Fixes integer overflow
Fixes: mozilla bug 1229167

Found-by: Tyson Smith
Signed-off-by: NMichael Niedermayer <michael@niedermayer.cc>

Fixes out of array read
Fixes: 0a7ff0c1d93da9cef28a315ec91b692a/asan_heap-oob_4a52e5_3604_9c56dbb20e308f4faeef7b35f688521a.ape

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: NMichael Niedermayer <michael@niedermayer.cc>

Fixes mozilla bug 1229128.

Signed-off-by: NAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>

Signed-off-by: NAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>

There can be one or more Huffman table segments DHT.

Reported-by: Andrey Utkin

Signed-off-by: NPaul B Mahol <onemda@gmail.com>

Signed-off-by: NPaul B Mahol <onemda@gmail.com>

This patch does 4 things, all of which interact and thus it
woudln't be possible to commit them separately without causing
either quality regressions or assertion failures.

Fate comparison targets don't all reflect improvements in
quality, yet listening tests show substantially improved quality
and stability.

1. Increase SF range utilization.

The spec requires SF delta values to be constrained within the
range -60..60. The previous code was applying that range to
the whole SF array and not only the deltas of consecutive values,
because doing so requires smarter code: zeroing or otherwise
skipping a band may invalidate lots of SF choices.

This patch implements that logic to allow the coders to utilize
the full dynamic range of scalefactors, increasing quality quite
considerably, and fixing delta-SF-related assertion failures,
since now the limitation is enforced rather than asserted.

2. PNS tweaks

The previous modification makes big improvements in twoloop's
efficiency, and every time that happens PNS logic needs to be
tweaked accordingly to avoid it from stepping all over twoloop's
decisions. This patch includes modifications of the sort.

3. Account for lowpass cutoff during PSY analysis

The closer PSY's allocation is to final allocation the better
the quality is, and given these modifications, twoloop is now
very efficient at avoiding holes. Thus, to compute accurate
thresholds, PSY needs to account for the lowpass applied
implicitly during twoloop (by zeroing high bands).

This patch makes twoloop set the cutoff in psymodel's context
the first time it runs, and makes PSY account for it during
threshold computation, making PE and threshold computations
closer to the final allocation and thus achieving better
subjective quality.

4. Tweaks to RC lambda tracking loop in relation to PNS

Without this tweak some corner cases cause quality regressions.
Basically, lambda needs to react faster to overall bitrate
efficiency changes since now PNS can be quite successful in
enforcing maximum bitrates, when PSY allocates too many bits
to the lower bands, suppressing the signals RC logic uses to
lower lambda in those cases and causing aggressive PNS.

This tweak makes PNS much less aggressive, though it can still
use some further tweaks.

Also update MIPS specializations and adjust fuzz

Also in lavc/mips/aacpsy_mips.h: remove trailing whitespace

matroskaenc.c applies divisors to the display width/height when generating
stereo content. This patch adds the corresponding multipliers to matroskadec.c
so that the original sample aspect ratio can be recovered.
Signed-off-by: Nwm4 <nfxjfg@googlemail.com>

"Fast seek" uses linear interpolation to find the position of the
requested seek time. For CBR this is more direct than using the
mp3 TOC and bypassing the TOC avoids problems with TOC precision.
(see https://crbug.com/545914#c13)

For VBR, fast seek is not precise, so continue to prefer the TOC
when available (the lesser of two evils).

Also, some re-ordering of the logic in mp3_seek to simplify and
give usetoc=1 precedence over fastseek flag.
Signed-off-by: Nwm4 <nfxjfg@googlemail.com>

Signed-off-by: NMichael Niedermayer <michael@niedermayer.cc>

This is likely more precise and conveys the intent better.
Reviewed-by: NMark Harris <mark.hsj@gmail.com>
Signed-off-by: NGanesh Ajjanagadde <gajjanagadde@gmail.com>

Signed-off-by: NAndrey Utkin <andrey.od.utkin@gmail.com>
Signed-off-by: NLou Logan <lou@lrcd.com>

On systems having cbrt, there is no reason to use the slow pow function.

Sample benchmark (x86-64, Haswell, GNU/Linux):
new:
5124920 decicycles in cbrt_tableinit,       1 runs,      0 skips

old:
12321680 decicycles in cbrt_tableinit,       1 runs,      0 skips
Reviewed-by: NRonald S. Bultje <rsbultje@gmail.com>
Signed-off-by: NGanesh Ajjanagadde <gajjanagadde@gmail.com>

This further speeds up runtime initialization, with identical generated tables.

Sample benchmark (x86-64, Haswell, GNU/Linux):

old:
34441423 decicycles in mpegaudio_tableinit,    8192 runs,      0 skips

new:
10776291 decicycles in mpegaudio_tableinit,    8192 runs,      0 skips

Most low hanging fruit is taken care of here. For some idea, note that
83,064 array elements totalling 233,722 bytes need to be initialized.
Thus, with this patch, we average ~ 12.9 cycles per element or ~ 4.6
cycles per byte.
Reviewed-by: NDerek Buitenhuis <derek.buitenhuis@gmail.com>
Signed-off-by: NGanesh Ajjanagadde <gajjanagadde@gmail.com>

This does some miscellaneous stuff mainly avoiding the usage of pow to
achieve significant speedups. This is not speed critical, but is
unnecessary latency and cycles wasted for a user.

All tables tested and are identical to the old ones
(bit-exact even in floating point case).

Sample benchmark (x86-64, Haswell, GNU/Linux):
old:
102329530 decicycles in mpegaudio_tableinit,       1 runs,      0 skips

new:
34111900 decicycles in mpegaudio_tableinit,       1 runs,      0 skips
Reviewed-by: NRonald S. Bultje <rsbultje@gmail.com>
Signed-off-by: NGanesh Ajjanagadde <gajjanagadde@gmail.com>

This is useful for build-time table generation (--enable-hardcoded-tables),
by providing compat shims for hosts that have broken libms.

This file is deliberately kept minimal; functions can always be added on
an as-needed basis.
Reviewed-by: NClément Bœsch <u@pkh.me>
Reviewed-by: NRonald S. Bultje <rsbultje@gmail.com>
Signed-off-by: NGanesh Ajjanagadde <gajjanagadde@gmail.com>

Whoever wrote this stuff had a pretty bad libm - digits differ pretty
quickly.
Reviewed-by: NRonald S. Bultje <rsbultje@gmail.com>
Signed-off-by: NGanesh Ajjanagadde <gajjanagadde@gmail.com>

Fixes CID1258479
Reviewed-by: NPaul B Mahol <onemda@gmail.com>
Signed-off-by: NMichael Niedermayer <michael@niedermayer.cc>

Remove all modes except levels mode.
Users should already switch to other filters with
extended funcionality: vectorscope and waveform.
Signed-off-by: NPaul B Mahol <onemda@gmail.com>

The code expects actual positive numbers and gives completely wrong
results if INT64_MIN is treated as positive
Instead clip it into the valid range that is add 1 and treat it as
negative
Signed-off-by: NMichael Niedermayer <michael@niedermayer.cc>

Signed-off-by: NMichael Niedermayer <michael@niedermayer.cc>

Fixes part of mozilla bug 1229167

Found-by: Tyson Smith
Signed-off-by: NMichael Niedermayer <michael@niedermayer.cc>

The table in question is a 253 byte one. In fact, it turns out that
dynamic generation of the table results in an increased binary size.

Code compiled with GCC 5.2.0, x86-64 (size in bytes), before and after
patch:
old: 62321064 libavcodec/libavcodec.so.57
new: 62320536 libavcodec/libavcodec.so.57

Thus, it always make sense to statically allocate this.

Tested with FATE with/without --enable-hardcoded-tables.
Reviewed-by: Nwm4 <nfxjfg@googlemail.com>
Signed-off-by: NGanesh Ajjanagadde <gajjanagadde@gmail.com>

Reviewed-by: NPaul B Mahol <onemda@gmail.com>
Signed-off-by: NGanesh Ajjanagadde <gajjanagadde@gmail.com>

Signed-off-by: NWill Kelleher <wkelleher@gogoair.com>
Previous version reviewed-by: Ivan Uskov <ivan.uskov@nablet.com>
Signed-off-by: NMichael Niedermayer <michael@niedermayer.cc>

Suggested-by: N"Reynaldo H. Verdejo Pinochet" <reynaldo@osg.samsung.com>
Signed-off-by: NMichael Niedermayer <michael@niedermayer.cc>

Fixes: ==13287== Invalid read of size 4
==13287==    at 0x45161A: flush_buffer (aviobuf.c:143)
==13287==    by 0x451971: avio_flush (aviobuf.c:200)
==13287==    by 0x512CCF: av_write_trailer (mux.c:1016)
==13287==    by 0x41A5E0: close_connection (ffserver.c:853)
==13287==    by 0x421EDC: rtsp_cmd_interrupt (ffserver.c:3245)
==13287==    by 0x420B9C: rtsp_parse_request (ffserver.c:2854)
==13287==    by 0x41A9C2: handle_connection (ffserver.c:930)
==13287==    by 0x41A04B: http_server (ffserver.c:700)
==13287==    by 0x423A60: main (ffserver.c:3897)
==13287==  Address 0xb6cd258 is 88 bytes inside a block of size 192 free'd
==13287==    at 0x4C2B5D9: free (vg_replace_malloc.c:446)
==13287==    by 0x1004DAC: av_free (mem.c:239)
==13287==    by 0x454835: avio_close_dyn_buf (aviobuf.c:1170)
==13287==    by 0x41F385: http_prepare_data (ffserver.c:2368)
==13287==    by 0x41F59B: http_send_data (ffserver.c:2416)
==13287==    by 0x41ABE2: handle_connection (ffserver.c:986)
==13287==    by 0x41A04B: http_server (ffserver.c:700)
==13287==    by 0x423A60: main (ffserver.c:3897)
Reviewed-by: N"Reynaldo H. Verdejo Pinochet" <reynaldo@osg.samsung.com>
Signed-off-by: NMichael Niedermayer <michael@niedermayer.cc>

Signed-off-by: NPaul B Mahol <onemda@gmail.com>

Signed-off-by: NPaul B Mahol <onemda@gmail.com>

Fixes assertion failure
Fixes: d0bb0662da342ec65f8f2a081222e6b9/signal_sigabrt_7ffff6ae7cc9_5471_82964f0a9ac2f4d3d59390c15473f6f7.ogg

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: NMichael Niedermayer <michael@niedermayer.cc>

Fixes: out of array read
Fixes: 76c515fc3779d1b838667c61ea13ce92/asan_heap-oob_1fc0d07_8913_794a4629a264ebdb25b58d3a94ed1785.bit

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: NMichael Niedermayer <michael@niedermayer.cc>

The DC VLC table used is too small, fixing this requires a sample,
thus request a sample.
Some samples are said to work even though the table has the wrong size, thus
this is left enabled if the user enables experimental features.

Fixes: 2abd25478c62a675f335fac00b467023/asan_static-oob_10aff98_1227_8811480c6ef1e970a7977ceb7e5a9958.mxf

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Approved-by: kurosu
Signed-off-by: NMichael Niedermayer <michael@niedermayer.cc>

Fixes ticket #5029.
Reported and analyzed by videolan trac user HenkDemper in vlc ticket #15762.

Signed-off-by: NPaul B Mahol <onemda@gmail.com>

As noted in a comment, pe.min in the reference encoder
is centered around current pe. The bit reservoir algo
needs pe.min to be a local minimum, because it can only
account for local PE variations. If it's set to a global
minimum as was being done, bit reservoir logic doesn't
work as efficiently.

This patch tries to forget old minimums and converge to
a local minimum without losing the stability of the
previous solution. Listening tests until now suggest this
solves numerous RC issues.

Needed after f62fe535/2c17fb61.

Reviewed-by: NHendrik Leppkes <h.leppkes@gmail.com>
Signed-off-by: NJames Almer <jamrial@gmail.com>

Signed-off-by: NMatt Oliver <protogonoi@gmail.com>