Signed-off-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>

Fixes invalid writes and crashes when doing conversions such as stereo to 5.1
channels or sample rate conversion on 5.1 channels.

Signed-off-by: Mans Rullgard <mans@mansr.com>

It may have improved cross-platform stability, but wasn't the only place in
the encoder with bitexact issues. It is no longer needed because we have FATE
tests for float encoders using fuzzy comparison.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

Signed-off-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

When using "-f x11grab -i :0.0" valgrind reports a definitely lost
memory block with this message:

==31544== 5 bytes in 1 blocks are definitely lost in loss record 1 of 2
==31544==    at 0x4026E68: memalign (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==31544==    by 0x4026F17: posix_memalign (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==31544==    by 0x60D399A: av_malloc (in /usr/lib/x86_64-linux-gnu/libavutil.so.51.22.1)
==31544==    by 0x60D3A70: av_strdup (in /usr/lib/x86_64-linux-gnu/libavutil.so.51.22.1)
==31544==    by 0x4A2BE58: ??? (in /usr/lib/x86_64-linux-gnu/libavdevice.so.53.2.0)
==31544==    by 0x506D29E: avformat_open_input (in /usr/lib/x86_64-linux-gnu/libavformat.so.53.21.0)
==31544==    by 0x400A80: main (in /home/ao2/WIP/am7xxx-play/tests/a.out)

The 5 bytes lost are the ones from param = av_strdup(":0.0"), so let's
free param in the exit path.

Also check the av_strdup() return value.

Note: calling av_free(param) even when av_strdup() fails and param is
NULL is OK and keeps the code simpler without adding another label to
skip av_free().
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

Calling avcodec_flush_buffers() and then avcodec_decode_video2() with
a 0-sized packet (to get remaining buffered frames) could incorrectly
return an old frame from before the avcodec_flush_buffers() call. Add
a loop in ff_thread_flush() to zero the got_frame field of each thread
to ensure the old frames will not be returned.
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

If the dummy frame are not created from a reference frame they could
be deleted untimely resulting in multithreaded decoder waiting on
the current frame to finish.
Noticed by Ronald S. Bultje in the RV34 decoder with a broken file.

If decoding a second complementary field, and the first was
decoded in our thread, mark decoding of that field as complete.
If decoding fails, mark the decoded field/frame as complete.
Do not allow switching between field modes or field/frame mode
between slices within the same field/frame. Ensure that two
subsequent fields cover top/bottom (rather than top/frame,
bottom/frame or such nonsense situations).

Fixes various deadlocks when decoding samples with errors in
reference frames.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Prevents hangs on corrupt input.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Fixes hangs on corrupt samples that reference self-frames.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Also remove some disabled code and fix a few comment typos.

This allows for testing floating-point audio encoders across different
platforms where exact comparisons are unreliable due to float rounding
differences.

This will allow for comparing decoded output to the original source when the
decoded size is not exactly the same as the original size.

This will allow comparison to original pre-encoded content instead of
comparing to expected decoded output.

This will allow adjusting for any encoder or decoder delay when doing
comparisons.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>

OutputStream.picref is guaranteed to be non-NULL if
get_filtered_video_frame() succeeds.

output_video_filter is always guaranteed to be set and is in fact
dereferenced right above the check.

Progressive images can have only 16 references, error out if there are
more, since the data is almost certainly corrupt, and the invalid value
will lead to random crashes or invalid writes later on.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Interlaced images can have 32 references (16 per field), so limiting the
array size to 16 leads to invalid writes.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Fixes NULL ptr dereference

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

Signed-off-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

Protects from overreads.
Signed-off-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

Signed-off-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

The safe bitstream reader broke it since the buffer size was specified
in bytes instead of bits.
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
CC: libav-stable@libav.org

Signed-off-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Janne Grunau <janne-libav@jannau.net>