Fixes CVE-2013-2495

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

CC: libav-stable@libav.org

According to the specification the timestamp is represented by a 32bit
unsigned.

CC: libav-stable@libav.org

It is supposed to be height * linesize, not width * linesize.
Thanks to Hendrik Leppkes for pointing out the bug.

They are auto-negotiated.

Filter private data is memset to 0 so there is no point in explicitly
initing anything to 0.

The named constant needs to be searched for in the same object on which
the option is set, i.e. target_obj.

This is more consistent with the naming in the rest of Libav.

To avoid allocating ridiculous amounts of memory for corrupted files,
read the input in chunks limited to filesize or an arbitrary large
amount when that is not known (chosen to be 50M).

The check `src > dst' in the form `&c->out[-back] > c->out' invokes
pointer overflow, which is undefined behavior in C.

Remove the check.  Also replace `&c->out[-back] < c->out_start' with
a safe form `c->out - c->out_start < back' to avoid overflow.

CC: libav-stable@libav.org
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Simplify `p->buf > p->buf + p->buf_size - 4' as `p->buf_size < 4'.
Avoid a possible out-of-bounds pointer, which is undefined behavior
in C.

CC: libav-stable@libav.org
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

When `off' is 0, `0x537F6103 << 32' in the following expression invokes
undefined behavior, the result of which is not necessarily 0.

    (0x537F6103 >> (off * 8)) | (0x537F6103 << (32 - (off * 8)))

Avoid oversized shifting.

CC: libav-stable@libav.org
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Range coder in 3.90-3.95 overread two bytes in the final normalize.

This will help in supporting old versions, e.g. version 3.93 uses the same
range coder but different predictor and version 3.82 uses different range
coder and predictor. Also this should not make decoding newer versions slower
by introducing additional checks on versions.

This allows demuxing and muxing of CAVS TS streams.
Signed-off-by: Anton Khirnov <anton@khirnov.net>

There are never any packets for those streams.
Fixes an infinite loop with -attach.

This allows reporting missing features and requesting samples from
all libraries in a standard way; with a simplified API.

Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Martin Storsjö <martin@martin.st>

The tool nowadays supports more than one track per file,
this makes reading the code slightly less confusing.
Signed-off-by: Martin Storsjö <martin@martin.st>

CC:libav-stable@libav.org
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Signed-off-by: Anton Khirnov <anton@khirnov.net>

Signed-off-by: Anton Khirnov <anton@khirnov.net>

Solve an infiniloop.

CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>