Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a2a12e33)

Fixes Ticket778
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 680880c9)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

* release/0.8: (22 commits)
  Update Changelog for 0.7.3 release
  4xm: Add a check in decode_i_frame to prevent buffer overreads
  wma: initialize prev_block_len_bits, next_block_len_bits, and block_len_bits.
  Update RELEASE file for 0.7.3
  swscale: #include "libavutil/mathematics.h"
  vp3dec: Check coefficient index in vp3_dequant()
  svq1dec: call avcodec_set_dimensions() after dimensions changed.
  mpegtsenc: fix handling of large audio packets (sorry i have no sample, just a user report)
  h264: Use mismatching frame numbers in fields
  swscale: Readd #define _SVID_SOURCE
  vp6: Fix illegal read.
  vp6: Fix illegal read.
  vp6: Reset the internal state when aborting key frames header parsing
  vp6: Check for huffman tree build errors
  vp6: partially propagate huffman tree building errors during coeff model parsing and fix misspelling
  imgutils: Fix illegal read.
  qdm2: check output buffer size before decoding
  Fix out of bound reads in the QDM2 decoder.
  Check for out of bound writes in the QDM2 decoder.
  vmd: fix segfaults on corruped streams
  ...

Conflicts:
	Doxyfile
	RELEASE
	VERSION
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* qatar/release/0.7:
  Update Changelog for 0.7.3 release

Conflicts:
	Changelog
Merged-by: Michael Niedermayer <michaelni@gmx.at>

This merge is primary for metadata, theres little actually changed
except cosmetics

* qatar/release/0.7:
  4xm: Add a check in decode_i_frame to prevent buffer overreads
  wma: initialize prev_block_len_bits, next_block_len_bits, and block_len_bits.
  Update RELEASE file for 0.7.3
  swscale: #include "libavutil/mathematics.h"
  vp3dec: Check coefficient index in vp3_dequant()
  svq1dec: call avcodec_set_dimensions() after dimensions changed.
  swscale: Readd #define _SVID_SOURCE

Conflicts:
	RELEASE
	libavcodec/4xm.c
	libavcodec/vp3.c
	libswscale/utils.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

Fixes bugzilla #135
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 355d917c

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

The initial values are not checked against the number of block sizes.
Initializing them to frame_len_bits will result in a block size index of 0
in these cases instead of something that might be out-of-range.

Fixes Bug 81.
(cherry picked from commit 05d1e45d

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

this file uses the M_PI macro since
4e74187d

, so include the correct header
directly.
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

(cherry picked from commit 5089ce1b

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Based on a patch by Michael Niedermayer <michaelni@gmx.at>

Fixes NGS00145, CVE-2011-4352

Found-by: Phillip Langlois
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

(cherry picked from commit 8b94df0f

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Fixes NGS00148, CVE-2011-4579

Found-by: Phillip Langlois
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

(cherry picked from commit 6e24b948

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

(sorry i have no sample, just a user report)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e31c5ebe

)

Conflicts:

	libavformat/mpegtsenc.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

(sorry i have no sample, just a user report)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e31c5ebe

)

Conflicts:

	libavformat/mpegtsenc.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Note, all these commits where already in our release, this merge thus
changes nothing, its just for metadata

* qatar/release/0.7:
  vp6: Fix illegal read.
  vp6: Fix illegal read.
  vp6: Reset the internal state when aborting key frames header parsing
  vp6: Check for huffman tree build errors
  vp6: partially propagate huffman tree building errors during coeff model parsing and fix misspelling
  imgutils: Fix illegal read.
  qdm2: check output buffer size before decoding
  Fix out of bound reads in the QDM2 decoder.
  Check for out of bound writes in the QDM2 decoder.
  vmd: fix segfaults on corruped streams

Conflicts:
	libavcodec/qdm2.c
	libavcodec/vmdav.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

to synchronize the first/second field state independant of them being reference or not.
Fixes Ticket354
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 545ec935)

to synchronize the first/second field state independant of them being reference or not.
Fixes Ticket354
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 545ec935)

This was removed erroneously in
046f081b

. This define still is
necessary for getting MAP_ANONYMOUS defined on linux/glibc,
despite the define reshuffling done in that commit.

Without MAP_ANONYMOUS defined, the mprotect calls for setting the
generated mmx2 scaler code pages executable are left out, causing
crashes if that codepath is chosen.

This patch fixes scaling from 192x144 to 320x240 with
-sws_flags fast_bilinear, which crashes on linux at the
moment.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit f32dfad9

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Found with Address Sanitizer
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit e0966eb1

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

(cherry picked from commit 2a6eb062

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

It prevents leaving the state only half initialized.
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit a72cad0a

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 066fff75

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

vp6: partially propagate huffman tree building errors during coeff model parsing and fix misspelling
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit f913eeea

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Found with address sanitizer.
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit c693aa6f

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

(cherry picked from commit 7d49f79f

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
(cherry picked from commit 5a19acb1

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
(cherry picked from commit 291d74a4

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Signed-off-by: Janne Grunau <janne-libav@jannau.net>
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 32ed7da1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 32ed7da1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

* release/0.8: (31 commits)
  svq1dec: call avcodec_set_dimensions() after dimensions changed. Fixes NGS00148
  vp3dec: Check coefficient index in vp3_dequant() Fixes NGS00145
  qdm2dec: fix buffer overflow. Fixes NGS00144
  h264: Fix invalid interlaced progressive MB combinations for direct mode prediction. Fixes Ticket312
  mpegvideo: dont use ff_mspel_motion() for vc1 Fixes Ticket655
  imgutils: Fix illegal read.
  ac3probe: Detect Sonic Foundry Soft Encode AC3 as raw AC3. Our ac3 code chain can handle it fine. More ideal would be to write a demuxer that actually extracts what can be from the additional headers and uses it for whatever it can be used for.
  mjpeg: support mpo Fixes stereoscopic_photo.mpo
  Add a version bump and APIchanges entry for avcodec_open2 and avformat_find_stream_info.
  lavf: fix multiplication overflow in avformat_find_stream_info()
  lavf: fix invalid reads in avformat_find_stream_info()
  lavf: add avformat_find_stream_info()
  lavc: fix parentheses placement in avcodec_open2().
  lavc: introduce avcodec_open2() as a replacement for avcodec_open().
  rawdec: use a default sample rate if none is specified. Fixes "ffmpeg -f s16le -i /dev/zero"
  rawdec: add check on sample_rate
  qdm2dec: check remaining input bits in the mainloop of qdm2_fft_decode_tones() This is neccessary but likely not sufficient to prevent out of array reads.
  cinepak: check strip_size
  wma: Check channel number before init. Fixes Ticket240
  Do not try to read 16bit gray png files with alpha channel.
  ...

Conflicts:
	libavcodec/version.h
	libavformat/version.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>

Fixes NGS00148

Found-by: Phillip Langlois
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4931c8f0

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes NGS00145

Found-by: Phillip Langlois
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit eef5c35b

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes NGS00144

This also adds a few lines of code from master that are needed for this fix.

Thanks to Phillip for suggestions to improve the patch.
Found-by: Phillip Langlois
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes Ticket312
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 833a1959

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes Ticket655
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 50d6f819

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>