Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

* release/0.8: (31 commits)
  svq1dec: call avcodec_set_dimensions() after dimensions changed. Fixes NGS00148
  vp3dec: Check coefficient index in vp3_dequant() Fixes NGS00145
  qdm2dec: fix buffer overflow. Fixes NGS00144
  h264: Fix invalid interlaced progressive MB combinations for direct mode prediction. Fixes Ticket312
  mpegvideo: dont use ff_mspel_motion() for vc1 Fixes Ticket655
  imgutils: Fix illegal read.
  ac3probe: Detect Sonic Foundry Soft Encode AC3 as raw AC3. Our ac3 code chain can handle it fine. More ideal would be to write a demuxer that actually extracts what can be from the additional headers and uses it for whatever it can be used for.
  mjpeg: support mpo Fixes stereoscopic_photo.mpo
  Add a version bump and APIchanges entry for avcodec_open2 and avformat_find_stream_info.
  lavf: fix multiplication overflow in avformat_find_stream_info()
  lavf: fix invalid reads in avformat_find_stream_info()
  lavf: add avformat_find_stream_info()
  lavc: fix parentheses placement in avcodec_open2().
  lavc: introduce avcodec_open2() as a replacement for avcodec_open().
  rawdec: use a default sample rate if none is specified. Fixes "ffmpeg -f s16le -i /dev/zero"
  rawdec: add check on sample_rate
  qdm2dec: check remaining input bits in the mainloop of qdm2_fft_decode_tones() This is neccessary but likely not sufficient to prevent out of array reads.
  cinepak: check strip_size
  wma: Check channel number before init. Fixes Ticket240
  Do not try to read 16bit gray png files with alpha channel.
  ...

Conflicts:
	libavcodec/version.h
	libavformat/version.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>

Fixes NGS00148

Found-by: Phillip Langlois
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4931c8f0

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes NGS00145

Found-by: Phillip Langlois
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit eef5c35b

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes NGS00144

This also adds a few lines of code from master that are needed for this fix.

Thanks to Phillip for suggestions to improve the patch.
Found-by: Phillip Langlois
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes Ticket312
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 833a1959

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes Ticket655
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 50d6f819

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Found with address sanitizer.
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit c693aa6f

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Our ac3 code chain can handle it fine.
More ideal would be to write a demuxer that actually extracts what can be from the additional
headers and uses it for whatever it can be used for.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 30ca700b

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes stereoscopic_photo.mpo
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1d23e524

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

* qatar/release/0.7:
  Add a version bump and APIchanges entry for avcodec_open2 and avformat_find_stream_info.
  lavf: fix multiplication overflow in avformat_find_stream_info()
  lavf: fix invalid reads in avformat_find_stream_info()
  lavf: add avformat_find_stream_info()
  lavc: fix parentheses placement in avcodec_open2().
  lavc: introduce avcodec_open2() as a replacement for avcodec_open().

Conflicts:
	doc/APIchanges
	libavcodec/utils.c
	libavcodec/version.h
	libavformat/avformat.h
	libavformat/version.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>

Converting to double before the multiplication rather than after
avoids an integer overflow in some cases.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 52767d89

)
Signed-off-by: Anton Khirnov <anton@khirnov.net>

(cherry picked from commit e358f7ee

)

Conflicts:

	libavformat/utils.c
Signed-off-by: Anton Khirnov <anton@khirnov.net>

It supports passing options to codecs.
(cherry picked from commit a67c061e

)

Conflicts:

	libavformat/utils.c
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 1d36fb13

)
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Adds support for decoder-private options and makes setting other options
simpler.
(cherry picked from commit 0b950fe2

)

Conflicts:

	libavcodec/avcodec.h
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Fixes "ffmpeg -f s16le -i /dev/zero"
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fca85ce5

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Prevent error condition in case sample_rate is unset or set to a negative
value. In particular, fix divide-by-zero error occurring in ffmpeg due to
sample_rate set to 0 in output_packet(), in code:

                ist->next_pts += ((int64_t)AV_TIME_BASE * ist->st->codec->frame_size) /
                    ist->st->codec->sample_rate;

Fix trac ticket #324.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

This is neccessary but likely not sufficient to prevent out of array reads.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 14db3af4

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cea0c82d

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes Ticket240

Based on patch by ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 20431a99

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

FFmpeg does not support gray16a.
Fixes the crash in ticket #644.
(cherry picked from commit 0c5fd637

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 554caed2

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit d8407ee2

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3fd0f6ed

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Found with Address Sanitizer
(cherry picked from commit bb4b0ad8

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Found with Address Sanitizer
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit e0966eb1

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avfilter_draw_slice() is already called in the end_frame() callback,
this avoids multiple calls. This is done by adding a null draw_slice()
callback.

In particular fix crash occurring with -vf transpose=3,hflip, fix trac
issue #371.
(cherry picked from commit d9c23a0d)

avfilter_draw_slice() is already called in the end_frame() callback,
this avoids multiple calls. This is done by adding a null draw_slice()
callback.

In particular fix crash occurring with -vf transpose=3,hflip, fix trac
issue #371.
(cherry picked from commit d9c23a0d)

There were multiple issues, for example might we have to re-run
the decompression when the size of the buffer increased,
we should always use a decompression buffer large enough for
the header (so we do not get stuck when the size is too small).
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>

Treating them like 0 is safest, current code would invoke
undefined pointer arithmetic behaviour in this case.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
(cherry picked from commit b9242fd1)
(cherry picked from commit 0411b192)

There were multiple issues, for example might we have to re-run
the decompression when the size of the buffer increased,
we should always use a decompression buffer large enough for
the header (so we do not get stuck when the size is too small).
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>

Treating them like 0 is safest, current code would invoke
undefined pointer arithmetic behaviour in this case.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
(cherry picked from commit b9242fd1)

Fixes Ticket611
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit df9c1cfb)

Seems to fix trac issue #569.
Sample is unfortunately not available, but it might be caused by
an index existing for non-existing audio stream (?).
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
(cherry picked from commit 6ea6ff05)

Seems to fix trac issue #569.
Sample is unfortunately not available, but it might be caused by
an index existing for non-existing audio stream (?).
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
(cherry picked from commit 6ea6ff05)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

* release/0.8: (96 commits)
  Version numbers for 0.8.6
  snow: emu edge support Fixes Ticket592
  imc: validate channel count
  imc: check for ff_fft_init() failure (cherry picked from commit 95fee70d)
  libgsmdec: check output buffer size before decoding (cherry picked from commit b03761b1)
  configure: fix arch x86_32
  mp3enc: avoid truncating id3v1 tags by one byte
  asfdec: Check packet_replic_size earlier
  cin audio: validate the channel count
  binkaudio: add some buffer overread checks.
  atrac1: validate number of channels (cherry picked from commit bff5b2c1)
  atrac1: check output buffer size before decoding (cherry picked from commit 33684b9c)
  vp3: fix oob read for negative tokens and memleaks on error. (cherry picked from commit 8370e426)
  apedec: set s->currentframeblocks after validating nblocks
  apedec: use unsigned int for 'nblocks' and make sure that it's within int range
  apedec: check for data buffer realloc failure (cherry picked from commit 11ca8b2d)
  apedec: check for filter buffer allocation failure (cherry picked from commit 75007813

)
  mpegaudiodec: check output data size based on avctx->frame_size
  resample: Fix array size
  resample2: fix potential overflow
  ...

Conflicts:
	Doxyfile
	RELEASE
	VERSION
Merged-by: Michael Niedermayer <michaelni@gmx.at>