A negative `size' will bypass FFMIN().  In the subsequent memcpy() call,
`size' will be considered as a large positive value, leading to a buffer
overflow.

Change the type of `size' to unsigned int to avoid buffer overflow, and
simplify overflow checks accordingly.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Sanity checks like `data + size >= data_end || data + size < data' are
broken, because `data + size < data' assumes pointer overflow, which is
undefined behavior in C.  Many compilers such as gcc/clang optimize such
checks away.

Use `size < 0 || size >= data_end - data' instead.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

The check `start + res < start' is broken since pointer overflow is
undefined behavior in C.  Many compilers such as gcc/clang optimize
away this check.

Use `res > end - start' instead.  Also change `res' to unsigned int
to avoid signed left-shift overflow.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes use of uninitialized values.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes use of uninitialized and half initialized values, which
can occur on several error pathes

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes division by 0

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes division by 0

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes input buffer overread

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Avoids integer overflows and out of array accesses.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Paul B Mahol <onemda@gmail.com>

outpicref is not always in synch with showwaves->outpicref, which is
changed as a side effect of the call to functions.

Fix regression introduced in 5f634480,
+10l to me.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

The live flags is currently unused, but still kept for backward
compatibility reasons (and in case it turns to be useful again for
whatever reason).

Fixes bug 431.

The function is known to be missing in at least one target (MSVC).
Signed-off-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

* qatar/master:
  proresdec: support mixed interlaced/non-interlaced content
  vp3/5: move put_no_rnd_pixels_l2 from dsputil to VP3DSPContext.
Merged-by: Michael Niedermayer <michaelni@gmx.at>

Fixes fate
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

* commit '4f56e773':
  x86: ac3: Fix HAVE_MMXEXT condition to only refer to external assembly
  rtpenc: Start the sequence numbers from a random offset

Conflicts:
	libavformat/version.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '9146e872':
  Revert "fate: Use wmv2 IDCT for wmv2 tests"

Conflicts:
	tests/fate-run.sh
	tests/fate/vcodec.mak
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '4af5310d':
  get_bits/put_bits: K&R formatting cosmetics

Conflicts:
	libavcodec/get_bits.h
	libavcodec/put_bits.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '570a4a01':
  avidec: use sensible error codes instead of -1

Conflicts:
	libavformat/avidec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

Set interlaced to false if we don't have an interlaced frame
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Fixes Ticket2148
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

x86_64 is affected by this too
Fixes Ticket2156
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

The function is only used in VP3 and VP5, so no need to have it in
DSPContext.

Documentation copied from asyncts, the options are supposed to do
the same thing. If not please submit a testcase where they differ
so we can fix it.

Disscussed-with: saste on IRC
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

CC: libav-stable@libav.org

Expose the current sequence number via an AVOption - this can
be used both for setting the initial sequence number, or for
querying the current number.
Signed-off-by: Martin Storsjö <martin@martin.st>

Found-by: durandal_1707
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Googling this term has 9 hits, 7 from ffmpeg
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>