Merge remote-tracking branch 'qatar/master'

* qatar/master:
  flicvideo: fix invalid reads
  vorbis: Avoid some out-of-bounds reads
  vqf: add more known extensions
  cabac: remove unused function renorm_cabac_decoder
  h264: Only use symbols from the SVQ3 decoder under proper conditionals.
  add bytestream2_tell() and bytestream2_seek() functions
  parsers: initialize MpegEncContext.slice_context_count to 1
  spdifenc: use special alignment for DTS-HD length_code

Conflicts:
	libavcodec/flicvideo.c
	libavcodec/h264.c
	libavcodec/mpeg4video_parser.c
	libavcodec/vorbis.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

diff --cc libavcodec/bytestream.h
Simple merge

diff --cc libavcodec/cabac.h
Simple merge

diff --cc libavcodec/flicvideo.c
index dded6f5,b7bbfb4..01962e1
--- 1/libavcodec/flicvideo.c
--- 2/libavcodec/flicvideo.c
+++ b/libavcodec/flicvideo.c
@@@ -133,7 -134,8 +135,7 @@@ static int flic_decode_frame_8BPP(AVCod
  {
      FlicDecodeContext *s = avctx->priv_data;
  
-     int stream_ptr = 0;
+     GetByteContext g2;
 -    int stream_ptr_after_color_chunk;
      int pixel_ptr;
      int palette_ptr;
      unsigned char palette_idx1;
@@@ -163,7 -165,9 +165,9 @@@
      unsigned char *pixels;
      unsigned int pixel_limit;
  
 -    s->frame.reference = 1;
+     bytestream2_init(&g2, buf, buf_size);
+ 
 +    s->frame.reference = 3;
      s->frame.buffer_hints = FF_BUFFER_HINTS_VALID | FF_BUFFER_HINTS_PRESERVE | FF_BUFFER_HINTS_REUSABLE;
      if (avctx->reget_buffer(avctx, &s->frame) < 0) {
          av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n");
@@@ -172,32 -176,17 +176,29 @@@
  
      pixels = s->frame.data[0];
      pixel_limit = s->avctx->height * s->frame.linesize[0];
- 
 +    if (buf_size < 16 || buf_size > INT_MAX - (3 * 256 + FF_INPUT_BUFFER_PADDING_SIZE))
 +        return AVERROR_INVALIDDATA;
-     frame_size = AV_RL32(&buf[stream_ptr]);
+     frame_size = bytestream2_get_le32(&g2);
 +    if (frame_size > buf_size)
 +        frame_size = buf_size;
-     stream_ptr += 6;  /* skip the magic number */
-     num_chunks = AV_RL16(&buf[stream_ptr]);
-     stream_ptr += 10;  /* skip padding */
+     bytestream2_skip(&g2, 2); /* skip the magic number */
+     num_chunks = bytestream2_get_le16(&g2);
+     bytestream2_skip(&g2, 8);  /* skip padding */
  
      frame_size -= 16;
  
      /* iterate through the chunks */
 -    while ((frame_size > 0) && (num_chunks > 0)) {
 +    while ((frame_size >= 6) && (num_chunks > 0)) {
 +        int stream_ptr_after_chunk;
-         chunk_size = AV_RL32(&buf[stream_ptr]);
+         chunk_size = bytestream2_get_le32(&g2);
 +        if (chunk_size > frame_size) {
 +            av_log(avctx, AV_LOG_WARNING,
 +                   "Invalid chunk_size = %u > frame_size = %u\n", chunk_size, frame_size);
 +            chunk_size = frame_size;
 +        }
-         stream_ptr_after_chunk = stream_ptr + chunk_size;
++        stream_ptr_after_chunk = bytestream2_tell(&g2) - 4 + chunk_size;
 +
-         stream_ptr += 4;
-         chunk_type = AV_RL16(&buf[stream_ptr]);
-         stream_ptr += 2;
+         chunk_type = bytestream2_get_le16(&g2);
  
          switch (chunk_type) {
          case FLI_256_COLOR:
@@@ -225,9 -215,6 +225,9 @@@
                  if (color_changes == 0)
                      color_changes = 256;
  
-                 if (stream_ptr + color_changes * 3 > stream_ptr_after_chunk)
++                if (bytestream2_tell(&g2) + color_changes * 3 > stream_ptr_after_chunk)
 +                    break;
 +
                  for (j = 0; j < color_changes; j++) {
                      unsigned int entry;
  
@@@ -235,12 -222,10 +235,12 @@@
                      if ((unsigned)palette_ptr >= 256)
                          palette_ptr = 0;
  
-                     r = buf[stream_ptr++] << color_shift;
-                     g = buf[stream_ptr++] << color_shift;
-                     b = buf[stream_ptr++] << color_shift;
+                     r = bytestream2_get_byte(&g2) << color_shift;
+                     g = bytestream2_get_byte(&g2) << color_shift;
+                     b = bytestream2_get_byte(&g2) << color_shift;
 -                    entry = (r << 16) | (g << 8) | b;
 +                    entry = 0xFF << 24 | r << 16 | g << 8 | b;
 +                    if (color_shift == 2)
 +                        entry |= entry >> 6 & 0x30303;
                      if (s->palette[palette_ptr] != entry)
                          s->new_palette = 1;
                      s->palette[palette_ptr++] = entry;
@@@ -250,13 -243,9 +250,11 @@@
  
          case FLI_DELTA:
              y_ptr = 0;
-             compressed_lines = AV_RL16(&buf[stream_ptr]);
-             stream_ptr += 2;
+             compressed_lines = bytestream2_get_le16(&g2);
              while (compressed_lines > 0) {
-                 if (stream_ptr + 2 > stream_ptr_after_chunk)
++                if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
 +                    break;
-                 line_packets = AV_RL16(&buf[stream_ptr]);
-                 stream_ptr += 2;
+                 line_packets = bytestream2_get_le16(&g2);
                  if ((line_packets & 0xC000) == 0xC000) {
                      // line skip opcode
                      line_packets = -line_packets;
@@@ -274,17 -263,15 +272,17 @@@
                      CHECK_PIXEL_PTR(0);
                      pixel_countdown = s->avctx->width;
                      for (i = 0; i < line_packets; i++) {
-                         if (stream_ptr + 2 > stream_ptr_after_chunk)
++                        if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
 +                            break;
                          /* account for the skip bytes */
-                         pixel_skip = buf[stream_ptr++];
+                         pixel_skip = bytestream2_get_byte(&g2);
                          pixel_ptr += pixel_skip;
                          pixel_countdown -= pixel_skip;
-                         byte_run = (signed char)(buf[stream_ptr++]);
+                         byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
                          if (byte_run < 0) {
                              byte_run = -byte_run;
-                             palette_idx1 = buf[stream_ptr++];
-                             palette_idx2 = buf[stream_ptr++];
+                             palette_idx1 = bytestream2_get_byte(&g2);
+                             palette_idx2 = bytestream2_get_byte(&g2);
                              CHECK_PIXEL_PTR(byte_run * 2);
                              for (j = 0; j < byte_run; j++, pixel_countdown -= 2) {
                                  pixels[pixel_ptr++] = palette_idx1;
@@@ -292,11 -279,8 +290,10 @@@
                              }
                          } else {
                              CHECK_PIXEL_PTR(byte_run * 2);
-                             if (stream_ptr + byte_run * 2 > stream_ptr_after_chunk)
++                            if (bytestream2_tell(&g2) + byte_run * 2 > stream_ptr_after_chunk)
 +                                break;
                              for (j = 0; j < byte_run * 2; j++, pixel_countdown--) {
-                                 palette_idx1 = buf[stream_ptr++];
-                                 pixels[pixel_ptr++] = palette_idx1;
+                                 pixels[pixel_ptr++] = bytestream2_get_byte(&g2);
                              }
                          }
                      }
@@@ -319,25 -301,18 +314,24 @@@
                  pixel_ptr = y_ptr;
                  CHECK_PIXEL_PTR(0);
                  pixel_countdown = s->avctx->width;
-                 if (stream_ptr + 1 > stream_ptr_after_chunk)
++                if (bytestream2_tell(&g2) + 1 > stream_ptr_after_chunk)
 +                    break;
-                 line_packets = buf[stream_ptr++];
+                 line_packets = bytestream2_get_byte(&g2);
                  if (line_packets > 0) {
                      for (i = 0; i < line_packets; i++) {
                          /* account for the skip bytes */
-                         if (stream_ptr + 2 > stream_ptr_after_chunk)
++                        if (bytestream2_tell(&g2) + 1 > stream_ptr_after_chunk)
 +                            break;
-                         pixel_skip = buf[stream_ptr++];
+                         pixel_skip = bytestream2_get_byte(&g2);
                          pixel_ptr += pixel_skip;
                          pixel_countdown -= pixel_skip;
-                         byte_run = (signed char)(buf[stream_ptr++]);
+                         byte_run = sign_extend(bytestream2_get_byte(&g2),8);
                          if (byte_run > 0) {
                              CHECK_PIXEL_PTR(byte_run);
-                             if (stream_ptr + byte_run > stream_ptr_after_chunk)
++                            if (bytestream2_tell(&g2) + byte_run > stream_ptr_after_chunk)
 +                                break;
                              for (j = 0; j < byte_run; j++, pixel_countdown--) {
-                                 palette_idx1 = buf[stream_ptr++];
-                                 pixels[pixel_ptr++] = palette_idx1;
+                                 pixels[pixel_ptr++] = bytestream2_get_byte(&g2);
                              }
                          } else if (byte_run < 0) {
                              byte_run = -byte_run;
@@@ -369,14 -344,12 +363,14 @@@
                  pixel_ptr = y_ptr;
                  /* disregard the line packets; instead, iterate through all
                   * pixels on a row */
-                 stream_ptr++;
+                  bytestream2_skip(&g2, 1);
                  pixel_countdown = s->avctx->width;
                  while (pixel_countdown > 0) {
-                     if (stream_ptr + 1 > stream_ptr_after_chunk)
++                    if (bytestream2_tell(&g2) + 1 > stream_ptr_after_chunk)
 +                        break;
-                     byte_run = (signed char)(buf[stream_ptr++]);
+                     byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
                      if (byte_run > 0) {
-                         palette_idx1 = buf[stream_ptr++];
+                         palette_idx1 = bytestream2_get_byte(&g2);
                          CHECK_PIXEL_PTR(byte_run);
                          for (j = 0; j < byte_run; j++) {
                              pixels[pixel_ptr++] = palette_idx1;
@@@ -388,11 -361,8 +382,10 @@@
                      } else {  /* copy bytes if byte_run < 0 */
                          byte_run = -byte_run;
                          CHECK_PIXEL_PTR(byte_run);
-                         if (stream_ptr + byte_run > stream_ptr_after_chunk)
++                        if (bytestream2_tell(&g2) + byte_run > stream_ptr_after_chunk)
 +                            break;
                          for (j = 0; j < byte_run; j++) {
-                             palette_idx1 = buf[stream_ptr++];
-                             pixels[pixel_ptr++] = palette_idx1;
+                             pixels[pixel_ptr++] = bytestream2_get_byte(&g2);
                              pixel_countdown--;
                              if (pixel_countdown < 0)
                                  av_log(avctx, AV_LOG_ERROR, "pixel_countdown < 0 (%d) at line %d\n",
@@@ -407,9 -377,10 +400,10 @@@
  
          case FLI_COPY:
              /* copy the chunk (uncompressed frame) */
 -            if (chunk_size - 6 > s->avctx->width * s->avctx->height) {
 +            if (chunk_size - 6 != s->avctx->width * s->avctx->height) {
                  av_log(avctx, AV_LOG_ERROR, "In chunk FLI_COPY : source data (%d bytes) " \
 -                       "bigger than image, skipping chunk\n", chunk_size - 6);
 +                       "has incorrect size, skipping chunk\n", chunk_size - 6);
+                 bytestream2_skip(&g2, chunk_size - 6);
              } else {
                  for (y_ptr = 0; y_ptr < s->frame.linesize[0] * s->avctx->height;
                       y_ptr += s->frame.linesize[0]) {
@@@ -429,8 -400,6 +422,9 @@@
              break;
          }
  
-         stream_ptr = stream_ptr_after_chunk;
++        if (stream_ptr_after_chunk - bytestream2_tell(&g2) > 0)
++            bytestream2_skip(&g2, stream_ptr_after_chunk - bytestream2_tell(&g2));
 +
          frame_size -= chunk_size;
          num_chunks--;
      }
@@@ -485,7 -456,9 +481,9 @@@ static int flic_decode_frame_15_16BPP(A
      int pixel;
      unsigned int pixel_limit;
  
 -    s->frame.reference = 1;
+     bytestream2_init(&g2, buf, buf_size);
+ 
 +    s->frame.reference = 3;
      s->frame.buffer_hints = FF_BUFFER_HINTS_VALID | FF_BUFFER_HINTS_PRESERVE | FF_BUFFER_HINTS_REUSABLE;
      if (avctx->reget_buffer(avctx, &s->frame) < 0) {
          av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n");
@@@ -495,31 -468,18 +493,29 @@@
      pixels = s->frame.data[0];
      pixel_limit = s->avctx->height * s->frame.linesize[0];
  
-     frame_size = AV_RL32(&buf[stream_ptr]);
-     stream_ptr += 6;  /* skip the magic number */
-     num_chunks = AV_RL16(&buf[stream_ptr]);
-     stream_ptr += 10;  /* skip padding */
+     frame_size = bytestream2_get_le32(&g2);
+     bytestream2_skip(&g2, 2);  /* skip the magic number */
+     num_chunks = bytestream2_get_le16(&g2);
+     bytestream2_skip(&g2, 8);  /* skip padding */
 +    if (frame_size > buf_size)
 +        frame_size = buf_size;
  
      frame_size -= 16;
  
      /* iterate through the chunks */
      while ((frame_size > 0) && (num_chunks > 0)) {
-         chunk_size = AV_RL32(&buf[stream_ptr]);
 +        int stream_ptr_after_chunk;
-         stream_ptr_after_chunk = stream_ptr + chunk_size;
+         chunk_size = bytestream2_get_le32(&g2);
 +        if (chunk_size > frame_size) {
 +            av_log(avctx, AV_LOG_WARNING,
 +                   "Invalid chunk_size = %u > frame_size = %u\n", chunk_size, frame_size);
 +            chunk_size = frame_size;
 +        }
-         stream_ptr += 4;
-         chunk_type = AV_RL16(&buf[stream_ptr]);
-         stream_ptr += 2;
++        stream_ptr_after_chunk = bytestream2_tell(&g2) - 4 + chunk_size;
 +
+         chunk_type = bytestream2_get_le16(&g2);
  
 +
          switch (chunk_type) {
          case FLI_256_COLOR:
          case FLI_COLOR:
@@@ -533,13 -493,9 +529,11 @@@
          case FLI_DELTA:
          case FLI_DTA_LC:
              y_ptr = 0;
-             compressed_lines = AV_RL16(&buf[stream_ptr]);
-             stream_ptr += 2;
+             compressed_lines = bytestream2_get_le16(&g2);
              while (compressed_lines > 0) {
-                 if (stream_ptr + 2 > stream_ptr_after_chunk)
++                if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
 +                    break;
-                 line_packets = AV_RL16(&buf[stream_ptr]);
-                 stream_ptr += 2;
+                 line_packets = bytestream2_get_le16(&g2);
                  if (line_packets < 0) {
                      line_packets = -line_packets;
                      y_ptr += line_packets * s->frame.linesize[0];
@@@ -550,28 -506,22 +544,26 @@@
                      pixel_countdown = s->avctx->width;
                      for (i = 0; i < line_packets; i++) {
                          /* account for the skip bytes */
-                         if (stream_ptr + 2 > stream_ptr_after_chunk)
++                        if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
 +                            break;
-                         pixel_skip = buf[stream_ptr++];
+                         pixel_skip = bytestream2_get_byte(&g2);
                          pixel_ptr += (pixel_skip*2); /* Pixel is 2 bytes wide */
                          pixel_countdown -= pixel_skip;
-                         byte_run = (signed char)(buf[stream_ptr++]);
+                         byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
                          if (byte_run < 0) {
                              byte_run = -byte_run;
-                             pixel    = AV_RL16(&buf[stream_ptr]);
-                             stream_ptr += 2;
+                             pixel    = bytestream2_get_le16(&g2);
                              CHECK_PIXEL_PTR(2 * byte_run);
                              for (j = 0; j < byte_run; j++, pixel_countdown -= 2) {
                                  *((signed short*)(&pixels[pixel_ptr])) = pixel;
                                  pixel_ptr += 2;
                              }
                          } else {
-                             if (stream_ptr + 2*byte_run > stream_ptr_after_chunk)
++                            if (bytestream2_tell(&g2) + 2*byte_run > stream_ptr_after_chunk)
 +                                break;
                              CHECK_PIXEL_PTR(2 * byte_run);
                              for (j = 0; j < byte_run; j++, pixel_countdown--) {
-                                 *((signed short*)(&pixels[pixel_ptr])) = AV_RL16(&buf[stream_ptr]);
-                                 stream_ptr += 2;
+                                 *((signed short*)(&pixels[pixel_ptr])) = bytestream2_get_le16(&g2);
                                  pixel_ptr += 2;
                              }
                          }
@@@ -603,11 -553,9 +595,11 @@@
                  pixel_countdown = (s->avctx->width * 2);
  
                  while (pixel_countdown > 0) {
-                     if (stream_ptr + 1 > stream_ptr_after_chunk)
++                    if (bytestream2_tell(&g2) + 1 > stream_ptr_after_chunk)
 +                        break;
-                     byte_run = (signed char)(buf[stream_ptr++]);
+                     byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
                      if (byte_run > 0) {
-                         palette_idx1 = buf[stream_ptr++];
+                         palette_idx1 = bytestream2_get_byte(&g2);
                          CHECK_PIXEL_PTR(byte_run);
                          for (j = 0; j < byte_run; j++) {
                              pixels[pixel_ptr++] = palette_idx1;
@@@ -618,11 -566,9 +610,11 @@@
                          }
                      } else {  /* copy bytes if byte_run < 0 */
                          byte_run = -byte_run;
-                         if (stream_ptr + byte_run > stream_ptr_after_chunk)
++                        if (bytestream2_tell(&g2) + byte_run > stream_ptr_after_chunk)
 +                            break;
                          CHECK_PIXEL_PTR(byte_run);
                          for (j = 0; j < byte_run; j++) {
-                             palette_idx1 = buf[stream_ptr++];
+                             palette_idx1 = bytestream2_get_byte(&g2);
                              pixels[pixel_ptr++] = palette_idx1;
                              pixel_countdown--;
                              if (pixel_countdown < 0)
@@@ -659,12 -605,9 +651,11 @@@
                  pixel_countdown = s->avctx->width; /* Width is in pixels, not bytes */
  
                  while (pixel_countdown > 0) {
-                     if (stream_ptr + 1 > stream_ptr_after_chunk)
++                    if (bytestream2_tell(&g2) + 1 > stream_ptr_after_chunk)
 +                        break;
-                     byte_run = (signed char)(buf[stream_ptr++]);
+                     byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
                      if (byte_run > 0) {
-                         pixel    = AV_RL16(&buf[stream_ptr]);
-                         stream_ptr += 2;
+                         pixel    = bytestream2_get_le16(&g2);
                          CHECK_PIXEL_PTR(2 * byte_run);
                          for (j = 0; j < byte_run; j++) {
                              *((signed short*)(&pixels[pixel_ptr])) = pixel;
@@@ -676,12 -619,9 +667,11 @@@
                          }
                      } else {  /* copy pixels if byte_run < 0 */
                          byte_run = -byte_run;
-                         if (stream_ptr + 2 * byte_run > stream_ptr_after_chunk)
++                        if (bytestream2_tell(&g2) + 2 * byte_run > stream_ptr_after_chunk)
 +                            break;
                          CHECK_PIXEL_PTR(2 * byte_run);
                          for (j = 0; j < byte_run; j++) {
-                             *((signed short*)(&pixels[pixel_ptr])) = AV_RL16(&buf[stream_ptr]);
-                             stream_ptr += 2;
+                             *((signed short*)(&pixels[pixel_ptr])) = bytestream2_get_le16(&g2);
                              pixel_ptr  += 2;
                              pixel_countdown--;
                              if (pixel_countdown < 0)

diff --cc libavcodec/h264.c
Simple merge

diff --cc libavcodec/h264_parser.c
Simple merge

diff --cc libavcodec/mpeg4video_parser.c
index 5f3b19d,89bbf34..3bd2b14
--- 1/libavcodec/mpeg4video_parser.c
--- 2/libavcodec/mpeg4video_parser.c
+++ b/libavcodec/mpeg4video_parser.c
@@@ -101,7 -99,7 +101,8 @@@ static av_cold int mpeg4video_parse_ini
      if (!pc->enc)
          return -1;
      pc->first_picture = 1;
 +    pc->enc->quant_precision=5;
+     pc->enc->slice_context_count = 1;
      return 0;
  }
  

diff --cc libavcodec/vc1_parser.c
Simple merge

diff --cc libavcodec/vorbis.c
Simple merge

diff --cc libavformat/vqf.c
Simple merge