* commit '83c285f8':
  wtv: Add more sanity checks for a length read from the file

Conflicts:
	libavformat/wtv.c

See: c42efad3Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'd8b68660':
  yop: Clear all references to the AVBuffer in the local AVPacket

Conflicts:
	libavformat/yop.c

See: 551f6838Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '3185a802':
  fraps: Make the input buffer size checks more strict

Conflicts:
	libavcodec/fraps.c

The added checks are mostly to handle duplicate frames, which
we discard, thus there are also no P frames for example.
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '82e266c6':
  segafilm: Validate the number of audio channels

Merge only for metadata as the change is incorrect, checking audio
parameters in video only files

See: 192db16bMerged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '601c2015':
  svq3: Avoid a division by zero

Conflicts:
	libavcodec/svq3.c

See: 4fa706a4Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '7a5a5572':
  qpeg: Add checks for running out of rows in qpeg_decode_inter

Conflicts:
	libavcodec/qpeg.c

See: 4299dfa5Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'e9d61de9':
  mpegaudiodec: Validate that the number of channels fits at the given offset

Conflicts:
	libavcodec/mpegaudiodec.c

See: 51fcf276Merged-by: Michael Niedermayer <michaelni@gmx.at>

extradata is not mandatory to decode asv
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'f5080335':
  asvdec: Verify the amount of extradata

See: 605f2b6bMerged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '72fe16a1':
  movenc: Use null buffers for measuring the amount of data to be written

Conflicts:
	libavformat/movenc.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '3627ce2f':
  aviobuf: Add functions for null buffers
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'bb461370':
  asfenc: mux chapters in ASF files using an ASF "marker" section

Conflicts:
	Changelog
	libavformat/version.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '09f3c937':
  asfenc: remember send time and offset of the index entries

Conflicts:
	libavformat/asfenc.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '1eb93280':
  asfenc: add ASF_Reserved_4 as defined in section 10.10 of the ASF spec
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'c53b5dda':
  asfdec: replace magic constant with DATA_HEADER_SIZE
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '5f408333':
  asfdec: substract preroll time from marker presentation time
Merged-by: Michael Niedermayer <michaelni@gmx.at>

Minor change to fix for Trac #1003 to avoid squawking about files
with valid keyframes that aren't marked (as opposed to frames that are
marked as keyframes and aren't).

Change correctly surpresses the spurious warnings, while still complaining
about (and handling) the genuinely broken file attached to bug #1003.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Paul B Mahol <onemda@gmail.com>

Found-by: Justin Ruggles
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Also make sure the existing length check can't overflow.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

This makes sure that it doesn't try to free an AVBuffer belonging
to an earlier packet when we free the local packet at the end.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

This avoids divisions by zero later.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

If the height is zero, the decompression will probably end up
failing due to not fitting into the allocated buffer later
anyway, so this doesn't need any more elaborate check.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

This is similar to the fix in 35cbc98b.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

The init function reads one byte of extradata.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Martin Storsjö <martin@martin.st>

Null buffers are useful for simulating writing to a real buffer
for the sake of measuring how many bytes are written.
Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Paul B Mahol <onemda@gmail.com>

ASF markers only have a start time, so we lose the chapter end times,
but that is ASF for you
Signed-off-by: Vladimir Pantelic <vladoman@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Signed-off-by: Paul B Mahol <onemda@gmail.com>

Signed-off-by: Vladimir Pantelic <vladoman@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Signed-off-by: Vladimir Pantelic <vladoman@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Signed-off-by: Vladimir Pantelic <vladoman@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>

this was forgotten when we changed ASF to not output the preroll time
Signed-off-by: Vladimir Pantelic <vladoman@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Signed-off-by: Paul B Mahol <onemda@gmail.com>