Merge remote-tracking branch 'qatar/master'

* qatar/master:
  mpeg12: fixed parsing in some mpeg2 streams
  Add SMPTE240M transfer characteristics flag.
  mpegts: Some additional HDMV types and reg descriptors for mpegts
  motionpixels: Clip YUV values after applying a gradient.
  jpeg: handle progressive in second field of interlaced.
  ituh263dec: Implement enough of Annex O (scalability) to fix a FPE.
  h263: more strictly forbid frame size changes with frame-mt.
  h264: additional protection against unsupported size/bitdepth changes.
  tta: prevents overflows for 32bit integers in header.
  configure: remove malloc_aligned.
  vp8: update frame size changes on thread context switches.
  snowdsp: explicitily state instruction size.
  wmall: fix reconstructing audio with uncoded channels
  WMAL cosmetics: fix indentation
  gitignore: add Win32 library suffixes

Conflicts:
	configure
	libavcodec/h263dec.c
	libavcodec/h264.c
	libavcodec/ituh263dec.c
	libavcodec/mjpegdec.c
	libavcodec/wmalosslessdec.c
	libavcodec/x86/snowdsp_mmx.c
	libavformat/mpegts.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

9 files changed, 41 insertions, 24 deletions

diff --git a/libavcodec/h263dec.c b/libavcodec/h263dec.c
index 4e8ff5d6bf..3967ff2865 100644
--- a/libavcodec/h263dec.c
+++ b/libavcodec/h263dec.c
@@ -452,6 +452,15 @@ retry:
     if (ret < 0){
         av_log(s->avctx, AV_LOG_ERROR, "header damaged\n");
         return -1;
+    } else if ((s->width  != avctx->coded_width  ||
+                s->height != avctx->coded_height ||
+                (s->width  + 15) >> 4 != s->mb_width ||
+                (s->height + 15) >> 4 != s->mb_height) &&
+               (HAVE_THREADS && (s->avctx->active_thread_type & FF_THREAD_FRAME))) {
+        av_log_missing_feature(s->avctx, "Width/height/bit depth/chroma idc changing with threads is", 0);
+        s->width = avctx->coded_width;
+        s->height= avctx->coded_height;
+        return AVERROR_PATCHWELCOME;   // width / height changed during parallelized decoding
     }
 
     avctx->has_b_frames= !s->low_delay;
@@ -592,13 +601,6 @@ retry:
         /* H.263 could change picture size any time */
         ParseContext pc= s->parse_context; //FIXME move these demuxng hack to avformat
 
-        if (HAVE_THREADS && (s->avctx->active_thread_type&FF_THREAD_FRAME)) {
-            av_log_missing_feature(s->avctx, "Width/height/bit depth/chroma idc changing with threads is", 0);
-            s->width = avctx->coded_width;
-            s->height= avctx->coded_height;
-            return -1;   // width / height changed during parallelized decoding
-        }
-
         s->parse_context.buffer=0;
         ff_MPV_common_end(s);
         s->parse_context= pc;
diff --git a/libavcodec/h264.c b/libavcodec/h264.c
index 117cd7e630..85787f40d1 100644
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -2956,7 +2956,7 @@ static int decode_slice_header(H264Context *h, H264Context *h0)
     if(must_reinit && (h != h0 || (s->avctx->active_thread_type & FF_THREAD_FRAME))) {
         av_log_missing_feature(s->avctx,
                                 "Width/height/bit depth/chroma idc changing with threads is", 0);
-        return -1;   // width / height changed during parallelized decoding
+        return AVERROR_PATCHWELCOME;   // width / height changed during parallelized decoding
     }
 
     s->mb_width  = h->sps.mb_width;
diff --git a/libavcodec/h264_ps.c b/libavcodec/h264_ps.c
index 82b4e6740e..261e2d2719 100644
--- a/libavcodec/h264_ps.c
+++ b/libavcodec/h264_ps.c
@@ -522,6 +522,9 @@ int ff_h264_decode_picture_parameter_set(H264Context *h, int bit_length){
     if(pps_id >= MAX_PPS_COUNT) {
         av_log(h->s.avctx, AV_LOG_ERROR, "pps_id (%d) out of range\n", pps_id);
         return -1;
+    } else if (h->sps.bit_depth_luma > 10) {
+        av_log(h->s.avctx, AV_LOG_ERROR, "Unimplemented luma bit depth=%d (max=10)\n", h->sps.bit_depth_luma);
+        return AVERROR_PATCHWELCOME;
     }
 
     pps= av_mallocz(sizeof(PPS));
diff --git a/libavcodec/ituh263dec.c b/libavcodec/ituh263dec.c
index a16b17f4b5..34a9e816ae 100644
--- a/libavcodec/ituh263dec.c
+++ b/libavcodec/ituh263dec.c
@@ -1086,13 +1086,15 @@ int ff_h263_decode_picture_header(MpegEncContext *s)
     }
 
     if (s->pict_type!=AV_PICTURE_TYPE_B) {
-        s->time= s->picture_number;
-        s->pp_time= s->time - s->last_non_b_time;
-        s->last_non_b_time= s->time;
+        s->time            = s->picture_number;
+        s->pp_time         = s->time - s->last_non_b_time;
+        s->last_non_b_time = s->time;
     }else{
-        s->time= s->picture_number;
-        s->pb_time= s->pp_time - (s->last_non_b_time - s->time);
-        if(s->pp_time <=s->pb_time || s->pp_time <= s->pp_time - s->pb_time || s->pp_time<=0){
+        s->time    = s->picture_number;
+        s->pb_time = s->pp_time - (s->last_non_b_time - s->time);
+        if (s->pp_time <=s->pb_time ||
+            s->pp_time <= s->pp_time - s->pb_time ||
+            s->pp_time <= 0){
             s->pp_time = 2;
             s->pb_time = 1;
         }
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index a841384af2..1e19b0c4ba 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -326,9 +326,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
             av_log_ask_for_sample(s->avctx, "progressively coded interlaced pictures not supported\n");
             return AVERROR_INVALIDDATA;
         }
-        return 0;
-    }
-
+    } else{
     /* XXX: not complete test ! */
     pix_fmt_id = (s->h_count[0] << 28) | (s->v_count[0] << 24) |
                  (s->h_count[1] << 20) | (s->v_count[1] << 16) |
@@ -445,6 +443,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
 
     if (len != (8 + (3 * nb_components)))
         av_log(s->avctx, AV_LOG_DEBUG, "decode_sof0: error, len(%d) mismatch\n", len);
+    }
 
     /* totally blank picture as progressive JPEG will only add details to it */
     if (s->progressive) {
diff --git a/libavcodec/motionpixels.c b/libavcodec/motionpixels.c
index 8c34e8b113..0ff8f3a54f 100644
--- a/libavcodec/motionpixels.c
+++ b/libavcodec/motionpixels.c
@@ -191,10 +191,13 @@ static void mp_decode_line(MotionPixelsContext *mp, GetBitContext *gb, int y)
             p = mp_get_yuv_from_rgb(mp, x - 1, y);
         } else {
             p.y += mp_gradient(mp, 0, mp_get_vlc(mp, gb));
+            p.y = av_clip(p.y, 0, 31);
             if ((x & 3) == 0) {
                 if ((y & 3) == 0) {
                     p.v += mp_gradient(mp, 1, mp_get_vlc(mp, gb));
+                    p.v = av_clip(p.v, -32, 31);
                     p.u += mp_gradient(mp, 2, mp_get_vlc(mp, gb));
+                    p.u = av_clip(p.u, -32, 31);
                     mp->hpt[((y / 4) * mp->avctx->width + x) / 4] = p;
                 } else {
                     p.v = mp->hpt[((y / 4) * mp->avctx->width + x) / 4].v;
@@ -218,9 +221,12 @@ static void mp_decode_frame_helper(MotionPixelsContext *mp, GetBitContext *gb)
             p = mp_get_yuv_from_rgb(mp, 0, y);
         } else {
             p.y += mp_gradient(mp, 0, mp_get_vlc(mp, gb));
+            p.y = av_clip(p.y, 0, 31);
             if ((y & 3) == 0) {
                 p.v += mp_gradient(mp, 1, mp_get_vlc(mp, gb));
+                p.v = av_clip(p.v, -32, 31);
                 p.u += mp_gradient(mp, 2, mp_get_vlc(mp, gb));
+                p.u = av_clip(p.u, -32, 31);
             }
             mp->vpt[y] = p;
             mp_set_rgb_from_yuv(mp, 0, y, &p);
diff --git a/libavcodec/tta.c b/libavcodec/tta.c
index 83d45abedf..03fa12d5dc 100644
--- a/libavcodec/tta.c
+++ b/libavcodec/tta.c
@@ -61,7 +61,8 @@ typedef struct TTAContext {
     GetBitContext gb;
     const AVCRC *crc_table;
 
-    int format, channels, bps, data_length;
+    int format, channels, bps;
+    unsigned data_length;
     int frame_length, last_frame_length, total_frames;
 
     int32_t *decode_buffer;
@@ -235,7 +236,7 @@ static av_cold int tta_decode_init(AVCodecContext * avctx)
         }
 
         // prevent overflow
-        if (avctx->sample_rate > 0x7FFFFF) {
+        if (avctx->sample_rate > 0x7FFFFFu) {
             av_log(avctx, AV_LOG_ERROR, "sample_rate too large\n");
             return AVERROR(EINVAL);
         }
@@ -255,7 +256,8 @@ static av_cold int tta_decode_init(AVCodecContext * avctx)
             return AVERROR_INVALIDDATA;
 
         // FIXME: seek table
-        if (get_bits_left(&s->gb) < 32 * s->total_frames + 32)
+        if (avctx->extradata_size <= 26 || s->total_frames > INT_MAX / 4 ||
+            avctx->extradata_size - 26 < s->total_frames * 4)
             av_log(avctx, AV_LOG_WARNING, "Seek table missing or too small\n");
         else if (avctx->err_recognition & AV_EF_CRCCHECK) {
             if (avctx->extradata_size < 26 + s->total_frames * 4 || tta_check_crc(s, avctx->extradata + 22, s->total_frames * 4))
diff --git a/libavcodec/vp8.c b/libavcodec/vp8.c
index 1ca5bab238..dfaa4cde4f 100644
--- a/libavcodec/vp8.c
+++ b/libavcodec/vp8.c
@@ -1834,6 +1834,8 @@ static int vp8_decode_update_thread_context(AVCodecContext *dst, const AVCodecCo
         (s_src->mb_width != s->mb_width || s_src->mb_height != s->mb_height)) {
         free_buffers(s);
         s->maps_are_invalid = 1;
+        s->mb_width  = s_src->mb_width;
+        s->mb_height = s_src->mb_height;
     }
 
     s->prob[0] = s_src->prob[!s_src->update_probabilities];
diff --git a/libavcodec/wmalosslessdec.c b/libavcodec/wmalosslessdec.c
index 48b767b18a..879bfb6d0e 100644
--- a/libavcodec/wmalosslessdec.c
+++ b/libavcodec/wmalosslessdec.c
@@ -793,7 +793,7 @@ static void revert_inter_ch_decorr(WmallDecodeCtx *s, int tile_size)
 {
     if (s->num_channels != 2)
         return;
-    else {
+    else if (s->is_channel_coded[0] || s->is_channel_coded[1]) {
         int icoef;
         for (icoef = 0; icoef < tile_size; icoef++) {
             s->channel_residues[0][icoef] -= s->channel_residues[1][icoef] >> 1;
@@ -959,8 +959,9 @@ static int decode_subframe(WmallDecodeCtx *s)
                 else
                     use_normal_update_speed(s, i);
                 revert_cdlms(s, i, 0, subframe_len);
-            } else
-                memset(s->channel_residues[i], 0, sizeof(s->channel_residues[i]));
+            } else {
+                memset(s->channel_residues[i], 0, sizeof(**s->channel_residues) * subframe_len);
+            }
     }
     if (s->do_mclms)
         revert_mclms(s, subframe_len);
@@ -1217,7 +1218,7 @@ static int decode_packet(AVCodecContext *avctx, void *data, int *got_frame_ptr,
 
             /* decode the cross packet frame if it is valid */
             if (num_bits_prev_frame < remaining_packet_bits && !s->packet_loss)
-                    decode_frame(s);
+                decode_frame(s);
         } else if (s->num_saved_bits - s->frame_offset) {
             av_dlog(avctx, "ignoring %x previously saved bits\n",
                     s->num_saved_bits - s->frame_offset);