The branch, master has been updated
       via  162e5a1121609ed62a1af4fcf261b749925945b1 (commit)
       via  fe06d5533f8085d685456c99cb1872c64c19f02e (commit)
       via  853229d1401498f87fd06e5c1481336754daf401 (commit)
       via  c48add609aa4715ba20b168ab98125d0fea93618 (commit)
       via  f33e62a8b440bc9b56b316b0ea9e157c5ea95747 (commit)
       via  b5cfabf0f54e315df5c7dd229bc569f118e7cae7 (commit)
       via  124c856d389af4ca1f6ac914271a892762df269d (commit)
       via  b11c8b76dff84bf86f2bc07ee32fccced746a570 (commit)
       via  3b1673db6ae272080df6bfe2ab41f90afd7994d5 (commit)
       via  a6c899bc6bd0320edeffa0a277e3e3dfa8f64b93 (commit)
       via  ac64c52b96e2545c5f51d79eb2da9f12bb5168e0 (commit)
       via  a2e4ba4df6e4d18b9a23ce735b42659ee1cf22e3 (commit)
       via  9a130a57cd86afbd4272798e14b84312ccc6f206 (commit)
       via  b3ac02eb83d47b87e023e700d72a431a856cebb2 (commit)
       via  ed9c8e98cce7a6a4433f2b56b526a0ed1e57237b (commit)
       via  8872c0c39d654fc2b2bbb9c3d19ddd344a8f9e4e (commit)
       via  057afba13d3758f85ffbe636d16c29c0b5101bb5 (commit)
       via  bd80640caeb07dfc3656a6b680fde2da2e46af5b (commit)
       via  987c955cd7e972d9940284fa6ae7187ac858ebb1 (commit)
      from  994bc08325897a7bc86cbb4f8975e1c09272f5d2 (commit)


- Log -----------------------------------------------------------------
commit 162e5a1121609ed62a1af4fcf261b749925945b1
Author:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
AuthorDate: Fri Sep 12 18:33:12 2025 +0200
Commit:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
CommitDate: Mon Sep 15 17:52:22 2025 +0200

    swresample/rematrix_template: Constify get_mix_any_func
    
    Reviewed-by: Michael Niedermayer <mich...@niedermayer.cc>
    Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>

diff --git a/libswresample/rematrix_template.c 
b/libswresample/rematrix_template.c
index b70e7489b0..450a276663 100644
--- a/libswresample/rematrix_template.c
+++ b/libswresample/rematrix_template.c
@@ -105,7 +105,7 @@ static void RENAME(mix8to2)(uint8_t *const *out_, const 
uint8_t *const *in_,
     }
 }
 
-static mix_any_func_type *RENAME(get_mix_any_func)(SwrContext *s)
+static mix_any_func_type *RENAME(get_mix_any_func)(const SwrContext *s)
 {
     if (  !av_channel_layout_compare(&s->out_ch_layout, 
&(AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO)
        && (   !av_channel_layout_compare(&s->in_ch_layout, 
&(AVChannelLayout)AV_CHANNEL_LAYOUT_5POINT1)

commit fe06d5533f8085d685456c99cb1872c64c19f02e
Author:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
AuthorDate: Fri Sep 12 18:23:14 2025 +0200
Commit:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
CommitDate: Mon Sep 15 17:52:22 2025 +0200

    swresample/x86/rematrix_init: Avoid allocation for native_simd_one
    
    Reviewed-by: Michael Niedermayer <mich...@niedermayer.cc>
    Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>

diff --git a/libswresample/rematrix.c b/libswresample/rematrix.c
index 906f6e0f34..76681e9229 100644
--- a/libswresample/rematrix.c
+++ b/libswresample/rematrix.c
@@ -562,7 +562,6 @@ av_cold int swri_rematrix_init(SwrContext *s){
 av_cold void swri_rematrix_free(SwrContext *s){
     av_freep(&s->native_matrix);
     av_freep(&s->native_simd_matrix);
-    av_freep(&s->native_simd_one);
 }
 
 int swri_rematrix(SwrContext *s, AudioData *out, AudioData *in, int len, int 
mustcopy){
diff --git a/libswresample/swresample.c b/libswresample/swresample.c
index 67fb7964b2..998ee7b73a 100644
--- a/libswresample/swresample.c
+++ b/libswresample/swresample.c
@@ -688,7 +688,7 @@ static int swr_convert_internal(struct SwrContext *s, 
AudioData *out, int out_co
 
                     if(len1)
                         for(ch=0; ch<preout->ch_count; ch++)
-                            s->mix_2_1_simd(conv_src->ch[ch], preout->ch[ch], 
s->dither.noise.ch[ch] + s->dither.noise.bps * s->dither.noise_pos, 
s->native_simd_one, 0, 0, len1);
+                            s->mix_2_1_simd(conv_src->ch[ch], preout->ch[ch], 
s->dither.noise.ch[ch] + s->dither.noise.bps * s->dither.noise_pos, 
&s->native_simd_one, 0, 0, len1);
                     if(out_count != len1)
                         for(ch=0; ch<preout->ch_count; ch++)
                             s->mix_2_1_f(conv_src->ch[ch] + off, 
preout->ch[ch] + off, s->dither.noise.ch[ch] + s->dither.noise.bps * 
s->dither.noise_pos + off, &s->native_one, 0, 0, out_count - len1);
diff --git a/libswresample/swresample_internal.h 
b/libswresample/swresample_internal.h
index 1c889272c8..b016ba3315 100644
--- a/libswresample/swresample_internal.h
+++ b/libswresample/swresample_internal.h
@@ -179,7 +179,10 @@ struct SwrContext {
         double d;
     } native_one;
     uint8_t *native_matrix;
-    uint8_t *native_simd_one;
+    union {
+        int16_t i16[2];
+        float   f;
+    } native_simd_one;
     uint8_t *native_simd_matrix;
     uint8_t matrix_ch[SWR_CH_MAX][SWR_CH_MAX+1];    ///< Lists of input 
channels per output channel that have non zero rematrixing coefficients
     mix_1_1_func_type *mix_1_1_f;
diff --git a/libswresample/x86/rematrix_init.c 
b/libswresample/x86/rematrix_init.c
index 5d2c7d9a37..89ec362d62 100644
--- a/libswresample/x86/rematrix_init.c
+++ b/libswresample/x86/rematrix_init.c
@@ -48,8 +48,7 @@ av_cold int swri_rematrix_init_x86(struct SwrContext *s){
             s->mix_2_1_simd = ff_mix_2_1_a_int16_sse2;
         }
         s->native_simd_matrix = av_calloc(num,  2 * sizeof(int16_t));
-        s->native_simd_one    = av_mallocz(2 * sizeof(int16_t));
-        if (!s->native_simd_matrix || !s->native_simd_one)
+        if (!s->native_simd_matrix)
             return AVERROR(ENOMEM);
 
         for(i=0; i<nb_out; i++){
@@ -63,8 +62,8 @@ av_cold int swri_rematrix_init_x86(struct SwrContext *s){
                     ((((int*)s->native_matrix)[i * nb_in + j]) + (1<<sh>>1)) 
>> sh;
             }
         }
-        ((int16_t*)s->native_simd_one)[1] = 14;
-        ((int16_t*)s->native_simd_one)[0] = 16384;
+        s->native_simd_one.i16[1] = 14;
+        s->native_simd_one.i16[0] = 16384;
     } else if(s->midbuf.fmt == AV_SAMPLE_FMT_FLTP){
         if(EXTERNAL_SSE(mm_flags)) {
             s->mix_1_1_simd = ff_mix_1_1_a_float_sse;
@@ -75,11 +74,10 @@ av_cold int swri_rematrix_init_x86(struct SwrContext *s){
             s->mix_2_1_simd = ff_mix_2_1_a_float_avx;
         }
         s->native_simd_matrix = av_calloc(num, sizeof(float));
-        s->native_simd_one = av_mallocz(sizeof(float));
-        if (!s->native_simd_matrix || !s->native_simd_one)
+        if (!s->native_simd_matrix)
             return AVERROR(ENOMEM);
         memcpy(s->native_simd_matrix, s->native_matrix, num * sizeof(float));
-        memcpy(s->native_simd_one, &s->native_one.f, sizeof(float));
+        s->native_simd_one.f = s->native_one.f;
     }
 #endif
 

commit 853229d1401498f87fd06e5c1481336754daf401
Author:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
AuthorDate: Fri Sep 12 18:19:48 2025 +0200
Commit:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
CommitDate: Mon Sep 15 17:52:22 2025 +0200

    swresample/rematrix: Avoid allocation for native_one
    
    Reviewed-by: Michael Niedermayer <mich...@niedermayer.cc>
    Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>

diff --git a/libswresample/rematrix.c b/libswresample/rematrix.c
index c88b22d8fb..906f6e0f34 100644
--- a/libswresample/rematrix.c
+++ b/libswresample/rematrix.c
@@ -466,8 +466,7 @@ av_cold int swri_rematrix_init(SwrContext *s){
     if (s->midbuf.fmt == AV_SAMPLE_FMT_S16P){
         int maxsum = 0;
         s->native_matrix = av_calloc(nb_in * nb_out, sizeof(int));
-        s->native_one    = av_mallocz(sizeof(int));
-        if (!s->native_matrix || !s->native_one)
+        if (!s->native_matrix)
             return AVERROR(ENOMEM);
         for (i = 0; i < nb_out; i++) {
             double rem = 0;
@@ -481,7 +480,7 @@ av_cold int swri_rematrix_init(SwrContext *s){
             }
             maxsum = FFMAX(maxsum, sum);
         }
-        *((int*)s->native_one) = 32768;
+        s->native_one.i = 32768;
         if (maxsum <= 32768) {
             s->mix_1_1_f = copy_s16;
             s->mix_2_1_f = sum2_s16;
@@ -493,37 +492,30 @@ av_cold int swri_rematrix_init(SwrContext *s){
         }
     }else if(s->midbuf.fmt == AV_SAMPLE_FMT_FLTP){
         s->native_matrix = av_calloc(nb_in * nb_out, sizeof(float));
-        s->native_one    = av_mallocz(sizeof(float));
-        if (!s->native_matrix || !s->native_one)
+        if (!s->native_matrix)
             return AVERROR(ENOMEM);
         for (i = 0; i < nb_out; i++)
             for (j = 0; j < nb_in; j++)
                 ((float*)s->native_matrix)[i * nb_in + j] = s->matrix[i][j];
-        *((float*)s->native_one) = 1.0;
+        s->native_one.f = 1.0;
         s->mix_1_1_f = copy_float;
         s->mix_2_1_f = sum2_float;
         s->mix_any_f = get_mix_any_func_float(s);
     }else if(s->midbuf.fmt == AV_SAMPLE_FMT_DBLP){
         s->native_matrix = av_calloc(nb_in * nb_out, sizeof(double));
-        s->native_one    = av_mallocz(sizeof(double));
-        if (!s->native_matrix || !s->native_one)
+        if (!s->native_matrix)
             return AVERROR(ENOMEM);
         for (i = 0; i < nb_out; i++)
             for (j = 0; j < nb_in; j++)
                 ((double*)s->native_matrix)[i * nb_in + j] = s->matrix[i][j];
-        *((double*)s->native_one) = 1.0;
+        s->native_one.d = 1.0;
         s->mix_1_1_f = copy_double;
         s->mix_2_1_f = sum2_double;
         s->mix_any_f = get_mix_any_func_double(s);
     }else if(s->midbuf.fmt == AV_SAMPLE_FMT_S32P){
-        s->native_one    = av_mallocz(sizeof(int));
-        if (!s->native_one)
-            return AVERROR(ENOMEM);
         s->native_matrix = av_calloc(nb_in * nb_out, sizeof(int));
-        if (!s->native_matrix) {
-            av_freep(&s->native_one);
+        if (!s->native_matrix)
             return AVERROR(ENOMEM);
-        }
         for (i = 0; i < nb_out; i++) {
             double rem = 0;
 
@@ -533,7 +525,7 @@ av_cold int swri_rematrix_init(SwrContext *s){
                 rem += target - ((int*)s->native_matrix)[i * nb_in + j];
             }
         }
-        *((int*)s->native_one) = 32768;
+        s->native_one.i = 32768;
         s->mix_1_1_f = copy_s32;
         s->mix_2_1_f = sum2_s32;
         s->mix_any_f = get_mix_any_func_s32(s);
@@ -569,7 +561,6 @@ av_cold int swri_rematrix_init(SwrContext *s){
 
 av_cold void swri_rematrix_free(SwrContext *s){
     av_freep(&s->native_matrix);
-    av_freep(&s->native_one);
     av_freep(&s->native_simd_matrix);
     av_freep(&s->native_simd_one);
 }
diff --git a/libswresample/swresample.c b/libswresample/swresample.c
index 0a4e216f9b..67fb7964b2 100644
--- a/libswresample/swresample.c
+++ b/libswresample/swresample.c
@@ -691,10 +691,10 @@ static int swr_convert_internal(struct SwrContext *s, 
AudioData *out, int out_co
                             s->mix_2_1_simd(conv_src->ch[ch], preout->ch[ch], 
s->dither.noise.ch[ch] + s->dither.noise.bps * s->dither.noise_pos, 
s->native_simd_one, 0, 0, len1);
                     if(out_count != len1)
                         for(ch=0; ch<preout->ch_count; ch++)
-                            s->mix_2_1_f(conv_src->ch[ch] + off, 
preout->ch[ch] + off, s->dither.noise.ch[ch] + s->dither.noise.bps * 
s->dither.noise_pos + off, s->native_one, 0, 0, out_count - len1);
+                            s->mix_2_1_f(conv_src->ch[ch] + off, 
preout->ch[ch] + off, s->dither.noise.ch[ch] + s->dither.noise.bps * 
s->dither.noise_pos + off, &s->native_one, 0, 0, out_count - len1);
                 } else {
                     for(ch=0; ch<preout->ch_count; ch++)
-                        s->mix_2_1_f(conv_src->ch[ch], preout->ch[ch], 
s->dither.noise.ch[ch] + s->dither.noise.bps * s->dither.noise_pos, 
s->native_one, 0, 0, out_count);
+                        s->mix_2_1_f(conv_src->ch[ch], preout->ch[ch], 
s->dither.noise.ch[ch] + s->dither.noise.bps * s->dither.noise_pos, 
&s->native_one, 0, 0, out_count);
                 }
             } else {
                 switch(s->int_sample_fmt) {
diff --git a/libswresample/swresample_internal.h 
b/libswresample/swresample_internal.h
index c2b5e18a2c..1c889272c8 100644
--- a/libswresample/swresample_internal.h
+++ b/libswresample/swresample_internal.h
@@ -173,8 +173,12 @@ struct SwrContext {
         int32_t matrix32[SWR_CH_MAX][SWR_CH_MAX];   ///< 17.15 fixed point 
rematrixing coefficients
                                                     ///< valid iff 
int_sample_fmt is != AV_SAMPLE_FMT_FLTP, AV_SAMPLE_FMT_DBLP
     };
+    union {
+        int    i;
+        float  f;
+        double d;
+    } native_one;
     uint8_t *native_matrix;
-    uint8_t *native_one;
     uint8_t *native_simd_one;
     uint8_t *native_simd_matrix;
     uint8_t matrix_ch[SWR_CH_MAX][SWR_CH_MAX+1];    ///< Lists of input 
channels per output channel that have non zero rematrixing coefficients
diff --git a/libswresample/x86/rematrix_init.c 
b/libswresample/x86/rematrix_init.c
index 623e154f5d..5d2c7d9a37 100644
--- a/libswresample/x86/rematrix_init.c
+++ b/libswresample/x86/rematrix_init.c
@@ -79,7 +79,7 @@ av_cold int swri_rematrix_init_x86(struct SwrContext *s){
         if (!s->native_simd_matrix || !s->native_simd_one)
             return AVERROR(ENOMEM);
         memcpy(s->native_simd_matrix, s->native_matrix, num * sizeof(float));
-        memcpy(s->native_simd_one, s->native_one, sizeof(float));
+        memcpy(s->native_simd_one, &s->native_one.f, sizeof(float));
     }
 #endif
 

commit c48add609aa4715ba20b168ab98125d0fea93618
Author:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
AuthorDate: Fri Sep 12 17:53:27 2025 +0200
Commit:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
CommitDate: Mon Sep 15 17:52:22 2025 +0200

    swresample/swresample_internal: Use union for float, int matrix
    
    Saves 16KiB from SwrContext.
    (FATE would also pass if one made the double matrix part of
    the union, too, but I don't know whether this is truely correct,
    because swri_rematrix() accesses the double matrix (to check whether
    it is equal to 1.0) even when one of the other matrices is in use.)
    
    Reviewed-by: Michael Niedermayer <mich...@niedermayer.cc>
    Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>

diff --git a/libswresample/rematrix.c b/libswresample/rematrix.c
index f55b85a52d..c88b22d8fb 100644
--- a/libswresample/rematrix.c
+++ b/libswresample/rematrix.c
@@ -69,13 +69,12 @@ int swr_set_matrix(struct SwrContext *s, const double 
*matrix, int stride)
     if (!s || s->in_convert) // s needs to be allocated but not initialized
         return AVERROR(EINVAL);
     memset(s->matrix, 0, sizeof(s->matrix));
-    memset(s->matrix_flt, 0, sizeof(s->matrix_flt));
 
     nb_in = s->user_in_chlayout.nb_channels;
     nb_out = s->user_out_chlayout.nb_channels;
     for (out = 0; out < nb_out; out++) {
         for (in = 0; in < nb_in; in++)
-            s->matrix_flt[out][in] = s->matrix[out][in] = matrix[in];
+            s->matrix[out][in] = matrix[in];
         matrix += stride;
     }
     s->rematrix_custom = 1;
@@ -436,7 +435,6 @@ fail:
 av_cold static int auto_matrix(SwrContext *s)
 {
     double maxval;
-    int ret;
 
     if (s->rematrix_maxval > 0) {
         maxval = s->rematrix_maxval;
@@ -447,19 +445,10 @@ av_cold static int auto_matrix(SwrContext *s)
         maxval = INT_MAX;
 
     memset(s->matrix, 0, sizeof(s->matrix));
-    ret = swr_build_matrix2(&s->in_ch_layout, &s->out_ch_layout,
-                           s->clev, s->slev, s->lfe_mix_level,
-                           maxval, s->rematrix_volume, (double*)s->matrix,
-                           s->matrix[1] - s->matrix[0], s->matrix_encoding, s);
-
-    if (ret >= 0 && s->int_sample_fmt == AV_SAMPLE_FMT_FLTP) {
-        int i, j;
-        for (i = 0; i < FF_ARRAY_ELEMS(s->matrix[0]); i++)
-            for (j = 0; j < FF_ARRAY_ELEMS(s->matrix[0]); j++)
-                s->matrix_flt[i][j] = s->matrix[i][j];
-    }
-
-    return ret;
+    return swr_build_matrix2(&s->in_ch_layout, &s->out_ch_layout,
+                             s->clev, s->slev, s->lfe_mix_level,
+                             maxval, s->rematrix_volume, (double*)s->matrix,
+                             s->matrix[1] - s->matrix[0], s->matrix_encoding, 
s);
 }
 
 av_cold int swri_rematrix_init(SwrContext *s){
@@ -554,9 +543,19 @@ av_cold int swri_rematrix_init(SwrContext *s){
     for (i = 0; i < SWR_CH_MAX; i++) {
         int ch_in=0;
         for (j = 0; j < SWR_CH_MAX; j++) {
-            s->matrix32[i][j]= lrintf(s->matrix[i][j] * 32768);
-            if(s->matrix[i][j])
+            const double coeff = s->matrix[i][j];
+            if (coeff)
                 s->matrix_ch[i][++ch_in]= j;
+            switch (s->int_sample_fmt) {
+            case AV_SAMPLE_FMT_FLTP:
+                s->matrix_flt[i][j] = coeff;
+                break;
+            case AV_SAMPLE_FMT_DBLP:
+                break;
+            default:
+                s->matrix32[i][j] = lrintf(coeff * 32768);
+                break;
+            }
         }
         s->matrix_ch[i][0]= ch_in;
     }
diff --git a/libswresample/swresample_internal.h 
b/libswresample/swresample_internal.h
index 21c9e33fa1..c2b5e18a2c 100644
--- a/libswresample/swresample_internal.h
+++ b/libswresample/swresample_internal.h
@@ -167,12 +167,16 @@ struct SwrContext {
     struct Resampler const *resampler;              ///< resampler virtual 
function table
 
     double matrix[SWR_CH_MAX][SWR_CH_MAX];          ///< floating point 
rematrixing coefficients
-    float matrix_flt[SWR_CH_MAX][SWR_CH_MAX];       ///< single precision 
floating point rematrixing coefficients
+    union {
+        float matrix_flt[SWR_CH_MAX][SWR_CH_MAX];   ///< single precision 
floating point rematrixing coefficients
+                                                    ///< valid iff 
int_sample_fmt is AV_SAMPLE_FMT_FLTP
+        int32_t matrix32[SWR_CH_MAX][SWR_CH_MAX];   ///< 17.15 fixed point 
rematrixing coefficients
+                                                    ///< valid iff 
int_sample_fmt is != AV_SAMPLE_FMT_FLTP, AV_SAMPLE_FMT_DBLP
+    };
     uint8_t *native_matrix;
     uint8_t *native_one;
     uint8_t *native_simd_one;
     uint8_t *native_simd_matrix;
-    int32_t matrix32[SWR_CH_MAX][SWR_CH_MAX];       ///< 17.15 fixed point 
rematrixing coefficients
     uint8_t matrix_ch[SWR_CH_MAX][SWR_CH_MAX+1];    ///< Lists of input 
channels per output channel that have non zero rematrixing coefficients
     mix_1_1_func_type *mix_1_1_f;
     mix_1_1_func_type *mix_1_1_simd;

commit f33e62a8b440bc9b56b316b0ea9e157c5ea95747
Author:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
AuthorDate: Fri Sep 12 04:03:07 2025 +0200
Commit:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
CommitDate: Mon Sep 15 17:52:22 2025 +0200

    avcodec/mjpegdec: Move reference dimension check to mxpegdec.c
    
    Only the mxpeg sets reference at all.
    
    Reviewed-by: Michael Niedermayer <mich...@niedermayer.cc>
    Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 3082031ba4..b829ab682b 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -1678,15 +1678,6 @@ int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const 
uint8_t *mb_bitmask,
         return -1;
     }
 
-    if (reference) {
-        if (reference->width  != s->picture_ptr->width  ||
-            reference->height != s->picture_ptr->height ||
-            reference->format != s->picture_ptr->format) {
-            av_log(s->avctx, AV_LOG_ERROR, "Reference mismatching\n");
-            return AVERROR_INVALIDDATA;
-        }
-    }
-
     /* XXX: verify len field validity */
     len = get_bits(&s->gb, 16);
     nb_components = get_bits(&s->gb, 8);
diff --git a/libavcodec/mxpegdec.c b/libavcodec/mxpegdec.c
index 9a5110a814..8861a3969d 100644
--- a/libavcodec/mxpegdec.c
+++ b/libavcodec/mxpegdec.c
@@ -179,6 +179,12 @@ static int mxpeg_check_dimensions(MXpegDecodeContext *s, 
MJpegDecodeContext *jpg
                 return AVERROR(EINVAL);
             }
         }
+        if (reference_ptr->width  != jpg->picture_ptr->width  ||
+            reference_ptr->height != jpg->picture_ptr->height ||
+            reference_ptr->format != jpg->picture_ptr->format) {
+            av_log(jpg->avctx, AV_LOG_ERROR, "Reference mismatching\n");
+            return AVERROR_INVALIDDATA;
+        }
     }
 
     return 0;

commit b5cfabf0f54e315df5c7dd229bc569f118e7cae7
Author:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
AuthorDate: Fri Sep 12 03:47:13 2025 +0200
Commit:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
CommitDate: Mon Sep 15 17:52:22 2025 +0200

    avcodec/mjpegdec: Avoid using HpelDSPContext
    
    It is quite big and we only need one function from it.
    
    Reviewed-by: Michael Niedermayer <mich...@niedermayer.cc>
    Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index b47d7f58ca..3082031ba4 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -1427,7 +1427,7 @@ static av_always_inline void 
mjpeg_copy_block(MJpegDecodeContext *s,
                                               int linesize, int lowres)
 {
     switch (lowres) {
-    case 0: s->hdsp.put_pixels_tab[1][0](dst, src, linesize, 8);
+    case 0: s->copy_block(dst, src, linesize, 8);
         break;
     case 1: copy_block4(dst, src, linesize, linesize, 4);
         break;
diff --git a/libavcodec/mjpegdec.h b/libavcodec/mjpegdec.h
index 8b9ed67856..ce688482cf 100644
--- a/libavcodec/mjpegdec.h
+++ b/libavcodec/mjpegdec.h
@@ -119,8 +119,8 @@ typedef struct MJpegDecodeContext {
     int force_pal8;
     uint8_t permutated_scantable[64];
     BlockDSPContext bdsp;
-    HpelDSPContext hdsp;
     IDCTDSPContext idsp;
+    op_pixels_func copy_block;             ///< only set and used by mxpeg
 
     int restart_interval;
     int restart_count;
diff --git a/libavcodec/mxpegdec.c b/libavcodec/mxpegdec.c
index 8054d016be..9a5110a814 100644
--- a/libavcodec/mxpegdec.c
+++ b/libavcodec/mxpegdec.c
@@ -65,8 +65,10 @@ static av_cold int mxpeg_decode_end(AVCodecContext *avctx)
 static av_cold int mxpeg_decode_init(AVCodecContext *avctx)
 {
     MXpegDecodeContext *s = avctx->priv_data;
+    HpelDSPContext hdsp;
 
-    ff_hpeldsp_init(&s->jpg.hdsp, avctx->flags);
+    ff_hpeldsp_init(&hdsp, avctx->flags);
+    s->jpg.copy_block = hdsp.put_pixels_tab[1][0];
 
     s->picture[0] = av_frame_alloc();
     s->picture[1] = av_frame_alloc();

commit 124c856d389af4ca1f6ac914271a892762df269d
Author:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
AuthorDate: Fri Sep 12 02:38:23 2025 +0200
Commit:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
CommitDate: Mon Sep 15 17:52:22 2025 +0200

    avcodec/mjpegdec: Move initializing HpelDSPContext to mxpegdec.c
    
    Only the mxpeg decoder uses it (and the reference/bitmask feature
    of ff_mjpeg_decode_sos()). So only initialize it for mxpeg which
    allows to remove the mjpeg->hpeldsp dependency.
    
    Reviewed-by: Michael Niedermayer <mich...@niedermayer.cc>
    Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>

diff --git a/configure b/configure
index 8f2decb95f..8def62a5d9 100755
--- a/configure
+++ b/configure
@@ -3076,9 +3076,9 @@ mdec_decoder_select="blockdsp bswapdsp idctdsp"
 media100_decoder_select="media100_to_mjpegb_bsf mjpegb_decoder"
 metasound_decoder_select="lsp sinewin"
 mimic_decoder_select="blockdsp bswapdsp hpeldsp idctdsp"
-mjpeg_decoder_select="blockdsp hpeldsp idctdsp jpegtables"
+mjpeg_decoder_select="blockdsp idctdsp jpegtables"
 mjpeg_encoder_select="jpegtables mpegvideoenc"
-mjpegb_decoder_select="mjpeg_decoder"
+mjpegb_decoder_select="hpeldsp mjpeg_decoder"
 mlp_decoder_select="mlp_parser"
 mlp_encoder_select="lpc audio_frame_queue"
 mobiclip_decoder_select="bswapdsp golomb"
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 9ee190c419..b47d7f58ca 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -133,7 +133,6 @@ av_cold int ff_mjpeg_decode_init(AVCodecContext *avctx)
 
     s->avctx = avctx;
     ff_blockdsp_init(&s->bdsp);
-    ff_hpeldsp_init(&s->hdsp, avctx->flags);
     init_idct(avctx);
     s->buffer_size   = 0;
     s->buffer        = NULL;
diff --git a/libavcodec/mxpegdec.c b/libavcodec/mxpegdec.c
index 8661bba566..8054d016be 100644
--- a/libavcodec/mxpegdec.c
+++ b/libavcodec/mxpegdec.c
@@ -28,6 +28,7 @@
 #include "libavutil/mem.h"
 #include "codec_internal.h"
 #include "decode.h"
+#include "hpeldsp.h"
 #include "mjpeg.h"
 #include "mjpegdec.h"
 
@@ -65,6 +66,8 @@ static av_cold int mxpeg_decode_init(AVCodecContext *avctx)
 {
     MXpegDecodeContext *s = avctx->priv_data;
 
+    ff_hpeldsp_init(&s->jpg.hdsp, avctx->flags);
+
     s->picture[0] = av_frame_alloc();
     s->picture[1] = av_frame_alloc();
     if (!s->picture[0] || !s->picture[1])

commit b11c8b76dff84bf86f2bc07ee32fccced746a570
Author:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
AuthorDate: Fri Sep 12 00:13:52 2025 +0200
Commit:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
CommitDate: Mon Sep 15 17:52:22 2025 +0200

    avcodec/mjpegdec: Avoid mixing return value and error code, avoid branch
    
    mjpeg_decode_dc() currently has a special return value (0xfffff)
    for the case of invalid data; this value does not overlap with
    the ordinary return values, yet the compiler can't prove this
    (at least on x86 where an asm version of NEG_USR32 is used
    inside get_xbits()), so the non-error return value has to be checked
    for being the special value even if mjpeg_decode_dc() is inlined.
    
    This commit avoids this by separating error code and ordinary return
    value. It also means that the ljpeg functions return the proper
    error code and not -1 in case of invalid data.
    
    Reviewed-by: Michael Niedermayer <mich...@niedermayer.cc>
    Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 8548f6888d..9ee190c419 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -815,20 +815,18 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
     return 0;
 }
 
-static inline int mjpeg_decode_dc(MJpegDecodeContext *s, int dc_index)
+static inline int mjpeg_decode_dc(MJpegDecodeContext *s, int dc_index, int 
*val)
 {
     int code;
     code = get_vlc2(&s->gb, s->vlcs[0][dc_index].table, 9, 2);
     if (code < 0 || code > 16) {
         av_log(s->avctx, AV_LOG_ERROR,
                "mjpeg_decode_dc: bad vlc: %d\n", dc_index);
-        return 0xfffff;
+        return AVERROR_INVALIDDATA;
     }
 
-    if (code)
-        return get_xbits(&s->gb, code);
-    else
-        return 0;
+    *val = code ? get_xbits(&s->gb, code) : 0;
+    return 0;
 }
 
 /* decode block and dequantize */
@@ -838,10 +836,10 @@ static int decode_block(MJpegDecodeContext *s, int16_t 
*block, int component,
     int code, i, j, level, val;
 
     /* DC coef */
-    val = mjpeg_decode_dc(s, dc_index);
-    if (val == 0xfffff) {
-        return AVERROR_INVALIDDATA;
-    }
+    int ret = mjpeg_decode_dc(s, dc_index, &val);
+    if (ret < 0)
+        return ret;
+
     val = val * (unsigned)quant_matrix[0] + s->last_dc[component];
     s->last_dc[component] = val;
     block[0] = av_clip_int16(val);
@@ -885,10 +883,10 @@ static int decode_dc_progressive(MJpegDecodeContext *s, 
int16_t *block,
 {
     unsigned val;
     s->bdsp.clear_block(block);
-    val = mjpeg_decode_dc(s, dc_index);
-    if (val == 0xfffff) {
-        return AVERROR_INVALIDDATA;
-    }
+    int ret = mjpeg_decode_dc(s, dc_index, &val);
+    if (ret < 0)
+        return ret;
+
     val = (val * (quant_matrix[0] << Al)) + s->last_dc[component];
     s->last_dc[component] = val;
     block[0] = val;
@@ -1106,6 +1104,7 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, 
int nb_components, int p
     int resync_mb_y = 0;
     int resync_mb_x = 0;
     int vpred[6];
+    int ret;
 
     if (!s->bayer && s->nb_components < 3)
         return AVERROR_INVALIDDATA;
@@ -1178,9 +1177,9 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, 
int nb_components, int p
                 topleft[i] = top[i];
                 top[i]     = buffer[mb_x][i];
 
-                dc = mjpeg_decode_dc(s, s->dc_index[i]);
-                if(dc == 0xFFFFF)
-                    return -1;
+                ret = mjpeg_decode_dc(s, s->dc_index[i], &dc);
+                if (ret < 0)
+                    return ret;
 
                 if (!s->bayer || mb_x) {
                     pred = left[i];
@@ -1274,6 +1273,7 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, 
int predictor,
     int bits= (s->bits+7)&~7;
     int resync_mb_y = 0;
     int resync_mb_x = 0;
+    int ret;
 
     point_transform += bits - s->bits;
     mask = ((1 << s->bits) - 1) << point_transform;
@@ -1312,9 +1312,10 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, 
int predictor,
                     for(j=0; j<n; j++) {
                         int pred, dc;
 
-                        dc = mjpeg_decode_dc(s, s->dc_index[i]);
-                        if(dc == 0xFFFFF)
-                            return -1;
+                        ret = mjpeg_decode_dc(s, s->dc_index[i], &dc);
+                        if (ret < 0)
+                            return ret;
+
                         if (   h * mb_x + x >= s->width
                             || v * mb_y + y >= s->height) {
                             // Nothing to do
@@ -1383,9 +1384,10 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, 
int predictor,
                     for (j = 0; j < n; j++) {
                         int pred;
 
-                        dc = mjpeg_decode_dc(s, s->dc_index[i]);
-                        if(dc == 0xFFFFF)
-                            return -1;
+                        ret = mjpeg_decode_dc(s, s->dc_index[i], &dc);
+                        if (ret < 0)
+                            return ret;
+
                         if (   h * mb_x + x >= s->width
                             || v * mb_y + y >= s->height) {
                             // Nothing to do

commit 3b1673db6ae272080df6bfe2ab41f90afd7994d5
Author:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
AuthorDate: Thu Sep 11 22:33:32 2025 +0200
Commit:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
CommitDate: Mon Sep 15 17:52:22 2025 +0200

    avcodec/mjpegdec: Avoid superfluous secondary error message
    
    Up until now, a DC error in decode_block() or decode_dc_progressive()
    would lead to a warning from mjpeg_decode_dc() and a (less verbose)
    error from the caller. Upgrade the former to an error status (all
    callers treat is an error) and remove the latter.
    
    Reviewed-by: Michael Niedermayer <mich...@niedermayer.cc>
    Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index fe8ecd3f85..8548f6888d 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -820,7 +820,7 @@ static inline int mjpeg_decode_dc(MJpegDecodeContext *s, 
int dc_index)
     int code;
     code = get_vlc2(&s->gb, s->vlcs[0][dc_index].table, 9, 2);
     if (code < 0 || code > 16) {
-        av_log(s->avctx, AV_LOG_WARNING,
+        av_log(s->avctx, AV_LOG_ERROR,
                "mjpeg_decode_dc: bad vlc: %d\n", dc_index);
         return 0xfffff;
     }
@@ -840,7 +840,6 @@ static int decode_block(MJpegDecodeContext *s, int16_t 
*block, int component,
     /* DC coef */
     val = mjpeg_decode_dc(s, dc_index);
     if (val == 0xfffff) {
-        av_log(s->avctx, AV_LOG_ERROR, "error dc\n");
         return AVERROR_INVALIDDATA;
     }
     val = val * (unsigned)quant_matrix[0] + s->last_dc[component];
@@ -888,7 +887,6 @@ static int decode_dc_progressive(MJpegDecodeContext *s, 
int16_t *block,
     s->bdsp.clear_block(block);
     val = mjpeg_decode_dc(s, dc_index);
     if (val == 0xfffff) {
-        av_log(s->avctx, AV_LOG_ERROR, "error dc\n");
         return AVERROR_INVALIDDATA;
     }
     val = (val * (quant_matrix[0] << Al)) + s->last_dc[component];

commit a6c899bc6bd0320edeffa0a277e3e3dfa8f64b93
Author:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
AuthorDate: Thu Sep 11 22:04:53 2025 +0200
Commit:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
CommitDate: Mon Sep 15 17:52:22 2025 +0200

    avcodec/mjpegdec: Remove pointless information from logmessage
    
    There is no reason to add the address of an element of
    MJpegDecodeContext (which makes logmessage nonreproducible).
    Also avoid always printing a zero.
    
    Reviewed-by: Michael Niedermayer <mich...@niedermayer.cc>
    Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 7c262cfb03..fe8ecd3f85 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -821,8 +821,7 @@ static inline int mjpeg_decode_dc(MJpegDecodeContext *s, 
int dc_index)
     code = get_vlc2(&s->gb, s->vlcs[0][dc_index].table, 9, 2);
     if (code < 0 || code > 16) {
         av_log(s->avctx, AV_LOG_WARNING,
-               "mjpeg_decode_dc: bad vlc: %d:%d (%p)\n",
-               0, dc_index, &s->vlcs[0][dc_index]);
+               "mjpeg_decode_dc: bad vlc: %d\n", dc_index);
         return 0xfffff;
     }
 

commit ac64c52b96e2545c5f51d79eb2da9f12bb5168e0
Author:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
AuthorDate: Fri Jul 11 16:46:27 2025 +0200
Commit:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
CommitDate: Mon Sep 15 17:52:21 2025 +0200

    avcodec/encode: Remove redundant av_image_check_size2()
    
    The dimensions have already been checked during init.
    
    Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>

diff --git a/libavcodec/encode.c b/libavcodec/encode.c
index c1a9bd587c..1eca5e38c1 100644
--- a/libavcodec/encode.c
+++ b/libavcodec/encode.c
@@ -18,12 +18,10 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
-#include "libavutil/attributes.h"
 #include "libavutil/avassert.h"
 #include "libavutil/channel_layout.h"
 #include "libavutil/emms.h"
 #include "libavutil/frame.h"
-#include "libavutil/imgutils.h"
 #include "libavutil/internal.h"
 #include "libavutil/mem.h"
 #include "libavutil/pixdesc.h"
@@ -357,8 +355,6 @@ static int encode_receive_packet_internal(AVCodecContext 
*avctx, AVPacket *avpkt
     if (avctx->codec->type == AVMEDIA_TYPE_VIDEO) {
         if ((avctx->flags & AV_CODEC_FLAG_PASS1) && avctx->stats_out)
             avctx->stats_out[0] = '\0';
-        if (av_image_check_size2(avctx->width, avctx->height, 
avctx->max_pixels, AV_PIX_FMT_NONE, 0, avctx))
-            return AVERROR(EINVAL);
     }
 
     if (ffcodec(avctx->codec)->cb_type == FF_CODEC_CB_TYPE_RECEIVE_PACKET) {

commit a2e4ba4df6e4d18b9a23ce735b42659ee1cf22e3
Author:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
AuthorDate: Fri Jul 11 16:27:34 2025 +0200
Commit:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
CommitDate: Mon Sep 15 17:52:21 2025 +0200

    avcodec/encode: Remove dead code
    
    Can be readded if needed (likely never).
    
    Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>

diff --git a/libavcodec/encode.c b/libavcodec/encode.c
index 37cf35460b..c1a9bd587c 100644
--- a/libavcodec/encode.c
+++ b/libavcodec/encode.c
@@ -841,24 +841,12 @@ int ff_encode_alloc_frame(AVCodecContext *avctx, AVFrame 
*frame)
 {
     int ret;
 
-    switch (avctx->codec->type) {
-    case AVMEDIA_TYPE_VIDEO:
-        frame->format = avctx->pix_fmt;
-        if (frame->width <= 0 || frame->height <= 0) {
-            frame->width  = avctx->width;
-            frame->height = avctx->height;
-        }
+    av_assert1(avctx->codec_type == AVMEDIA_TYPE_VIDEO);
 
-        break;
-    case AVMEDIA_TYPE_AUDIO:
-        frame->sample_rate = avctx->sample_rate;
-        frame->format      = avctx->sample_fmt;
-        if (!frame->ch_layout.nb_channels) {
-            ret = av_channel_layout_copy(&frame->ch_layout, &avctx->ch_layout);
-            if (ret < 0)
-                return ret;
-        }
-        break;
+    frame->format = avctx->pix_fmt;
+    if (frame->width <= 0 || frame->height <= 0) {
+        frame->width  = avctx->width;
+        frame->height = avctx->height;
     }
 
     ret = avcodec_default_get_buffer2(avctx, frame, 0);

commit 9a130a57cd86afbd4272798e14b84312ccc6f206
Author:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
AuthorDate: Fri Jul 11 16:25:41 2025 +0200
Commit:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
CommitDate: Mon Sep 15 17:52:21 2025 +0200

    avcodec/encode: Ignore coded_{width,height}
    
    It is supposed to be unused by encoders.
    
    Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>

diff --git a/libavcodec/encode.c b/libavcodec/encode.c
index 7e0daba4d5..37cf35460b 100644
--- a/libavcodec/encode.c
+++ b/libavcodec/encode.c
@@ -845,8 +845,8 @@ int ff_encode_alloc_frame(AVCodecContext *avctx, AVFrame 
*frame)
     case AVMEDIA_TYPE_VIDEO:
         frame->format = avctx->pix_fmt;
         if (frame->width <= 0 || frame->height <= 0) {
-            frame->width  = FFMAX(avctx->width,  avctx->coded_width);
-            frame->height = FFMAX(avctx->height, avctx->coded_height);
+            frame->width  = avctx->width;
+            frame->height = avctx->height;
         }
 
         break;

commit b3ac02eb83d47b87e023e700d72a431a856cebb2
Author:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
AuthorDate: Fri Jul 11 16:17:49 2025 +0200
Commit:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
CommitDate: Mon Sep 15 17:52:21 2025 +0200

    avcodec/encode: Simplify pixel format validity check
    
    Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>

diff --git a/libavcodec/encode.c b/libavcodec/encode.c
index 9012708130..7e0daba4d5 100644
--- a/libavcodec/encode.c
+++ b/libavcodec/encode.c
@@ -551,7 +551,7 @@ static int encode_preinit_video(AVCodecContext *avctx)
     const enum AVPixelFormat *pix_fmts;
     int ret, i, num_pix_fmts;
 
-    if (!av_get_pix_fmt_name(avctx->pix_fmt)) {
+    if (!pixdesc) {
         av_log(avctx, AV_LOG_ERROR, "Invalid video pixel format: %d\n",
                avctx->pix_fmt);
         return AVERROR(EINVAL);

commit ed9c8e98cce7a6a4433f2b56b526a0ed1e57237b
Author:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
AuthorDate: Fri Jul 4 15:56:52 2025 +0200
Commit:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
CommitDate: Mon Sep 15 17:52:21 2025 +0200

    avcodec/av1dec,libdav1d,wbmpdec: Avoid direct access to GetByteContext
    
    Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>

diff --git a/libavcodec/av1dec.c b/libavcodec/av1dec.c
index 3d4363cfaa..b0c4efab8a 100644
--- a/libavcodec/av1dec.c
+++ b/libavcodec/av1dec.c
@@ -1019,7 +1019,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
         if (provider_oriented_code != 0x800)
             return 0; // ignore
 
-        ret = ff_dovi_rpu_parse(&s->dovi, gb.buffer, gb.buffer_end - gb.buffer,
+        ret = ff_dovi_rpu_parse(&s->dovi, gb.buffer, 
bytestream2_get_bytes_left(&gb),
                                 avctx->err_recognition);
         if (ret < 0) {
             av_log(avctx, AV_LOG_WARNING, "Error parsing DOVI OBU.\n");
diff --git a/libavcodec/libdav1d.c b/libavcodec/libdav1d.c
index a1158a23c4..bd3050b881 100644
--- a/libavcodec/libdav1d.c
+++ b/libavcodec/libdav1d.c
@@ -444,7 +444,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
         if (provider_oriented_code != 0x800)
             return 0; // ignore
 
-        res = ff_dovi_rpu_parse(&dav1d->dovi, gb.buffer, gb.buffer_end - 
gb.buffer,
+        res = ff_dovi_rpu_parse(&dav1d->dovi, gb.buffer, 
bytestream2_get_bytes_left(&gb),
                                 c->err_recognition);
         if (res < 0) {
             av_log(c, AV_LOG_WARNING, "Error parsing DOVI OBU.\n");
diff --git a/libavcodec/wbmpdec.c b/libavcodec/wbmpdec.c
index 50c729047d..5a61510a88 100644
--- a/libavcodec/wbmpdec.c
+++ b/libavcodec/wbmpdec.c
@@ -72,7 +72,8 @@ static int wbmp_decode_frame(AVCodecContext *avctx, AVFrame 
*p,
     if (p->linesize[0] == (width + 7) / 8)
         bytestream2_get_buffer(&gb, p->data[0], height * ((width + 7) / 8));
     else
-        readbits(p->data[0], width, height, p->linesize[0], gb.buffer, 
gb.buffer_end - gb.buffer);
+        readbits(p->data[0], width, height, p->linesize[0],
+                 gb.buffer, bytestream2_get_bytes_left(&gb));
 
     *got_frame   = 1;
 

commit 8872c0c39d654fc2b2bbb9c3d19ddd344a8f9e4e
Author:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
AuthorDate: Fri Jul 11 23:17:17 2025 +0200
Commit:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
CommitDate: Mon Sep 15 17:52:21 2025 +0200

    avformat/takdec: Don't truncate return value
    
    This is unlikely to matter for real files.
    
    Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>

diff --git a/libavformat/takdec.c b/libavformat/takdec.c
index b8f76aaa67..c1271601b5 100644
--- a/libavformat/takdec.c
+++ b/libavformat/takdec.c
@@ -141,10 +141,11 @@ static int tak_read_header(AVFormatContext *s)
             tc->data_end += curpos;
             return 0;
         }
-        default:
-            ret = avio_skip(pb, size);
-            if (ret < 0)
-                return ret;
+        default: {
+            int64_t ret64 = avio_skip(pb, size);
+            if (ret64 < 0)
+                return ret64;
+        }
         }
 
         if (type == TAK_METADATA_STREAMINFO) {

commit 057afba13d3758f85ffbe636d16c29c0b5101bb5
Author:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
AuthorDate: Fri Jul 11 22:52:18 2025 +0200
Commit:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
CommitDate: Mon Sep 15 17:52:21 2025 +0200

    avformat/tta: Avoid seek when reading header
    
    Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>

diff --git a/libavformat/tta.c b/libavformat/tta.c
index 70642324af..2921e9bd38 100644
--- a/libavformat/tta.c
+++ b/libavformat/tta.c
@@ -51,36 +51,34 @@ static int tta_read_header(AVFormatContext *s)
 {
     TTAContext *c = s->priv_data;
     AVStream *st;
-    int i, channels, bps, samplerate;
-    int64_t framepos, start_offset;
-    uint32_t nb_samples, crc;
+    int64_t framepos;
+    uint8_t header[22];
 
     ff_id3v1_read(s);
 
-    start_offset = avio_tell(s->pb);
-    if (start_offset < 0)
-        return start_offset;
-    ffio_init_checksum(s->pb, ff_crcEDB88320_update, UINT32_MAX);
-    if (avio_rl32(s->pb) != AV_RL32("TTA1"))
+    int ret = ffio_read_size(s->pb, header, sizeof(header));
+    if (ret < 0)
+        return ret;
+
+    if (AV_RL32(header) != MKTAG('T', 'T', 'A', '1'))
         return AVERROR_INVALIDDATA;
 
-    avio_skip(s->pb, 2); // FIXME: flags
-    channels = avio_rl16(s->pb);
-    bps = avio_rl16(s->pb);
-    samplerate = avio_rl32(s->pb);
+    int channels   = AV_RL16(header +  6);
+    int bps        = AV_RL16(header +  8);
+    int samplerate = AV_RL32(header + 10);
     if(samplerate <= 0 || samplerate > 1000000){
         av_log(s, AV_LOG_ERROR, "nonsense samplerate\n");
         return AVERROR_INVALIDDATA;
     }
 
-    nb_samples = avio_rl32(s->pb);
+    uint32_t nb_samples = AV_RL32(header + 14);
     if (!nb_samples) {
         av_log(s, AV_LOG_ERROR, "invalid number of samples\n");
         return AVERROR_INVALIDDATA;
     }
 
-    crc = ffio_get_checksum(s->pb) ^ UINT32_MAX;
-    if (crc != avio_rl32(s->pb) && s->error_recognition & AV_EF_CRCCHECK) {
+    uint32_t crc = av_crc(av_crc_get_table(AV_CRC_32_IEEE_LE), UINT32_MAX, 
header, 18) ^ UINT32_MAX;
+    if (crc != AV_RL32(header + 18) && s->error_recognition & AV_EF_CRCCHECK) {
         av_log(s, AV_LOG_ERROR, "Header CRC error\n");
         return AVERROR_INVALIDDATA;
     }
@@ -105,19 +103,18 @@ static int tta_read_header(AVFormatContext *s)
     st->start_time = 0;
     st->duration = nb_samples;
 
+    ret = ff_alloc_extradata(st->codecpar, sizeof(header));
+    if (ret < 0)
+        return ret;
+    memcpy(st->codecpar->extradata, header, sizeof(header));
+
     framepos = avio_tell(s->pb);
     if (framepos < 0)
         return framepos;
     framepos += 4 * c->totalframes + 4;
 
-    if (ff_alloc_extradata(st->codecpar, avio_tell(s->pb) - start_offset))
-        return AVERROR(ENOMEM);
-
-    avio_seek(s->pb, start_offset, SEEK_SET);
-    avio_read(s->pb, st->codecpar->extradata, st->codecpar->extradata_size);
-
     ffio_init_checksum(s->pb, ff_crcEDB88320_update, UINT32_MAX);
-    for (i = 0; i < c->totalframes; i++) {
+    for (int i = 0; i < c->totalframes; i++) {
         uint32_t size = avio_rl32(s->pb);
         int r;
         if (avio_feof(s->pb))

commit bd80640caeb07dfc3656a6b680fde2da2e46af5b
Author:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
AuthorDate: Fri Jul 11 22:26:21 2025 +0200
Commit:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
CommitDate: Mon Sep 15 17:52:21 2025 +0200

    avformat/oggdec: Don't skip over data whose checksum is used
    
    The behavior of the ffio_*_checksum feature is not well defined
    when using avio_skip(). The code in oggdec.c relied on the skipped
    data (four bytes) to be checksummed, which is mostly true
    because short_seek_threshold is 32768 by default, so that
    avio_seek() will normally read data instead of calling the
    underlying seek function. Yet this has two problems:
    
    a) It relies on implementation details of avio_seek().
    b) There is an exception, namely if the AVIO_FLAG_DIRECT is set.
    In this case the underlying seek function (if set) is always
    called and the data is skipped, leading to CRC errors.
    
    So don't skip the data.
    
    Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>

diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c
index da3ef815db..9dc2c62035 100644
--- a/libavformat/oggdec.c
+++ b/libavformat/oggdec.c
@@ -370,7 +370,7 @@ static int ogg_read_page(AVFormatContext *s, int *sid, int 
probing)
     flags   = avio_r8(bc);
     gp      = avio_rl64(bc);
     serial  = avio_rl32(bc);
-    avio_skip(bc, 4); /* seq */
+    avio_rl32(bc); /* seq */
 
     crc_tmp = ffio_get_checksum(bc);
     crc     = avio_rb32(bc);

commit 987c955cd7e972d9940284fa6ae7187ac858ebb1
Author:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
AuthorDate: Fri Jul 11 22:58:26 2025 +0200
Commit:     Andreas Rheinhardt <andreas.rheinha...@outlook.com>
CommitDate: Mon Sep 15 17:52:21 2025 +0200

    avformat/aviobuf: Keep checksum_ptr consistent in avio_seek()
    
    Otherwise it might be > buf_ptr in which case ffio_get_checksum()
    could segfault (s->buf_ptr - s->checksum_ptr would be negative
    which would be converted to something very big when converted
    to unsigned for the update_checksum callback).
    
    Fixes ticket #11233.
    
    Reported-by: Du4t
    Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>

diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
index 6a6ec36e28..9beac8bcd5 100644
--- a/libavformat/aviobuf.c
+++ b/libavformat/aviobuf.c
@@ -311,7 +311,7 @@ int64_t avio_seek(AVIOContext *s, int64_t offset, int 
whence)
         ctx->seek_count++;
         if (!s->write_flag)
             s->buf_end = s->buffer;
-        s->buf_ptr = s->buf_ptr_max = s->buffer;
+        s->checksum_ptr = s->buf_ptr = s->buf_ptr_max = s->buffer;
         s->pos = offset;
     }
     s->eof_reached = 0;

-----------------------------------------------------------------------

Summary of changes:
 configure                           |  4 +--
 libavcodec/av1dec.c                 |  2 +-
 libavcodec/encode.c                 | 28 ++++------------
 libavcodec/libdav1d.c               |  2 +-
 libavcodec/mjpegdec.c               | 67 ++++++++++++++++---------------------
 libavcodec/mjpegdec.h               |  2 +-
 libavcodec/mxpegdec.c               | 11 ++++++
 libavcodec/wbmpdec.c                |  3 +-
 libavformat/aviobuf.c               |  2 +-
 libavformat/oggdec.c                |  2 +-
 libavformat/takdec.c                |  9 ++---
 libavformat/tta.c                   | 41 +++++++++++------------
 libswresample/rematrix.c            | 61 ++++++++++++++-------------------
 libswresample/rematrix_template.c   |  2 +-
 libswresample/swresample.c          |  6 ++--
 libswresample/swresample_internal.h | 19 ++++++++---
 libswresample/x86/rematrix_init.c   | 12 +++----
 17 files changed, 127 insertions(+), 146 deletions(-)


hooks/post-receive
-- 

_______________________________________________
ffmpeg-cvslog mailing list -- ffmpeg-cvslog@ffmpeg.org
To unsubscribe send an email to ffmpeg-cvslog-le...@ffmpeg.org

Reply via email to