Fixes invalid reads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 2240e207)

Fixes invalid reads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 1713eec2)

CC:libav-stable@libav.org
(cherry picked from commit 0e830094)

f777504f changed a - in +

CC: libav-stable@libav.org
(cherry picked from commit d922c5a5)
(cherry picked from commit 3ce77e04c2ca4b9e7fa6b94b51e8d7c5f188da86)

And use the value from the specification.

Sample-Id: 00000451-google
Found-by: Mateusz j00ru Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit f777504f)
(cherry picked from commit 5bd083d0216d9ee649039c84999fb61386536ac1)

Conflicts:
	libavcodec/h264.c

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Fixes invalid writes.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 77bb0004

)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Fixes a potential divide by zero.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 75647dea

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

It is a public function, it must not assert on its parameters.

(cherry picked from commit 94a417ac

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Fixes an issue where the B-frame coding mode switches from interlaced
fields to interlaced frames, causing incorrect decisions in the motion
compensation code and resulting in visual artifacts.

CC: libav-stable@libav.org
Signed-off-by: Tim Walker <tdskywalker@gmail.com>
(cherry picked from commit dd2d0039

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

An invalid VUI is not considered a fatal error, so the SPS containing it
may still be used. Leaving an invalid value of num_reorder_frames there
can result in writing over the bounds of H264Context.delayed_pic.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 9ecabd78

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Conflicts:
	libavcodec/h264_ps.c

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 8b2e5e42

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

It could probably also be considered an error if the pointer isn't
null at this point, but then we might risk rejecting some
slightly broken files that we might have handled so far.

Sample-Id: 00000496-google
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 2620df13

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

These arrays are normally freed at the end of mov_read_trak,
but make sure they're freed in case mov_read_trak returned
early (due to errors) or in case the atoms that allocate arrays
are encountered at some other point than within a trak (which
we don't have checks against).

Sample-Id: 00000496-google
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit d51f0996

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 6892d145

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Fixes invalid reads.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org

And use init_get_bits8 to check for integer overflows while at it.

CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org

Sample-Id: 00000647-google
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

And manage the reallocation failure path.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 5e992a46)

Fix some buffer overreads.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Signed-off-by: Diego Biurrun <diego@biurrun.de>

Fix out of array accesses.

Found-by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Adresses: CVE-2013-7015
(cherry picked from commit 57070b14

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Fixes out of array accesses and integer overflows.

(cherry picked from commit d1916d13

)
Adresses: CVE-2013-7010, CVE-2013-7014
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Always use the actually read size as the offset instead of making
possibly invalid assumptions.

Addresses: CVE-2012-6618

(cherry picked from commit 2115a359

)

Conflicts:
	libavformat/utils.c
Signed-off-by: Anton Khirnov <anton@khirnov.net>

It's shorter and more consistent with the rest of the code.

(cherry picked from commit 8b763628

)
Signed-off-by: Anton Khirnov <anton@khirnov.net>

(cherry picked from commit c1868e7e

)
Signed-off-by: Anton Khirnov <anton@khirnov.net>

(cherry picked from commit 2df7f771

)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

pred_order == FF_ARRAY_ELEMS(fixed_coeffs) is invalid too.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 5f5ada3d

)
Signed-off-by: Tim Walker <tdskywalker@gmail.com>

(cherry picked from commit 44690dfa

)
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>

CC: libav-stable@libav.org

(cherry picked from commit b1fcdc08

)
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit ceec6e79

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit b698542a

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit b2148fac

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

CC: libav-stable@libav.org
(cherry picked from commit 1cac9acc

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>