Merge remote-tracking branch 'qatar/master'

* qatar/master:
  flicvideo: fix invalid reads
  vorbis: Avoid some out-of-bounds reads
  vqf: add more known extensions
  cabac: remove unused function renorm_cabac_decoder
  h264: Only use symbols from the SVQ3 decoder under proper conditionals.
  add bytestream2_tell() and bytestream2_seek() functions
  parsers: initialize MpegEncContext.slice_context_count to 1
  spdifenc: use special alignment for DTS-HD length_code

Conflicts:
	libavcodec/flicvideo.c
	libavcodec/h264.c
	libavcodec/mpeg4video_parser.c
	libavcodec/vorbis.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

8 files changed, 144 insertions, 127 deletions

diff --git a/libavcodec/bytestream.h b/libavcodec/bytestream.h
index 73ea0c880f..4e17e9d9f7 100644
--- a/libavcodec/bytestream.h
+++ b/libavcodec/bytestream.h
@@ -27,7 +27,7 @@
 #include "libavutil/intreadwrite.h"
 
 typedef struct {
-    const uint8_t *buffer, *buffer_end;
+    const uint8_t *buffer, *buffer_end, *buffer_start;
 } GetByteContext;
 
 #define DEF_T(type, name, bytes, read, write)                             \
@@ -79,6 +79,7 @@ static av_always_inline void bytestream2_init(GetByteContext *g,
                                               const uint8_t *buf, int buf_size)
 {
     g->buffer =  buf;
+    g->buffer_start = buf;
     g->buffer_end = buf + buf_size;
 }
 
@@ -93,6 +94,34 @@ static av_always_inline void bytestream2_skip(GetByteContext *g,
     g->buffer += FFMIN(g->buffer_end - g->buffer, size);
 }
 
+static av_always_inline int bytestream2_tell(GetByteContext *g)
+{
+    return (int)(g->buffer - g->buffer_start);
+}
+
+static av_always_inline int bytestream2_seek(GetByteContext *g, int offset,
+                                             int whence)
+{
+    switch (whence) {
+    case SEEK_CUR:
+        offset = av_clip(offset, -(g->buffer - g->buffer_start),
+                         g->buffer_end - g->buffer);
+        g->buffer += offset;
+        break;
+    case SEEK_END:
+        offset = av_clip(offset, -(g->buffer_end - g->buffer_start), 0);
+        g->buffer = g->buffer_end + offset;
+        break;
+    case SEEK_SET:
+        offset = av_clip(offset, 0, g->buffer_end - g->buffer_start);
+        g->buffer = g->buffer_start + offset;
+        break;
+    default:
+        return AVERROR(EINVAL);
+    }
+    return bytestream2_tell(g);
+}
+
 static av_always_inline unsigned int bytestream2_get_buffer(GetByteContext *g,
                                                             uint8_t *dst,
                                                             unsigned int size)
diff --git a/libavcodec/cabac.h b/libavcodec/cabac.h
index d31d75b030..0ee8e315f4 100644
--- a/libavcodec/cabac.h
+++ b/libavcodec/cabac.h
@@ -97,15 +97,6 @@ static void refill(CABACContext *c){
     c->bytestream+= CABAC_BITS/8;
 }
 
-static inline void renorm_cabac_decoder(CABACContext *c){
-    while(c->range < 0x100){
-        c->range+= c->range;
-        c->low+= c->low;
-        if(!(c->low & CABAC_MASK))
-            refill(c);
-    }
-}
-
 static inline void renorm_cabac_decoder_once(CABACContext *c){
     int shift= (uint32_t)(c->range - 0x100)>>31;
     c->range<<= shift;
diff --git a/libavcodec/flicvideo.c b/libavcodec/flicvideo.c
index dded6f5293..01962e1122 100644
--- a/libavcodec/flicvideo.c
+++ b/libavcodec/flicvideo.c
@@ -41,6 +41,8 @@
 
 #include "libavutil/intreadwrite.h"
 #include "avcodec.h"
+#include "bytestream.h"
+#include "mathops.h"
 
 #define FLI_256_COLOR 4
 #define FLI_DELTA     7
@@ -133,7 +135,7 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
 {
     FlicDecodeContext *s = avctx->priv_data;
 
-    int stream_ptr = 0;
+    GetByteContext g2;
     int pixel_ptr;
     int palette_ptr;
     unsigned char palette_idx1;
@@ -163,6 +165,8 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
     unsigned char *pixels;
     unsigned int pixel_limit;
 
+    bytestream2_init(&g2, buf, buf_size);
+
     s->frame.reference = 3;
     s->frame.buffer_hints = FF_BUFFER_HINTS_VALID | FF_BUFFER_HINTS_PRESERVE | FF_BUFFER_HINTS_REUSABLE;
     if (avctx->reget_buffer(avctx, &s->frame) < 0) {
@@ -172,32 +176,29 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
 
     pixels = s->frame.data[0];
     pixel_limit = s->avctx->height * s->frame.linesize[0];
-
     if (buf_size < 16 || buf_size > INT_MAX - (3 * 256 + FF_INPUT_BUFFER_PADDING_SIZE))
         return AVERROR_INVALIDDATA;
-    frame_size = AV_RL32(&buf[stream_ptr]);
+    frame_size = bytestream2_get_le32(&g2);
     if (frame_size > buf_size)
         frame_size = buf_size;
-    stream_ptr += 6;  /* skip the magic number */
-    num_chunks = AV_RL16(&buf[stream_ptr]);
-    stream_ptr += 10;  /* skip padding */
+    bytestream2_skip(&g2, 2); /* skip the magic number */
+    num_chunks = bytestream2_get_le16(&g2);
+    bytestream2_skip(&g2, 8);  /* skip padding */
 
     frame_size -= 16;
 
     /* iterate through the chunks */
     while ((frame_size >= 6) && (num_chunks > 0)) {
         int stream_ptr_after_chunk;
-        chunk_size = AV_RL32(&buf[stream_ptr]);
+        chunk_size = bytestream2_get_le32(&g2);
         if (chunk_size > frame_size) {
             av_log(avctx, AV_LOG_WARNING,
                    "Invalid chunk_size = %u > frame_size = %u\n", chunk_size, frame_size);
             chunk_size = frame_size;
         }
-        stream_ptr_after_chunk = stream_ptr + chunk_size;
+        stream_ptr_after_chunk = bytestream2_tell(&g2) - 4 + chunk_size;
 
-        stream_ptr += 4;
-        chunk_type = AV_RL16(&buf[stream_ptr]);
-        stream_ptr += 2;
+        chunk_type = bytestream2_get_le16(&g2);
 
         switch (chunk_type) {
         case FLI_256_COLOR:
@@ -211,21 +212,20 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
             else
                 color_shift = 2;
             /* set up the palette */
-            color_packets = AV_RL16(&buf[stream_ptr]);
-            stream_ptr += 2;
+            color_packets = bytestream2_get_le16(&g2);
             palette_ptr = 0;
             for (i = 0; i < color_packets; i++) {
                 /* first byte is how many colors to skip */
-                palette_ptr += buf[stream_ptr++];
+                palette_ptr += bytestream2_get_byte(&g2);
 
                 /* next byte indicates how many entries to change */
-                color_changes = buf[stream_ptr++];
+                color_changes = bytestream2_get_byte(&g2);
 
                 /* if there are 0 color changes, there are actually 256 */
                 if (color_changes == 0)
                     color_changes = 256;
 
-                if (stream_ptr + color_changes * 3 > stream_ptr_after_chunk)
+                if (bytestream2_tell(&g2) + color_changes * 3 > stream_ptr_after_chunk)
                     break;
 
                 for (j = 0; j < color_changes; j++) {
@@ -235,9 +235,9 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
                     if ((unsigned)palette_ptr >= 256)
                         palette_ptr = 0;
 
-                    r = buf[stream_ptr++] << color_shift;
-                    g = buf[stream_ptr++] << color_shift;
-                    b = buf[stream_ptr++] << color_shift;
+                    r = bytestream2_get_byte(&g2) << color_shift;
+                    g = bytestream2_get_byte(&g2) << color_shift;
+                    b = bytestream2_get_byte(&g2) << color_shift;
                     entry = 0xFF << 24 | r << 16 | g << 8 | b;
                     if (color_shift == 2)
                         entry |= entry >> 6 & 0x30303;
@@ -250,13 +250,11 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
 
         case FLI_DELTA:
             y_ptr = 0;
-            compressed_lines = AV_RL16(&buf[stream_ptr]);
-            stream_ptr += 2;
+            compressed_lines = bytestream2_get_le16(&g2);
             while (compressed_lines > 0) {
-                if (stream_ptr + 2 > stream_ptr_after_chunk)
+                if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
                     break;
-                line_packets = AV_RL16(&buf[stream_ptr]);
-                stream_ptr += 2;
+                line_packets = bytestream2_get_le16(&g2);
                 if ((line_packets & 0xC000) == 0xC000) {
                     // line skip opcode
                     line_packets = -line_packets;
@@ -274,17 +272,17 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
                     CHECK_PIXEL_PTR(0);
                     pixel_countdown = s->avctx->width;
                     for (i = 0; i < line_packets; i++) {
-                        if (stream_ptr + 2 > stream_ptr_after_chunk)
+                        if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
                             break;
                         /* account for the skip bytes */
-                        pixel_skip = buf[stream_ptr++];
+                        pixel_skip = bytestream2_get_byte(&g2);
                         pixel_ptr += pixel_skip;
                         pixel_countdown -= pixel_skip;
-                        byte_run = (signed char)(buf[stream_ptr++]);
+                        byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
                         if (byte_run < 0) {
                             byte_run = -byte_run;
-                            palette_idx1 = buf[stream_ptr++];
-                            palette_idx2 = buf[stream_ptr++];
+                            palette_idx1 = bytestream2_get_byte(&g2);
+                            palette_idx2 = bytestream2_get_byte(&g2);
                             CHECK_PIXEL_PTR(byte_run * 2);
                             for (j = 0; j < byte_run; j++, pixel_countdown -= 2) {
                                 pixels[pixel_ptr++] = palette_idx1;
@@ -292,11 +290,10 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
                             }
                         } else {
                             CHECK_PIXEL_PTR(byte_run * 2);
-                            if (stream_ptr + byte_run * 2 > stream_ptr_after_chunk)
+                            if (bytestream2_tell(&g2) + byte_run * 2 > stream_ptr_after_chunk)
                                 break;
                             for (j = 0; j < byte_run * 2; j++, pixel_countdown--) {
-                                palette_idx1 = buf[stream_ptr++];
-                                pixels[pixel_ptr++] = palette_idx1;
+                                pixels[pixel_ptr++] = bytestream2_get_byte(&g2);
                             }
                         }
                     }
@@ -308,40 +305,37 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
 
         case FLI_LC:
             /* line compressed */
-            starting_line = AV_RL16(&buf[stream_ptr]);
-            stream_ptr += 2;
+            starting_line = bytestream2_get_le16(&g2);
             y_ptr = 0;
             y_ptr += starting_line * s->frame.linesize[0];
 
-            compressed_lines = AV_RL16(&buf[stream_ptr]);
-            stream_ptr += 2;
+            compressed_lines = bytestream2_get_le16(&g2);
             while (compressed_lines > 0) {
                 pixel_ptr = y_ptr;
                 CHECK_PIXEL_PTR(0);
                 pixel_countdown = s->avctx->width;
-                if (stream_ptr + 1 > stream_ptr_after_chunk)
+                if (bytestream2_tell(&g2) + 1 > stream_ptr_after_chunk)
                     break;
-                line_packets = buf[stream_ptr++];
+                line_packets = bytestream2_get_byte(&g2);
                 if (line_packets > 0) {
                     for (i = 0; i < line_packets; i++) {
                         /* account for the skip bytes */
-                        if (stream_ptr + 2 > stream_ptr_after_chunk)
+                        if (bytestream2_tell(&g2) + 1 > stream_ptr_after_chunk)
                             break;
-                        pixel_skip = buf[stream_ptr++];
+                        pixel_skip = bytestream2_get_byte(&g2);
                         pixel_ptr += pixel_skip;
                         pixel_countdown -= pixel_skip;
-                        byte_run = (signed char)(buf[stream_ptr++]);
+                        byte_run = sign_extend(bytestream2_get_byte(&g2),8);
                         if (byte_run > 0) {
                             CHECK_PIXEL_PTR(byte_run);
-                            if (stream_ptr + byte_run > stream_ptr_after_chunk)
+                            if (bytestream2_tell(&g2) + byte_run > stream_ptr_after_chunk)
                                 break;
                             for (j = 0; j < byte_run; j++, pixel_countdown--) {
-                                palette_idx1 = buf[stream_ptr++];
-                                pixels[pixel_ptr++] = palette_idx1;
+                                pixels[pixel_ptr++] = bytestream2_get_byte(&g2);
                             }
                         } else if (byte_run < 0) {
                             byte_run = -byte_run;
-                            palette_idx1 = buf[stream_ptr++];
+                            palette_idx1 = bytestream2_get_byte(&g2);
                             CHECK_PIXEL_PTR(byte_run);
                             for (j = 0; j < byte_run; j++, pixel_countdown--) {
                                 pixels[pixel_ptr++] = palette_idx1;
@@ -369,14 +363,14 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
                 pixel_ptr = y_ptr;
                 /* disregard the line packets; instead, iterate through all
                  * pixels on a row */
-                stream_ptr++;
+                 bytestream2_skip(&g2, 1);
                 pixel_countdown = s->avctx->width;
                 while (pixel_countdown > 0) {
-                    if (stream_ptr + 1 > stream_ptr_after_chunk)
+                    if (bytestream2_tell(&g2) + 1 > stream_ptr_after_chunk)
                         break;
-                    byte_run = (signed char)(buf[stream_ptr++]);
+                    byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
                     if (byte_run > 0) {
-                        palette_idx1 = buf[stream_ptr++];
+                        palette_idx1 = bytestream2_get_byte(&g2);
                         CHECK_PIXEL_PTR(byte_run);
                         for (j = 0; j < byte_run; j++) {
                             pixels[pixel_ptr++] = palette_idx1;
@@ -388,11 +382,10 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
                     } else {  /* copy bytes if byte_run < 0 */
                         byte_run = -byte_run;
                         CHECK_PIXEL_PTR(byte_run);
-                        if (stream_ptr + byte_run > stream_ptr_after_chunk)
+                        if (bytestream2_tell(&g2) + byte_run > stream_ptr_after_chunk)
                             break;
                         for (j = 0; j < byte_run; j++) {
-                            palette_idx1 = buf[stream_ptr++];
-                            pixels[pixel_ptr++] = palette_idx1;
+                            pixels[pixel_ptr++] = bytestream2_get_byte(&g2);
                             pixel_countdown--;
                             if (pixel_countdown < 0)
                                 av_log(avctx, AV_LOG_ERROR, "pixel_countdown < 0 (%d) at line %d\n",
@@ -410,12 +403,12 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
             if (chunk_size - 6 != s->avctx->width * s->avctx->height) {
                 av_log(avctx, AV_LOG_ERROR, "In chunk FLI_COPY : source data (%d bytes) " \
                        "has incorrect size, skipping chunk\n", chunk_size - 6);
+                bytestream2_skip(&g2, chunk_size - 6);
             } else {
                 for (y_ptr = 0; y_ptr < s->frame.linesize[0] * s->avctx->height;
                      y_ptr += s->frame.linesize[0]) {
-                    memcpy(&pixels[y_ptr], &buf[stream_ptr],
-                        s->avctx->width);
-                    stream_ptr += s->avctx->width;
+                    bytestream2_get_buffer(&g2, &pixels[y_ptr],
+                                           s->avctx->width);
                 }
             }
             break;
@@ -429,7 +422,8 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
             break;
         }
 
-        stream_ptr = stream_ptr_after_chunk;
+        if (stream_ptr_after_chunk - bytestream2_tell(&g2) > 0)
+            bytestream2_skip(&g2, stream_ptr_after_chunk - bytestream2_tell(&g2));
 
         frame_size -= chunk_size;
         num_chunks--;
@@ -437,9 +431,11 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
 
     /* by the end of the chunk, the stream ptr should equal the frame
      * size (minus 1, possibly); if it doesn't, issue a warning */
-    if ((stream_ptr != buf_size) && (stream_ptr != buf_size - 1))
+    if ((bytestream2_get_bytes_left(&g2) != 0) &&
+        (bytestream2_get_bytes_left(&g2) != 1))
         av_log(avctx, AV_LOG_ERROR, "Processed FLI chunk where chunk size = %d " \
-               "and final chunk ptr = %d\n", buf_size, stream_ptr);
+               "and final chunk ptr = %d\n", buf_size,
+               buf_size - bytestream2_get_bytes_left(&g2));
 
     /* make the palette available on the way out */
     memcpy(s->frame.data[1], s->palette, AVPALETTE_SIZE);
@@ -462,7 +458,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
     /* Format is the pixel format, the packets are processed the same. */
     FlicDecodeContext *s = avctx->priv_data;
 
-    int stream_ptr = 0;
+    GetByteContext g2;
     int pixel_ptr;
     unsigned char palette_idx1;
 
@@ -485,6 +481,8 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
     int pixel;
     unsigned int pixel_limit;
 
+    bytestream2_init(&g2, buf, buf_size);
+
     s->frame.reference = 3;
     s->frame.buffer_hints = FF_BUFFER_HINTS_VALID | FF_BUFFER_HINTS_PRESERVE | FF_BUFFER_HINTS_REUSABLE;
     if (avctx->reget_buffer(avctx, &s->frame) < 0) {
@@ -495,10 +493,10 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
     pixels = s->frame.data[0];
     pixel_limit = s->avctx->height * s->frame.linesize[0];
 
-    frame_size = AV_RL32(&buf[stream_ptr]);
-    stream_ptr += 6;  /* skip the magic number */
-    num_chunks = AV_RL16(&buf[stream_ptr]);
-    stream_ptr += 10;  /* skip padding */
+    frame_size = bytestream2_get_le32(&g2);
+    bytestream2_skip(&g2, 2);  /* skip the magic number */
+    num_chunks = bytestream2_get_le16(&g2);
+    bytestream2_skip(&g2, 8);  /* skip padding */
     if (frame_size > buf_size)
         frame_size = buf_size;
 
@@ -507,17 +505,15 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
     /* iterate through the chunks */
     while ((frame_size > 0) && (num_chunks > 0)) {
         int stream_ptr_after_chunk;
-        chunk_size = AV_RL32(&buf[stream_ptr]);
+        chunk_size = bytestream2_get_le32(&g2);
         if (chunk_size > frame_size) {
             av_log(avctx, AV_LOG_WARNING,
                    "Invalid chunk_size = %u > frame_size = %u\n", chunk_size, frame_size);
             chunk_size = frame_size;
         }
-        stream_ptr_after_chunk = stream_ptr + chunk_size;
+        stream_ptr_after_chunk = bytestream2_tell(&g2) - 4 + chunk_size;
 
-        stream_ptr += 4;
-        chunk_type = AV_RL16(&buf[stream_ptr]);
-        stream_ptr += 2;
+        chunk_type = bytestream2_get_le16(&g2);
 
 
         switch (chunk_type) {
@@ -527,19 +523,17 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
              * include one of these chunks in their first frame.
              * Why I do not know, it seems rather extraneous. */
 /*            av_log(avctx, AV_LOG_ERROR, "Unexpected Palette chunk %d in non-paletised FLC\n",chunk_type);*/
-            stream_ptr = stream_ptr + chunk_size - 6;
+            bytestream2_skip(&g2, chunk_size - 6);
             break;
 
         case FLI_DELTA:
         case FLI_DTA_LC:
             y_ptr = 0;
-            compressed_lines = AV_RL16(&buf[stream_ptr]);
-            stream_ptr += 2;
+            compressed_lines = bytestream2_get_le16(&g2);
             while (compressed_lines > 0) {
-                if (stream_ptr + 2 > stream_ptr_after_chunk)
+                if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
                     break;
-                line_packets = AV_RL16(&buf[stream_ptr]);
-                stream_ptr += 2;
+                line_packets = bytestream2_get_le16(&g2);
                 if (line_packets < 0) {
                     line_packets = -line_packets;
                     y_ptr += line_packets * s->frame.linesize[0];
@@ -550,28 +544,26 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                     pixel_countdown = s->avctx->width;
                     for (i = 0; i < line_packets; i++) {
                         /* account for the skip bytes */
-                        if (stream_ptr + 2 > stream_ptr_after_chunk)
+                        if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
                             break;
-                        pixel_skip = buf[stream_ptr++];
+                        pixel_skip = bytestream2_get_byte(&g2);
                         pixel_ptr += (pixel_skip*2); /* Pixel is 2 bytes wide */
                         pixel_countdown -= pixel_skip;
-                        byte_run = (signed char)(buf[stream_ptr++]);
+                        byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
                         if (byte_run < 0) {
                             byte_run = -byte_run;
-                            pixel    = AV_RL16(&buf[stream_ptr]);
-                            stream_ptr += 2;
+                            pixel    = bytestream2_get_le16(&g2);
                             CHECK_PIXEL_PTR(2 * byte_run);
                             for (j = 0; j < byte_run; j++, pixel_countdown -= 2) {
                                 *((signed short*)(&pixels[pixel_ptr])) = pixel;
                                 pixel_ptr += 2;
                             }
                         } else {
-                            if (stream_ptr + 2*byte_run > stream_ptr_after_chunk)
+                            if (bytestream2_tell(&g2) + 2*byte_run > stream_ptr_after_chunk)
                                 break;
                             CHECK_PIXEL_PTR(2 * byte_run);
                             for (j = 0; j < byte_run; j++, pixel_countdown--) {
-                                *((signed short*)(&pixels[pixel_ptr])) = AV_RL16(&buf[stream_ptr]);
-                                stream_ptr += 2;
+                                *((signed short*)(&pixels[pixel_ptr])) = bytestream2_get_le16(&g2);
                                 pixel_ptr += 2;
                             }
                         }
@@ -584,7 +576,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
 
         case FLI_LC:
             av_log(avctx, AV_LOG_ERROR, "Unexpected FLI_LC chunk in non-paletised FLC\n");
-            stream_ptr = stream_ptr + chunk_size - 6;
+            bytestream2_skip(&g2, chunk_size - 6);
             break;
 
         case FLI_BLACK:
@@ -599,15 +591,15 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                 pixel_ptr = y_ptr;
                 /* disregard the line packets; instead, iterate through all
                  * pixels on a row */
-                stream_ptr++;
+                bytestream2_skip(&g2, 1);
                 pixel_countdown = (s->avctx->width * 2);
 
                 while (pixel_countdown > 0) {
-                    if (stream_ptr + 1 > stream_ptr_after_chunk)
+                    if (bytestream2_tell(&g2) + 1 > stream_ptr_after_chunk)
                         break;
-                    byte_run = (signed char)(buf[stream_ptr++]);
+                    byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
                     if (byte_run > 0) {
-                        palette_idx1 = buf[stream_ptr++];
+                        palette_idx1 = bytestream2_get_byte(&g2);
                         CHECK_PIXEL_PTR(byte_run);
                         for (j = 0; j < byte_run; j++) {
                             pixels[pixel_ptr++] = palette_idx1;
@@ -618,11 +610,11 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                         }
                     } else {  /* copy bytes if byte_run < 0 */
                         byte_run = -byte_run;
-                        if (stream_ptr + byte_run > stream_ptr_after_chunk)
+                        if (bytestream2_tell(&g2) + byte_run > stream_ptr_after_chunk)
                             break;
                         CHECK_PIXEL_PTR(byte_run);
                         for (j = 0; j < byte_run; j++) {
-                            palette_idx1 = buf[stream_ptr++];
+                            palette_idx1 = bytestream2_get_byte(&g2);
                             pixels[pixel_ptr++] = palette_idx1;
                             pixel_countdown--;
                             if (pixel_countdown < 0)
@@ -655,16 +647,15 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                 pixel_ptr = y_ptr;
                 /* disregard the line packets; instead, iterate through all
                  * pixels on a row */
-                stream_ptr++;
+                bytestream2_skip(&g2, 1);
                 pixel_countdown = s->avctx->width; /* Width is in pixels, not bytes */
 
                 while (pixel_countdown > 0) {
-                    if (stream_ptr + 1 > stream_ptr_after_chunk)
+                    if (bytestream2_tell(&g2) + 1 > stream_ptr_after_chunk)
                         break;
-                    byte_run = (signed char)(buf[stream_ptr++]);
+                    byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
                     if (byte_run > 0) {
-                        pixel    = AV_RL16(&buf[stream_ptr]);
-                        stream_ptr += 2;
+                        pixel    = bytestream2_get_le16(&g2);
                         CHECK_PIXEL_PTR(2 * byte_run);
                         for (j = 0; j < byte_run; j++) {
                             *((signed short*)(&pixels[pixel_ptr])) = pixel;
@@ -676,12 +667,11 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                         }
                     } else {  /* copy pixels if byte_run < 0 */
                         byte_run = -byte_run;
-                        if (stream_ptr + 2 * byte_run > stream_ptr_after_chunk)
+                        if (bytestream2_tell(&g2) + 2 * byte_run > stream_ptr_after_chunk)
                             break;
                         CHECK_PIXEL_PTR(2 * byte_run);
                         for (j = 0; j < byte_run; j++) {
-                            *((signed short*)(&pixels[pixel_ptr])) = AV_RL16(&buf[stream_ptr]);
-                            stream_ptr += 2;
+                            *((signed short*)(&pixels[pixel_ptr])) = bytestream2_get_le16(&g2);
                             pixel_ptr  += 2;
                             pixel_countdown--;
                             if (pixel_countdown < 0)
@@ -701,7 +691,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
             if (chunk_size - 6 > (unsigned int)(s->avctx->width * s->avctx->height)*2) {
                 av_log(avctx, AV_LOG_ERROR, "In chunk FLI_COPY : source data (%d bytes) " \
                        "bigger than image, skipping chunk\n", chunk_size - 6);
-                stream_ptr += chunk_size - 6;
+                bytestream2_skip(&g2, chunk_size - 6);
             } else {
 
                 for (y_ptr = 0; y_ptr < s->frame.linesize[0] * s->avctx->height;
@@ -710,18 +700,17 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                     pixel_countdown = s->avctx->width;
                     pixel_ptr = 0;
                     while (pixel_countdown > 0) {
-                      *((signed short*)(&pixels[y_ptr + pixel_ptr])) = AV_RL16(&buf[stream_ptr+pixel_ptr]);
+                      *((signed short*)(&pixels[y_ptr + pixel_ptr])) = bytestream2_get_le16(&g2);
                       pixel_ptr += 2;
                       pixel_countdown--;
                     }
-                    stream_ptr += s->avctx->width*2;
                 }
             }
             break;
 
         case FLI_MINI:
             /* some sort of a thumbnail? disregard this chunk... */
-            stream_ptr += chunk_size - 6;
+            bytestream2_skip(&g2, chunk_size - 6);
             break;
 
         default:
@@ -735,9 +724,9 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
 
     /* by the end of the chunk, the stream ptr should equal the frame
      * size (minus 1, possibly); if it doesn't, issue a warning */
-    if ((stream_ptr != buf_size) && (stream_ptr != buf_size - 1))
+    if ((bytestream2_get_bytes_left(&g2) != 0) && (bytestream2_get_bytes_left(&g2) != 1))
         av_log(avctx, AV_LOG_ERROR, "Processed FLI chunk where chunk size = %d " \
-               "and final chunk ptr = %d\n", buf_size, stream_ptr);
+               "and final chunk ptr = %d\n", buf_size, bytestream2_tell(&g2));
 
 
     *data_size=sizeof(AVFrame);
diff --git a/libavcodec/h264.c b/libavcodec/h264.c
index 8cd9fe72ef..e4d6ee10a9 100644
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -1818,7 +1818,7 @@ static av_always_inline void hl_decode_mb_predict_luma(H264Context *h, int mb_ty
                                     idct_dc_add(ptr, h->mb + (i*16+p*256 << pixel_shift), linesize);
                                 else
                                     idct_add   (ptr, h->mb + (i*16+p*256 << pixel_shift), linesize);
-                            }else if(CONFIG_SVQ3_DECODER)
+                            } else if (CONFIG_SVQ3_DECODER)
                                 ff_svq3_add_idct_c(ptr, h->mb + i*16+p*256, linesize, qscale, 0);
                         }
                     }
@@ -1838,7 +1838,7 @@ static av_always_inline void hl_decode_mb_predict_luma(H264Context *h, int mb_ty
                         dctcoef_set(h->mb+(p*256 << pixel_shift), pixel_shift, dc_mapping[i], dctcoef_get(h->mb_luma_dc[p], pixel_shift, i));
                 }
             }
-        }else if(CONFIG_SVQ3_DECODER)
+        } else if (CONFIG_SVQ3_DECODER)
             ff_svq3_luma_dc_dequant_idct_c(h->mb+p*256, h->mb_luma_dc[p], qscale);
     }
 }
@@ -1882,7 +1882,7 @@ static av_always_inline void hl_decode_mb_idct_luma(H264Context *h, int mb_type,
                     }
                 }
             }
-        }else if(CONFIG_SVQ3_DECODER) {
+        } else if (CONFIG_SVQ3_DECODER) {
             for(i=0; i<16; i++){
                 if(h->non_zero_count_cache[ scan8[i+p*16] ] || h->mb[i*16+p*256]){ //FIXME benchmark weird rule, & below
                     uint8_t * const ptr= dest_y + block_offset[i];
@@ -2076,9 +2076,7 @@ static av_always_inline void hl_decode_mb_internal(H264Context *h, int simple, i
                     h->h264dsp.h264_idct_add8(dest, block_offset,
                                               h->mb, uvlinesize,
                                               h->non_zero_count_cache);
-                }
-#if CONFIG_SVQ3_DECODER
-                else{
+                } else if (CONFIG_SVQ3_DECODER) {
                     h->h264dsp.h264_chroma_dc_dequant_idct(h->mb + 16*16*1, h->dequant4_coeff[IS_INTRA(mb_type) ? 1:4][h->chroma_qp[0]][0]);
                     h->h264dsp.h264_chroma_dc_dequant_idct(h->mb + 16*16*2, h->dequant4_coeff[IS_INTRA(mb_type) ? 2:5][h->chroma_qp[1]][0]);
                     for(j=1; j<3; j++){
@@ -2090,7 +2088,6 @@ static av_always_inline void hl_decode_mb_internal(H264Context *h, int simple, i
                         }
                     }
                 }
-#endif
             }
         }
     }
diff --git a/libavcodec/h264_parser.c b/libavcodec/h264_parser.c
index 9d28cc3707..c9dea81a49 100644
--- a/libavcodec/h264_parser.c
+++ b/libavcodec/h264_parser.c
@@ -376,6 +376,7 @@ static int init(AVCodecParserContext *s)
 {
     H264Context *h = s->priv_data;
     h->thread_context[0] = h;
+    h->s.slice_context_count = 1;
     return 0;
 }
 
diff --git a/libavcodec/mpeg4video_parser.c b/libavcodec/mpeg4video_parser.c
index 5f3b19d5aa..3bd2b14291 100644
--- a/libavcodec/mpeg4video_parser.c
+++ b/libavcodec/mpeg4video_parser.c
@@ -102,6 +102,7 @@ static av_cold int mpeg4video_parse_init(AVCodecParserContext *s)
         return -1;
     pc->first_picture = 1;
     pc->enc->quant_precision=5;
+    pc->enc->slice_context_count = 1;
     return 0;
 }
 
diff --git a/libavcodec/vc1_parser.c b/libavcodec/vc1_parser.c
index 5e1bd2cd5f..a4130d9885 100644
--- a/libavcodec/vc1_parser.c
+++ b/libavcodec/vc1_parser.c
@@ -184,9 +184,17 @@ static int vc1_split(AVCodecContext *avctx,
     return 0;
 }
 
+static int vc1_parse_init(AVCodecParserContext *s)
+{
+    VC1ParseContext *vpc = s->priv_data;
+    vpc->v.s.slice_context_count = 1;
+    return 0;
+}
+
 AVCodecParser ff_vc1_parser = {
     .codec_ids      = { CODEC_ID_VC1 },
     .priv_data_size = sizeof(VC1ParseContext),
+    .parser_init    = vc1_parse_init,
     .parser_parse   = vc1_parse,
     .parser_close   = ff_parse1_close,
     .split          = vc1_split,
diff --git a/libavcodec/vorbis.c b/libavcodec/vorbis.c
index b20e398b93..28176f3b12 100644
--- a/libavcodec/vorbis.c
+++ b/libavcodec/vorbis.c
@@ -156,7 +156,7 @@ void ff_vorbis_ready_floor1_list(vorbis_floor1_entry * list, int values)
     }
 }
 
-static inline void render_line_unrolled(intptr_t x, unsigned char y, int x1,
+static inline void render_line_unrolled(intptr_t x, uint8_t y, int x1,
                                         intptr_t sy, int ady, int adx,
                                         float *buf)
 {
@@ -179,7 +179,7 @@ static inline void render_line_unrolled(intptr_t x, unsigned char y, int x1,
     }
 }
 
-static void render_line(int x0, unsigned char y0, int x1, int y1, float *buf)
+static void render_line(int x0, uint8_t y0, int x1, int y1, float *buf)
 {
     int dy  = y1 - y0;
     int adx = x1 - x0;
@@ -189,10 +189,10 @@ static void render_line(int x0, unsigned char y0, int x1, int y1, float *buf)
     if (ady*2 <= adx) { // optimized common case
         render_line_unrolled(x0, y0, x1, sy, ady, adx, buf);
     } else {
-        int base = dy / adx;
-        int x    = x0;
-        unsigned char y = y0;
-        int err  = -adx;
+        int base  = dy / adx;
+        int x     = x0;
+        uint8_t y = y0;
+        int err   = -adx;
         ady -= FFABS(base) * adx;
         while (++x < x1) {
             y += base;
@@ -210,7 +210,8 @@ void ff_vorbis_floor1_render_list(vorbis_floor1_entry * list, int values,
                                   uint16_t *y_list, int *flag,
                                   int multiplier, float *out, int samples)
 {
-    int lx, ly, i;
+    int lx, i;
+    uint8_t ly;
     lx = 0;
     ly = y_list[0] * multiplier;
     for (i = 1; i < values; i++) {