avcodec/vc1: check REFDIST

"9.1.1.43 P Reference Distance (REFDIST)"
"The value of REFDIST shall be less than, or equal to, 16."

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/apedec: Allocate decoded_buffer after successful ff_get_buffer()

We need to reset samples in this case to avoid being stuck with incorrect
samples value.

Fixes: OOM
Fixes: Timeout
Fixes: 16627/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5638059583864832
Fixes: 17089/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5672188463546368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/apedec: Fix several integer overflows in predictor_update_filter() and do_apply_filter()

Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: signed integer overflow: -14527961 - 2147483425 cannot be represented in type 'int'
Fixes: 16380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5645957131141120
Fixes: 16968/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5716169901735936
Fixes: 17074/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5198710497083392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/hevc_cabac: Tighten the limit on k in ff_hevc_cu_qp_delta_abs()

Values larger would fail subsequent tests.

Fixes: signed integer overflow: 5 + 2147483646 cannot be represented in type 'int'
Fixes: 16966/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5695709549953024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avfilter/vf_xbr: Fix left shift of negative number

Affected every usage of vf_xbr, e.g. the FATE-tests filter-2xbr,
filter-3xbr, filter-4xbr.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avfilter/vf_hqx: Fix undefined left shifts of negative numbers

Affected every usage of this filter; in particular, it affected the
FATE-tests filter-2xbr, filter-3xbr and filter-4xbr.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/jpeg2000dwt: Fix undefined shifts of negative numbers

Affected the vsynth*-jpeg2000 and the vsynth*-jpeg2000-97 FATE tests
(where * ranges over { 1, 2, 3, _lena }) as well as ticket #7983.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/ituh263dec: Fix undefined left shift of negative number

Fixes ticket #8160.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/dnxhdenc: Fix undefined left shifts of negative numbers

Affected 61 FATE-tests: 60 vsynth tests and lavf-mxf_opatom.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

swscale/utils: Fix invalid left shifts of negative numbers

Affected the FATE-tests vsynth_lena-dv-411, vsynth1-dv-411,
vsynth2-dv-411 and hevc-paramchange-yuv420p.yuv420p10.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/ffv1enc: Fix out-of-bounds-array access

libavcodec/ffv1enc.c accessed an array of uint8_t [32] via array[0][j]
in order to loop over all the uint8_t in this array of arrays. Of course
this implied an out-of-bounds access for array[0] and UBSan complained
about this. So replace this with nested loops; furthermore, factor this
out into a function of its own to easily break out of the nested loops.

This affected the FATE-tests vsynth1-ffv1, vsynth1-ffv1-v3-yuv420p,
vsynth1-ffv1-v3-yuv422p10, vsynth1-ffv1-v3-yuv444p16,
vsynth1-ffv1-v3-bgr0, vsynth1-ffv1-ffv1-v3-rgb48 as well as the
corresponding vsynth2-*, vsynth3-* and the vsynth_lena-* tests.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

swscale/x86/swscale: Fix undefined left shifts of negative numbers

This affected many FATE-tests: The number of failing tests went down
from 663 to 344. (Both numbers exclude tests that failed because of
unaligned accesses in code that is inside #if HAVE_FAST_UNALIGNED.)

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

ffmpeg_opt: remove errant space

Signed-off-by: Lou Logan <lou@lrcd.com>

doc/ffmpeg: -timelimit is in user time

Signed-off-by: Lou Logan <lou@lrcd.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/nvenc: make use of new GetLastErrorString function

Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org>

avcodec/nvenc: pass CUstream to nvenc when available

Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org>

avcodec/nvenc: add multiple reference frames support

Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org>

avcodec/nvenc: switch to dedicated dpb_size option

Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org>

libavformat/rtsp: return error if rtsp_hd_out is null instead of crash

Signed-off-by: Aman Gupta <aman@tmm1.net>

lavu/qsv: remove redundant version query

Signed-off-by: Zhong Li <zhong.li@intel.com>

lavc/mpeg4audio: add chan_config check to avoid indeterminate channels

add chan_config check to avoid indeterminate channels.

Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
Signed-off-by: James Almer <jamrial@gmail.com>

avcodec/mpeg4audio: fix doxy for ff_mpeg4audio_get_config_gb()

Signed-off-by: James Almer <jamrial@gmail.com>

avformat: use avpriv_mpeg4audio_get_config2()

Signed-off-by: James Almer <jamrial@gmail.com>

avcodec: use avpriv_mpeg4audio_get_config2()

Signed-off-by: James Almer <jamrial@gmail.com>

avcodec/mpeg4audio: add avpriv_mpeg4audio_get_config2()

Identical to avpriv_mpeg4audio_get_config() except taking a size argument in
bytes, and featuring a new logging context paremeter.

Schedule avpriv_mpeg4audio_get_config() for removal as soon as major is bumped
as well.

Signed-off-by: James Almer <jamrial@gmail.com>

avformat/dhav: fix demuxer since recent breakage

avformat/g729dec: set packet duration and correctly set timebase info

Fixes #6704.

avformat/nut: add pcm_s64 support

swscale/swscale: cosmetics

Signed-off-by: Limin Wang <lance.lmwang@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avfilter/vf_scale: cosmetics

Signed-off-by: Limin Wang <lance.lmwang@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/4xm: Check index in decode_i_block() also in the path where its not used.

Fixes: Infinite loop
Fixes: signed integer overflow: 2147483644 + 16 cannot be represented in type 'int'
Fixes: 16169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5662570416963584
Fixes: 16782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5743163859271680
Fixes: 17641/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5711603562971136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/loco: Check for end of input in the first line

Fixes: Timeout (85sec -> 0.1sec)
Fixes: 17634/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5666410809786368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/atrac3: Check block_align

Fixes: Infinite loop
Fixes: 17620/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3_fuzzer-5086123012915200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

tools/target_dec_fuzzer: Print samples decoded like pixels

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

tools/target_dec_fuzzer: Check number of all samples decoded too, like max pixels

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/alsdec: Avoid dereferencing context pointer in inner interleave loop

This makes the decoder faster

Improves/Fixes: Timeout (22sec -> 20sec)
Testcase: 17619/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5078510820917248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/hcom: Check that there are dictionary entries

Fixes: out of array read
Fixes: 17617/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCOM_fuzzer-5674970478280704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/fitsdec: Prevent division by 0 with huge data_max

Fixes: division by 0
Fixes: 15657/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5738154838982656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/dstdec: Fix integer overflow in samples_per_frame computation

Fixes: Timeout (? -> 2ms)
Fixes: 17616/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5198057947267072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/g729_parser: Check block_size

Fixes: Infinite loop
Fixes: 17611/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5765134928052224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/sbcdec: Initialize number of channels

Fixes: out of array access
Fixes: 17609/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SBC_fuzzer-5758729319874560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Reviewed-by: Moritz Barsnick <barsnick@gmx.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/exr: Fix undefined left shifts of negative numbers

Affected the FATE-tests exr-rgb-scanline-pxr24-half-uint32-13x9 and
exr-rgb-scanline-pxr24-uint32.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

aformat/movenc: add missing padding to output track extradata

Fixes ticket #8183.

Tested-by: Thierry Foucu <tfoucu@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>

doc/filters: warn about gaps/overlaps in xstack

doc/filters: add 4x4 layout example for xstack filter

Add layouts for existing examples.

Reviewed-by: Gyan <ffmpeg@gyani.pro>
Signed-off-by: Limin Wang <lance.lmwang@gmail.com>

avfilter/vf_eq: fix compilation with x86 asm disabled

Signed-off-by: James Almer <jamrial@gmail.com>

fate: update hashes after ya16 change

swresample/audioconvert: fix invalid left shift for 64bit sample format

Fixes #8002.

avcodec/hevc_ps: Remove dead code in vps_id check

Since reading 4 bits always returns a value in the range [0, 15], the
check for vps_id >= HEVC_MAX_VPS_COUNT, where HEVC_MAX_VPS_COUNT = 16, is redundant.

Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>

avcodec/truespeech: fix left shift of negative value

swscale/output: fix signed integer overflow for ya16

Fixes #7666.

avformat/movenc: Fix undefined shift

Fixes the movenc FATE-test.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>

avcodec/mpeg12dec: Sanitize start codes earlier

The MPEG-1/2 decoder uses avpriv_find_start_code to search for start
codes and worked with the resulting start code before checking that it
is really a start code of a slice. In particular, if the picture is so
big that a slice_vertical_position_extension is present, it added the
slice_vertical_position_extension as if it had a slice. Then a left
shift is performed, without making sure that the value to be shifted is
nonnegative.
Afterwards the end result is checked, but even if a start code of a
non-slice has been found, it might pass these checks: If
slice_vertical_position_extension is present a start code <
SLICE_MIN_START_CODE can lead to a macroblock-row index that appears
valid. Furthermore, the left shift might make an invalid start code
appear valid by discarding the highest bit.
This has been fixed by checking directly after avpriv_find_start_code
has returned.

Fixes ticket #8162 (which is about the undefined left shifts).

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>

avcodec/pcm: Cosmetics

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>

avcodec/pcm: Fix undefined shifts

Fixes the acodec-pcm-u16[lb]e FATE-tests.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>

avcodec/wavpackenc: Fix undefined shifts

Fixes ticket #8161 and the acodec-wavpack FATE-test.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>

lavc/qsv: add memory type message

Signed-off-by: Zhong Li <zhong.li@intel.com>

lavc/qsv: Fix MSDK initialization failure in system memory mode

MSDK does not create internal acceleration device on Linux,
So MFXVideoCORE_SetHandle() is necessary.
It has been added for ff_qsv_init_session_device().
But missed for ff_qsv_init_internal_session() due to commit
1f26a23 overwrited commit db89f45

Fix #7030

Signed-off-by: Zhong Li <zhong.li@intel.com>

avformat/utils: ensure that all packets in AVPacketList are reference counted

This is done so that its data is really owned by the packet.
This was already true for the current callers.

Signed-off-by: James Almer <jamrial@gmail.com>

avfilter/x86/vf_eq: add SSE2 version

Signed-off-by: Ting Fu <ting.fu@intel.com>

avfilter/x86/vf_eq: Change inline assembly into nasm code

Signed-off-by: Ting Fu <ting.fu@intel.com>

checkasm/vf_eq: add test for vf_eq

Signed-off-by: Ting Fu <ting.fu@intel.com>
Signed-off-by: Ruiling Song <ruiling.song@intel.com>

avformat/utils: Move the reference to the packet list

Up until now, ff_packet_list_put had a flaw: When it moved a packet to
the list (meaning, when it ought to move the reference to the packet
list instead of creating a new one via av_packet_ref), it did not reset
the original packet, confusing the ownership of the data in the packet.
This has been done because some callers of this function were not
compatible with resetting the packet.

This commit changes these callers and fixes this flaw. In order to
indicate that the ownership of the packet has moved to the packet list,
pointers to constant AVPackets are used whenever the target of the
pointer might already be owned by the packet list.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>

avformat/utils: unref packet on AVInputFormat.read_packet() failure

Demuxers may have allocated a packet before encountering an error and aborting.

Fixes ticket #8150

Signed-off-by: James Almer <jamrial@gmail.com>

avformat/utils: Fix memleaks

ff_read_packet had potential memleaks:
1. If av_packet_make_refcounted fails, it means that the packet is not
refcounted, but it could nevertheless carry side data and therefore
needs to be unreferenced.
2. If putting a packet on a packet list fails, it wasn't unreferenced.

Furthermore, read_frame_internal leaked a packet's (side) data if a
context update was required and failed.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>

avformat/utils: Assert that stream_index is valid

There is currently an ordinary check for this (which would lead to a
memleak), but given that no demuxer should ever return a packet with an
invalid stream_index it is more appropriate for this to be an assert.

FATE passes with this change.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>

lavf/mov: Fix timestamp rescale on sidx atom

Fix #5090
Fix the timestamp rescale issue, from sidx timebase to
stream's timebase.

Revert "lavc/tiff: correct the default value of YCbCrSubsampling to 2x2"

This reverts commit eb5d0f18ff609ba2280cea4e2c6286d216c8756b.

Together with 89f464e9, it breaks decoding of tiff files like fate-suite/exif/image_small.tiff

avcodec/dnxhdenc: return error if av_malloc failed

Signed-off-by: Limin Wang <lance.lmwang@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>

avfilter/vf_zoompan: fix leaks

avfilter/vf_zoompan: forward status back from output to input

avfilter/vf_stack: add slice threading

avfilter/vf_stack: simplify main processing path

avformat/sdsdec: fix undefined behaviour

Fixes #8163, #8164, #8165.

avformat/aiffdec: fix signed integer overflow

Fixes #8151

avcodec/decode: Check max_samples in get_buffer_internal()

This checks max_samples at the same level as max_pixels

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

tools/target_dec_fuzzer: Set max_samples

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec: add max_samples

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avfilter/Makefile: fix case for sierpinski

avfilter: add sierpinski video source

avfilter/vf_premultiply: forward status back from output to all input links

avfilter/vf_fieldmatch: forward status back from output to all input links

Fixes #8199.

avfilter/vf_fieldmatch: fix more leaks

avfilter/vf_v360: add sinusoidal format

lavc/tiff: correct the default value of YCbCrSubsampling to 2x2

lavf/4xm: fix memory leak in error handing path

need to free the header in error path.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>

libavcodec/libx265: add a flag to output ROI warnings only once.

Signed-off-by: Guo, Yejun <yejun.guo@intel.com>

libavcodec/libx264: add a flag to output ROI warnings only once.

Signed-off-by: Guo, Yejun <yejun.guo@intel.com>

avcodec/utils: Optimize ff_color_frame() using memcpy()

4650975 -> 4493240 dezicycles

This optimizes lines 2 and later. Line 1 still uses av_memcpy_backptr()
This change originally fixed ossfuzz 10790 but this is now fixed by other
optimizations already

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/aacdec: Check if we run out of input in read_stream_mux_config()

Fixes: Infinite loop
Fixes: 16920/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5653421289373696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/h264_slice: clear frame only on gaps when it is not otherwise initilaized

Fixes: Timeout (53sec -> 31sec)
Fixes: 16908/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5711207859748864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/utils: Use av_memcpy_backptr() in ff_color_frame()

Fixes: Timeout (191sec -> 53sec)
Fixes: 16908/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5711207859748864
Fixes: 10709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5630617975259136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/smacker: Fix integer overflow in signed int multiply in SMK_BLK_FILL

Fixes: signed integer overflow: 238 * 16843009 cannot be represented in type 'int'
Fixes: 16958/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5193905355620352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/alac: Fix invalid shifts in 20/24 bps

Fixes: left shift of negative value -256
Fixes: 16892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-4880802642395136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/alac: fix undefined behavior with INT_MIN in lpc_prediction()

Fixes: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
Fixes: 16786/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5632818851348480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avformat/utils: Do not assume duration is non negative in compute_pkt_fields()

Several subtitle demuxers set negative durations

Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 16925/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5766519790764032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/ffwavesynth: Fix integer overflow in timestamps

Fixes: signed integer overflow: 9223371075321077760 * 2 cannot be represented in type 'long'
Fixes: 16447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5698937431785472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avformat/vividas: Test size and packet numbers a bit more

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avformat/vividas: Check n_sb_blocks against input space

Fixes: OOM
Fixes: 16726/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5719320750981120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avcodec/aacdec_fixed: Add FF_CODEC_CAP_INIT_CLEANUP

Fixes: memleaks
Fixes: 16788/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5649873898045440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>