Fixes out of array accesses for non default buffers with large strides
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4a30f085

)
(cherry picked from commit 9c9fc79d9237d28e33161cb2e75082d8ad232b2e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes CID1194435
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 18af0ce6

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes CID1194388
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b4329605

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes CID1206652
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 09b16619

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes Ticket 3542
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 291d4641

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

The code was missing 1 bit in the src format
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fc145e57

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes assertion failure
Fixes Ticket3575
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit dc6a17cf

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

These asserts cannot fail since d6af26c5

Based-on: ccda51b1

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cf2b7c01

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Embargoed-till: 2014-06-27 requested by researcher, but embargo broken by libav today (git and mailing list)

Fixes: LMS-2014-06-16-4
Found-by: "Don A. Bailey" <donb@securitymouse.com>
See: ccda51b1

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d6af26c5

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

The check `src > dst' in the form `&c->out[-back] > c->out' invokes
pointer overflow, which is undefined behavior in C.

Remove the check.  Also replace `&c->out[-back] < c->out_start' with
a safe form `c->out - c->out_start < back' to avoid overflow.

CC: libav-stable@libav.org
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit ca6c3f2c

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes crash
Fixes Ticket3468
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 59c7615d

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes part of Ticket3466
Found-by: Andrey_Karpov / PVS-Studio
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cb53beb8

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes part of Ticket3466
Found-by: Andrey_Karpov / PVS-Studio
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 73734282

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1457f3fd

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes part of Ticket3466
Found-by: Andrey_Karpov / PVS-Studio
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b8598f6c

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes part of Ticket3466
Found-by: Andrey_Karpov / PVS-Studio
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ff6fa0b4

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes part of Ticket3466
Found-by: Andrey_Karpov / PVS-Studio
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 256f5306

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes part of Ticket3466
Found by: Andrey_Karpov / PVS-Studio
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 14fa7fc6

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Found-by: Matt Oliver <protogonoi@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 46d5625f

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes Ticket3540

The function dirac_get_arith_bit in libavcodec/dirac_arith.h can't be
built with PIC and check-stack because the asm code needs 6 registers
and PIC and check-stack options take 1 each and x86 is quite limited
in this area.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d8ab7f31

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f6759d9a

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5027f397

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a5290cb1

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Related to CID1197063

The limit choosen is arbitrary and much larger than what makes sense.
It avoids the need for checking arithmetic operations with the length for overflow
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f9158b01

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

The check is possibly redundant, but better to check for errors
that dont occur than to skip the check and crash

Fixes CID1197060
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 754f8466

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d167faaf

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

This change make error handling simplier.
av_opt_freep_ranges may be called when some ranges are NULL,
for example after memory allocation fail.
Signed-off-by: Lukasz Marek <lukasz.m.luki@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3aac5fcf

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

fixes x264opts opengop=1
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 64b79141

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes h264_mp4toannexb_bsf_failure.mkv
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 289b149c

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Should fix fate failure with clang ftrapv
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c9c04512

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes ticket #3428.
(cherry picked from commit e3fd263f)

Revert "ff_id3v2_read: add option to limit ID3 magic number search"
Revert "ff_id3v2_free_extra_meta: set the pointer pointing to extra_meta to NULL"

This reverts commit 7f8aa37b.
This reverts commit 5219e20d.

The actual predictor value, set by the trellis code, never
was written back into the variable that was written into
the block header. This was accidentally removed in b304244b.

This significantly improves the audio quality of the trellis
case, which was plain broken since b304244b

.

Encoding IMA QT with trellis still actually gives a slightly
worse quality than without trellis, since the trellis encoder
doesn't use the exact same way of rounding as in
adpcm_ima_qt_compress_sample and adpcm_ima_qt_expand_nibble.

Fixes part of Ticket3701
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fa8f060b)

Conflicts:
	tests/ref/acodec/adpcm-ima_qt-trellis

This was broken in 095be4fb

 - samples+ch (for the previous
non-planar case) equals &samples_p[ch][0]. The confusion
probably stemmed from the IMA WAV case where it originally
was &samples[avctx->channels + ch], which was correctly
changed into &samples_p[ch][1].

Fixes part of Ticket3701
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a32765c4)

Fixes a regression since fb3e3808

 similar to ticket #2661,
reported by fluffrabbit at aol dot com.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 673716c5)

Conflicts:
	libavcodec/utvideodec.c

Fixes Ticket3670
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 571ab834)

Conflicts:
	libavformat/avidec.c

Fixes Ticket3594
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 421b21ca)

Fixes Ticket3590
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0a266cb5)

Conflicts:
	libavcodec/vorbisdec.c

Fix trac ticket #3523.
(cherry picked from commit 1ba59b1c)