| Index: source/libvpx/vp8/decoder/dboolhuff.h | 
| =================================================================== | 
| --- source/libvpx/vp8/decoder/dboolhuff.h	(revision 96967) | 
| +++ source/libvpx/vp8/decoder/dboolhuff.h	(working copy) | 
| @@ -34,7 +34,7 @@ | 
| unsigned int         range; | 
| } BOOL_DECODER; | 
|  | 
| -DECLARE_ALIGNED(16, extern const unsigned char, vp8dx_bitreader_norm[256]); | 
| +DECLARE_ALIGNED(16, extern const unsigned char, vp8_norm[256]); | 
|  | 
| int vp8dx_start_decode(BOOL_DECODER *br, | 
| const unsigned char *source, | 
| @@ -51,19 +51,26 @@ | 
| #define VP8DX_BOOL_DECODER_FILL(_count,_value,_bufptr,_bufend) \ | 
| do \ | 
| { \ | 
| -        int shift; \ | 
| -        for(shift = VP8_BD_VALUE_SIZE - 8 - ((_count) + 8); shift >= 0; ) \ | 
| +        int shift = VP8_BD_VALUE_SIZE - 8 - ((_count) + 8); \ | 
| +        int loop_end, x; \ | 
| +        size_t bits_left = ((_bufend)-(_bufptr))*CHAR_BIT; \ | 
| +        \ | 
| +        x = shift + CHAR_BIT - bits_left; \ | 
| +        loop_end = 0; \ | 
| +        if(x >= 0) \ | 
| { \ | 
| -            if((_bufptr) >= (_bufend)) { \ | 
| -                (_count) = VP8_LOTS_OF_BITS; \ | 
| -                break; \ | 
| -            } \ | 
| -            (_count) += 8; \ | 
| +            (_count) += VP8_LOTS_OF_BITS; \ | 
| +            loop_end = x; \ | 
| +            if(!bits_left) break; \ | 
| +        } \ | 
| +        while(shift >= loop_end) \ | 
| +        { \ | 
| +            (_count) += CHAR_BIT; \ | 
| (_value) |= (VP8_BD_VALUE)*(_bufptr)++ << shift; \ | 
| -            shift -= 8; \ | 
| +            shift -= CHAR_BIT; \ | 
| } \ | 
| } \ | 
| -    while(0) | 
| +    while(0) \ | 
|  | 
|  | 
| static int vp8dx_decode_bool(BOOL_DECODER *br, int probability) { | 
| @@ -74,11 +81,14 @@ | 
| int count; | 
| unsigned int range; | 
|  | 
| +    split = 1 + (((br->range - 1) * probability) >> 8); | 
| + | 
| +    if(br->count < 0) | 
| +        vp8dx_bool_decoder_fill(br); | 
| + | 
| value = br->value; | 
| count = br->count; | 
| -    range = br->range; | 
|  | 
| -    split = 1 + (((range - 1) * probability) >> 8); | 
| bigsplit = (VP8_BD_VALUE)split << (VP8_BD_VALUE_SIZE - 8); | 
|  | 
| range = split; | 
| @@ -91,7 +101,7 @@ | 
| } | 
|  | 
| { | 
| -        register unsigned int shift = vp8dx_bitreader_norm[range]; | 
| +        register unsigned int shift = vp8_norm[range]; | 
| range <<= shift; | 
| value <<= shift; | 
| count -= shift; | 
| @@ -99,8 +109,7 @@ | 
| br->value = value; | 
| br->count = count; | 
| br->range = range; | 
| -    if(count < 0) | 
| -        vp8dx_bool_decoder_fill(br); | 
| + | 
| return bit; | 
| } | 
|  | 
| @@ -119,18 +128,19 @@ | 
|  | 
| static int vp8dx_bool_error(BOOL_DECODER *br) | 
| { | 
| -  /* Check if we have reached the end of the buffer. | 
| -   * | 
| -   * Variable 'count' stores the number of bits in the 'value' buffer, | 
| -   * minus 8. So if count == 8, there are 16 bits available to be read. | 
| -   * Normally, count is filled with 8 and one byte is filled into the | 
| -   * value buffer. When we reach the end of the buffer, count is instead | 
| -   * filled with VP8_LOTS_OF_BITS, 8 of which represent the last 8 real | 
| -   * bits from the bitstream. So the last bit in the bitstream will be | 
| -   * represented by count == VP8_LOTS_OF_BITS - 16. | 
| -   */ | 
| -    if ((br->count > VP8_BD_VALUE_SIZE) | 
| -        && (br->count <= VP8_LOTS_OF_BITS - 16)) | 
| +    /* Check if we have reached the end of the buffer. | 
| +     * | 
| +     * Variable 'count' stores the number of bits in the 'value' buffer, minus | 
| +     * 8. The top byte is part of the algorithm, and the remainder is buffered | 
| +     * to be shifted into it. So if count == 8, the top 16 bits of 'value' are | 
| +     * occupied, 8 for the algorithm and 8 in the buffer. | 
| +     * | 
| +     * When reading a byte from the user's buffer, count is filled with 8 and | 
| +     * one byte is filled into the value buffer. When we reach the end of the | 
| +     * data, count is additionally filled with VP8_LOTS_OF_BITS. So when | 
| +     * count == VP8_LOTS_OF_BITS - 1, the user's data has been exhausted. | 
| +     */ | 
| +    if ((br->count > VP8_BD_VALUE_SIZE) && (br->count < VP8_LOTS_OF_BITS)) | 
| { | 
| /* We have tried to decode bits after the end of | 
| * stream was encountered. | 
|  |