This reverts commit d1bec33b, it breaks
FATE.

Those are not usable from the avtools, so mentioning them in the
manpages just confuses the reader.

The total frame size is a combination of the 12 bits in the sequence
header and 2 more bits in the the sequence extension. While the
specification explicitly forbids the dimensions from the sequence header
from being 0 (thus ruling out multiples of 4096), such videos
apparrently exist in the wild so we should attempt to decode them.

Based on a patch by Michael Niedermayer <michaelni@gmx.at>

Fixes Bug 416.

Fixes CVE-2013-2495

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

CC: libav-stable@libav.org

According to the specification the timestamp is represented by a 32bit
unsigned.

CC: libav-stable@libav.org

It is supposed to be height * linesize, not width * linesize.
Thanks to Hendrik Leppkes for pointing out the bug.

They are auto-negotiated.

Filter private data is memset to 0 so there is no point in explicitly
initing anything to 0.

The named constant needs to be searched for in the same object on which
the option is set, i.e. target_obj.

This is more consistent with the naming in the rest of Libav.

To avoid allocating ridiculous amounts of memory for corrupted files,
read the input in chunks limited to filesize or an arbitrary large
amount when that is not known (chosen to be 50M).

The check `src > dst' in the form `&c->out[-back] > c->out' invokes
pointer overflow, which is undefined behavior in C.

Remove the check.  Also replace `&c->out[-back] < c->out_start' with
a safe form `c->out - c->out_start < back' to avoid overflow.

CC: libav-stable@libav.org
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Simplify `p->buf > p->buf + p->buf_size - 4' as `p->buf_size < 4'.
Avoid a possible out-of-bounds pointer, which is undefined behavior
in C.

CC: libav-stable@libav.org
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

When `off' is 0, `0x537F6103 << 32' in the following expression invokes
undefined behavior, the result of which is not necessarily 0.

    (0x537F6103 >> (off * 8)) | (0x537F6103 << (32 - (off * 8)))

Avoid oversized shifting.

CC: libav-stable@libav.org
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Range coder in 3.90-3.95 overread two bytes in the final normalize.

This will help in supporting old versions, e.g. version 3.93 uses the same
range coder but different predictor and version 3.82 uses different range
coder and predictor. Also this should not make decoding newer versions slower
by introducing additional checks on versions.

This allows demuxing and muxing of CAVS TS streams.
Signed-off-by: Anton Khirnov <anton@khirnov.net>

There are never any packets for those streams.
Fixes an infinite loop with -attach.

This allows reporting missing features and requesting samples from
all libraries in a standard way; with a simplified API.

Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Martin Storsjö <martin@martin.st>

The tool nowadays supports more than one track per file,
this makes reading the code slightly less confusing.
Signed-off-by: Martin Storsjö <martin@martin.st>

CC:libav-stable@libav.org
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Signed-off-by: Anton Khirnov <anton@khirnov.net>

Signed-off-by: Anton Khirnov <anton@khirnov.net>