Fix valgrind and asan memory leaks and crashes.

libavcodec/vp3.c

 /*
  * Copyright (C) 2003-2004 the ffmpeg project
  *
  * This file is part of FFmpeg.
  *
  * FFmpeg is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *
@@ skipping 381 matching lines @@
 {
     int *bounding_values= s->bounding_values_array+127;
     int filter_limit;
     int x;
     int value;
 
     filter_limit = s->filter_limit_values[s->qps[0]];
 
     /* set up the bounding values */
     memset(s->bounding_values_array, 0, 256 * sizeof(int));
-    for (x = 0; x < filter_limit; x++) {
+    for (x = 0; x < filter_limit && x < 128; x++) {
         bounding_values[-x] = -x;
         bounding_values[x] = x;
     }
     for (x = value = filter_limit; x < 128 && value; x++, value--) {
         bounding_values[ x] =  value;
         bounding_values[-x] = -value;
     }
     if (value)
         bounding_values[128] = value;
     bounding_values[129] = bounding_values[130] = filter_limit * 0x02020202;
@@ skipping 1210 matching lines @@
 {
     Vp3DecodeContext *s = avctx->priv_data;
     int y_fragment_count, c_fragment_count;
 
     y_fragment_count = s->fragment_width[0] * s->fragment_height[0];
     c_fragment_count = s->fragment_width[1] * s->fragment_height[1];
 
     s->superblock_coding = av_malloc(s->superblock_count);
     s->all_fragments = av_malloc(s->fragment_count * sizeof(Vp3Fragment));
     s->coded_fragment_list[0] = av_malloc(s->fragment_count * sizeof(int));
-    s->dct_tokens_base = av_malloc(64*s->fragment_count * sizeof(*s->dct_tokens_base));
+    s->dct_tokens_base = av_mallocz(64*s->fragment_count * sizeof(*s->dct_tokens_base));
     s->motion_val[0] = av_malloc(y_fragment_count * sizeof(*s->motion_val[0]));
     s->motion_val[1] = av_malloc(c_fragment_count * sizeof(*s->motion_val[1]));
 
     /* work out the block mapping tables */
     s->superblock_fragments = av_malloc(s->superblock_count * 16 * sizeof(int));
     s->macroblock_coding = av_malloc(s->macroblock_count + 1);
 
     if (!s->superblock_coding || !s->all_fragments || !s->dct_tokens_base ||
         !s->coded_fragment_list[0] || !s->superblock_fragments || !s->macroblock_coding ||
         !s->motion_val[0] || !s->motion_val[1]) {
@@ skipping 747 matching lines @@
     .priv_data_size = sizeof(Vp3DecodeContext),
     .init           = vp3_decode_init,
     .close          = vp3_decode_end,
     .decode         = vp3_decode_frame,
     .capabilities   = CODEC_CAP_DR1 | CODEC_CAP_DRAW_HORIZ_BAND | CODEC_CAP_FRAME_THREADS,
     .flush = vp3_decode_flush,
     .long_name = NULL_IF_CONFIG_SMALL("On2 VP3"),
     .init_thread_copy      = ONLY_IF_THREADS_ENABLED(vp3_init_thread_copy),
     .update_thread_context = ONLY_IF_THREADS_ENABLED(vp3_update_thread_context)
 };