* commit '4a2b26fc':
  tak: decode directly to the user-provided AVFrame
  smackaud: decode directly to the user-provided AVFrame
  sipr: decode directly to the user-provided AVFrame
  shorten: decode directly to the user-provided AVFrame

Conflicts:
	libavcodec/shorten.c
	libavcodec/takdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '5d5c248c':
  s302m: decode directly to the user-provided AVFrame
  ra288: decode directly to the user-provided AVFrame
  ra144: decode directly to the user-provided AVFrame
  ralf: decode directly to the user-provided AVFrame
  qdm2: decode directly to the user-provided AVFrame
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '1b9b6d6e':
  qcelp: decode directly to the user-provided AVFrame
  pcm-bluray: decode directly to the user-provided AVFrame
  nellymoser: decode directly to the user-provided AVFrame
  mpc7/8: decode directly to the user-provided AVFrame
  mpegaudio: decode directly to the user-provided AVFrame
  mlp/truehd: decode directly to the user-provided AVFrame

Conflicts:
	libavcodec/mpc7.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '86bfcfcf':
  mace: decode directly to the user-provided AVFrame
  libspeex: decode directly to the user-provided AVFrame
  libopus: decode directly to the user-provided AVFrame
  libopencore-amr: decode directly to the user-provided AVFrame
  libgsm: decode directly to the user-provided AVFrame

Conflicts:
	libavcodec/libopusdec.c
	libavcodec/mace.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'a8ea936a':
  libilbc: decode directly to the user-provided AVFrame
  dpcm: decode directly to the user-provided AVFrame
  imc/iac: decode directly to the user-provided AVFrame
  gsm: decode directly to the user-provided AVFrame

Conflicts:
	libavcodec/dpcm.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'cb7b47a6':
  g726: decode directly to the user-provided AVFrame
  g723.1: decode directly to the user-provided AVFrame
  g722: decode directly to the user-provided AVFrame
  flac: decode directly to the user-provided AVFrame
  cinaudio: decode directly to the user-provided AVFrame

Conflicts:
	libavcodec/g723_1.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '182821cf':
  dca: decode directly to the user-provided AVFrame
  cook: decode directly to the user-provided AVFrame
  comfortnoise: decode directly to the user-provided AVFrame
  bmvaudio: decode directly to the user-provided AVFrame
  pcm: decode directly to the user-provided AVFrame

Conflicts:
	libavcodec/pcm.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '5cc0bd2c':
  binkaudio: decode directly to the user-provided AVFrame
  atrac3: decode directly to the user-provided AVFrame
  atrac1: decode directly to the user-provided AVFrame
  ape: decode directly to the user-provided AVFrame
  amrwb: decode directly to the user-provided AVFrame

Conflicts:
	libavcodec/amrwbdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'e3db3429':
  amrnb: decode directly to the user-provided AVFrame
  als: decode directly to the user-provided AVFrame
  alac: decode directly to the user-provided AVFrame
  adxenc: alloc/free coded_frame instead of keeping it in the ADXContext
  adx: decode directly to the user-provided AVFrame

Conflicts:
	libavcodec/alsdec.c
	libavcodec/amrnbdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'e57daa87':
  adpcm: decode directly to the user-provided AVFrame
  ac3: decode directly to the user-provided AVFrame
  aac: decode directly to the user-provided AVFrame
  8svx: decode directly to the user-provided AVFrame

Conflicts:
	libavcodec/8svx.c
	libavcodec/ac3dec.c
	libavcodec/adpcm.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes freeing invalid addresses

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes out of array accesses

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes reading over the end

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>