as all the
-        //   necessary information can be found in the moov box.
-        return 0;
-    }

    version = avio_r8(pb);
    avio_rb24(pb);  // flags.
@@ -8210,18 +8196,33 @@ static int mov_read_iinf(MOVContext *c, AVIOContext *pb, MOVAtom atom)
               sizeof(*c->heif_item) * (entry_count - c->nb_heif_item));
    c->nb_heif_item = FFMAX(c->nb_heif_item, entry_count);

-    for (int i = 0; i < entry_count; i++) {
+    for (i = 0; i < entry_count; i++) {
        MOVAtom infe;

        infe.size = avio_rb32(pb) - 8;
        infe.type = avio_rl32(pb);
        ret = mov_read_infe(c, pb, infe, i);
        if (ret < 0)
-            return ret;
+            goto fail;
+        if (!ret)
+            got_stream = 1;
    }

-    c->found_iinf = 1;
+    c->found_iinf = got_stream;
    return 0;
+fail:
+    for (; i >= 0; i--) {
+        HEIFItem *item = &c->heif_item[i];
+
+        av_freep(&item->name);
+        if (!item->st)
+            continue;
+
+        mov_free_stream_context(c->fc, item->st);
+        ff_remove_stream(c->fc, item->st);
+        item->st = NULL;
+    }
+    return ret;
 }

 static int mov_read_iref_dimg(MOVContext *c, AVIOContext *pb, int version)
@@ -8349,12 +8350,6 @@ static int mov_read_ispe(MOVContext *c, AVIOContext *pb, MOVAtom atom)
 {
    uint32_t width, height;

-    if (c->found_moov) {
-        // * For animated heif, we don't care about the ispe box as all the
-        //   necessary information can be found in the moov box.
-        return 0;
-    }
-
    avio_r8(pb);  /* version */
    avio_rb24(pb);  /* flags */
    width  = avio_rb32(pb);
@@ -8389,12 +8384,6 @@ static int mov_read_iprp(MOVContext *c, AVIOContext *pb, MOVAtom atom)
    int version, flags;
    int ret;

-    if (c->found_moov) {
-        // * For animated heif, we don't care about the iprp box as all the
-        //   necessary information can be found in the moov box.
-        return 0;
-    }
-
    a.size = avio_rb32(pb);
    a.type = avio_rl32(pb);

@@ -8478,6 +8467,7 @@ static int mov_read_iprp(MOVContext *c, AVIOContext *pb, MOVAtom atom)

    ret = 0;
 fail:
+    c->cur_item_id = -1;
    for (int i = 0; i < nb_atoms; i++)
        av_free(atoms[i].data);
    av_free(atoms);
@@ -8849,7 +8839,7 @@ static void mov_read_chapters(AVFormatContext *s)

        if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO) {
            st->disposition |= AV_DISPOSITION_ATTACHED_PIC | AV_DISPOSITION_TIMED_THUMBNAILS;
-            if (sti->nb_index_entries) {
+            if (!st->attached_pic.data && sti->nb_index_entries) {
                // Retrieve the first frame, if possible
                AVIndexEntry *sample = &sti->index_entries[0];
                if (avio_seek(sc->pb, sample->pos, SEEK_SET) != sample->pos) {
@@ -9426,8 +9416,9 @@ static int mov_parse_tiles(AVFormatContext *s)

        for (int j = 0; j < grid->nb_tiles; j++) {
            int tile_id = grid->tile_id_list[j];
+            int k;

-            for (int k = 0; k < mov->nb_heif_item; k++) {
+            for (k = 0; k < mov->nb_heif_item; k++) {
                HEIFItem *item = &mov->heif_item[k];
                AVStream *st = item->st;

@@ -9453,6 +9444,14 @@ static int mov_parse_tiles(AVFormatContext *s)
                break;
            }

+            if (k == mov->nb_heif_item) {
+                av_assert0(loop);
+                av_log(s, AV_LOG_WARNING, "HEIF item id %d referenced by grid id %d doesn't "
+                                          "exist\n",
+                       tile_id, grid->item->item_id);
+                ff_remove_stream_group(s, stg);
+                loop = 0;
+            }
            if (!loop)
                break;
        }
@@ -9501,6 +9500,7 @@ static int mov_read_header(AVFormatContext *s)
    mov->trak_index = -1;
    mov->thmb_item_id = -1;
    mov->primary_item_id = -1;
+    mov->cur_item_id = -1;
    /* .mov and .mp4 aren't streamable anyway (only progressive download if moov is before mdat) */
    if (pb->seekable & AVIO_SEEKABLE_NORMAL)
        atom.size = avio_size(pb);
@@ -9515,14 +9515,15 @@ static int mov_read_header(AVFormatContext *s)
            av_log(s, AV_LOG_ERROR, "error reading header\n");
            return err;
        }
-    } while ((pb->seekable & AVIO_SEEKABLE_NORMAL) && !mov->found_moov && !mov->found_iloc && !mov->moov_retry++);
-    if (!mov->found_moov && !mov->found_iloc) {
+    } while ((pb->seekable & AVIO_SEEKABLE_NORMAL) &&
+             !mov->found_moov && (!mov->found_iloc || !mov->found_iinf) && !mov->moov_retry++);
+    if (!mov->found_moov && !mov->found_iloc && !mov->found_iinf) {
        av_log(s, AV_LOG_ERROR, "moov atom not found\n");
        return AVERROR_INVALIDDATA;
    }
    av_log(mov->fc, AV_LOG_TRACE, "on_parse_exit_offset=%"PRId64"\n", avio_tell(pb));

-    if (mov->found_iloc) {
+    if (mov->found_iloc && mov->found_iinf) {
        for (i = 0; i < mov->nb_heif_item; i++) {
            HEIFItem *item = &mov->heif_item[i];
            MOVStreamContext *sc;
@@ -9564,6 +9565,10 @@ static int mov_read_header(AVFormatContext *s)
                return err;
        }
    }
+    // prevent iloc and iinf boxes from being parsed while reading packets.
+    // this is needed because an iinf box may have been parsed but ignored
+    // for having old infe boxes which create no streams.
+    mov->found_iloc = mov->found_iinf = 1;

    if (pb->seekable & AVIO_SEEKABLE_NORMAL) {
        if (mov->nb_chapter_tracks > 0 && !mov->ignore_chapters)
@@ -1222,6 +1222,8 @@ static int mov_write_chnl_tag(AVFormatContext *s, AVIOContext *pb, MOVTrack *tra
    if (ret || !config) {
        config = 0;
        speaker_pos = av_malloc(layout->nb_channels);
+        if (!speaker_pos)
+            return AVERROR(ENOMEM);
        ret = ff_mov_get_channel_positions_from_layout(layout,
                speaker_pos, layout->nb_channels);
        if (ret) {
@@ -6195,6 +6197,12 @@ int ff_mov_write_packet(AVFormatContext *s, AVPacket *pkt)
    if (ret < 0)
        return ret;

+    if (pkt->pts != AV_NOPTS_VALUE &&
+        (uint64_t)pkt->dts - pkt->pts != (int32_t)((uint64_t)pkt->dts - pkt->pts)) {
+        av_log(s, AV_LOG_WARNING, "pts/dts pair unsupported\n");
+        return AVERROR_PATCHWELCOME;
+    }
+
    if (mov->flags & FF_MOV_FLAG_FRAGMENT || mov->mode == MODE_AVIF) {
        int ret;
        if (mov->moov_written || mov->flags & FF_MOV_FLAG_EMPTY_MOOV) {
@@ -32,6 +32,7 @@
 #include "replaygain.h"

 #include "libavcodec/codec_id.h"
+#include "libavcodec/mpegaudio.h"
 #include "libavcodec/mpegaudiodecheader.h"

 #define XING_FLAG_FRAMES 0x01
@@ -400,27 +401,22 @@ static int mp3_read_header(AVFormatContext *s)
    if (ret < 0)
        return ret;

+    ret = ffio_ensure_seekback(s->pb, 64 * 1024 + MPA_MAX_CODED_FRAME_SIZE + 4);
+    if (ret < 0)
+        return ret;
+
    off = avio_tell(s->pb);
    for (i = 0; i < 64 * 1024; i++) {
        uint32_t header, header2;
        int frame_size;
-        if (!(i&1023))
-            ffio_ensure_seekback(s->pb, i + 1024 + 4);
        frame_size = check(s->pb, off + i, &header);
        if (frame_size > 0) {
-            ffio_ensure_seekback(s->pb, i + 1024 + frame_size + 4);
            ret = check(s->pb, off + i + frame_size, &header2);
-            if (ret >= 0 &&
-                (header & MP3_MASK) == (header2 & MP3_MASK))
-            {
+            if (ret >= 0 && (header & MP3_MASK) == (header2 & MP3_MASK))
                break;
-            } else if (ret == CHECK_SEEK_FAILED) {
-                av_log(s, AV_LOG_ERROR, "Invalid frame size (%d): Could not seek to %"PRId64".\n", frame_size, off + i + frame_size);
-                return AVERROR(EINVAL);
-            }
        } else if (frame_size == CHECK_SEEK_FAILED) {
-            av_log(s, AV_LOG_ERROR, "Failed to read frame size: Could not seek to %"PRId64".\n", (int64_t) (i + 1024 + frame_size + 4));
-            return AVERROR(EINVAL);
+            av_log(s, AV_LOG_ERROR, "Failed to find two consecutive MPEG audio frames.\n");
+            return AVERROR_INVALIDDATA;
        }
    }
    if (i == 64 * 1024) {
@@ -2605,7 +2605,8 @@ static void pat_cb(MpegTSFilter *filter, const uint8_t *section, int section_len
                    FFSWAP(struct Program, ts->prg[nb_prg], ts->prg[prg_idx]);
                if (prg_idx >= nb_prg)
                    nb_prg++;
-            }
+            } else
+                nb_prg = 0;
        }
    }
    ts->nb_prg = nb_prg;
@@ -250,7 +250,7 @@ typedef struct MXFFFV1SubDescriptor {

 typedef struct MXFIndexTableSegment {
    MXFMetadataSet meta;
-    int edit_unit_byte_count;
+    unsigned edit_unit_byte_count;
    int index_sid;
    int body_sid;
    AVRational index_edit_rate;
@@ -790,6 +790,9 @@ static int mxf_read_partition_pack(void *arg, AVIOContext *pb, int tag, int size
    partition->index_sid = avio_rb32(pb);
    partition->body_offset = avio_rb64(pb);
    partition->body_sid = avio_rb32(pb);
+    if (partition->body_offset < 0)
+        return AVERROR_INVALIDDATA;
+
    if (avio_read(pb, op, sizeof(UID)) != sizeof(UID)) {
        av_log(mxf->fc, AV_LOG_ERROR, "Failed reading UID\n");
        return AVERROR_INVALIDDATA;
@@ -1263,6 +1266,9 @@ static int mxf_read_index_table_segment(void *arg, AVIOContext *pb, int tag, int
    case 0x3F0B:
        segment->index_edit_rate.num = avio_rb32(pb);
        segment->index_edit_rate.den = avio_rb32(pb);
+        if (segment->index_edit_rate.num <= 0 ||
+            segment->index_edit_rate.den <= 0)
+            return AVERROR_INVALIDDATA;
        av_log(NULL, AV_LOG_TRACE, "IndexEditRate %d/%d\n", segment->index_edit_rate.num,
                segment->index_edit_rate.den);
        break;
@@ -1891,9 +1897,13 @@ static int mxf_edit_unit_absolute_offset(MXFContext *mxf, MXFIndexTable *index_t
        if (edit_unit < s->index_start_position + s->index_duration) {
            int64_t index = edit_unit - s->index_start_position;

-            if (s->edit_unit_byte_count)
+            if (s->edit_unit_byte_count) {
+                if (index > INT64_MAX / s->edit_unit_byte_count ||
+                    s->edit_unit_byte_count * index > INT64_MAX - offset_temp)
+                    return AVERROR_INVALIDDATA;
+
                offset_temp += s->edit_unit_byte_count * index;
-            else {
+            } else {
                if (s->nb_index_entries == 2 * s->index_duration + 1)
                    index *= 2;     /* Avid index */

@@ -41,7 +41,7 @@ int ff_pcm_default_packet_size(AVCodecParameters *par)
    /* Don't trust the codecpar bitrate if we can calculate it ourselves */
    if (bits_per_sample > 0 && par->sample_rate > 0 && par->ch_layout.nb_channels > 0)
        if ((int64_t)par->sample_rate * par->ch_layout.nb_channels < INT64_MAX / bits_per_sample)
-            bitrate = bits_per_sample * par->sample_rate * par->ch_layout.nb_channels;
+            bitrate = bits_per_sample * (int64_t)par->sample_rate * par->ch_layout.nb_channels;

    if (bitrate > 0) {
        nb_samples = av_clip64(bitrate / 8 / PCM_DEMUX_TARGET_FPS / par->block_align, 1, max_samples);
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .1.git
 .0.1