Merge remote-tracking branch 'qatar/master'

* qatar/master:
  build: link test programs with static libraries
  dct-test: remove unused variable cropTbl
  swscale: fix overflow in gray16 vertical scaling.
  get_bits: remove LAST_SKIP_CACHE macro
  swscale: fix integer overflows in RGB pixel writing.
  swscale: add endian conversion for RGB555 and RGB444 pixel formats
  swscale: fix overflows in output of RGB48 pixels.
  get_bits: remove strange/obsolete comments
  get_bits: whitespace (mostly) cosmetics
  swscale: add rgb565 endianess conversion
  get_bits: remove unnecessary #includes
  mp3dec: hack: fix decoding with safe bitstream reader
  fate: fix eatqi test
  adpcm: Check for channels to be a non-zero integer
  swscale: fix overflows in RGB rounding constants.
  get_bits: introduce safe bitreading to prevent overreads.

Conflicts:
	libswscale/swscale.c
	libswscale/swscale_unscaled.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

configure

@@ -116,6 +116,9 @@ Configuration options:
   --disable-vda            disable VDA code
   --enable-runtime-cpudetect detect cpu capabilities at runtime (bigger binary)
   --enable-hardcoded-tables use hardcoded tables instead of runtime generation
+  --disable-safe-bitstream-reader
+                           disable buffer boundary checking in bitreaders
+                           (faster, but may crash)
   --enable-memalign-hack   emulate memalign, interferes with memory debuggers
   --disable-everything     disable all components listed below
   --disable-encoder=NAME   disable encoder NAME
@@ -1060,6 +1063,7 @@ CONFIG_LIST="
     rdft
     rtpdec
     runtime_cpudetect
+    safe_bitstream_reader
     shared
     sinewin
     small
@@ -1812,6 +1816,7 @@ enable doc
 enable fastdiv
 enable network
 enable optimizations
+enable safe_bitstream_reader
 enable static
 enable swscale_alpha
 

libavcodec/adpcm.c

@@ -101,8 +101,9 @@ static av_cold int adpcm_decode_init(AVCodecContext * avctx)
         max_channels = 6;
         break;
     }
-    if(avctx->channels > max_channels){
-        return -1;
+    if (avctx->channels <= 0 || avctx->channels > max_channels) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid number of channels\n");
+        return AVERROR(EINVAL);
     }
 
     switch(avctx->codec->id) {

libavcodec/dct-test.c

@@ -170,8 +170,6 @@ static const struct algo idct_tab[] = {
 
 #define AANSCALE_BITS 12
 
-static uint8_t cropTbl[256 + 2 * MAX_NEG_CROP];
-
 static int64_t gettime(void)
 {
     struct timeval tv;
@@ -557,13 +555,6 @@ int main(int argc, char **argv)
     ff_ref_dct_init();
     idct_mmx_init();
 
-    for (i = 0; i < 256; i++)
-        cropTbl[i + MAX_NEG_CROP] = i;
-    for (i = 0; i < MAX_NEG_CROP; i++) {
-        cropTbl[i] = 0;
-        cropTbl[i + MAX_NEG_CROP + 256] = 255;
-    }
-
     for (;;) {
         c = getopt(argc, argv, "ih4t");
         if (c == -1)

libavcodec/get_bits.h

@@ -27,20 +27,33 @@
 #define AVCODEC_GET_BITS_H
 
 #include <stdint.h>
-#include <stdlib.h>
-#include <assert.h>
-#include "libavutil/bswap.h"
 #include "libavutil/common.h"
 #include "libavutil/intreadwrite.h"
 #include "libavutil/log.h"
 #include "mathops.h"
 
-/* bit input */
-/* buffer, buffer_end and size_in_bits must be present and used by every reader */
+/*
+ * Safe bitstream reading:
+ * optionally, the get_bits API can check to ensure that we
+ * don't read past input buffer boundaries. This is protected
+ * with CONFIG_SAFE_BITSTREAM_READER at the global level, and
+ * then below that with UNCHECKED_BITSTREAM_READER at the per-
+ * decoder level. This means that decoders that check internally
+ * can "#define UNCHECKED_BITSTREAM_READER 1" to disable
+ * overread checks.
+ * Boundary checking causes a minor performance penalty so for
+ * applications that won't want/need this, it can be disabled
+ * globally using "#define CONFIG_SAFE_BITSTREAM_READER 0".
+ */
+#ifndef UNCHECKED_BITSTREAM_READER
+#define UNCHECKED_BITSTREAM_READER !CONFIG_SAFE_BITSTREAM_READER
+#endif
+
 typedef struct GetBitContext {
     const uint8_t *buffer, *buffer_end;
     int index;
     int size_in_bits;
+    int size_in_bits_plus8;
 } GetBitContext;
 
 #define VLC_TYPE int16_t
@@ -93,11 +106,8 @@ SKIP_CACHE(name, gb, num)
 SKIP_COUNTER(name, gb, num)
     will increment the internal bit counter (see SKIP_CACHE & SKIP_BITS)
 
-LAST_SKIP_CACHE(name, gb, num)
-    will remove the next num bits from the cache if it is needed for UPDATE_CACHE otherwise it will do nothing
-
 LAST_SKIP_BITS(name, gb, num)
-    is equivalent to LAST_SKIP_CACHE; SKIP_COUNTER
+    like SKIP_BITS, to be used if next call is UPDATE_CACHE or CLOSE_READER
 
 for examples see get_bits, show_bits, skip_bits, get_vlc
 */
@@ -108,72 +118,82 @@ for examples see get_bits, show_bits, skip_bits, get_vlc
 #   define MIN_CACHE_BITS 25
 #endif
 
-#   define OPEN_READER(name, gb)                \
+#define OPEN_READER(name, gb)                   \
     unsigned int name##_index = (gb)->index;    \
     av_unused unsigned int name##_cache
 
-#   define CLOSE_READER(name, gb) (gb)->index = name##_index
+#define CLOSE_READER(name, gb) (gb)->index = name##_index
+
+#ifdef ALT_BITSTREAM_READER_LE
 
-# ifdef ALT_BITSTREAM_READER_LE
 # ifdef LONG_BITSTREAM_READER
-#   define UPDATE_CACHE(name, gb) \
-    name##_cache = AV_RL64((gb)->buffer+(name##_index>>3)) >> (name##_index&0x07)
+#   define UPDATE_CACHE(name, gb) name##_cache = \
+        AV_RL64((gb)->buffer + (name##_index >> 3)) >> (name##_index & 7)
 # else
-#   define UPDATE_CACHE(name, gb) \
-    name##_cache = AV_RL32((gb)->buffer+(name##_index>>3)) >> (name##_index&0x07)
+#   define UPDATE_CACHE(name, gb) name##_cache = \
+        AV_RL32((gb)->buffer + (name##_index >> 3)) >> (name##_index & 7)
 # endif
 
-#   define SKIP_CACHE(name, gb, num) name##_cache >>= (num)
-# else
+# define SKIP_CACHE(name, gb, num) name##_cache >>= (num)
+
+#else
+
 # ifdef LONG_BITSTREAM_READER
-#   define UPDATE_CACHE(name, gb) \
-    name##_cache = AV_RB64((gb)->buffer+(name##_index >> 3)) >> (32 - (name##_index & 0x07))
+#   define UPDATE_CACHE(name, gb) name##_cache = \
+        AV_RB64((gb)->buffer + (name##_index >> 3)) >> (32 - (name##_index & 7))
 # else
-#   define UPDATE_CACHE(name, gb) \
-    name##_cache = AV_RB32((gb)->buffer+(name##_index>>3)) << (name##_index&0x07)
+#   define UPDATE_CACHE(name, gb) name##_cache = \
+        AV_RB32((gb)->buffer + (name##_index >> 3)) << (name##_index & 7)
 # endif
 
-#   define SKIP_CACHE(name, gb, num) name##_cache <<= (num)
-# endif
+# define SKIP_CACHE(name, gb, num) name##_cache <<= (num)
 
-// FIXME name?
+#endif
+
+#if UNCHECKED_BITSTREAM_READER
 #   define SKIP_COUNTER(name, gb, num) name##_index += (num)
+#else
+#   define SKIP_COUNTER(name, gb, num) \
+    name##_index = FFMIN((gb)->size_in_bits_plus8, name##_index + (num))
+#endif
 
-#   define SKIP_BITS(name, gb, num) do {        \
+#define SKIP_BITS(name, gb, num) do {           \
         SKIP_CACHE(name, gb, num);              \
         SKIP_COUNTER(name, gb, num);            \
     } while (0)
 
-#   define LAST_SKIP_BITS(name, gb, num) SKIP_COUNTER(name, gb, num)
-#   define LAST_SKIP_CACHE(name, gb, num)
+#define LAST_SKIP_BITS(name, gb, num) SKIP_COUNTER(name, gb, num)
 
-# ifdef ALT_BITSTREAM_READER_LE
+#ifdef ALT_BITSTREAM_READER_LE
 #   define SHOW_UBITS(name, gb, num) zero_extend(name##_cache, num)
-
 #   define SHOW_SBITS(name, gb, num) sign_extend(name##_cache, num)
-# else
+#else
 #   define SHOW_UBITS(name, gb, num) NEG_USR32(name##_cache, num)
-
 #   define SHOW_SBITS(name, gb, num) NEG_SSR32(name##_cache, num)
-# endif
+#endif
 
-#   define GET_CACHE(name, gb) ((uint32_t)name##_cache)
+#define GET_CACHE(name, gb) ((uint32_t)name##_cache)
 
-static inline int get_bits_count(const GetBitContext *s){
+static inline int get_bits_count(const GetBitContext *s)
+{
     return s->index;
 }
 
 static inline void skip_bits_long(GetBitContext *s, int n){
+#if UNCHECKED_BITSTREAM_READER
     s->index += n;
+#else
+    s->index += av_clip(n, -s->index, s->size_in_bits_plus8 - s->index);
+#endif
 }
 
 /**
  * read mpeg1 dc style vlc (sign bit + mantisse with no MSB).
  * if MSB not set it is negative
  * @param n length in bits
- * @author BERO
  */
-static inline int get_xbits(GetBitContext *s, int n){
+static inline int get_xbits(GetBitContext *s, int n)
+{
     register int sign;
     register int32_t cache;
     OPEN_READER(re, s);
@@ -185,7 +205,8 @@ static inline int get_xbits(GetBitContext *s, int n){
     return (NEG_USR32(sign ^ cache, n) ^ sign) - sign;
 }
 
-static inline int get_sbits(GetBitContext *s, int n){
+static inline int get_sbits(GetBitContext *s, int n)
+{
     register int tmp;
     OPEN_READER(re, s);
     UPDATE_CACHE(re, s);
@@ -198,7 +219,8 @@ static inline int get_sbits(GetBitContext *s, int n){
 /**
  * Read 1-25 bits.
  */
-static inline unsigned int get_bits(GetBitContext *s, int n){
+static inline unsigned int get_bits(GetBitContext *s, int n)
+{
     register int tmp;
     OPEN_READER(re, s);
     UPDATE_CACHE(re, s);
@@ -211,7 +233,8 @@ static inline unsigned int get_bits(GetBitContext *s, int n){
 /**
  * Show 1-25 bits.
  */
-static inline unsigned int show_bits(GetBitContext *s, int n){
+static inline unsigned int show_bits(GetBitContext *s, int n)
+{
     register int tmp;
     OPEN_READER(re, s);
     UPDATE_CACHE(re, s);
@@ -219,15 +242,16 @@ static inline unsigned int show_bits(GetBitContext *s, int n){
     return tmp;
 }
 
-static inline void skip_bits(GetBitContext *s, int n){
- //Note gcc seems to optimize this to s->index+=n for the ALT_READER :))
+static inline void skip_bits(GetBitContext *s, int n)
+{
     OPEN_READER(re, s);
     UPDATE_CACHE(re, s);
     LAST_SKIP_BITS(re, s, n);
     CLOSE_READER(re, s);
 }
 
-static inline unsigned int get_bits1(GetBitContext *s){
+static inline unsigned int get_bits1(GetBitContext *s)
+{
     unsigned int index = s->index;
     uint8_t result = s->buffer[index>>3];
 #ifdef ALT_BITSTREAM_READER_LE
@@ -237,25 +261,32 @@ static inline unsigned int get_bits1(GetBitContext *s){
     result <<= index & 7;
     result >>= 8 - 1;
 #endif
-    index++;
+#if !UNCHECKED_BITSTREAM_READER
+    if (s->index < s->size_in_bits_plus8)
+#endif
+        index++;
     s->index = index;
 
     return result;
 }
 
-static inline unsigned int show_bits1(GetBitContext *s){
+static inline unsigned int show_bits1(GetBitContext *s)
+{
     return show_bits(s, 1);
 }
 
-static inline void skip_bits1(GetBitContext *s){
+static inline void skip_bits1(GetBitContext *s)
+{
     skip_bits(s, 1);
 }
 
 /**
  * Read 0-32 bits.
  */
-static inline unsigned int get_bits_long(GetBitContext *s, int n){
-    if (n <= MIN_CACHE_BITS) return get_bits(s, n);
+static inline unsigned int get_bits_long(GetBitContext *s, int n)
+{
+    if (n <= MIN_CACHE_BITS)
+        return get_bits(s, n);
     else {
 #ifdef ALT_BITSTREAM_READER_LE
         int ret = get_bits(s, 16);
@@ -270,15 +301,18 @@ static inline unsigned int get_bits_long(GetBitContext *s, int n){
 /**
  * Read 0-32 bits as a signed integer.
  */
-static inline int get_sbits_long(GetBitContext *s, int n) {
+static inline int get_sbits_long(GetBitContext *s, int n)
+{
     return sign_extend(get_bits_long(s, n), n);
 }
 
 /**
  * Show 0-32 bits.
  */
-static inline unsigned int show_bits_long(GetBitContext *s, int n){
-    if (n <= MIN_CACHE_BITS) return show_bits(s, n);
+static inline unsigned int show_bits_long(GetBitContext *s, int n)
+{
+    if (n <= MIN_CACHE_BITS)
+        return show_bits(s, n);
     else {
         GetBitContext gb = *s;
         return get_bits_long(&gb, n);
@@ -299,12 +333,9 @@ static inline int check_marker(GetBitContext *s, const char *msg)
  * @param buffer bitstream buffer, must be FF_INPUT_BUFFER_PADDING_SIZE bytes larger than the actual read bits
  * because some optimized bitstream readers read 32 or 64 bit at once and could read over the end
  * @param bit_size the size of the buffer in bits
- *
- * While GetBitContext stores the buffer size, for performance reasons you are
- * responsible for checking for the buffer end yourself (take advantage of the padding)!
  */
-static inline void init_get_bits(GetBitContext *s,
-                   const uint8_t *buffer, int bit_size)
+static inline void init_get_bits(GetBitContext *s, const uint8_t *buffer,
+                                 int bit_size)
 {
     int buffer_size = (bit_size+7)>>3;
     if (buffer_size < 0 || bit_size < 0) {
@@ -314,6 +345,7 @@ static inline void init_get_bits(GetBitContext *s,
 
     s->buffer       = buffer;
     s->size_in_bits = bit_size;
+    s->size_in_bits_plus8 = bit_size + 8;
     s->buffer_end   = buffer + buffer_size;
     s->index        = 0;
 }
@@ -355,7 +387,8 @@ void free_vlc(VLC *vlc);
  * If the vlc code is invalid and max_depth>1, then the number of bits removed
  * is undefined.
  */
-#define GET_VLC(code, name, gb, table, bits, max_depth) do {    \
+#define GET_VLC(code, name, gb, table, bits, max_depth)         \
+    do {                                                        \
         int n, nb_bits;                                         \
         unsigned int index;                                     \
                                                                 \
@@ -386,7 +419,8 @@ void free_vlc(VLC *vlc);
         SKIP_BITS(name, gb, n);                                 \
     } while (0)
 
-#define GET_RL_VLC(level, run, name, gb, table, bits, max_depth, need_update) do { \
+#define GET_RL_VLC(level, run, name, gb, table, bits, max_depth, need_update) \
+    do {                                                                \
         int n, nb_bits;                                                 \
         unsigned int index;                                             \
                                                                         \
@@ -412,7 +446,7 @@ void free_vlc(VLC *vlc);
 
 
 /**
- * Parse a vlc code, faster than get_vlc().
+ * Parse a vlc code.
  * @param bits is the number of bits which will be read at once, must be
  *             identical to nb_bits in init_vlc()
  * @param max_depth is the number of times bits bits must be read to completely
@@ -420,7 +454,7 @@ void free_vlc(VLC *vlc);
  *                  = (max_vlc_length + bits - 1) / bits
  */
 static av_always_inline int get_vlc2(GetBitContext *s, VLC_TYPE (*table)[2],
-                                  int bits, int max_depth)
+                                     int bits, int max_depth)
 {
     int code;
 
@@ -433,7 +467,8 @@ static av_always_inline int get_vlc2(GetBitContext *s, VLC_TYPE (*table)[2],
     return code;
 }
 
-static inline int decode012(GetBitContext *gb){
+static inline int decode012(GetBitContext *gb)
+{
     int n;
     n = get_bits1(gb);
     if (n == 0)
@@ -442,7 +477,8 @@ static inline int decode012(GetBitContext *gb){
         return get_bits1(gb) + 1;
 }
 
-static inline int decode210(GetBitContext *gb){
+static inline int decode210(GetBitContext *gb)
+{
     if (get_bits1(gb))
         return 0;
     else
@@ -457,7 +493,8 @@ static inline int get_bits_left(GetBitContext *gb)
 //#define TRACE
 
 #ifdef TRACE
-static inline void print_bin(int bits, int n){
+static inline void print_bin(int bits, int n)
+{
     int i;
 
     for (i = n-1; i >= 0; i--) {
@@ -468,7 +505,8 @@ static inline void print_bin(int bits, int n){
 }
 
 static inline int get_bits_trace(GetBitContext *s, int n, char *file,
-                                 const char *func, int line){
+                                 const char *func, int line)
+{
     int r = get_bits(s, n);
 
     print_bin(r, n);
@@ -478,7 +516,8 @@ static inline int get_bits_trace(GetBitContext *s, int n, char *file,
 }
 static inline int get_vlc_trace(GetBitContext *s, VLC_TYPE (*table)[2],
                                 int bits, int max_depth, char *file,
-                                const char *func, int line){
+                                const char *func, int line)
+{
     int show  = show_bits(s, 24);
     int pos   = get_bits_count(s);
     int r     = get_vlc2(s, table, bits, max_depth);
@@ -492,7 +531,8 @@ static inline int get_vlc_trace(GetBitContext *s, VLC_TYPE (*table)[2],
     return r;
 }
 static inline int get_xbits_trace(GetBitContext *s, int n, char *file,
-                                  const char *func, int line){
+                                  const char *func, int line)
+{
     int show = show_bits(s, n);
     int r    = get_xbits(s, n);
 

libavcodec/mpeg4videodec.c

@@ -930,7 +930,7 @@ static inline int mpeg4_decode_block(MpegEncContext * s, DCTELEM * block,
                 }; SKIP_CACHE(re, &s->gb, 1);
 
                 last=  SHOW_UBITS(re, &s->gb, 1); SKIP_CACHE(re, &s->gb, 1);
-                run=   SHOW_UBITS(re, &s->gb, 6); LAST_SKIP_CACHE(re, &s->gb, 6);
+                run=   SHOW_UBITS(re, &s->gb, 6);
                 SKIP_COUNTER(re, &s->gb, 1+1+6);
                 UPDATE_CACHE(re, &s->gb);
 
@@ -947,7 +947,7 @@ static inline int mpeg4_decode_block(MpegEncContext * s, DCTELEM * block,
                 }; SKIP_CACHE(re, &s->gb, 5);
 
                 level=  level * qmul + qadd;
-                level = (level ^ SHOW_SBITS(re, &s->gb, 1)) - SHOW_SBITS(re, &s->gb, 1); LAST_SKIP_CACHE(re, &s->gb, 1);
+                level = (level ^ SHOW_SBITS(re, &s->gb, 1)) - SHOW_SBITS(re, &s->gb, 1);
                 SKIP_COUNTER(re, &s->gb, 1+11+5+1);
 
                 i+= run + 1;
@@ -964,7 +964,7 @@ static inline int mpeg4_decode_block(MpegEncContext * s, DCTELEM * block,
                     /* third escape */
                     SKIP_CACHE(re, &s->gb, 2);
                     last=  SHOW_UBITS(re, &s->gb, 1); SKIP_CACHE(re, &s->gb, 1);
-                    run=   SHOW_UBITS(re, &s->gb, 6); LAST_SKIP_CACHE(re, &s->gb, 6);
+                    run=   SHOW_UBITS(re, &s->gb, 6);
                     SKIP_COUNTER(re, &s->gb, 2+1+6);
                     UPDATE_CACHE(re, &s->gb);
 
@@ -981,7 +981,7 @@ static inline int mpeg4_decode_block(MpegEncContext * s, DCTELEM * block,
                         if(SHOW_UBITS(re, &s->gb, 1)==0){
                             av_log(s->avctx, AV_LOG_ERROR, "2. marker bit missing in 3. esc\n");
                             return -1;
-                        }; LAST_SKIP_CACHE(re, &s->gb, 1);
+                        }
 
                         SKIP_COUNTER(re, &s->gb, 1+12+1);
                     }

libavcodec/mpegaudiodec.c

@@ -24,6 +24,8 @@
  * MPEG Audio decoder
  */
 
+#define UNCHECKED_BITSTREAM_READER 1
+
 #include "libavutil/audioconvert.h"
 #include "avcodec.h"
 #include "get_bits.h"
@@ -1434,6 +1436,9 @@ static int mp_decode_layer3(MPADecodeContext *s)
         memcpy(s->last_buf + s->last_buf_size, ptr, EXTRABYTES);
         s->in_gb = s->gb;
         init_get_bits(&s->gb, s->last_buf, s->last_buf_size*8);
+#if CONFIG_SAFE_BITSTREAM_READER
+        s->gb.size_in_bits_plus8 += EXTRABYTES * 8;
+#endif
         skip_bits_long(&s->gb, 8*(s->last_buf_size - main_data_begin));
     }
 

libavcodec/msmpeg4.c

@@ -1691,7 +1691,7 @@ int ff_msmpeg4_decode_block(MpegEncContext * s, DCTELEM * block,
                     if(s->msmpeg4_version<=3){
                         last=  SHOW_UBITS(re, &s->gb, 1); SKIP_CACHE(re, &s->gb, 1);
                         run=   SHOW_UBITS(re, &s->gb, 6); SKIP_CACHE(re, &s->gb, 6);
-                        level= SHOW_SBITS(re, &s->gb, 8); LAST_SKIP_CACHE(re, &s->gb, 8);
+                        level= SHOW_SBITS(re, &s->gb, 8);
                         SKIP_COUNTER(re, &s->gb, 1+6+8);
                     }else{
                         int sign;

libavcodec/wmavoice.c

@@ -25,6 +25,8 @@
  * @author Ronald S. Bultje <rsbultje@gmail.com>
  */
 
+#define UNCHECKED_BITSTREAM_READER 1
+
 #include <math.h>
 #include "avcodec.h"
 #include "get_bits.h"

library.mak

@@ -97,6 +97,7 @@ endef
 $(eval $(RULES))
 
 $(EXAMPLES) $(TESTPROGS) $(TOOLS): $(THIS_LIB) $(DEP_LIBS)
+$(TESTPROGS): $(SUBDIR)$(LIBNAME)
 
 examples: $(EXAMPLES)
 testprogs: $(TESTPROGS)

libswscale/swscale.c

@@ -483,8 +483,8 @@ yuv2gray16_X_c_template(SwsContext *c, const int16_t *lumFilter,
 
     for (i = 0; i < (dstW >> 1); i++) {
         int j;
-        int Y1 = 1 << 14;
-        int Y2 = 1 << 14;
+        int Y1 = (1 << 14) - 0x40000000;
+        int Y2 = (1 << 14) - 0x40000000;
 
         for (j = 0; j < lumFilterSize; j++) {
             Y1 += lumSrc[j][i * 2]     * lumFilter[j];
@@ -492,12 +492,10 @@ yuv2gray16_X_c_template(SwsContext *c, const int16_t *lumFilter,
         }
         Y1 >>= 15;
         Y2 >>= 15;
-        if ((Y1 | Y2) & 0x10000) {
-            Y1 = av_clip_uint16(Y1);
-            Y2 = av_clip_uint16(Y2);
-        }
-        output_pixel(&dest[i * 2 + 0], Y1);
-        output_pixel(&dest[i * 2 + 1], Y2);
+        Y1 = av_clip_int16(Y1);
+        Y2 = av_clip_int16(Y2);
+        output_pixel(&dest[i * 2 + 0], 0x8000 + Y1);
+        output_pixel(&dest[i * 2 + 1], 0x8000 + Y2);
     }
 }
 
@@ -851,8 +849,8 @@ yuv2rgb48_X_c_template(SwsContext *c, const int16_t *lumFilter,
 
     for (i = 0; i < (dstW >> 1); i++) {
         int j;
-        int Y1 = 0;
-        int Y2 = 0;
+        int Y1 = -0x40000000;
+        int Y2 = -0x40000000;
         int U  = -128 << 23; // 19
         int V  = -128 << 23;
         int R, G, B;
@@ -868,7 +866,9 @@ yuv2rgb48_X_c_template(SwsContext *c, const int16_t *lumFilter,
 
         // 8bit: 12+15=27; 16-bit: 12+19=31
         Y1 >>= 14; // 10
+        Y1 += 0x10000;
         Y2 >>= 14;
+        Y2 += 0x10000;
         U  >>= 14;
         V  >>= 14;
 
@@ -1015,8 +1015,8 @@ YUV2PACKED16WRAPPER(yuv2, rgb48, bgr48be, PIX_FMT_BGR48BE)
 YUV2PACKED16WRAPPER(yuv2, rgb48, bgr48le, PIX_FMT_BGR48LE)
 
 static av_always_inline void
-yuv2rgb_write(uint8_t *_dest, int i, int Y1, int Y2,
-              int U, int V, int A1, int A2,
+yuv2rgb_write(uint8_t *_dest, int i, unsigned Y1, unsigned Y2,
+              unsigned U, unsigned V, unsigned A1, unsigned A2,
               const void *_r, const void *_g, const void *_b, int y,
               enum PixelFormat target, int hasAlpha)
 {
@@ -1553,8 +1553,8 @@ rgb16_32ToY_c_template(int16_t *dst, const uint8_t *src,
                        int maskr, int maskg, int maskb,
                        int rsh,   int gsh,   int bsh, int S)
 {
-    const int ry = RY << rsh, gy = GY << gsh, by = BY << bsh,
-              rnd = (32<<((S)-1)) + (1<<(S-7));
+    const int ry = RY << rsh, gy = GY << gsh, by = BY << bsh;
+    const unsigned rnd = (32<<((S)-1)) + (1<<(S-7));
     int i;
 
     for (i = 0; i < width; i++) {
@@ -1576,8 +1576,8 @@ rgb16_32ToUV_c_template(int16_t *dstU, int16_t *dstV,
                         int rsh,   int gsh,   int bsh, int S)
 {
     const int ru = RU << rsh, gu = GU << gsh, bu = BU << bsh,
-              rv = RV << rsh, gv = GV << gsh, bv = BV << bsh,
-              rnd = (256<<((S)-1)) + (1<<(S-7));
+              rv = RV << rsh, gv = GV << gsh, bv = BV << bsh;
+    const unsigned rnd = (256u<<((S)-1)) + (1<<(S-7));
     int i;
 
     for (i = 0; i < width; i++) {
@@ -1601,7 +1601,8 @@ rgb16_32ToUV_half_c_template(int16_t *dstU, int16_t *dstV,
 {
     const int ru = RU << rsh, gu = GU << gsh, bu = BU << bsh,
               rv = RV << rsh, gv = GV << gsh, bv = BV << bsh,
-              rnd = (256U<<(S)) + (1<<(S-6)), maskgx = ~(maskr | maskb);
+              maskgx = ~(maskr | maskb);
+    const unsigned rnd = (256U<<(S)) + (1<<(S-6));
     int i;
 
     maskr |= maskr << 1; maskb |= maskb << 1; maskg |= maskg << 1;

libswscale/swscale_unscaled.c

@@ -667,6 +667,12 @@ static int planarCopyWrapper(SwsContext *c, const uint8_t* src[], int srcStride[
     return srcSliceH;
 }
 
+
+#define IS_DIFFERENT_ENDIANESS(src_fmt, dst_fmt, pix_fmt)          \
+    ((src_fmt == pix_fmt ## BE && dst_fmt == pix_fmt ## LE) ||     \
+     (src_fmt == pix_fmt ## LE && dst_fmt == pix_fmt ## BE))
+
+
 void ff_get_unscaled_swscale(SwsContext *c)
 {
     const enum PixelFormat srcFormat = c->srcFormat;
@@ -697,15 +703,6 @@ void ff_get_unscaled_swscale(SwsContext *c)
     if (srcFormat==PIX_FMT_BGR24 && (dstFormat==PIX_FMT_YUV420P || dstFormat==PIX_FMT_YUVA420P) && !(flags & SWS_ACCURATE_RND))
         c->swScale= bgr24ToYv12Wrapper;
 
-    /* bswap 16 bits per component packed formats */
-    if ((srcFormat == PIX_FMT_RGB48LE  && dstFormat == PIX_FMT_RGB48BE)  ||
-        (srcFormat == PIX_FMT_RGB48BE  && dstFormat == PIX_FMT_RGB48LE)  ||
-        (srcFormat == PIX_FMT_BGR48LE  && dstFormat == PIX_FMT_BGR48BE)  ||
-        (srcFormat == PIX_FMT_BGR48BE  && dstFormat == PIX_FMT_BGR48LE)  ||
-        (srcFormat == PIX_FMT_GRAY16LE && dstFormat == PIX_FMT_GRAY16BE) ||
-        (srcFormat == PIX_FMT_GRAY16BE && dstFormat == PIX_FMT_GRAY16LE))
-        c->swScale = packed_16bpc_bswap;
-
     /* RGB/BGR -> RGB/BGR (no dither needed forms) */
     if (   isAnyRGB(srcFormat)
         && isAnyRGB(dstFormat)
@@ -735,6 +732,18 @@ void ff_get_unscaled_swscale(SwsContext *c)
     if (isAnyRGB(srcFormat) && isPlanar(srcFormat) && isByteRGB(dstFormat))
         c->swScale= planarRgbToRgbWrapper;
 
+    /* bswap 16 bits per pixel/component packed formats */
+    if (IS_DIFFERENT_ENDIANESS(srcFormat, dstFormat, PIX_FMT_BGR444) ||
+        IS_DIFFERENT_ENDIANESS(srcFormat, dstFormat, PIX_FMT_BGR48)  ||
+        IS_DIFFERENT_ENDIANESS(srcFormat, dstFormat, PIX_FMT_BGR555) ||
+        IS_DIFFERENT_ENDIANESS(srcFormat, dstFormat, PIX_FMT_BGR565) ||
+        IS_DIFFERENT_ENDIANESS(srcFormat, dstFormat, PIX_FMT_GRAY16) ||
+        IS_DIFFERENT_ENDIANESS(srcFormat, dstFormat, PIX_FMT_RGB444) ||
+        IS_DIFFERENT_ENDIANESS(srcFormat, dstFormat, PIX_FMT_RGB48)  ||
+        IS_DIFFERENT_ENDIANESS(srcFormat, dstFormat, PIX_FMT_RGB555) ||
+        IS_DIFFERENT_ENDIANESS(srcFormat, dstFormat, PIX_FMT_RGB565))
+        c->swScale = packed_16bpc_bswap;
+
     if (usePal(srcFormat) && isByteRGB(dstFormat))
         c->swScale= palToRgbWrapper;
 

tests/fate.mak

@@ -89,7 +89,7 @@ fate-ea-tgv-ima-ea-eacs: CMD = framecrc  -i $(SAMPLES)/ea-tgv/INTRO8K-partial.TG
 FATE_TESTS += fate-ea-tgv-ima-ea-sead
 fate-ea-tgv-ima-ea-sead: CMD = framecrc  -i $(SAMPLES)/ea-tgv/INTEL_S.TGV -pix_fmt rgb24
 FATE_TESTS += fate-ea-tqi-adpcm
-fate-ea-tqi-adpcm: CMD = framecrc  -i $(SAMPLES)/ea-wve/networkBackbone-partial.wve
+fate-ea-tqi-adpcm: CMD = framecrc  -i $(SAMPLES)/ea-wve/networkBackbone-partial.wve -frames:v 26
 FATE_TESTS += fate-ea-vp60
 fate-ea-vp60: CMD = framecrc  -i $(SAMPLES)/ea-vp6/g36.vp6
 FATE_TESTS += fate-ea-vp61

tests/ref/fate/ea-tqi-adpcm

@@ -49,4 +49,3 @@
 0, 144000, 115200, 0x65fd5e60
 1, 144000, 5936, 0x2174304d
 0, 150000, 115200, 0x0c256424
-0, 156000, 115200, 0xa9cdd8d2