Merge remote-tracking branch 'qatar/release/0.6' into release/0.6

* qatar/release/0.6:
  update version
  Release notes and changelog for 0.6.3
  Fix memory (re)allocation in matroskadec.c, related to MSVR-11-0080.
  cavs: fix some crashes with invalid bitstreams
  libvo-aacenc: Sync up with 0.7.2
  Fix MMX rgb24 to yuv conversion with gcc 4.6
  oggdec: prevent heap corruption.
  Fix ff_imdct_calc_sse() on gcc-4.6
  backport libvo-aacenc wrapper for aac encoding

Conflicts:
	Changelog
	VERSION

Merged-by: Michael Niedermayer <michaelni@gmx.at>

12 files changed, 204 insertions, 32 deletions

diff --git a/Changelog b/Changelog
index 2c30322037..8536a0e1b2 100644
--- a/Changelog
+++ b/Changelog
@@ -7,6 +7,14 @@ version 0.6.4:
 - mjpeg: Detect overreads in mjpeg_decode_scan() and error out.
 - aac: add headers needed for log2f()
 - lavf: inspect more frames for fps when container time base is coarse
+- AMV: disable DR1 and don't override EMU_EDGE
+  (addresses http://seclists.org/bugtraq/2011/Apr/257)
+- Fix memory (re)allocation in matroskadec.c (MSVR11-011/CVE-2011-3504)
+- Fix some crashes with invalid bitstreams in the CAVS decoder
+  (CVE-2011-3362, CVE-2011-3973, CVE-2011-3974)
+- Compilation fixes for gcc-4.6, testsuite now passes again
+- Fix a heap corruption issue in the OGG decoder
+- Backported the Android VisualOn AAC encoder wrapper from 0.7.2
 
 
 version 0.6.3:
diff --git a/RELEASE b/RELEASE
index 5dbdf03b08..97f04d6ae6 100644
--- a/RELEASE
+++ b/RELEASE
@@ -151,9 +151,10 @@ codecs and container formats:
 General notes
 -------------
 
-This is another maintenance-only release that addresses a small number
-of bugs such as security and compilation issues. Distributors and system
+This is a mostly maintenance-only release that addresses a small number
+of bugs such as security and compilation issues. Moreover, this release
+has been updated to work with gcc-4.6 and the VisualOn AAC encoder has
+been backported from the Libav 0.7.2 release. Distributors and system
 integrators are encouraged to update and share their patches against
 this branch.
-
 For a full list of changes please see the Changelog file.
diff --git a/configure b/configure
index 8fab67b186..954398f658 100755
--- a/configure
+++ b/configure
@@ -181,6 +181,7 @@ External library support:
   --enable-libschroedinger enable Dirac support via libschroedinger [no]
   --enable-libspeex        enable Speex decoding via libspeex [no]
   --enable-libtheora       enable Theora encoding via libtheora [no]
+  --enable-libvo-aacenc    enable AAC encoding via libvo-aacenc [no]
   --enable-libvorbis       enable Vorbis encoding via libvorbis,
                            native implementation exists [no]
   --enable-libvpx          enable VP8 support via libvpx [no]
@@ -929,6 +930,7 @@ CONFIG_LIST="
     libschroedinger
     libspeex
     libtheora
+    libvo_aacenc
     libvorbis
     libvpx
     libx264
@@ -1357,6 +1359,7 @@ libschroedinger_decoder_deps="libschroedinger"
 libschroedinger_encoder_deps="libschroedinger"
 libspeex_decoder_deps="libspeex"
 libtheora_encoder_deps="libtheora"
+libvo_aacenc_encoder_deps="libvo_aacenc"
 libvorbis_encoder_deps="libvorbis"
 libvpx_decoder_deps="libvpx"
 libvpx_encoder_deps="libvpx"
@@ -2347,6 +2350,7 @@ die_license_disabled nonfree libfaac
 
 die_license_disabled version3 libopencore_amrnb
 die_license_disabled version3 libopencore_amrwb
+die_license_disabled version3 libvo_aacenc
 
 enabled version3 && { enabled gpl && enable gplv3 || enable lgplv3; }
 
@@ -2623,6 +2627,7 @@ enabled libschroedinger && add_cflags $(pkg-config --cflags schroedinger-1.0) &&
                            require libschroedinger schroedinger/schro.h schro_init $(pkg-config --libs schroedinger-1.0)
 enabled libspeex   && require  libspeex speex/speex.h speex_decoder_init -lspeex
 enabled libtheora  && require  libtheora theora/theoraenc.h th_info_init -ltheoraenc -ltheoradec -logg
+enabled libvo_aacenc && require libvo_aacenc vo-aacenc/voAAC.h voGetAACEncAPI -lvo-aacenc
 enabled libvorbis  && require  libvorbis vorbis/vorbisenc.h vorbis_info_init -lvorbisenc -lvorbis -logg
 enabled libvpx     && require2 libvpx "vpx/vpx_decoder.h vpx/vp8dx.h" "vpx_codec_dec_init_ver" -lvpx &&
                       require2 libvpx "vpx/vpx_encoder.h vpx/vp8cx.h" "vpx_codec_enc_init_ver" -lvpx
@@ -2903,6 +2908,7 @@ echo "librtmp enabled           ${librtmp-no}"
 echo "libschroedinger enabled   ${libschroedinger-no}"
 echo "libspeex enabled          ${libspeex-no}"
 echo "libtheora enabled         ${libtheora-no}"
+echo "libvo-aacenc support      ${libvo_aacenc-no}"
 echo "libvorbis enabled         ${libvorbis-no}"
 echo "libvpx enabled            ${libvpx-no}"
 echo "libx264 enabled           ${libx264-no}"
diff --git a/doc/general.texi b/doc/general.texi
index dfa5b07e18..843d4f681c 100644
--- a/doc/general.texi
+++ b/doc/general.texi
@@ -511,7 +511,7 @@ following image formats are supported:
 @item Name @tab Encoding @tab Decoding @tab Comments
 @item 8SVX audio             @tab     @tab  X
 @item AAC                    @tab  E  @tab  X
-    @tab encoding supported through external library libfaac
+    @tab encoding supported through external library libfaac and libvo-aacenc
 @item AC-3                   @tab IX  @tab  X
 @item ADPCM 4X Movie         @tab     @tab  X
 @item ADPCM CDROM XA         @tab     @tab  X
diff --git a/libavcodec/Makefile b/libavcodec/Makefile
index 3dd24e7e12..4afce9a243 100644
--- a/libavcodec/Makefile
+++ b/libavcodec/Makefile
@@ -527,6 +527,7 @@ OBJS-$(CONFIG_LIBSCHROEDINGER_ENCODER)    += libschroedingerenc.o \
 OBJS-$(CONFIG_LIBSPEEX_DECODER)           += libspeexdec.o
 OBJS-$(CONFIG_LIBTHEORA_ENCODER)          += libtheoraenc.o
 OBJS-$(CONFIG_LIBVORBIS_ENCODER)          += libvorbis.o
+OBJS-$(CONFIG_LIBVO_AACENC_ENCODER)       += libvo-aacenc.o mpeg4audio.o
 OBJS-$(CONFIG_LIBVPX_DECODER)             += libvpxdec.o
 OBJS-$(CONFIG_LIBVPX_ENCODER)             += libvpxenc.o
 OBJS-$(CONFIG_LIBX264_ENCODER)            += libx264.o
diff --git a/libavcodec/allcodecs.c b/libavcodec/allcodecs.c
index aa3001c546..245a77be78 100644
--- a/libavcodec/allcodecs.c
+++ b/libavcodec/allcodecs.c
@@ -343,6 +343,7 @@ void avcodec_register_all(void)
     REGISTER_ENCDEC  (LIBSCHROEDINGER, libschroedinger);
     REGISTER_DECODER (LIBSPEEX, libspeex);
     REGISTER_ENCODER (LIBTHEORA, libtheora);
+    REGISTER_ENCODER (LIBVO_AACENC, libvo_aacenc);
     REGISTER_ENCODER (LIBVORBIS, libvorbis);
     REGISTER_ENCDEC  (LIBVPX, libvpx);
     REGISTER_ENCODER (LIBX264, libx264);
diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c
index 9d6307c217..626f33a4a2 100644
--- a/libavcodec/cavsdec.c
+++ b/libavcodec/cavsdec.c
@@ -130,12 +130,14 @@ static int decode_residual_block(AVSContext *h, GetBitContext *gb,
                 r++;
             mask = -(level_code & 1);
             level = (level^mask) - mask;
-        } else {
+        } else if (level_code >= 0) {
             level = r->rltab[level_code][0];
             if(!level) //end of block signal
                 break;
             run   = r->rltab[level_code][1];
             r += r->rltab[level_code][2];
+        } else {
+            break;
         }
         level_buf[i] = level;
         run_buf[i] = run;
@@ -189,7 +191,8 @@ static inline int decode_residual_inter(AVSContext *h) {
 
 static int decode_mb_i(AVSContext *h, int cbp_code) {
     GetBitContext *gb = &h->s.gb;
-    int block, pred_mode_uv;
+    unsigned pred_mode_uv;
+    int block;
     uint8_t top[18];
     uint8_t *left = NULL;
     uint8_t *d;
@@ -445,6 +448,8 @@ static inline int check_for_slice(AVSContext *h) {
     if((show_bits_long(gb,24+align) & 0xFFFFFF) == 0x000001) {
         skip_bits_long(gb,24+align);
         h->stc = get_bits(gb,8);
+        if (h->stc >= h->mb_height)
+            return 0;
         decode_slice_header(h,gb);
         return 1;
     }
@@ -659,7 +664,7 @@ static int cavs_decode_frame(AVCodecContext * avctx,void *data, int *data_size,
     buf_end = buf + buf_size;
     for(;;) {
         buf_ptr = ff_find_start_code(buf_ptr,buf_end, &stc);
-        if(stc & 0xFFFFFE00)
+        if((stc & 0xFFFFFE00) || buf_ptr == buf_end)
             return FFMAX(0, buf_ptr - buf - s->parse_context.last_index);
         input_size = (buf_end - buf_ptr)*8;
         switch(stc) {
diff --git a/libavcodec/libvo-aacenc.c b/libavcodec/libvo-aacenc.c
new file mode 100644
index 0000000000..da4a7bf07d
--- /dev/null
+++ b/libavcodec/libvo-aacenc.c
@@ -0,0 +1,130 @@
+/*
+ * AAC encoder wrapper
+ * Copyright (c) 2010 Martin Storsjo
+ *
+ * This file is part of Libav.
+ *
+ * Libav is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * Libav is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with Libav; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include <vo-aacenc/voAAC.h>
+#include <vo-aacenc/cmnMemory.h>
+
+#include "avcodec.h"
+#include "mpeg4audio.h"
+
+typedef struct AACContext {
+    VO_AUDIO_CODECAPI codec_api;
+    VO_HANDLE handle;
+    VO_MEM_OPERATOR mem_operator;
+    VO_CODEC_INIT_USERDATA user_data;
+} AACContext;
+
+static av_cold int aac_encode_init(AVCodecContext *avctx)
+{
+    AACContext *s = avctx->priv_data;
+    AACENC_PARAM params = { 0 };
+    int index;
+
+    avctx->coded_frame = avcodec_alloc_frame();
+    avctx->frame_size = 1024;
+
+    voGetAACEncAPI(&s->codec_api);
+
+    s->mem_operator.Alloc = cmnMemAlloc;
+    s->mem_operator.Copy = cmnMemCopy;
+    s->mem_operator.Free = cmnMemFree;
+    s->mem_operator.Set = cmnMemSet;
+    s->mem_operator.Check = cmnMemCheck;
+    s->user_data.memflag = VO_IMF_USERMEMOPERATOR;
+    s->user_data.memData = &s->mem_operator;
+    s->codec_api.Init(&s->handle, VO_AUDIO_CodingAAC, &s->user_data);
+
+    params.sampleRate = avctx->sample_rate;
+    params.bitRate    = avctx->bit_rate;
+    params.nChannels  = avctx->channels;
+    params.adtsUsed   = !(avctx->flags & CODEC_FLAG_GLOBAL_HEADER);
+    if (s->codec_api.SetParam(s->handle, VO_PID_AAC_ENCPARAM, &params)
+        != VO_ERR_NONE) {
+        av_log(avctx, AV_LOG_ERROR, "Unable to set encoding parameters\n");
+        return AVERROR(EINVAL);
+    }
+
+    for (index = 0; index < 16; index++)
+        if (avctx->sample_rate == ff_mpeg4audio_sample_rates[index])
+            break;
+    if (index == 16) {
+        av_log(avctx, AV_LOG_ERROR, "Unsupported sample rate %d\n",
+                                    avctx->sample_rate);
+        return AVERROR(ENOSYS);
+    }
+    if (avctx->flags & CODEC_FLAG_GLOBAL_HEADER) {
+        avctx->extradata_size = 2;
+        avctx->extradata      = av_mallocz(avctx->extradata_size +
+                                           FF_INPUT_BUFFER_PADDING_SIZE);
+        if (!avctx->extradata)
+            return AVERROR(ENOMEM);
+
+        avctx->extradata[0] = 0x02 << 3 | index >> 1;
+        avctx->extradata[1] = (index & 0x01) << 7 | avctx->channels << 3;
+    }
+    return 0;
+}
+
+static int aac_encode_close(AVCodecContext *avctx)
+{
+    AACContext *s = avctx->priv_data;
+
+    s->codec_api.Uninit(s->handle);
+    av_freep(&avctx->coded_frame);
+
+    return 0;
+}
+
+static int aac_encode_frame(AVCodecContext *avctx,
+                            unsigned char *frame/*out*/,
+                            int buf_size, void *data/*in*/)
+{
+    AACContext *s = avctx->priv_data;
+    VO_CODECBUFFER input = { 0 }, output = { 0 };
+    VO_AUDIO_OUTPUTINFO output_info = { { 0 } };
+
+    input.Buffer = data;
+    input.Length = 2 * avctx->channels * avctx->frame_size;
+    output.Buffer = frame;
+    output.Length = buf_size;
+
+    s->codec_api.SetInputData(s->handle, &input);
+    if (s->codec_api.GetOutputData(s->handle, &output, &output_info)
+        != VO_ERR_NONE) {
+        av_log(avctx, AV_LOG_ERROR, "Unable to encode frame\n");
+        return AVERROR(EINVAL);
+    }
+    return output.Length;
+}
+
+AVCodec libvo_aacenc_encoder = {
+    "libvo_aacenc",
+    CODEC_TYPE_AUDIO,
+    CODEC_ID_AAC,
+    sizeof(AACContext),
+    aac_encode_init,
+    aac_encode_frame,
+    aac_encode_close,
+    NULL,
+    .sample_fmts = (const enum SampleFormat[]){SAMPLE_FMT_S16,SAMPLE_FMT_NONE},
+    .long_name = NULL_IF_CONFIG_SMALL("Android VisualOn AAC"),
+};
+
diff --git a/libavcodec/x86/fft_sse.c b/libavcodec/x86/fft_sse.c
index a4cce69db1..eaca44a34f 100644
--- a/libavcodec/x86/fft_sse.c
+++ b/libavcodec/x86/fft_sse.c
@@ -23,7 +23,7 @@
 #include "libavcodec/dsputil.h"
 #include "fft.h"
 
-DECLARE_ALIGNED(16, static const int, m1m1m1m1)[4] =
+DECLARE_ASM_CONST(16, int, ff_m1m1m1m1)[4] =
     { 1 << 31, 1 << 31, 1 << 31, 1 << 31 };
 
 void ff_fft_dispatch_sse(FFTComplex *z, int nbits);
@@ -183,7 +183,7 @@ void ff_imdct_calc_sse(FFTContext *s, FFTSample *output, const FFTSample *input)
     j = -n;
     k = n-16;
     __asm__ volatile(
-        "movaps %4, %%xmm7 \n"
+        "movaps "MANGLE(ff_m1m1m1m1)", %%xmm7 \n"
         "1: \n"
         "movaps       (%2,%1), %%xmm0 \n"
         "movaps       (%3,%0), %%xmm1 \n"
@@ -196,8 +196,7 @@ void ff_imdct_calc_sse(FFTContext *s, FFTSample *output, const FFTSample *input)
         "add $16, %0 \n"
         "jl 1b \n"
         :"+r"(j), "+r"(k)
-        :"r"(output+n4), "r"(output+n4*3),
-         "m"(*m1m1m1m1)
+        :"r"(output+n4), "r"(output+n4*3)
     );
 }
 
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index e254a31416..9745585ca5 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -759,11 +759,15 @@ static int ebml_parse_elem(MatroskaDemuxContext *matroska,
     uint32_t id = syntax->id;
     uint64_t length;
     int res;
+    void *newelem;
 
     data = (char *)data + syntax->data_offset;
     if (syntax->list_elem_size) {
         EbmlList *list = data;
-        list->elem = av_realloc(list->elem, (list->nb_elem+1)*syntax->list_elem_size);
+        newelem = av_realloc(list->elem, (list->nb_elem+1)*syntax->list_elem_size);
+        if (!newelem)
+            return AVERROR(ENOMEM);
+        list->elem = newelem;
         data = (char*)list->elem + list->nb_elem*syntax->list_elem_size;
         memset(data, 0, syntax->list_elem_size);
         list->nb_elem++;
@@ -883,6 +887,7 @@ static int matroska_decode_buffer(uint8_t** buf, int* buf_size,
     uint8_t* data = *buf;
     int isize = *buf_size;
     uint8_t* pkt_data = NULL;
+    uint8_t* newpktdata;
     int pkt_size = isize;
     int result = 0;
     int olen;
@@ -909,7 +914,12 @@ static int matroska_decode_buffer(uint8_t** buf, int* buf_size,
         zstream.avail_in = isize;
         do {
             pkt_size *= 3;
-            pkt_data = av_realloc(pkt_data, pkt_size);
+            newpktdata = av_realloc(pkt_data, pkt_size);
+            if (!newpktdata) {
+                inflateEnd(&zstream);
+                goto failed;
+            }
+            pkt_data = newpktdata;
             zstream.avail_out = pkt_size - zstream.total_out;
             zstream.next_out = pkt_data + zstream.total_out;
             result = inflate(&zstream, Z_NO_FLUSH);
@@ -930,7 +940,12 @@ static int matroska_decode_buffer(uint8_t** buf, int* buf_size,
         bzstream.avail_in = isize;
         do {
             pkt_size *= 3;
-            pkt_data = av_realloc(pkt_data, pkt_size);
+            newpktdata = av_realloc(pkt_data, pkt_size);
+            if (!newpktdata) {
+                BZ2_bzDecompressEnd(&bzstream);
+                goto failed;
+            }
+            pkt_data = newpktdata;
             bzstream.avail_out = pkt_size - bzstream.total_out_lo32;
             bzstream.next_out = pkt_data + bzstream.total_out_lo32;
             result = BZ2_bzDecompress(&bzstream);
@@ -985,13 +1000,17 @@ static void matroska_fix_ass_packet(MatroskaDemuxContext *matroska,
     }
 }
 
-static void matroska_merge_packets(AVPacket *out, AVPacket *in)
+static int matroska_merge_packets(AVPacket *out, AVPacket *in)
 {
-    out->data = av_realloc(out->data, out->size+in->size);
+    void *newdata = av_realloc(out->data, out->size+in->size);
+    if (!newdata)
+        return AVERROR(ENOMEM);
+    out->data = newdata;
     memcpy(out->data+out->size, in->data, in->size);
     out->size += in->size;
     av_destruct_packet(in);
     av_free(in);
+    return 0;
 }
 
 static void matroska_convert_tag(AVFormatContext *s, EbmlList *list,
@@ -1494,11 +1513,13 @@ static int matroska_deliver_packet(MatroskaDemuxContext *matroska,
         memcpy(pkt, matroska->packets[0], sizeof(AVPacket));
         av_free(matroska->packets[0]);
         if (matroska->num_packets > 1) {
+            void *newpackets;
             memmove(&matroska->packets[0], &matroska->packets[1],
                     (matroska->num_packets - 1) * sizeof(AVPacket *));
-            matroska->packets =
-                av_realloc(matroska->packets, (matroska->num_packets - 1) *
-                           sizeof(AVPacket *));
+            newpackets = av_realloc(matroska->packets,
+                            (matroska->num_packets - 1) * sizeof(AVPacket *));
+            if (newpackets)
+                matroska->packets = newpackets;
         } else {
             av_freep(&matroska->packets);
         }
diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c
index 3161e68c6c..76b28ab212 100644
--- a/libavformat/oggdec.c
+++ b/libavformat/oggdec.c
@@ -577,20 +577,19 @@ ogg_read_close (AVFormatContext * s)
 }
 
 
-static int64_t
-ogg_read_timestamp (AVFormatContext * s, int stream_index, int64_t * pos_arg,
-                    int64_t pos_limit)
+static int64_t ogg_read_timestamp (AVFormatContext * s, int stream_index,
+                                   int64_t * pos_arg, int64_t pos_limit)
 {
     struct ogg *ogg = s->priv_data;
-    struct ogg_stream *os = ogg->streams + stream_index;
     ByteIOContext *bc = s->pb;
     int64_t pts = AV_NOPTS_VALUE;
-    int i;
+    int i = -1;
     url_fseek(bc, *pos_arg, SEEK_SET);
     ogg_reset(ogg);
 
     while (url_ftell(bc) < pos_limit && !ogg_packet(s, &i, NULL, NULL, pos_arg)) {
         if (i == stream_index) {
+            struct ogg_stream *os = ogg->streams + stream_index;
             pts = ogg_calc_pts(s, i, NULL);
             if (os->keyframe_seek && !(os->pflags & AV_PKT_FLAG_KEY))
                 pts = AV_NOPTS_VALUE;
@@ -615,6 +614,7 @@ static int ogg_read_seek(AVFormatContext *s, int stream_index, int64_t timestamp
         os->keyframe_seek = 1;
 
     ret = av_seek_frame_binary(s, stream_index, timestamp, flags);
+    os = ogg->streams + stream_index;
     if (ret < 0)
         os->keyframe_seek = 0;
     return ret;
diff --git a/libswscale/swscale_template.c b/libswscale/swscale_template.c
index 0d259ed1a0..b1a28b5bc3 100644
--- a/libswscale/swscale_template.c
+++ b/libswscale/swscale_template.c
@@ -1882,7 +1882,7 @@ static inline void RENAME(bgr24ToY_mmx)(uint8_t *dst, const uint8_t *src, long w
 static inline void RENAME(bgr24ToUV_mmx)(uint8_t *dstU, uint8_t *dstV, const uint8_t *src, long width, enum PixelFormat srcFormat)
 {
     __asm__ volatile(
-        "movq                    24+%4, %%mm6       \n\t"
+        "movq                   24(%4), %%mm6       \n\t"
         "mov                        %3, %%"REG_a"   \n\t"
         "pxor                    %%mm7, %%mm7       \n\t"
         "1:                                         \n\t"
@@ -1893,9 +1893,9 @@ static inline void RENAME(bgr24ToUV_mmx)(uint8_t *dstU, uint8_t *dstV, const uin
         "punpcklbw               %%mm7, %%mm1       \n\t"
         "movq                    %%mm0, %%mm2       \n\t"
         "movq                    %%mm1, %%mm3       \n\t"
-        "pmaddwd                    %4, %%mm0       \n\t"
-        "pmaddwd                  8+%4, %%mm1       \n\t"
-        "pmaddwd                 16+%4, %%mm2       \n\t"
+        "pmaddwd                  (%4), %%mm0       \n\t"
+        "pmaddwd                 8(%4), %%mm1       \n\t"
+        "pmaddwd                16(%4), %%mm2       \n\t"
         "pmaddwd                 %%mm6, %%mm3       \n\t"
         "paddd                   %%mm1, %%mm0       \n\t"
         "paddd                   %%mm3, %%mm2       \n\t"
@@ -1907,9 +1907,9 @@ static inline void RENAME(bgr24ToUV_mmx)(uint8_t *dstU, uint8_t *dstV, const uin
         "punpcklbw               %%mm7, %%mm3       \n\t"
         "movq                    %%mm1, %%mm4       \n\t"
         "movq                    %%mm3, %%mm5       \n\t"
-        "pmaddwd                    %4, %%mm1       \n\t"
-        "pmaddwd                  8+%4, %%mm3       \n\t"
-        "pmaddwd                 16+%4, %%mm4       \n\t"
+        "pmaddwd                  (%4), %%mm1       \n\t"
+        "pmaddwd                 8(%4), %%mm3       \n\t"
+        "pmaddwd                16(%4), %%mm4       \n\t"
         "pmaddwd                 %%mm6, %%mm5       \n\t"
         "paddd                   %%mm3, %%mm1       \n\t"
         "paddd                   %%mm5, %%mm4       \n\t"
@@ -1932,7 +1932,7 @@ static inline void RENAME(bgr24ToUV_mmx)(uint8_t *dstU, uint8_t *dstV, const uin
         "add                        $4, %%"REG_a"   \n\t"
         " js                        1b              \n\t"
     : "+r" (src)
-    : "r" (dstU+width), "r" (dstV+width), "g" ((x86_reg)-width), "m"(ff_bgr24toUV[srcFormat == PIX_FMT_RGB24][0])
+    : "r" (dstU+width), "r" (dstV+width), "g" ((x86_reg)-width), "r"(ff_bgr24toUV[srcFormat == PIX_FMT_RGB24])
     : "%"REG_a
     );
 }