Merge branch 'master' of git+ssh://openadk.org/git/openadk

package/ffmpeg/Makefile

@@ -5,7 +5,7 @@ include ${TOPDIR}/rules.mk
 
 PKG_NAME:=		ffmpeg
 PKG_VERSION:=		2.0.2
-PKG_RELEASE:=		1
+PKG_RELEASE:=		2
 PKG_MD5SUM:=		6c5cfed204d8a108325d1fc439ab734a
 PKG_DESCR:=		record, convert and stream audio & video
 PKG_SECTION:=		libs

package/ffmpeg/patches/patch-libavcodec_arm_Makefile

@@ -0,0 +1,12 @@
+--- ffmpeg-2.0.1.orig/libavcodec/arm/Makefile	2013-08-11 01:23:24.000000000 +0200
++++ ffmpeg-2.0.1/libavcodec/arm/Makefile	2013-10-14 17:47:19.000000000 +0200
+@@ -52,7 +52,8 @@ ARMV6-OBJS-$(CONFIG_VP8_DECODER)       +
+                                           arm/vp8dsp_init_armv6.o       \
+                                           arm/vp8dsp_armv6.o
+ 
+-VFP-OBJS-$(HAVE_ARMV6)                 += arm/fmtconvert_vfp.o
++VFP-OBJS-$(HAVE_ARMV6)                 += arm/fmtconvert_vfp.o \
++					  arm/synth_filter_vfp.o	
+ 
+ NEON-OBJS                              += arm/fmtconvert_neon.o
+ 

package/ffmpeg/patches/patch-libavcodec_arm_fft_init_arm_c

@@ -0,0 +1,25 @@
+--- ffmpeg-2.0.2.orig/libavcodec/arm/fft_init_arm.c	2013-10-08 19:52:31.000000000 +0200
++++ ffmpeg-2.0.2/libavcodec/arm/fft_init_arm.c	2013-10-16 12:59:04.000000000 +0200
+@@ -32,6 +32,12 @@ void ff_mdct_calc_neon(FFTContext *s, FF
+ 
+ void ff_rdft_calc_neon(struct RDFTContext *s, FFTSample *z);
+ 
++void ff_synth_filter_float_vfp(FFTContext *imdct,
++                               float *synth_buf_ptr, int *synth_buf_offset,
++                               float synth_buf2[32], const float window[512],
++                               float out[32], const float in[32],
++                               float scale);
++
+ void ff_synth_filter_float_neon(FFTContext *imdct,
+                                 float *synth_buf_ptr, int *synth_buf_offset,
+                                 float synth_buf2[32], const float window[512],
+@@ -71,6 +77,9 @@ av_cold void ff_synth_filter_init_arm(Sy
+ {
+     int cpu_flags = av_get_cpu_flags();
+ 
++    if (have_vfp(cpu_flags))
++        s->synth_filter_float = ff_synth_filter_float_vfp;
++
+     if (have_neon(cpu_flags))
+         s->synth_filter_float = ff_synth_filter_float_neon;
+ }

package/ffmpeg/src/libavcodec/arm/synth_filter_vfp.S

@@ -0,0 +1,206 @@
+/*
+ * Copyright (c) 2013 RISC OS Open Ltd
+ *
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ *
+ * Author: Ben Avison <bavison@riscosopen.org>
+ */
+
+#include "libavutil/arm/asm.S"
+
+IMDCT         .req    r0
+ORIG_P_SB     .req    r1
+P_SB_OFF      .req    r2
+I             .req    r0
+P_SB2_UP      .req    r1
+OLDFPSCR      .req    r2
+P_SB2_DN      .req    r3
+P_WIN_DN      .req    r4
+P_OUT_DN      .req    r5
+P_SB          .req    r6
+J_WRAP        .req    r7
+P_WIN_UP      .req    r12
+P_OUT_UP      .req    r14
+
+SCALE         .req    s0
+SBUF_DAT_REV0 .req    s4
+SBUF_DAT_REV1 .req    s5
+SBUF_DAT_REV2 .req    s6
+SBUF_DAT_REV3 .req    s7
+VA0           .req    s8
+VA3           .req    s11
+VB0           .req    s12
+VB3           .req    s15
+VC0           .req    s8
+VC3           .req    s11
+VD0           .req    s12
+VD3           .req    s15
+SBUF_DAT0     .req    s16
+SBUF_DAT1     .req    s17
+SBUF_DAT2     .req    s18
+SBUF_DAT3     .req    s19
+SBUF_DAT_ALT0 .req    s20
+SBUF_DAT_ALT1 .req    s21
+SBUF_DAT_ALT2 .req    s22
+SBUF_DAT_ALT3 .req    s23
+WIN_DN_DAT0   .req    s24
+WIN_UP_DAT0   .req    s28
+
+
+.macro inner_loop  half, tail, head
+ .if (OFFSET & (64*4)) == 0                @ even numbered call
+        SBUF_DAT_THIS0 .req SBUF_DAT0
+        SBUF_DAT_THIS1 .req SBUF_DAT1
+        SBUF_DAT_THIS2 .req SBUF_DAT2
+        SBUF_DAT_THIS3 .req SBUF_DAT3
+  .ifnc "\head",""
+        vldr    d8, [P_SB, #OFFSET]        @ d8 = SBUF_DAT
+        vldr    d9, [P_SB, #OFFSET+8]
+  .endif
+ .else
+        SBUF_DAT_THIS0 .req SBUF_DAT_ALT0
+        SBUF_DAT_THIS1 .req SBUF_DAT_ALT1
+        SBUF_DAT_THIS2 .req SBUF_DAT_ALT2
+        SBUF_DAT_THIS3 .req SBUF_DAT_ALT3
+  .ifnc "\head",""
+        vldr    d10, [P_SB, #OFFSET]       @ d10 = SBUF_DAT_ALT
+        vldr    d11, [P_SB, #OFFSET+8]
+  .endif
+ .endif
+ .ifnc "\tail",""
+  .ifc "\half","ab"
+        vmls.f  VA0, SBUF_DAT_REV0, WIN_DN_DAT0  @ all operands treated as vectors
+  .else
+        vmla.f  VD0, SBUF_DAT_REV0, WIN_DN_DAT0  @ all operands treated as vectors
+  .endif
+ .endif
+ .ifnc "\head",""
+        vldr    d14, [P_WIN_UP, #OFFSET]   @ d14 = WIN_UP_DAT
+        vldr    d15, [P_WIN_UP, #OFFSET+8]
+        vldr    d12, [P_WIN_DN, #OFFSET]   @ d12 = WIN_DN_DAT
+        vldr    d13, [P_WIN_DN, #OFFSET+8]
+        vmov    SBUF_DAT_REV3, SBUF_DAT_THIS0
+        vmov    SBUF_DAT_REV2, SBUF_DAT_THIS1
+        vmov    SBUF_DAT_REV1, SBUF_DAT_THIS2
+        vmov    SBUF_DAT_REV0, SBUF_DAT_THIS3
+  .ifc "\half","ab"
+        vmla.f  VB0, SBUF_DAT_THIS0, WIN_UP_DAT0
+  .else
+        vmla.f  VC0, SBUF_DAT_THIS0, WIN_UP_DAT0
+  .endif
+        teq     J_WRAP, #J
+        bne     2f             @ strongly predictable, so better than cond exec in this case
+        sub     P_SB, P_SB, #512*4
+2:
+  .set J, J - 64
+  .set OFFSET, OFFSET + 64*4
+ .endif
+        .unreq  SBUF_DAT_THIS0
+        .unreq  SBUF_DAT_THIS1
+        .unreq  SBUF_DAT_THIS2
+        .unreq  SBUF_DAT_THIS3
+.endm
+
+
+/* void ff_synth_filter_float_vfp(FFTContext *imdct,
+ *                                float *synth_buf_ptr, int *synth_buf_offset,
+ *                                float synth_buf2[32], const float window[512],
+ *                                float out[32], const float in[32], float scale)
+ */
+function ff_synth_filter_float_vfp, export=1
+        push    {r3-r7,lr}
+        vpush   {s16-s31}
+        ldr     lr, [P_SB_OFF]
+        add     a2, ORIG_P_SB, lr, LSL #2 @ calculate synth_buf to pass to imdct_half
+        mov     P_SB, a2                  @ and keep a copy for ourselves
+        bic     J_WRAP, lr, #63           @ mangled to make testing for wrap easier in inner loop
+        sub     lr, lr, #32
+        and     lr, lr, #512-32
+        str     lr, [P_SB_OFF]            @ rotate offset, modulo buffer size, ready for next call
+        ldr     a3, [sp, #(16+6+2)*4]     @ fetch in from stack, to pass to imdct_half
+VFP     vmov    s16, SCALE                @ imdct_half is free to corrupt s0, but it contains one of our arguments in hardfp case
+        bl      ff_imdct_half_c
+VFP     vmov    SCALE, s16
+
+        vmrs    OLDFPSCR, FPSCR
+        ldr     lr, =0x03030000           @ RunFast mode, short vectors of length 4, stride 1
+        vmsr    FPSCR, lr
+        ldr     P_SB2_DN, [sp, #16*4]
+        ldr     P_WIN_DN, [sp, #(16+6+0)*4]
+        ldr     P_OUT_DN, [sp, #(16+6+1)*4]
+NOVFP   vldr    SCALE, [sp, #(16+6+3)*4]
+
+#define IMM_OFF_SKEW 956                   /* also valid immediate constant when you add 16*4 */
+        add     P_SB, P_SB, #IMM_OFF_SKEW  @ so we can use -ve offsets to use full immediate offset range
+        add     P_SB2_UP, P_SB2_DN, #16*4
+        add     P_WIN_UP, P_WIN_DN, #16*4+IMM_OFF_SKEW
+        add     P_OUT_UP, P_OUT_DN, #16*4
+        add     P_SB2_DN, P_SB2_DN, #16*4
+        add     P_WIN_DN, P_WIN_DN, #12*4+IMM_OFF_SKEW
+        add     P_OUT_DN, P_OUT_DN, #16*4
+        mov     I, #4
+1:
+        vldmia  P_SB2_UP!, {VB0-VB3}
+        vldmdb  P_SB2_DN!, {VA0-VA3}
+ .set J, 512 - 64
+ .set OFFSET, -IMM_OFF_SKEW
+        inner_loop  ab,, head
+ .rept 7
+        inner_loop  ab, tail, head
+ .endr
+        inner_loop  ab, tail
+        add     P_WIN_UP, P_WIN_UP, #4*4
+        sub     P_WIN_DN, P_WIN_DN, #4*4
+        vmul.f  VB0, VB0, SCALE      @ SCALE treated as scalar
+        add     P_SB, P_SB, #(512+4)*4
+        subs    I, I, #1
+        vmul.f  VA0, VA0, SCALE
+        vstmia  P_OUT_UP!, {VB0-VB3}
+        vstmdb  P_OUT_DN!, {VA0-VA3}
+        bne     1b
+
+        add     P_SB2_DN, P_SB2_DN, #(16+28-12)*4
+        sub     P_SB2_UP, P_SB2_UP, #(16+16)*4
+        add     P_WIN_DN, P_WIN_DN, #(32+16+28-12)*4
+        mov     I, #4
+1:
+        vldr.d  d4, zero             @ d4 = VC0
+        vldr.d  d5, zero
+        vldr.d  d6, zero             @ d6 = VD0
+        vldr.d  d7, zero
+ .set J, 512 - 64
+ .set OFFSET, -IMM_OFF_SKEW
+        inner_loop  cd,, head
+ .rept 7
+        inner_loop  cd, tail, head
+ .endr
+        inner_loop  cd, tail
+        add     P_WIN_UP, P_WIN_UP, #4*4
+        sub     P_WIN_DN, P_WIN_DN, #4*4
+        add     P_SB, P_SB, #(512+4)*4
+        subs    I, I, #1
+        vstmia  P_SB2_UP!, {VC0-VC3}
+        vstmdb  P_SB2_DN!, {VD0-VD3}
+        bne     1b
+
+        vmsr    FPSCR, OLDFPSCR
+        vpop    {s16-s31}
+        pop     {r3-r7,pc}
+endfunc
+
+        .align  3
+zero:   .word   0, 0

package/libid3tag/Makefile

@@ -5,7 +5,7 @@ include ${TOPDIR}/rules.mk
 
 PKG_NAME:=		libid3tag
 PKG_VERSION:=		0.15.1b
-PKG_RELEASE:=		1
+PKG_RELEASE:=		2
 PKG_MD5SUM:=		e5808ad997ba32c498803822078748c3
 PKG_DESCR:=		an ID3 tag manipulation library
 PKG_SECTION:=		libs

package/libid3tag/patches/patch-compat_gperf

@@ -0,0 +1,13 @@
+--- libid3tag-0.15.1b.orig/compat.gperf	2004-01-23 10:41:32.000000000 +0100
++++ libid3tag-0.15.1b/compat.gperf	2013-10-16 12:34:31.000000000 +0200
+@@ -236,6 +236,10 @@ int id3_compat_fixup(struct id3_tag *tag
+ 
+     encoding = id3_parse_uint(&data, 1);
+     string   = id3_parse_string(&data, end - data, encoding, 0);
++    if (!string)
++    {
++	continue;
++    }
+ 
+     if (id3_ucs4_length(string) < 4) {
+       free(string);

package/libid3tag/patches/patch-genre_dat

@@ -0,0 +1,22 @@
+--- libid3tag-0.15.1b.orig/genre.dat	2004-02-17 03:34:39.000000000 +0100
++++ libid3tag-0.15.1b/genre.dat	2013-10-16 12:34:37.000000000 +0200
+@@ -277,8 +277,8 @@ static id3_ucs4_t const genre_PUNK_ROCK[
+   { 'P', 'u', 'n', 'k', ' ', 'R', 'o', 'c', 'k', 0 };
+ static id3_ucs4_t const genre_DRUM_SOLO[] =
+   { 'D', 'r', 'u', 'm', ' ', 'S', 'o', 'l', 'o', 0 };
+-static id3_ucs4_t const genre_A_CAPPELLA[] =
+-  { 'A', ' ', 'C', 'a', 'p', 'p', 'e', 'l', 'l', 'a', 0 };
++static id3_ucs4_t const genre_A_CAPELLA[] =
++  { 'A', ' ', 'C', 'a', 'p', 'e', 'l', 'l', 'a', 0 };
+ static id3_ucs4_t const genre_EURO_HOUSE[] =
+   { 'E', 'u', 'r', 'o', '-', 'H', 'o', 'u', 's', 'e', 0 };
+ static id3_ucs4_t const genre_DANCE_HALL[] =
+@@ -452,7 +452,7 @@ static id3_ucs4_t const *const genre_tab
+   genre_DUET,
+   genre_PUNK_ROCK,
+   genre_DRUM_SOLO,
+-  genre_A_CAPPELLA,
++  genre_A_CAPELLA,
+   genre_EURO_HOUSE,
+   genre_DANCE_HALL,
+   genre_GOA,

package/libid3tag/patches/patch-genre_dat_in

@@ -0,0 +1,11 @@
+--- libid3tag-0.15.1b.orig/genre.dat.in	2004-01-23 10:41:32.000000000 +0100
++++ libid3tag-0.15.1b/genre.dat.in	2013-10-16 12:34:37.000000000 +0200
+@@ -153,7 +153,7 @@ Freestyle
+ Duet
+ Punk Rock
+ Drum Solo
+-A Cappella
++A Capella
+ Euro-House
+ Dance Hall
+ Goa

package/libid3tag/patches/patch-parse_c

@@ -0,0 +1,12 @@
+--- libid3tag-0.15.1b.orig/parse.c	2004-01-23 10:41:32.000000000 +0100
++++ libid3tag-0.15.1b/parse.c	2013-10-16 12:34:31.000000000 +0200
+@@ -165,6 +165,9 @@ id3_ucs4_t *id3_parse_string(id3_byte_t
+   case ID3_FIELD_TEXTENCODING_UTF_8:
+     ucs4 = id3_utf8_deserialize(ptr, length);
+     break;
++  default:
++  	/* FIXME: Unknown encoding! Print warning? */
++	return NULL;
+   }
+ 
+   if (ucs4 && !full) {

package/libid3tag/patches/patch-utf16_c

@@ -0,0 +1,21 @@
+--- libid3tag-0.15.1b.orig/utf16.c	2004-01-23 10:41:32.000000000 +0100
++++ libid3tag-0.15.1b/utf16.c	2013-10-16 12:34:27.000000000 +0200
+@@ -282,5 +282,18 @@ id3_ucs4_t *id3_utf16_deserialize(id3_by
+ 
+   free(utf16);
+ 
++  if (end == *ptr && length % 2 != 0)
++  {
++     /* We were called with a bogus length.  It should always
++      * be an even number.  We can deal with this in a few ways:
++      * - Always give an error.
++      * - Try and parse as much as we can and
++      *   - return an error if we're called again when we
++      *     already tried to parse everything we can.
++      *   - tell that we parsed it, which is what we do here.
++      */
++     (*ptr)++;
++  }
++
+   return ucs4;
+ }

package/libmad/Makefile

@@ -5,7 +5,7 @@ include ${TOPDIR}/rules.mk
 
 PKG_NAME:=		libmad
 PKG_VERSION:=		0.15.1b
-PKG_RELEASE:=		3
+PKG_RELEASE:=		4
 PKG_MD5SUM:=		1be543bc30c56fb6bea1d7bf6a64e66c
 PKG_DESCR:=		An high-quality MPEG audio decoding library
 PKG_SECTION:=		libs
@@ -28,10 +28,18 @@ endif
 ifeq (${ARCH},arm)
 FPM:=arm
 endif
-# MIPS optimization is broken for gcc 4.4 (removed h constraint)
-#ifeq (${ARCH},mips)
-#FPM:=mips
-#endif
+ifeq (${ARCH},mips)
+FPM:=mips
+endif
+ifeq (${ARCH},ppc)
+FPM:=ppc
+endif
+ifeq (${ARCH},sparc)
+FPM:=sparc
+endif
+ifeq (${ARCH},x86_64)
+FPM:=64bit
+endif
 
 CONFIGURE_ARGS+=	--enable-fpm=${FPM} \
 			--disable-debugging \

package/libmad/patches/patch-fixed_h

@@ -0,0 +1,44 @@
+--- libmad-0.15.1b.orig/fixed.h	2004-02-17 03:02:03.000000000 +0100
++++ libmad-0.15.1b/fixed.h	2013-10-16 10:51:56.000000000 +0200
+@@ -275,12 +275,25 @@ mad_fixed_t mad_f_mul_inline(mad_fixed_t
+ 	 : "+r" (lo), "+r" (hi)  \
+ 	 : "%r" (x), "r" (y))
+ 
++#ifdef __thumb__
++/* In Thumb-2, the RSB-immediate instruction is only allowed with a zero
++	operand.  If needed this code can also support Thumb-1 
++	(simply append "s" to the end of the second two instructions). */
++#  define MAD_F_MLN(hi, lo)  \
++    asm ("rsbs        %0, %0, #0\n\t"  \
++	 "sbc   %1, %1, %1\n\t"  \
++	 "sub   %1, %1, %2"  \
++	 : "+&r" (lo), "=&r" (hi)  \
++	 : "r" (hi)  \
++	 : "cc")
++#else /* ! __thumb__ */
+ #  define MAD_F_MLN(hi, lo)  \
+     asm ("rsbs	%0, %2, #0\n\t"  \
+ 	 "rsc	%1, %3, #0"  \
+-	 : "=r" (lo), "=r" (hi)  \
++	 : "=&r" (lo), "=r" (hi)  \
+ 	 : "0" (lo), "1" (hi)  \
+ 	 : "cc")
++#endif /* __thumb__ */
+ 
+ #  define mad_f_scale64(hi, lo)  \
+     ({ mad_fixed_t __result;  \
+@@ -297,6 +310,14 @@ mad_fixed_t mad_f_mul_inline(mad_fixed_t
+ 
+ /* --- MIPS ---------------------------------------------------------------- */
+ 
++# elif defined(FPM_MIPS) && (__GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 4))
++   typedef unsigned int u64_di_t __attribute__ ((mode (DI))); 
++#  define MAD_F_MLX(hi, lo, x, y) \
++   do { \
++      u64_di_t __ll = (u64_di_t) (x) * (y); \
++      hi = __ll >> 32; \
++      lo = __ll; \
++   } while (0)
+ # elif defined(FPM_MIPS)
+ 
+ /*

package/libmad/patches/patch-imdct_l_arm_S

@@ -0,0 +1,11 @@
+--- libmad-0.15.1b.orig/imdct_l_arm.S	2001-03-25 22:03:34.000000000 +0200
++++ libmad-0.15.1b/imdct_l_arm.S	2013-10-16 10:51:50.000000000 +0200
+@@ -468,7 +468,7 @@ _III_imdct_l:
+ 
+     @----
+ 
+-    add     r2, pc, #(imdct36_long_karray-.-8)  @ r2 = base address of Knn array (PIC safe ?)
++    adr     r2, imdct36_long_karray
+ 
+ 
+ loop:

package/libmad/patches/patch-layer12_c

@@ -0,0 +1,173 @@
+--- libmad-0.15.1b.orig/layer12.c	2004-02-05 10:02:39.000000000 +0100
++++ libmad-0.15.1b/layer12.c	2013-10-16 10:51:25.000000000 +0200
+@@ -134,6 +134,12 @@ int mad_layer_I(struct mad_stream *strea
+   for (sb = 0; sb < bound; ++sb) {
+     for (ch = 0; ch < nch; ++ch) {
+       nb = mad_bit_read(&stream->ptr, 4);
++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++	{
++		stream->error = MAD_ERROR_LOSTSYNC;
++		stream->sync = 0;
++		return -1;
++	}
+ 
+       if (nb == 15) {
+ 	stream->error = MAD_ERROR_BADBITALLOC;
+@@ -146,6 +152,12 @@ int mad_layer_I(struct mad_stream *strea
+ 
+   for (sb = bound; sb < 32; ++sb) {
+     nb = mad_bit_read(&stream->ptr, 4);
++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++	{
++		stream->error = MAD_ERROR_LOSTSYNC;
++		stream->sync = 0;
++		return -1;
++	}
+ 
+     if (nb == 15) {
+       stream->error = MAD_ERROR_BADBITALLOC;
+@@ -162,6 +174,12 @@ int mad_layer_I(struct mad_stream *strea
+     for (ch = 0; ch < nch; ++ch) {
+       if (allocation[ch][sb]) {
+ 	scalefactor[ch][sb] = mad_bit_read(&stream->ptr, 6);
++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++	{
++		stream->error = MAD_ERROR_LOSTSYNC;
++		stream->sync = 0;
++		return -1;
++	}
+ 
+ # if defined(OPT_STRICT)
+ 	/*
+@@ -187,6 +205,12 @@ int mad_layer_I(struct mad_stream *strea
+ 	frame->sbsample[ch][s][sb] = nb ?
+ 	  mad_f_mul(I_sample(&stream->ptr, nb),
+ 		    sf_table[scalefactor[ch][sb]]) : 0;
++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++	{
++		stream->error = MAD_ERROR_LOSTSYNC;
++		stream->sync = 0;
++		return -1;
++	}
+       }
+     }
+ 
+@@ -195,6 +219,12 @@ int mad_layer_I(struct mad_stream *strea
+ 	mad_fixed_t sample;
+ 
+ 	sample = I_sample(&stream->ptr, nb);
++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++	{
++		stream->error = MAD_ERROR_LOSTSYNC;
++		stream->sync = 0;
++		return -1;
++	}
+ 
+ 	for (ch = 0; ch < nch; ++ch) {
+ 	  frame->sbsample[ch][s][sb] =
+@@ -403,7 +433,15 @@ int mad_layer_II(struct mad_stream *stre
+     nbal = bitalloc_table[offsets[sb]].nbal;
+ 
+     for (ch = 0; ch < nch; ++ch)
++    {
+       allocation[ch][sb] = mad_bit_read(&stream->ptr, nbal);
++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++	{
++		stream->error = MAD_ERROR_LOSTSYNC;
++		stream->sync = 0;
++		return -1;
++	}
++    }
+   }
+ 
+   for (sb = bound; sb < sblimit; ++sb) {
+@@ -411,6 +449,13 @@ int mad_layer_II(struct mad_stream *stre
+ 
+     allocation[0][sb] =
+     allocation[1][sb] = mad_bit_read(&stream->ptr, nbal);
++
++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++	{
++		stream->error = MAD_ERROR_LOSTSYNC;
++		stream->sync = 0;
++		return -1;
++	}
+   }
+ 
+   /* decode scalefactor selection info */
+@@ -419,6 +464,12 @@ int mad_layer_II(struct mad_stream *stre
+     for (ch = 0; ch < nch; ++ch) {
+       if (allocation[ch][sb])
+ 	scfsi[ch][sb] = mad_bit_read(&stream->ptr, 2);
++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++	{
++		stream->error = MAD_ERROR_LOSTSYNC;
++		stream->sync = 0;
++		return -1;
++	}
+     }
+   }
+ 
+@@ -442,6 +493,12 @@ int mad_layer_II(struct mad_stream *stre
+     for (ch = 0; ch < nch; ++ch) {
+       if (allocation[ch][sb]) {
+ 	scalefactor[ch][sb][0] = mad_bit_read(&stream->ptr, 6);
++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++	{
++		stream->error = MAD_ERROR_LOSTSYNC;
++		stream->sync = 0;
++		return -1;
++	}
+ 
+ 	switch (scfsi[ch][sb]) {
+ 	case 2:
+@@ -452,11 +509,23 @@ int mad_layer_II(struct mad_stream *stre
+ 
+ 	case 0:
+ 	  scalefactor[ch][sb][1] = mad_bit_read(&stream->ptr, 6);
++		if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++		{
++			stream->error = MAD_ERROR_LOSTSYNC;
++			stream->sync = 0;
++			return -1;
++		}
+ 	  /* fall through */
+ 
+ 	case 1:
+ 	case 3:
+ 	  scalefactor[ch][sb][2] = mad_bit_read(&stream->ptr, 6);
++		if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++		{
++			stream->error = MAD_ERROR_LOSTSYNC;
++			stream->sync = 0;
++			return -1;
++		}
+ 	}
+ 
+ 	if (scfsi[ch][sb] & 1)
+@@ -488,6 +557,12 @@ int mad_layer_II(struct mad_stream *stre
+ 	  index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
+ 
+ 	  II_samples(&stream->ptr, &qc_table[index], samples);
++		if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++		{
++			stream->error = MAD_ERROR_LOSTSYNC;
++			stream->sync = 0;
++			return -1;
++		}
+ 
+ 	  for (s = 0; s < 3; ++s) {
+ 	    frame->sbsample[ch][3 * gr + s][sb] =
+@@ -506,6 +581,12 @@ int mad_layer_II(struct mad_stream *stre
+ 	index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
+ 
+ 	II_samples(&stream->ptr, &qc_table[index], samples);
++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++	{
++		stream->error = MAD_ERROR_LOSTSYNC;
++		stream->sync = 0;
++		return -1;
++	}
+ 
+ 	for (ch = 0; ch < nch; ++ch) {
+ 	  for (s = 0; s < 3; ++s) {

package/libmad/patches/patch-layer3_c

@@ -0,0 +1,15 @@
+--- libmad-0.15.1b.orig/layer3.c	2004-01-23 10:41:32.000000000 +0100
++++ libmad-0.15.1b/layer3.c	2013-10-16 10:51:25.000000000 +0200
+@@ -2608,6 +2608,12 @@ int mad_layer_III(struct mad_stream *str
+     next_md_begin = 0;
+ 
+   md_len = si.main_data_begin + frame_space - next_md_begin;
++  if (md_len + MAD_BUFFER_GUARD > MAD_BUFFER_MDLEN)
++  {
++	stream->error = MAD_ERROR_LOSTSYNC;
++	stream->sync = 0;
++	return -1;
++  }
+ 
+   frame_used = 0;
+