Fixes: integer overflows
Fixes: 911/clusterfuzz-testcase-5415105606975488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpegReviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

* commit '212c6a1d':
  mjpegdec: Check return values of functions that may fail
Merged-by: Clément Bœsch <u@pkh.me>

* commit '3ee5f25d':
  dxva2: Adjust printf length modifiers where appropriate
Merged-by: Clément Bœsch <u@pkh.me>

* commit '239d02ef':
  avisynth: Cast to the right type when loading avisynth library functions

This commit is a noop, we are using dlsym() instead of GetProcAdress().
Merged-by: Clément Bœsch <u@pkh.me>

* commit '3fe2a01d':
  lavc: move decoding-related code from utils.c to a new file
Merged-by: James Almer <jamrial@gmail.com>

* commit '328cd2b5':
  lavc: move encoding-related code from utils.c to a new file
Merged-by: James Almer <jamrial@gmail.com>

* commit '45d199d5':
  aac_adtstoasc_bsf: validate and forward extradata if the stream is already ASC

This commit is a noop, see 6e1902baMerged-by: James Almer <jamrial@gmail.com>

* commit '1762a39e':
  mss2: only use error correction for matching block counts

This commit is a noop, see 2566ad98Merged-by: James Almer <jamrial@gmail.com>

* commit 'd0c84c41':
  avconv: Fix the audio next dts computation

This commit is a noop.
Merged-by: James Almer <jamrial@gmail.com>

Signed-off-by: James Almer <jamrial@gmail.com>

* commit 'eb135516':
  ac3enc: Avoid unnecessary macro indirections

This commit is a noop.
Merged-by: James Almer <jamrial@gmail.com>

* commit 'f0d3e43b':
  ac3enc: Reshuffle functions to avoid forward declarations
Merged-by: James Almer <jamrial@gmail.com>

* commit 'e22c63ac':
  ac3enc: Reshuffle some float/fixed-mode ifdefs to avoid a dummy function
Merged-by: James Almer <jamrial@gmail.com>

* commit 'd30719e6':
  hwcontext_vaapi: Don't abort on failing to allocate from a fixed-size pool

This commit is a noop, see 2b8151c8Merged-by: James Almer <jamrial@gmail.com>

* commit '4adbb44a':
  tta: avoid undefined shifts
Merged-by: James Almer <jamrial@gmail.com>

* commit 'dc4b6250':
  tta: use get_unary() instead of a custom implementation

This commit is a noop, see 58b36959Merged-by: James Almer <jamrial@gmail.com>

* commit 'e122b12c':
  build: Drop gcrypt support

This commit is a noop. GCrypt support is exposed in configure as a
command line option, and it's independent of GnuTLS.
Merged-by: James Almer <jamrial@gmail.com>

avcodec/dvdsubdec: Fixes 2 runtime error: left shift of 170 by 24 places cannot be represented in type 'int'

Fixes: 619/clusterfuzz-testcase-5803914534322176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpegSigned-off-by: Michael Niedermayer <michael@niedermayer.cc>

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

It is assigned from 64bit input in some branches and used with 64bit timestamps
This thus fixes a potential integer truncation
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Consider the following sequence of events:

- open a codec without AV_CODEC_CAP_DELAY
- decode call fails with an error
- ff_thread_flush() is called
- drain packet is sent

Then the last step would make ff_thread_decode_frame() return an error,
because p->result can still be set to an error value. This is because
submit_packet returns immediately if AV_CODEC_CAP_DELAY is not set, and
no worker thread gets the chance to reset p->result, yet its value is
trusted by ff_thread_decode_frame().

Fix this by clearing the error fields on flush.

Signed-off-by: James Almer <jamrial@gmail.com>

These data are necessary when transmitting HDR over HDMI.
Signed-off-by: James Almer <jamrial@gmail.com>

As found in HEVC.
Signed-off-by: James Almer <jamrial@gmail.com>

Signed-off-by: Shivraj Patil <shivraj.patil@imgtec.com>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

Fixes tsan warnings like this in fate-vp8-test-vector-007:

WARNING: ThreadSanitizer: data race (pid=65909)
  Write of size 4 at 0x7d8c0000e088 by thread T1:
    #0 vp8_decode_mb_row_sliced vp8.c:2519 (ffmpeg:x86_64+0x100995ede)
[..]
  Previous write of size 4 at 0x7d8c0000e088 by thread T2:
    #0 vp8_decode_mb_row_sliced vp8.c:2519 (ffmpeg:x86_64+0x100995ede)

Fixes tsan warnings like this in fate-vp8-test-vector-007:

WARNING: ThreadSanitizer: data race (pid=3590)
  Write of size 4 at 0x7d8c0000e07c by thread T2:
    #0 decode_mb_row_no_filter src/libavcodec/vp8.c:2330 (ffmpeg+0x000000ffb59e)
[..]
  Previous write of size 4 at 0x7d8c0000e07c by thread T1:
    #0 decode_mb_row_no_filter src/libavcodec/vp8.c:2330 (ffmpeg+0x000000ffb59e)

This removes the last use of the ff_put/add_pixels_clamped global
function pointers, and as such they are removed.

This patch has a negative effect on performance on MIPS, since there's
a SIMD-optimized put/add_pixels_clamped, but no xvid or jrev. From a
code maintenance point of view, that is probably acceptable.

Because the global function pointers are removed, this fixes the following
tsan warnings when running e.g. fate-dnxhr-parse:

WARNING: ThreadSanitizer: data race (pid=29917)
  Write of size 8 at 0x0000025b12d8 by thread T2 (mutexes: write M1543):
    #0 ff_idctdsp_init src/libavcodec/idctdsp.c:313 (ffmpeg+0x00000044b68e)
[..]
  Previous write of size 8 at 0x0000025b12d8 by thread T1 (mutexes: write M1541):
    #0 ff_idctdsp_init src/libavcodec/idctdsp.c:313 (ffmpeg+0x00000044b68e)

These use the mmx IDCT, but sse2 put/add_pixels_clamped implementations.
This way we don't need to use the ff_put/add_pixels_clamped function
pointers.

This makes using the function pointer ff_add_pixels_clamped() unnecessary,
since we always know what the best implementation is at compile-time.

Since there's separate SSE2 implementations of xvid_idct_put/add, this
patch has no practical impact on performance.

Instead, hardcode the use of the _arm implementation of add_pixels,
and use the C version for put_pixels (as no arm-optimized version
exists). Since there's separate implementations of idct{,_put,_add}
for neon, this has no practical impact on performance.

This tries to handle cases where separate invocations of decode_frame()
(each running in separate threads) write to respective fields in the
same AVFrame->data[]. Having per-field owners makes interaction between
readers (the referencing thread) and writers (the decoding thread)
slightly more optimal if both accesses are field-based, since they will
use the respective producer's thread objects (mutex/cond) instead of
sharing the thread objects of the first field's producer.

In practice, this fixes the following tsan-warning in fate-h264:

WARNING: ThreadSanitizer: data race (pid=21615)
  Read of size 4 at 0x7d640000d9fc by thread T2 (mutexes: write M1006):
    #0 ff_thread_report_progress pthread_frame.c:569 (ffmpeg:x86_64+0x100f7cf54)
[..]
  Previous write of size 4 at 0x7d640000d9fc by main thread (mutexes: write M1004):
    #0 update_context_from_user pthread_frame.c:335 (ffmpeg:x86_64+0x100f81abb)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

This fixes a proble where ffmpeg would cause crash to do a seek when the network disconnect.
The log like this:
01-01 10:53:03.441  6580  6580 F DEBUG   : backtrace:
01-01 10:53:03.441  6580  6580 F DEBUG   :     #00 pc 0002942e  /system/lib/libavformat.so (ffurl_write+9)
Signed-off-by: tiejun.peng <tiejun.peng@foxmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Fixes: CID1404842
Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com>