5 files changed, 227 insertions, 0 deletions

diff --git a/multimedia/libvpx/Makefile b/multimedia/libvpx/Makefile
index aa278032d3f9..9d0aa6838fb1 100644
--- a/multimedia/libvpx/Makefile
+++ b/multimedia/libvpx/Makefile
@@ -4,6 +4,7 @@
 PORTNAME=	libvpx
 DISTVERSIONPREFIX=	v
 DISTVERSION=	1.5.0
+PORTREVISION=	1
 CATEGORIES=	multimedia
 
 MAINTAINER=	ashish@FreeBSD.org
diff --git a/multimedia/libvpx/files/patch-mozilla-bug1224361 b/multimedia/libvpx/files/patch-mozilla-bug1224361
new file mode 100644
index 000000000000..f3b90cee21b6
--- /dev/null
+++ b/multimedia/libvpx/files/patch-mozilla-bug1224361
@@ -0,0 +1,32 @@
+From ff3674a15e5b1a006546e1edc64c3e778eb34ab1 Mon Sep 17 00:00:00 2001
+From: James Zern <jzern@google.com>
+Date: Thu, 3 Dec 2015 16:16:28 -0800
+Subject: vp8: fix quantizer clamping
+
+the quantizer is transmitted as 7-bits + sign so needs to be clamped in
+the delta + absolute case.
+
+BUG=https://bugzilla.mozilla.org/show_bug.cgi?id=1224361
+
+Change-Id: I9115f5d1d5cf7e0a1d149d79486d9d17de9b9639
+---
+ vp8/decoder/decodeframe.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git vp8/decoder/decodeframe.c vp8/decoder/decodeframe.c
+index f0d7603..4bc87eb 100644
+--- vp8/decoder/decodeframe.c
++++ vp8/decoder/decodeframe.c
+@@ -73,10 +73,9 @@ void vp8_mb_init_dequantizer(VP8D_COMP *pbi, MACROBLOCKD *xd)
+ 
+         /* Delta Value */
+         else
+-        {
+             QIndex = pc->base_qindex + xd->segment_feature_data[MB_LVL_ALT_Q][mbmi->segment_id];
+-            QIndex = (QIndex >= 0) ? ((QIndex <= MAXQ) ? QIndex : MAXQ) : 0;    /* Clamp to valid range */
+-        }
++
++        QIndex = (QIndex >= 0) ? ((QIndex <= MAXQ) ? QIndex : MAXQ) : 0;    /* Clamp to valid range */
+     }
+     else
+         QIndex = pc->base_qindex;
diff --git a/multimedia/libvpx/files/patch-mozilla-bug1224363 b/multimedia/libvpx/files/patch-mozilla-bug1224363
new file mode 100644
index 000000000000..30069c7eafff
--- /dev/null
+++ b/multimedia/libvpx/files/patch-mozilla-bug1224363
@@ -0,0 +1,29 @@
+From 2e693eb80e705ea68e23eed19616d22b4778b45a Mon Sep 17 00:00:00 2001
+From: James Zern <jzern@google.com>
+Date: Thu, 3 Dec 2015 16:18:48 -0800
+Subject: vp8: fix loop filter level clamping
+
+the loop filter level is transmitted as 6-bits + sign so needs to be clamped in
+the delta + absolute case.
+
+BUG=https://bugzilla.mozilla.org/show_bug.cgi?id=1224363
+
+Change-Id: Icbdca4fdbf043466429bd5c9d59dbe913bf153bc
+---
+ vp8/common/vp8_loopfilter.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git vp8/common/vp8_loopfilter.c vp8/common/vp8_loopfilter.c
+index 8b55dff..756ad48 100644
+--- vp8/common/vp8_loopfilter.c
++++ vp8/common/vp8_loopfilter.c
+@@ -141,8 +141,8 @@ void vp8_loop_filter_frame_init(VP8_COMMON *cm,
+             else  /* Delta Value */
+             {
+                 lvl_seg += mbd->segment_feature_data[MB_LVL_ALT_LF][seg];
+-                lvl_seg = (lvl_seg > 0) ? ((lvl_seg > 63) ? 63: lvl_seg) : 0;
+             }
++            lvl_seg = (lvl_seg > 0) ? ((lvl_seg > 63) ? 63: lvl_seg) : 0;
+         }
+ 
+         if (!mbd->mode_ref_lf_delta_enabled)
diff --git a/multimedia/libvpx/files/patch-mozilla-bug1224371 b/multimedia/libvpx/files/patch-mozilla-bug1224371
new file mode 100644
index 000000000000..774589e1fe50
--- /dev/null
+++ b/multimedia/libvpx/files/patch-mozilla-bug1224371
@@ -0,0 +1,31 @@
+# HG changeset patch
+# User Gerald Squelart <gsquelart@mozilla.com>
+# Date 1451894747 -3600
+#      Mon Jan 04 09:05:47 2016 +0100
+# Node ID 7e497a0b15cdfeca00bd1b9ad234785899073a4c
+# Parent  c2133ad4a73860ef18662c5144777e76652d4cde
+Bug 1224371 - Cast uint8_t to uint32_t before shift. r=jya
+
+Note: C-style cast because it is C code.
+
+diff --git a/media/libvpx/vp9/decoder/vp9_decoder.c b/media/libvpx/vp9/decoder/vp9_decoder.c
+--- vp9/decoder/vp9_decoder.c
++++ vp9/decoder/vp9_decoder.c
+@@ -494,16 +494,16 @@ vpx_codec_err_t vp9_parse_superframe_ind
+         decrypt_cb(decrypt_state, x, clear_buffer, frames * mag);
+         x = clear_buffer;
+       }
+ 
+       for (i = 0; i < frames; ++i) {
+         uint32_t this_sz = 0;
+ 
+         for (j = 0; j < mag; ++j)
+-          this_sz |= (*x++) << (j * 8);
++          this_sz |= (uint32_t)(*x++) << (j * 8);
+         sizes[i] = this_sz;
+       }
+       *count = frames;
+     }
+   }
+   return VPX_CODEC_OK;
+ }
diff --git a/multimedia/libvpx/files/patch-mozilla-bug1237848 b/multimedia/libvpx/files/patch-mozilla-bug1237848
new file mode 100644
index 000000000000..b14e2342139c
--- /dev/null
+++ b/multimedia/libvpx/files/patch-mozilla-bug1237848
@@ -0,0 +1,134 @@
+From 4f780e94a1fa54f22256e0f4d42a77c340a38fa1 Mon Sep 17 00:00:00 2001
+From: James Zern <jzern@google.com>
+Date: Thu, 28 Jan 2016 12:53:41 -0800
+Subject: vp9/10: fix encoder crash on flush
+
+the lookahead buffer allocation is deferred to receipt of the first
+frame to allow profile changes. if the encoder was flushed before
+supplying any frames the encoder would crash trying to dereference the
+NULL buffer. vp8 is unaffected.
+
+fixes mozilla bug:
+https://bugzilla.mozilla.org/show_bug.cgi?id=1237848
+
+Change-Id: Icee4b64de760476eee0d33b568f0a1010335ff13
+---
+ test/encode_api_test.cc     | 68 +++++++++++++++++++++++++++++++++++++++++++++
+ test/test.mk                |  1 +
+ vp10/encoder/lookahead.c    |  2 +-
+ vp8/encoder/lookahead.c     |  1 +
+ vp9/encoder/vp9_lookahead.c |  2 +-
+ 5 files changed, 72 insertions(+), 2 deletions(-)
+ create mode 100644 test/encode_api_test.cc
+
+diff --git test/encode_api_test.cc test/encode_api_test.cc
+new file mode 100644
+index 0000000..a7200e6
+--- /dev/null
++++ test/encode_api_test.cc
+@@ -0,0 +1,68 @@
++/*
++ *  Copyright (c) 2016 The WebM project authors. All Rights Reserved.
++ *
++ *  Use of this source code is governed by a BSD-style license
++ *  that can be found in the LICENSE file in the root of the source
++ *  tree. An additional intellectual property rights grant can be found
++ *  in the file PATENTS.  All contributing project authors may
++ *  be found in the AUTHORS file in the root of the source tree.
++ */
++
++#include "third_party/googletest/src/include/gtest/gtest.h"
++
++#include "./vpx_config.h"
++#include "vpx/vp8cx.h"
++#include "vpx/vpx_encoder.h"
++
++namespace {
++
++#define NELEMENTS(x) static_cast<int>(sizeof(x) / sizeof(x[0]))
++
++TEST(EncodeAPI, InvalidParams) {
++  static const vpx_codec_iface_t *kCodecs[] = {
++#if CONFIG_VP8_ENCODER
++    &vpx_codec_vp8_cx_algo,
++#endif
++#if CONFIG_VP9_ENCODER
++    &vpx_codec_vp9_cx_algo,
++#endif
++#if CONFIG_VP10_ENCODER
++    &vpx_codec_vp10_cx_algo,
++#endif
++  };
++  uint8_t buf[1] = {0};
++  vpx_image_t img;
++  vpx_codec_ctx_t enc;
++  vpx_codec_enc_cfg_t cfg;
++
++  EXPECT_EQ(&img, vpx_img_wrap(&img, VPX_IMG_FMT_I420, 1, 1, 1, buf));
++
++  EXPECT_EQ(VPX_CODEC_INVALID_PARAM, vpx_codec_enc_init(NULL, NULL, NULL, 0));
++  EXPECT_EQ(VPX_CODEC_INVALID_PARAM, vpx_codec_enc_init(&enc, NULL, NULL, 0));
++  EXPECT_EQ(VPX_CODEC_INVALID_PARAM, vpx_codec_encode(NULL, NULL, 0, 0, 0, 0));
++  EXPECT_EQ(VPX_CODEC_INVALID_PARAM, vpx_codec_encode(NULL, &img, 0, 0, 0, 0));
++  EXPECT_EQ(VPX_CODEC_INVALID_PARAM, vpx_codec_destroy(NULL));
++  EXPECT_EQ(VPX_CODEC_INVALID_PARAM,
++            vpx_codec_enc_config_default(NULL, NULL, 0));
++  EXPECT_EQ(VPX_CODEC_INVALID_PARAM,
++            vpx_codec_enc_config_default(NULL, &cfg, 0));
++  EXPECT_TRUE(vpx_codec_error(NULL) != NULL);
++
++  for (int i = 0; i < NELEMENTS(kCodecs); ++i) {
++    SCOPED_TRACE(vpx_codec_iface_name(kCodecs[i]));
++    EXPECT_EQ(VPX_CODEC_INVALID_PARAM,
++              vpx_codec_enc_init(NULL, kCodecs[i], NULL, 0));
++    EXPECT_EQ(VPX_CODEC_INVALID_PARAM,
++              vpx_codec_enc_init(&enc, kCodecs[i], NULL, 0));
++    EXPECT_EQ(VPX_CODEC_INVALID_PARAM,
++              vpx_codec_enc_config_default(kCodecs[i], &cfg, 1));
++
++    EXPECT_EQ(VPX_CODEC_OK, vpx_codec_enc_config_default(kCodecs[i], &cfg, 0));
++    EXPECT_EQ(VPX_CODEC_OK, vpx_codec_enc_init(&enc, kCodecs[i], &cfg, 0));
++    EXPECT_EQ(VPX_CODEC_OK, vpx_codec_encode(&enc, NULL, 0, 0, 0, 0));
++
++    EXPECT_EQ(VPX_CODEC_OK, vpx_codec_destroy(&enc));
++  }
++}
++
++}  // namespace
+diff --git test/test.mk test/test.mk
+index 80b57e5..e8e8304 100644
+--- test/test.mk
++++ test/test.mk
+@@ -20,6 +20,7 @@ LIBVPX_TEST_SRCS-$(CONFIG_DECODERS)    += ivf_video_source.h
+ LIBVPX_TEST_SRCS-$(CONFIG_ENCODERS)    += ../y4minput.h ../y4minput.c
+ LIBVPX_TEST_SRCS-$(CONFIG_ENCODERS)    += aq_segment_test.cc
+ LIBVPX_TEST_SRCS-$(CONFIG_ENCODERS)    += datarate_test.cc
++LIBVPX_TEST_SRCS-$(CONFIG_ENCODERS)    += encode_api_test.cc
+ LIBVPX_TEST_SRCS-$(CONFIG_ENCODERS)    += error_resilience_test.cc
+ LIBVPX_TEST_SRCS-$(CONFIG_ENCODERS)    += i420_video_source.h
+ LIBVPX_TEST_SRCS-$(CONFIG_ENCODERS)    += resize_test.cc
+diff --git vp8/encoder/lookahead.c vp8/encoder/lookahead.c
+index ce2ce08..6623385 100644
+--- vp8/encoder/lookahead.c
++++ vp8/encoder/lookahead.c
+@@ -181,6 +181,7 @@ vp8_lookahead_pop(struct lookahead_ctx *ctx,
+ {
+     struct lookahead_entry* buf = NULL;
+ 
++    assert(ctx != NULL);
+     if(ctx->sz && (drain || ctx->sz == ctx->max_sz - 1))
+     {
+         buf = pop(ctx, &ctx->read_idx);
+diff --git vp9/encoder/vp9_lookahead.c vp9/encoder/vp9_lookahead.c
+index 8787be8..def9b8c 100644
+--- vp9/encoder/vp9_lookahead.c
++++ vp9/encoder/vp9_lookahead.c
+@@ -207,7 +207,7 @@ struct lookahead_entry *vp9_lookahead_pop(struct lookahead_ctx *ctx,
+                                           int drain) {
+   struct lookahead_entry *buf = NULL;
+ 
+-  if (ctx->sz && (drain || ctx->sz == ctx->max_sz - MAX_PRE_FRAMES)) {
++  if (ctx && ctx->sz && (drain || ctx->sz == ctx->max_sz - MAX_PRE_FRAMES)) {
+     buf = pop(ctx, &ctx->read_idx);
+     ctx->sz--;
+   }