Browse code

Merge remote-tracking branch 'qatar/master'

* qatar/master:
flicvideo: fix invalid reads
vorbis: Avoid some out-of-bounds reads
vqf: add more known extensions
cabac: remove unused function renorm_cabac_decoder
h264: Only use symbols from the SVQ3 decoder under proper conditionals.
add bytestream2_tell() and bytestream2_seek() functions
parsers: initialize MpegEncContext.slice_context_count to 1
spdifenc: use special alignment for DTS-HD length_code

Conflicts:
libavcodec/flicvideo.c
libavcodec/h264.c
libavcodec/mpeg4video_parser.c
libavcodec/vorbis.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

Michael Niedermayer authored on 2012/01/07 10:02:13
Showing 9 changed files
... ...
@@ -27,7 +27,7 @@
27 27
 #include "libavutil/intreadwrite.h"
28 28
 
29 29
 typedef struct {
30
-    const uint8_t *buffer, *buffer_end;
30
+    const uint8_t *buffer, *buffer_end, *buffer_start;
31 31
 } GetByteContext;
32 32
 
33 33
 #define DEF_T(type, name, bytes, read, write)                             \
... ...
@@ -79,6 +79,7 @@ static av_always_inline void bytestream2_init(GetByteContext *g,
79 79
                                               const uint8_t *buf, int buf_size)
80 80
 {
81 81
     g->buffer =  buf;
82
+    g->buffer_start = buf;
82 83
     g->buffer_end = buf + buf_size;
83 84
 }
84 85
 
... ...
@@ -93,6 +94,34 @@ static av_always_inline void bytestream2_skip(GetByteContext *g,
93 93
     g->buffer += FFMIN(g->buffer_end - g->buffer, size);
94 94
 }
95 95
 
96
+static av_always_inline int bytestream2_tell(GetByteContext *g)
97
+{
98
+    return (int)(g->buffer - g->buffer_start);
99
+}
100
+
101
+static av_always_inline int bytestream2_seek(GetByteContext *g, int offset,
102
+                                             int whence)
103
+{
104
+    switch (whence) {
105
+    case SEEK_CUR:
106
+        offset = av_clip(offset, -(g->buffer - g->buffer_start),
107
+                         g->buffer_end - g->buffer);
108
+        g->buffer += offset;
109
+        break;
110
+    case SEEK_END:
111
+        offset = av_clip(offset, -(g->buffer_end - g->buffer_start), 0);
112
+        g->buffer = g->buffer_end + offset;
113
+        break;
114
+    case SEEK_SET:
115
+        offset = av_clip(offset, 0, g->buffer_end - g->buffer_start);
116
+        g->buffer = g->buffer_start + offset;
117
+        break;
118
+    default:
119
+        return AVERROR(EINVAL);
120
+    }
121
+    return bytestream2_tell(g);
122
+}
123
+
96 124
 static av_always_inline unsigned int bytestream2_get_buffer(GetByteContext *g,
97 125
                                                             uint8_t *dst,
98 126
                                                             unsigned int size)
... ...
@@ -97,15 +97,6 @@ static void refill(CABACContext *c){
97 97
     c->bytestream+= CABAC_BITS/8;
98 98
 }
99 99
 
100
-static inline void renorm_cabac_decoder(CABACContext *c){
101
-    while(c->range < 0x100){
102
-        c->range+= c->range;
103
-        c->low+= c->low;
104
-        if(!(c->low & CABAC_MASK))
105
-            refill(c);
106
-    }
107
-}
108
-
109 100
 static inline void renorm_cabac_decoder_once(CABACContext *c){
110 101
     int shift= (uint32_t)(c->range - 0x100)>>31;
111 102
     c->range<<= shift;
... ...
@@ -41,6 +41,8 @@
41 41
 
42 42
 #include "libavutil/intreadwrite.h"
43 43
 #include "avcodec.h"
44
+#include "bytestream.h"
45
+#include "mathops.h"
44 46
 
45 47
 #define FLI_256_COLOR 4
46 48
 #define FLI_DELTA     7
... ...
@@ -133,7 +135,7 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
133 133
 {
134 134
     FlicDecodeContext *s = avctx->priv_data;
135 135
 
136
-    int stream_ptr = 0;
136
+    GetByteContext g2;
137 137
     int pixel_ptr;
138 138
     int palette_ptr;
139 139
     unsigned char palette_idx1;
... ...
@@ -163,6 +165,8 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
163 163
     unsigned char *pixels;
164 164
     unsigned int pixel_limit;
165 165
 
166
+    bytestream2_init(&g2, buf, buf_size);
167
+
166 168
     s->frame.reference = 3;
167 169
     s->frame.buffer_hints = FF_BUFFER_HINTS_VALID | FF_BUFFER_HINTS_PRESERVE | FF_BUFFER_HINTS_REUSABLE;
168 170
     if (avctx->reget_buffer(avctx, &s->frame) < 0) {
... ...
@@ -172,32 +176,29 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
172 172
 
173 173
     pixels = s->frame.data[0];
174 174
     pixel_limit = s->avctx->height * s->frame.linesize[0];
175
-
176 175
     if (buf_size < 16 || buf_size > INT_MAX - (3 * 256 + FF_INPUT_BUFFER_PADDING_SIZE))
177 176
         return AVERROR_INVALIDDATA;
178
-    frame_size = AV_RL32(&buf[stream_ptr]);
177
+    frame_size = bytestream2_get_le32(&g2);
179 178
     if (frame_size > buf_size)
180 179
         frame_size = buf_size;
181
-    stream_ptr += 6;  /* skip the magic number */
182
-    num_chunks = AV_RL16(&buf[stream_ptr]);
183
-    stream_ptr += 10;  /* skip padding */
180
+    bytestream2_skip(&g2, 2); /* skip the magic number */
181
+    num_chunks = bytestream2_get_le16(&g2);
182
+    bytestream2_skip(&g2, 8);  /* skip padding */
184 183
 
185 184
     frame_size -= 16;
186 185
 
187 186
     /* iterate through the chunks */
188 187
     while ((frame_size >= 6) && (num_chunks > 0)) {
189 188
         int stream_ptr_after_chunk;
190
-        chunk_size = AV_RL32(&buf[stream_ptr]);
189
+        chunk_size = bytestream2_get_le32(&g2);
191 190
         if (chunk_size > frame_size) {
192 191
             av_log(avctx, AV_LOG_WARNING,
193 192
                    "Invalid chunk_size = %u > frame_size = %u\n", chunk_size, frame_size);
194 193
             chunk_size = frame_size;
195 194
         }
196
-        stream_ptr_after_chunk = stream_ptr + chunk_size;
195
+        stream_ptr_after_chunk = bytestream2_tell(&g2) - 4 + chunk_size;
197 196
 
198
-        stream_ptr += 4;
199
-        chunk_type = AV_RL16(&buf[stream_ptr]);
200
-        stream_ptr += 2;
197
+        chunk_type = bytestream2_get_le16(&g2);
201 198
 
202 199
         switch (chunk_type) {
203 200
         case FLI_256_COLOR:
... ...
@@ -211,21 +212,20 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
211 211
             else
212 212
                 color_shift = 2;
213 213
             /* set up the palette */
214
-            color_packets = AV_RL16(&buf[stream_ptr]);
215
-            stream_ptr += 2;
214
+            color_packets = bytestream2_get_le16(&g2);
216 215
             palette_ptr = 0;
217 216
             for (i = 0; i < color_packets; i++) {
218 217
                 /* first byte is how many colors to skip */
219
-                palette_ptr += buf[stream_ptr++];
218
+                palette_ptr += bytestream2_get_byte(&g2);
220 219
 
221 220
                 /* next byte indicates how many entries to change */
222
-                color_changes = buf[stream_ptr++];
221
+                color_changes = bytestream2_get_byte(&g2);
223 222
 
224 223
                 /* if there are 0 color changes, there are actually 256 */
225 224
                 if (color_changes == 0)
226 225
                     color_changes = 256;
227 226
 
228
-                if (stream_ptr + color_changes * 3 > stream_ptr_after_chunk)
227
+                if (bytestream2_tell(&g2) + color_changes * 3 > stream_ptr_after_chunk)
229 228
                     break;
230 229
 
231 230
                 for (j = 0; j < color_changes; j++) {
... ...
@@ -235,9 +235,9 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
235 235
                     if ((unsigned)palette_ptr >= 256)
236 236
                         palette_ptr = 0;
237 237
 
238
-                    r = buf[stream_ptr++] << color_shift;
239
-                    g = buf[stream_ptr++] << color_shift;
240
-                    b = buf[stream_ptr++] << color_shift;
238
+                    r = bytestream2_get_byte(&g2) << color_shift;
239
+                    g = bytestream2_get_byte(&g2) << color_shift;
240
+                    b = bytestream2_get_byte(&g2) << color_shift;
241 241
                     entry = 0xFF << 24 | r << 16 | g << 8 | b;
242 242
                     if (color_shift == 2)
243 243
                         entry |= entry >> 6 & 0x30303;
... ...
@@ -250,13 +250,11 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
250 250
 
251 251
         case FLI_DELTA:
252 252
             y_ptr = 0;
253
-            compressed_lines = AV_RL16(&buf[stream_ptr]);
254
-            stream_ptr += 2;
253
+            compressed_lines = bytestream2_get_le16(&g2);
255 254
             while (compressed_lines > 0) {
256
-                if (stream_ptr + 2 > stream_ptr_after_chunk)
255
+                if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
257 256
                     break;
258
-                line_packets = AV_RL16(&buf[stream_ptr]);
259
-                stream_ptr += 2;
257
+                line_packets = bytestream2_get_le16(&g2);
260 258
                 if ((line_packets & 0xC000) == 0xC000) {
261 259
                     // line skip opcode
262 260
                     line_packets = -line_packets;
... ...
@@ -274,17 +272,17 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
274 274
                     CHECK_PIXEL_PTR(0);
275 275
                     pixel_countdown = s->avctx->width;
276 276
                     for (i = 0; i < line_packets; i++) {
277
-                        if (stream_ptr + 2 > stream_ptr_after_chunk)
277
+                        if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
278 278
                             break;
279 279
                         /* account for the skip bytes */
280
-                        pixel_skip = buf[stream_ptr++];
280
+                        pixel_skip = bytestream2_get_byte(&g2);
281 281
                         pixel_ptr += pixel_skip;
282 282
                         pixel_countdown -= pixel_skip;
283
-                        byte_run = (signed char)(buf[stream_ptr++]);
283
+                        byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
284 284
                         if (byte_run < 0) {
285 285
                             byte_run = -byte_run;
286
-                            palette_idx1 = buf[stream_ptr++];
287
-                            palette_idx2 = buf[stream_ptr++];
286
+                            palette_idx1 = bytestream2_get_byte(&g2);
287
+                            palette_idx2 = bytestream2_get_byte(&g2);
288 288
                             CHECK_PIXEL_PTR(byte_run * 2);
289 289
                             for (j = 0; j < byte_run; j++, pixel_countdown -= 2) {
290 290
                                 pixels[pixel_ptr++] = palette_idx1;
... ...
@@ -292,11 +290,10 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
292 292
                             }
293 293
                         } else {
294 294
                             CHECK_PIXEL_PTR(byte_run * 2);
295
-                            if (stream_ptr + byte_run * 2 > stream_ptr_after_chunk)
295
+                            if (bytestream2_tell(&g2) + byte_run * 2 > stream_ptr_after_chunk)
296 296
                                 break;
297 297
                             for (j = 0; j < byte_run * 2; j++, pixel_countdown--) {
298
-                                palette_idx1 = buf[stream_ptr++];
299
-                                pixels[pixel_ptr++] = palette_idx1;
298
+                                pixels[pixel_ptr++] = bytestream2_get_byte(&g2);
300 299
                             }
301 300
                         }
302 301
                     }
... ...
@@ -308,40 +305,37 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
308 308
 
309 309
         case FLI_LC:
310 310
             /* line compressed */
311
-            starting_line = AV_RL16(&buf[stream_ptr]);
312
-            stream_ptr += 2;
311
+            starting_line = bytestream2_get_le16(&g2);
313 312
             y_ptr = 0;
314 313
             y_ptr += starting_line * s->frame.linesize[0];
315 314
 
316
-            compressed_lines = AV_RL16(&buf[stream_ptr]);
317
-            stream_ptr += 2;
315
+            compressed_lines = bytestream2_get_le16(&g2);
318 316
             while (compressed_lines > 0) {
319 317
                 pixel_ptr = y_ptr;
320 318
                 CHECK_PIXEL_PTR(0);
321 319
                 pixel_countdown = s->avctx->width;
322
-                if (stream_ptr + 1 > stream_ptr_after_chunk)
320
+                if (bytestream2_tell(&g2) + 1 > stream_ptr_after_chunk)
323 321
                     break;
324
-                line_packets = buf[stream_ptr++];
322
+                line_packets = bytestream2_get_byte(&g2);
325 323
                 if (line_packets > 0) {
326 324
                     for (i = 0; i < line_packets; i++) {
327 325
                         /* account for the skip bytes */
328
-                        if (stream_ptr + 2 > stream_ptr_after_chunk)
326
+                        if (bytestream2_tell(&g2) + 1 > stream_ptr_after_chunk)
329 327
                             break;
330
-                        pixel_skip = buf[stream_ptr++];
328
+                        pixel_skip = bytestream2_get_byte(&g2);
331 329
                         pixel_ptr += pixel_skip;
332 330
                         pixel_countdown -= pixel_skip;
333
-                        byte_run = (signed char)(buf[stream_ptr++]);
331
+                        byte_run = sign_extend(bytestream2_get_byte(&g2),8);
334 332
                         if (byte_run > 0) {
335 333
                             CHECK_PIXEL_PTR(byte_run);
336
-                            if (stream_ptr + byte_run > stream_ptr_after_chunk)
334
+                            if (bytestream2_tell(&g2) + byte_run > stream_ptr_after_chunk)
337 335
                                 break;
338 336
                             for (j = 0; j < byte_run; j++, pixel_countdown--) {
339
-                                palette_idx1 = buf[stream_ptr++];
340
-                                pixels[pixel_ptr++] = palette_idx1;
337
+                                pixels[pixel_ptr++] = bytestream2_get_byte(&g2);
341 338
                             }
342 339
                         } else if (byte_run < 0) {
343 340
                             byte_run = -byte_run;
344
-                            palette_idx1 = buf[stream_ptr++];
341
+                            palette_idx1 = bytestream2_get_byte(&g2);
345 342
                             CHECK_PIXEL_PTR(byte_run);
346 343
                             for (j = 0; j < byte_run; j++, pixel_countdown--) {
347 344
                                 pixels[pixel_ptr++] = palette_idx1;
... ...
@@ -369,14 +363,14 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
369 369
                 pixel_ptr = y_ptr;
370 370
                 /* disregard the line packets; instead, iterate through all
371 371
                  * pixels on a row */
372
-                stream_ptr++;
372
+                 bytestream2_skip(&g2, 1);
373 373
                 pixel_countdown = s->avctx->width;
374 374
                 while (pixel_countdown > 0) {
375
-                    if (stream_ptr + 1 > stream_ptr_after_chunk)
375
+                    if (bytestream2_tell(&g2) + 1 > stream_ptr_after_chunk)
376 376
                         break;
377
-                    byte_run = (signed char)(buf[stream_ptr++]);
377
+                    byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
378 378
                     if (byte_run > 0) {
379
-                        palette_idx1 = buf[stream_ptr++];
379
+                        palette_idx1 = bytestream2_get_byte(&g2);
380 380
                         CHECK_PIXEL_PTR(byte_run);
381 381
                         for (j = 0; j < byte_run; j++) {
382 382
                             pixels[pixel_ptr++] = palette_idx1;
... ...
@@ -388,11 +382,10 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
388 388
                     } else {  /* copy bytes if byte_run < 0 */
389 389
                         byte_run = -byte_run;
390 390
                         CHECK_PIXEL_PTR(byte_run);
391
-                        if (stream_ptr + byte_run > stream_ptr_after_chunk)
391
+                        if (bytestream2_tell(&g2) + byte_run > stream_ptr_after_chunk)
392 392
                             break;
393 393
                         for (j = 0; j < byte_run; j++) {
394
-                            palette_idx1 = buf[stream_ptr++];
395
-                            pixels[pixel_ptr++] = palette_idx1;
394
+                            pixels[pixel_ptr++] = bytestream2_get_byte(&g2);
396 395
                             pixel_countdown--;
397 396
                             if (pixel_countdown < 0)
398 397
                                 av_log(avctx, AV_LOG_ERROR, "pixel_countdown < 0 (%d) at line %d\n",
... ...
@@ -410,12 +403,12 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
410 410
             if (chunk_size - 6 != s->avctx->width * s->avctx->height) {
411 411
                 av_log(avctx, AV_LOG_ERROR, "In chunk FLI_COPY : source data (%d bytes) " \
412 412
                        "has incorrect size, skipping chunk\n", chunk_size - 6);
413
+                bytestream2_skip(&g2, chunk_size - 6);
413 414
             } else {
414 415
                 for (y_ptr = 0; y_ptr < s->frame.linesize[0] * s->avctx->height;
415 416
                      y_ptr += s->frame.linesize[0]) {
416
-                    memcpy(&pixels[y_ptr], &buf[stream_ptr],
417
-                        s->avctx->width);
418
-                    stream_ptr += s->avctx->width;
417
+                    bytestream2_get_buffer(&g2, &pixels[y_ptr],
418
+                                           s->avctx->width);
419 419
                 }
420 420
             }
421 421
             break;
... ...
@@ -429,7 +422,8 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
429 429
             break;
430 430
         }
431 431
 
432
-        stream_ptr = stream_ptr_after_chunk;
432
+        if (stream_ptr_after_chunk - bytestream2_tell(&g2) > 0)
433
+            bytestream2_skip(&g2, stream_ptr_after_chunk - bytestream2_tell(&g2));
433 434
 
434 435
         frame_size -= chunk_size;
435 436
         num_chunks--;
... ...
@@ -437,9 +431,11 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
437 437
 
438 438
     /* by the end of the chunk, the stream ptr should equal the frame
439 439
      * size (minus 1, possibly); if it doesn't, issue a warning */
440
-    if ((stream_ptr != buf_size) && (stream_ptr != buf_size - 1))
440
+    if ((bytestream2_get_bytes_left(&g2) != 0) &&
441
+        (bytestream2_get_bytes_left(&g2) != 1))
441 442
         av_log(avctx, AV_LOG_ERROR, "Processed FLI chunk where chunk size = %d " \
442
-               "and final chunk ptr = %d\n", buf_size, stream_ptr);
443
+               "and final chunk ptr = %d\n", buf_size,
444
+               buf_size - bytestream2_get_bytes_left(&g2));
443 445
 
444 446
     /* make the palette available on the way out */
445 447
     memcpy(s->frame.data[1], s->palette, AVPALETTE_SIZE);
... ...
@@ -462,7 +458,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
462 462
     /* Format is the pixel format, the packets are processed the same. */
463 463
     FlicDecodeContext *s = avctx->priv_data;
464 464
 
465
-    int stream_ptr = 0;
465
+    GetByteContext g2;
466 466
     int pixel_ptr;
467 467
     unsigned char palette_idx1;
468 468
 
... ...
@@ -485,6 +481,8 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
485 485
     int pixel;
486 486
     unsigned int pixel_limit;
487 487
 
488
+    bytestream2_init(&g2, buf, buf_size);
489
+
488 490
     s->frame.reference = 3;
489 491
     s->frame.buffer_hints = FF_BUFFER_HINTS_VALID | FF_BUFFER_HINTS_PRESERVE | FF_BUFFER_HINTS_REUSABLE;
490 492
     if (avctx->reget_buffer(avctx, &s->frame) < 0) {
... ...
@@ -495,10 +493,10 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
495 495
     pixels = s->frame.data[0];
496 496
     pixel_limit = s->avctx->height * s->frame.linesize[0];
497 497
 
498
-    frame_size = AV_RL32(&buf[stream_ptr]);
499
-    stream_ptr += 6;  /* skip the magic number */
500
-    num_chunks = AV_RL16(&buf[stream_ptr]);
501
-    stream_ptr += 10;  /* skip padding */
498
+    frame_size = bytestream2_get_le32(&g2);
499
+    bytestream2_skip(&g2, 2);  /* skip the magic number */
500
+    num_chunks = bytestream2_get_le16(&g2);
501
+    bytestream2_skip(&g2, 8);  /* skip padding */
502 502
     if (frame_size > buf_size)
503 503
         frame_size = buf_size;
504 504
 
... ...
@@ -507,17 +505,15 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
507 507
     /* iterate through the chunks */
508 508
     while ((frame_size > 0) && (num_chunks > 0)) {
509 509
         int stream_ptr_after_chunk;
510
-        chunk_size = AV_RL32(&buf[stream_ptr]);
510
+        chunk_size = bytestream2_get_le32(&g2);
511 511
         if (chunk_size > frame_size) {
512 512
             av_log(avctx, AV_LOG_WARNING,
513 513
                    "Invalid chunk_size = %u > frame_size = %u\n", chunk_size, frame_size);
514 514
             chunk_size = frame_size;
515 515
         }
516
-        stream_ptr_after_chunk = stream_ptr + chunk_size;
516
+        stream_ptr_after_chunk = bytestream2_tell(&g2) - 4 + chunk_size;
517 517
 
518
-        stream_ptr += 4;
519
-        chunk_type = AV_RL16(&buf[stream_ptr]);
520
-        stream_ptr += 2;
518
+        chunk_type = bytestream2_get_le16(&g2);
521 519
 
522 520
 
523 521
         switch (chunk_type) {
... ...
@@ -527,19 +523,17 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
527 527
              * include one of these chunks in their first frame.
528 528
              * Why I do not know, it seems rather extraneous. */
529 529
 /*            av_log(avctx, AV_LOG_ERROR, "Unexpected Palette chunk %d in non-paletised FLC\n",chunk_type);*/
530
-            stream_ptr = stream_ptr + chunk_size - 6;
530
+            bytestream2_skip(&g2, chunk_size - 6);
531 531
             break;
532 532
 
533 533
         case FLI_DELTA:
534 534
         case FLI_DTA_LC:
535 535
             y_ptr = 0;
536
-            compressed_lines = AV_RL16(&buf[stream_ptr]);
537
-            stream_ptr += 2;
536
+            compressed_lines = bytestream2_get_le16(&g2);
538 537
             while (compressed_lines > 0) {
539
-                if (stream_ptr + 2 > stream_ptr_after_chunk)
538
+                if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
540 539
                     break;
541
-                line_packets = AV_RL16(&buf[stream_ptr]);
542
-                stream_ptr += 2;
540
+                line_packets = bytestream2_get_le16(&g2);
543 541
                 if (line_packets < 0) {
544 542
                     line_packets = -line_packets;
545 543
                     y_ptr += line_packets * s->frame.linesize[0];
... ...
@@ -550,28 +544,26 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
550 550
                     pixel_countdown = s->avctx->width;
551 551
                     for (i = 0; i < line_packets; i++) {
552 552
                         /* account for the skip bytes */
553
-                        if (stream_ptr + 2 > stream_ptr_after_chunk)
553
+                        if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
554 554
                             break;
555
-                        pixel_skip = buf[stream_ptr++];
555
+                        pixel_skip = bytestream2_get_byte(&g2);
556 556
                         pixel_ptr += (pixel_skip*2); /* Pixel is 2 bytes wide */
557 557
                         pixel_countdown -= pixel_skip;
558
-                        byte_run = (signed char)(buf[stream_ptr++]);
558
+                        byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
559 559
                         if (byte_run < 0) {
560 560
                             byte_run = -byte_run;
561
-                            pixel    = AV_RL16(&buf[stream_ptr]);
562
-                            stream_ptr += 2;
561
+                            pixel    = bytestream2_get_le16(&g2);
563 562
                             CHECK_PIXEL_PTR(2 * byte_run);
564 563
                             for (j = 0; j < byte_run; j++, pixel_countdown -= 2) {
565 564
                                 *((signed short*)(&pixels[pixel_ptr])) = pixel;
566 565
                                 pixel_ptr += 2;
567 566
                             }
568 567
                         } else {
569
-                            if (stream_ptr + 2*byte_run > stream_ptr_after_chunk)
568
+                            if (bytestream2_tell(&g2) + 2*byte_run > stream_ptr_after_chunk)
570 569
                                 break;
571 570
                             CHECK_PIXEL_PTR(2 * byte_run);
572 571
                             for (j = 0; j < byte_run; j++, pixel_countdown--) {
573
-                                *((signed short*)(&pixels[pixel_ptr])) = AV_RL16(&buf[stream_ptr]);
574
-                                stream_ptr += 2;
572
+                                *((signed short*)(&pixels[pixel_ptr])) = bytestream2_get_le16(&g2);
575 573
                                 pixel_ptr += 2;
576 574
                             }
577 575
                         }
... ...
@@ -584,7 +576,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
584 584
 
585 585
         case FLI_LC:
586 586
             av_log(avctx, AV_LOG_ERROR, "Unexpected FLI_LC chunk in non-paletised FLC\n");
587
-            stream_ptr = stream_ptr + chunk_size - 6;
587
+            bytestream2_skip(&g2, chunk_size - 6);
588 588
             break;
589 589
 
590 590
         case FLI_BLACK:
... ...
@@ -599,15 +591,15 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
599 599
                 pixel_ptr = y_ptr;
600 600
                 /* disregard the line packets; instead, iterate through all
601 601
                  * pixels on a row */
602
-                stream_ptr++;
602
+                bytestream2_skip(&g2, 1);
603 603
                 pixel_countdown = (s->avctx->width * 2);
604 604
 
605 605
                 while (pixel_countdown > 0) {
606
-                    if (stream_ptr + 1 > stream_ptr_after_chunk)
606
+                    if (bytestream2_tell(&g2) + 1 > stream_ptr_after_chunk)
607 607
                         break;
608
-                    byte_run = (signed char)(buf[stream_ptr++]);
608
+                    byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
609 609
                     if (byte_run > 0) {
610
-                        palette_idx1 = buf[stream_ptr++];
610
+                        palette_idx1 = bytestream2_get_byte(&g2);
611 611
                         CHECK_PIXEL_PTR(byte_run);
612 612
                         for (j = 0; j < byte_run; j++) {
613 613
                             pixels[pixel_ptr++] = palette_idx1;
... ...
@@ -618,11 +610,11 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
618 618
                         }
619 619
                     } else {  /* copy bytes if byte_run < 0 */
620 620
                         byte_run = -byte_run;
621
-                        if (stream_ptr + byte_run > stream_ptr_after_chunk)
621
+                        if (bytestream2_tell(&g2) + byte_run > stream_ptr_after_chunk)
622 622
                             break;
623 623
                         CHECK_PIXEL_PTR(byte_run);
624 624
                         for (j = 0; j < byte_run; j++) {
625
-                            palette_idx1 = buf[stream_ptr++];
625
+                            palette_idx1 = bytestream2_get_byte(&g2);
626 626
                             pixels[pixel_ptr++] = palette_idx1;
627 627
                             pixel_countdown--;
628 628
                             if (pixel_countdown < 0)
... ...
@@ -655,16 +647,15 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
655 655
                 pixel_ptr = y_ptr;
656 656
                 /* disregard the line packets; instead, iterate through all
657 657
                  * pixels on a row */
658
-                stream_ptr++;
658
+                bytestream2_skip(&g2, 1);
659 659
                 pixel_countdown = s->avctx->width; /* Width is in pixels, not bytes */
660 660
 
661 661
                 while (pixel_countdown > 0) {
662
-                    if (stream_ptr + 1 > stream_ptr_after_chunk)
662
+                    if (bytestream2_tell(&g2) + 1 > stream_ptr_after_chunk)
663 663
                         break;
664
-                    byte_run = (signed char)(buf[stream_ptr++]);
664
+                    byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
665 665
                     if (byte_run > 0) {
666
-                        pixel    = AV_RL16(&buf[stream_ptr]);
667
-                        stream_ptr += 2;
666
+                        pixel    = bytestream2_get_le16(&g2);
668 667
                         CHECK_PIXEL_PTR(2 * byte_run);
669 668
                         for (j = 0; j < byte_run; j++) {
670 669
                             *((signed short*)(&pixels[pixel_ptr])) = pixel;
... ...
@@ -676,12 +667,11 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
676 676
                         }
677 677
                     } else {  /* copy pixels if byte_run < 0 */
678 678
                         byte_run = -byte_run;
679
-                        if (stream_ptr + 2 * byte_run > stream_ptr_after_chunk)
679
+                        if (bytestream2_tell(&g2) + 2 * byte_run > stream_ptr_after_chunk)
680 680
                             break;
681 681
                         CHECK_PIXEL_PTR(2 * byte_run);
682 682
                         for (j = 0; j < byte_run; j++) {
683
-                            *((signed short*)(&pixels[pixel_ptr])) = AV_RL16(&buf[stream_ptr]);
684
-                            stream_ptr += 2;
683
+                            *((signed short*)(&pixels[pixel_ptr])) = bytestream2_get_le16(&g2);
685 684
                             pixel_ptr  += 2;
686 685
                             pixel_countdown--;
687 686
                             if (pixel_countdown < 0)
... ...
@@ -701,7 +691,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
701 701
             if (chunk_size - 6 > (unsigned int)(s->avctx->width * s->avctx->height)*2) {
702 702
                 av_log(avctx, AV_LOG_ERROR, "In chunk FLI_COPY : source data (%d bytes) " \
703 703
                        "bigger than image, skipping chunk\n", chunk_size - 6);
704
-                stream_ptr += chunk_size - 6;
704
+                bytestream2_skip(&g2, chunk_size - 6);
705 705
             } else {
706 706
 
707 707
                 for (y_ptr = 0; y_ptr < s->frame.linesize[0] * s->avctx->height;
... ...
@@ -710,18 +700,17 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
710 710
                     pixel_countdown = s->avctx->width;
711 711
                     pixel_ptr = 0;
712 712
                     while (pixel_countdown > 0) {
713
-                      *((signed short*)(&pixels[y_ptr + pixel_ptr])) = AV_RL16(&buf[stream_ptr+pixel_ptr]);
713
+                      *((signed short*)(&pixels[y_ptr + pixel_ptr])) = bytestream2_get_le16(&g2);
714 714
                       pixel_ptr += 2;
715 715
                       pixel_countdown--;
716 716
                     }
717
-                    stream_ptr += s->avctx->width*2;
718 717
                 }
719 718
             }
720 719
             break;
721 720
 
722 721
         case FLI_MINI:
723 722
             /* some sort of a thumbnail? disregard this chunk... */
724
-            stream_ptr += chunk_size - 6;
723
+            bytestream2_skip(&g2, chunk_size - 6);
725 724
             break;
726 725
 
727 726
         default:
... ...
@@ -735,9 +724,9 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
735 735
 
736 736
     /* by the end of the chunk, the stream ptr should equal the frame
737 737
      * size (minus 1, possibly); if it doesn't, issue a warning */
738
-    if ((stream_ptr != buf_size) && (stream_ptr != buf_size - 1))
738
+    if ((bytestream2_get_bytes_left(&g2) != 0) && (bytestream2_get_bytes_left(&g2) != 1))
739 739
         av_log(avctx, AV_LOG_ERROR, "Processed FLI chunk where chunk size = %d " \
740
-               "and final chunk ptr = %d\n", buf_size, stream_ptr);
740
+               "and final chunk ptr = %d\n", buf_size, bytestream2_tell(&g2));
741 741
 
742 742
 
743 743
     *data_size=sizeof(AVFrame);
... ...
@@ -1818,7 +1818,7 @@ static av_always_inline void hl_decode_mb_predict_luma(H264Context *h, int mb_ty
1818 1818
                                     idct_dc_add(ptr, h->mb + (i*16+p*256 << pixel_shift), linesize);
1819 1819
                                 else
1820 1820
                                     idct_add   (ptr, h->mb + (i*16+p*256 << pixel_shift), linesize);
1821
-                            }else if(CONFIG_SVQ3_DECODER)
1821
+                            } else if (CONFIG_SVQ3_DECODER)
1822 1822
                                 ff_svq3_add_idct_c(ptr, h->mb + i*16+p*256, linesize, qscale, 0);
1823 1823
                         }
1824 1824
                     }
... ...
@@ -1838,7 +1838,7 @@ static av_always_inline void hl_decode_mb_predict_luma(H264Context *h, int mb_ty
1838 1838
                         dctcoef_set(h->mb+(p*256 << pixel_shift), pixel_shift, dc_mapping[i], dctcoef_get(h->mb_luma_dc[p], pixel_shift, i));
1839 1839
                 }
1840 1840
             }
1841
-        }else if(CONFIG_SVQ3_DECODER)
1841
+        } else if (CONFIG_SVQ3_DECODER)
1842 1842
             ff_svq3_luma_dc_dequant_idct_c(h->mb+p*256, h->mb_luma_dc[p], qscale);
1843 1843
     }
1844 1844
 }
... ...
@@ -1882,7 +1882,7 @@ static av_always_inline void hl_decode_mb_idct_luma(H264Context *h, int mb_type,
1882 1882
                     }
1883 1883
                 }
1884 1884
             }
1885
-        }else if(CONFIG_SVQ3_DECODER) {
1885
+        } else if (CONFIG_SVQ3_DECODER) {
1886 1886
             for(i=0; i<16; i++){
1887 1887
                 if(h->non_zero_count_cache[ scan8[i+p*16] ] || h->mb[i*16+p*256]){ //FIXME benchmark weird rule, & below
1888 1888
                     uint8_t * const ptr= dest_y + block_offset[i];
... ...
@@ -2076,9 +2076,7 @@ static av_always_inline void hl_decode_mb_internal(H264Context *h, int simple, i
2076 2076
                     h->h264dsp.h264_idct_add8(dest, block_offset,
2077 2077
                                               h->mb, uvlinesize,
2078 2078
                                               h->non_zero_count_cache);
2079
-                }
2080
-#if CONFIG_SVQ3_DECODER
2081
-                else{
2079
+                } else if (CONFIG_SVQ3_DECODER) {
2082 2080
                     h->h264dsp.h264_chroma_dc_dequant_idct(h->mb + 16*16*1, h->dequant4_coeff[IS_INTRA(mb_type) ? 1:4][h->chroma_qp[0]][0]);
2083 2081
                     h->h264dsp.h264_chroma_dc_dequant_idct(h->mb + 16*16*2, h->dequant4_coeff[IS_INTRA(mb_type) ? 2:5][h->chroma_qp[1]][0]);
2084 2082
                     for(j=1; j<3; j++){
... ...
@@ -2090,7 +2088,6 @@ static av_always_inline void hl_decode_mb_internal(H264Context *h, int simple, i
2090 2090
                         }
2091 2091
                     }
2092 2092
                 }
2093
-#endif
2094 2093
             }
2095 2094
         }
2096 2095
     }
... ...
@@ -376,6 +376,7 @@ static int init(AVCodecParserContext *s)
376 376
 {
377 377
     H264Context *h = s->priv_data;
378 378
     h->thread_context[0] = h;
379
+    h->s.slice_context_count = 1;
379 380
     return 0;
380 381
 }
381 382
 
... ...
@@ -102,6 +102,7 @@ static av_cold int mpeg4video_parse_init(AVCodecParserContext *s)
102 102
         return -1;
103 103
     pc->first_picture = 1;
104 104
     pc->enc->quant_precision=5;
105
+    pc->enc->slice_context_count = 1;
105 106
     return 0;
106 107
 }
107 108
 
... ...
@@ -184,9 +184,17 @@ static int vc1_split(AVCodecContext *avctx,
184 184
     return 0;
185 185
 }
186 186
 
187
+static int vc1_parse_init(AVCodecParserContext *s)
188
+{
189
+    VC1ParseContext *vpc = s->priv_data;
190
+    vpc->v.s.slice_context_count = 1;
191
+    return 0;
192
+}
193
+
187 194
 AVCodecParser ff_vc1_parser = {
188 195
     .codec_ids      = { CODEC_ID_VC1 },
189 196
     .priv_data_size = sizeof(VC1ParseContext),
197
+    .parser_init    = vc1_parse_init,
190 198
     .parser_parse   = vc1_parse,
191 199
     .parser_close   = ff_parse1_close,
192 200
     .split          = vc1_split,
... ...
@@ -156,7 +156,7 @@ void ff_vorbis_ready_floor1_list(vorbis_floor1_entry * list, int values)
156 156
     }
157 157
 }
158 158
 
159
-static inline void render_line_unrolled(intptr_t x, unsigned char y, int x1,
159
+static inline void render_line_unrolled(intptr_t x, uint8_t y, int x1,
160 160
                                         intptr_t sy, int ady, int adx,
161 161
                                         float *buf)
162 162
 {
... ...
@@ -179,7 +179,7 @@ static inline void render_line_unrolled(intptr_t x, unsigned char y, int x1,
179 179
     }
180 180
 }
181 181
 
182
-static void render_line(int x0, unsigned char y0, int x1, int y1, float *buf)
182
+static void render_line(int x0, uint8_t y0, int x1, int y1, float *buf)
183 183
 {
184 184
     int dy  = y1 - y0;
185 185
     int adx = x1 - x0;
... ...
@@ -189,10 +189,10 @@ static void render_line(int x0, unsigned char y0, int x1, int y1, float *buf)
189 189
     if (ady*2 <= adx) { // optimized common case
190 190
         render_line_unrolled(x0, y0, x1, sy, ady, adx, buf);
191 191
     } else {
192
-        int base = dy / adx;
193
-        int x    = x0;
194
-        unsigned char y = y0;
195
-        int err  = -adx;
192
+        int base  = dy / adx;
193
+        int x     = x0;
194
+        uint8_t y = y0;
195
+        int err   = -adx;
196 196
         ady -= FFABS(base) * adx;
197 197
         while (++x < x1) {
198 198
             y += base;
... ...
@@ -210,7 +210,8 @@ void ff_vorbis_floor1_render_list(vorbis_floor1_entry * list, int values,
210 210
                                   uint16_t *y_list, int *flag,
211 211
                                   int multiplier, float *out, int samples)
212 212
 {
213
-    int lx, ly, i;
213
+    int lx, i;
214
+    uint8_t ly;
214 215
     lx = 0;
215 216
     ly = y_list[0] * multiplier;
216 217
     for (i = 1; i < values; i++) {
... ...
@@ -265,5 +265,5 @@ AVInputFormat ff_vqf_demuxer = {
265 265
     .read_header    = vqf_read_header,
266 266
     .read_packet    = vqf_read_packet,
267 267
     .read_seek      = vqf_read_seek,
268
-    .extensions = "vqf",
268
+    .extensions     = "vqf,vql,vqe",
269 269
 };