GitLab

* commit 'dcc68de9':
  vp3: Copy all 3 frames for thread updates

See: 247d30a7

Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'ebe2292e':
  mpegts: Do not try to write a PMT larger than SECTION_SIZE

Conflicts:
	libavformat/mpegtsenc.c

See: 68b14c04

Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'd86df7dd

':
  mpegts: Define the section length with a constant
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'a79e58cd

':
  Update Changelog for v0.8.14
  Prepare for 0.8.14 Release

Conflicts:
	Changelog
	RELEASE

No change as this does not apply to FFmpeg 1:1
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'c79cf012

':
  error_concealment: avoid using the picture if not fully setup
Merged-by: Michael Niedermayer <michaelni@gmx.at>

Add padding, clear size, use the correct pointer.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4213fc5b

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

* commit '9d5f4f02

':
  svq1: do not modify the input packet
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'cf6b2a0a

':
  cdgraphics: do not return 0 from the decode function
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '3aebdffb

':
  cdgraphics: switch to bytestream2

Conflicts:
	libavcodec/cdgraphics.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'a1804df6

':
  huffyuvdec: check width size for yuv422p
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'e17dc0a2

':
  mmvideo: check horizontal coordinate too
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '4a662255

':
  huffyuv: Check and propagate function return values

Conflicts:
	libavcodec/huffyuv.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '50493f1f

':
  twinvq: fix out of bounds array access
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '3e60501f

':
  h264: slice-mt: check master context for valid current_picture_ptr
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '7585a625

':
  h264: prevent theoretical infinite loop in SEI parsing

Conflicts:
	libavcodec/h264_sei.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '184c7972

':
  h264_sei: check SEI size

Conflicts:
	libavcodec/h264_sei.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'a465ed57

':
  pgssubdec: Check RLE size before copying
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '976f2e0a

':
  x86: Fix linking with some or all of yasm, mmx, optimizations disabled

Conflicts:
	libavcodec/x86/mpegaudiodec_mmx.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '28f2d3c5

':
  cmdutils: Conditionally compile libswscale-related bits

Conflicts:
	cmdutils.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '277103e0

':
  video4linux2: Avoid a floating point exception

Conflicts:
	avconv.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'e4fdfdf6

':
  vf_select: Drop a debug av_log with an unchecked double to enum conversion
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '187cfd3c

':
  eamad: use the bytestream2 API instead of AV_RL

Conflicts:
	libavcodec/eamad.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

Fixes a double release of the current frame on deinit.

Bug-Id: CVE-2011-3934
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>

Prevent out of array write.

Similar to what Michael Niedermayer did to address the same issue.

Bug-Id: CVE-2014-2263
CC: libav-stable@libav.org
(cherry picked from commit addbaf13

)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

The specification says the value is expressed in 10 bits including
the 4-byte CRC.

(cherry picked from commit 694b7cd8

)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavformat/mpegtsenc.c

Fixes state becoming inconsistent and a null pointer dereference.

CC: libav-stable@libav.org
Bug-Id: CVE-2013-0860
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>

The input data must remain constant, make a copy instead. This is in
theory a performance hit, but since I failed to find any samples
using this feature, this should not matter in practice.

Also, check the size of the header, avoiding invalid reads on truncated
data.

CC:libav-stable@libav.org
(cherry picked from commit 7b588bb6

)
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Conflicts:
	libavcodec/svq1dec.c

0 means no data consumed, so it can trigger an infinite loop in the
caller.

CC:libav-stable@libav.org
(cherry picked from commit c7d9b473

)
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Conflicts:
	libavcodec/cdgraphics.c

Fixes possible invalid memory accesses on corrupted data.

CC:libav-stable@libav.org
Bug-ID: CVE-2013-3674
(cherry picked from commit a1599f3f

)
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Avoid out of array accesses.

CC: libav-stable@libav.org
Bug-Id: CVE-2013-0848
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit a7153444

)
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Conflicts:
	libavcodec/huffyuvdec.c

Fixes out of array accesses.

Bug-Id: CVE-2013-3672
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 70cd3b8e

)
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Bug-Id: CVE-2013-0868

inspired by a patch from Michael Niedermayer <michaelni@gmx.at>
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

(cherry picked from commit 744b406f

)
Signed-off-by: Diego Biurrun <diego@biurrun.de>

Conflicts:
	libavcodec/huffyuvdec.c

ModeTab.fmode has only 3 elements, so indexing it with ftype
in the initialier for 'size' is invalid when ftype == FT_PPC.

This fixes crashes with gcc 4.8.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 4bf2e7c5

)
Signed-off-by: Diego Biurrun <diego@biurrun.de>

Fixes errors in slice based multithreading introduced in 0b300daa.

CC: libav-stable@libav.org
(cherry picked from commit 5945c7b3

)
Signed-off-by: Diego Biurrun <diego@biurrun.de>

Properly address CVE-2011-3946 and parse bitstream as described in the spec.

CC: libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

Signed-off-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>

Make sure the buffer size does not exceed the expected
RLE size.

Prevent an out of array bound write.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Bug-Id: CVE-2013-0852
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 00915d3c

)
Signed-off-by: Diego Biurrun <diego@biurrun.de>

Some optimized template functions reference optimized symbols, so they
must be explicitly disabled when those symbols are unavailable.

(cherry picked from commit ec36aa69

)
Signed-off-by: Diego Biurrun <diego@biurrun.de>