Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 18bcfc91

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 282bb028

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3eedf9f7

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes Ticket780
Bug Found by: cosminamironesei
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9af6abdc

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes Ticket758
Bug found by: Diana Elena Muscalu
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7fff64e0

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes Ticket760 and Ticket761
Bug Found by: Diana Elena Muscalu
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 944f5b27

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes Ticket776
Bug found by: Diana Elena Muscalu
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1f99939a

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5257743a

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Avoid out-of-buffer data access when nb_channels is 8.
(cherry picked from commit ae217762

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

* qatar/release/0.7:
  Update Changelog for 0.7.4 release
  Update RELEASE file for 0.7.4
  swscale: fix crash in fast_bilinear code when compiled with -mred-zone.
  vorbis: An additional defense in the Vorbis codec.
  vorbisdec: Fix decoding bug with channel handling

Conflicts:
	Changelog
	RELEASE
Merged-by: Michael Niedermayer <michaelni@gmx.at>

Additional comments from Måns Rullgard have been integrated
by Reinhard Tartler.
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit b14fa557

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Fixes Bug: #190
Chromium Bug: #100543
Related to CVE-2011-3893
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit afb2aa53

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Fixes Bug: #191
Chromium Bug: #101458
CVE-2011-3895
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit e6d527ff

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

* qatar/release/0.7:
  matroskadec: Fix a bug where a pointer was cached to an array that might later move due to a realloc()
  vorbis: Avoid some out-of-bounds reads
  vp3: fix oob read for negative tokens and memleaks on error. (cherry picked from commit 8370e426

)
  avserver: Fix a bug where the socket is IPv4, but IPv6 is autoselected for the loopback address.
  vp3: fix streams with non-zero last coefficient
Merged-by: Michael Niedermayer <michaelni@gmx.at>

matroskadec: Fix a bug where a pointer was cached to an array that might later move due to a realloc()

Fixes bug #190
Chromium bug #100492
related to CVE-2011-3893
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

(cherry-picked from commit faaec467

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Fixes Bug: #190
Chromium Bug: #100543
Related to CVE-2011-3893
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 57cd6d70

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

(cherry picked from commit 8370e426

)

Fixes: #189
Chromium-Bug: 101172,100465
CVE-2011-3892
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

This fixes bind(8080): Address family not supported by protocol.
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit f5e717f3

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Fixes a regression introduced in 8b94df0f.
(cherry picked from commit 9b4767e4

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a2a12e33)

Fixes Ticket778
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

* qatar/release/0.7:
  Update Changelog for 0.7.3 release

Conflicts:
	Changelog
Merged-by: Michael Niedermayer <michaelni@gmx.at>

This merge is primary for metadata, theres little actually changed
except cosmetics

* qatar/release/0.7:
  4xm: Add a check in decode_i_frame to prevent buffer overreads
  wma: initialize prev_block_len_bits, next_block_len_bits, and block_len_bits.
  Update RELEASE file for 0.7.3
  swscale: #include "libavutil/mathematics.h"
  vp3dec: Check coefficient index in vp3_dequant()
  svq1dec: call avcodec_set_dimensions() after dimensions changed.
  swscale: Readd #define _SVID_SOURCE

Conflicts:
	RELEASE
	libavcodec/4xm.c
	libavcodec/vp3.c
	libswscale/utils.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

Fixes bugzilla #135
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 355d917c

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

The initial values are not checked against the number of block sizes.
Initializing them to frame_len_bits will result in a block size index of 0
in these cases instead of something that might be out-of-range.

Fixes Bug 81.
(cherry picked from commit 05d1e45d

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

this file uses the M_PI macro since
4e74187d

, so include the correct header
directly.
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

(cherry picked from commit 5089ce1b

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Based on a patch by Michael Niedermayer <michaelni@gmx.at>

Fixes NGS00145, CVE-2011-4352

Found-by: Phillip Langlois
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

(cherry picked from commit 8b94df0f

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Fixes NGS00148, CVE-2011-4579

Found-by: Phillip Langlois
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

(cherry picked from commit 6e24b948

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

(sorry i have no sample, just a user report)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e31c5ebe

)

Conflicts:

	libavformat/mpegtsenc.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Note, all these commits where already in our release, this merge thus
changes nothing, its just for metadata

* qatar/release/0.7:
  vp6: Fix illegal read.
  vp6: Fix illegal read.
  vp6: Reset the internal state when aborting key frames header parsing
  vp6: Check for huffman tree build errors
  vp6: partially propagate huffman tree building errors during coeff model parsing and fix misspelling
  imgutils: Fix illegal read.
  qdm2: check output buffer size before decoding
  Fix out of bound reads in the QDM2 decoder.
  Check for out of bound writes in the QDM2 decoder.
  vmd: fix segfaults on corruped streams

Conflicts:
	libavcodec/qdm2.c
	libavcodec/vmdav.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

to synchronize the first/second field state independant of them being reference or not.
Fixes Ticket354
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 545ec935)

This was removed erroneously in
046f081b

. This define still is
necessary for getting MAP_ANONYMOUS defined on linux/glibc,
despite the define reshuffling done in that commit.

Without MAP_ANONYMOUS defined, the mprotect calls for setting the
generated mmx2 scaler code pages executable are left out, causing
crashes if that codepath is chosen.

This patch fixes scaling from 192x144 to 320x240 with
-sws_flags fast_bilinear, which crashes on linux at the
moment.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit f32dfad9

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Found with Address Sanitizer
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit e0966eb1

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>