If chan2 is not smaller than the number of channels, it can cause
segmentation faults due to dereferencing a NULL pointer.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

The AVFrame values are closer to the AVFrame bitmap changed instead of
the AVCodecContext values, so this should be more robust
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes Ticket4602
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Found-by: carl
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Otherwise it can be 0 in sonic_decode_frame, causing SIGFPE crashes.
Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

libavutil/channel_layout: Correctly return layout when channel specification ends with a trailing 'c'.

Return layout when FF_API_GET_CHANNEL_LAYOUT_COMPAT is set even if the
layout itself is not in the deprecated style.
Signed-off-by: Simon Thelen <ffmpeg-dev@c-14.de>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

The flag was set unintentionally and the code will break if a NULL
packet is passed in.
Signed-off-by: Vignesh Venkatasubramanian <vigneshv@google.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Found-by: carl
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

so that no external decoder is used which would break the test
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'b14086ca':
  mkv: Correctly report the latest packet had been flushed
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'b3803370':
  mpjpegdec: don't try to alloc an AVIOContext when probe is guaranteed to fail

See: 1382add5Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '21092172':
  imc: add required padding for GetBitContext buffer

Conflicts:
	libavcodec/imc.c

See: 7444cf9aMerged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '09447f2b':
  ac3_parser: add required padding for GetBitContext buffer

See: fccd85b9Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'fb147308':
  aac_parser: add required padding for GetBitContext buffer

See: fccd85b9Merged-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

The code gave apparently completely wrong values

Fixes Ticket2872
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes Ticket2869
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Bug-Id: 865
CC: libav-stable@libav.org

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

The first check is done without the AVIOContext, so alloc it only if said check succeeds
Signed-off-by: James Almer <jamrial@gmail.com>
Signed-off-by: Janne Grunau <janne-libav@jannau.net>

Fixes stack buffer overflow errors detected by address sanitizer in
fate-imc.

CC: libav-stable@libav.org

Fixes stack buffer overflow errors detected by address sanitizer in
various fate tests.

CC: libav-stable@libav.org

Fixes stack buffer overflow errors detected by address sanitizer in
various fate tests.

CC: libav-stable@libav.org

Fix ticket4596
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes part of Ticket3619
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

This avoid potential out of array accesses
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fix part of Ticket3619
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

If one of the dimensions is larger than 8176, s->mb_width or
s->mb_height is larger than 511, leading to an int16_t overflow of
s->mv_max.{x,y}. This then causes av_clip to be called with amin > amax.

Changing the type to int avoids the overflow and has no negative
effect, because s->mv_max is only used in clamp_mv for clipping.
Since mv_max.{x,y} is positive and mv_min.{x,y} negative, av_clip can't
increase the absolute value. The input to av_clip is an int16_t, and
thus the output fits into int16_t as well.

For additional safety, s->mv_{min,max}.{x,y} are clipped to int16_t range
before use.
Reviewed-by: Ronald S. Bultje <rsbultje@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>