If EOF is reached, while skipping bytes, avio_tell(pb) won't change
anymore, resulting in an infinite loop.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

They are used in a switch statement, but it is not guaranteed that the
COMM case (where they are set to 0) is reached before the other cases.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

* commit '0ce3a0f9':
  utvideodec: Handle slice_height being zero

See: 38816062Merged-by: Michael Niedermayer <michaelni@gmx.at>

Fixes out of array accesses.

CC: libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Bug-Id: CVE-2014-9604
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

* commit '7b9cb7b3':
  avprobe: Export coded_{width,height} in -show_streams

Conflicts:
	avprobe.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

This ensures that all current and future code-pathes get bpp checked
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'ae5e1f3d':
  tiff: Check that there is no aliasing in pixel format selection

See: e1c0cfaaMerged-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: James Almer <jamrial@gmail.com>

Signed-off-by: Reynaldo H. Verdejo Pinochet <reynaldo@osg.samsung.com>

Signed-off-by: Reynaldo H. Verdejo Pinochet <reynaldo@osg.samsung.com>

Signed-off-by: Reynaldo H. Verdejo Pinochet <reynaldo@osg.samsung.com>

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

This fixes depending on implementation defined behavior
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

This fixes depending on implementation defined behavior
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

This fixes depending on implementation defined behavior

Regression test for the bug from trac ticket #4359 fixed in commit efff3854Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: James Almer <jamrial@gmail.com>

* commit '6448f15a':
  mxfdec: Fix the error handling for when strftime fails
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '5f5b78ac':
  xcbgrab: Free the host string after checking the connection

Conflicts:
	libavdevice/xcbgrab.c

No change as the bug was not in FFmpeg
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '0025f740':
  vorbis: Check the vlc value in setup_classifs

Conflicts:
	libavcodec/vorbisdec.c

See: ae038c09
See: 709cae2bMerged-by: Michael Niedermayer <michaelni@gmx.at>

Fixes possible issues with unexpected bpp/bppcount values.

CC: libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Bug-Id: CVE-2014-8544
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

* commit '62de77ff':
  vorbis: Use a local codebook variable
Merged-by: Michael Niedermayer <michaelni@gmx.at>

The str variable is a char ** here.
Signed-off-by: Martin Storsjö <martin@martin.st>

Reviewed-by: Timothy Gu <timothygu99@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Prevent an use after free in the error message.

Bug-Id: CID 1274040
CC: libav-stable@libav.org

The valid returned values are always at most 11bit.
Remove the previous check that assumed larger values plausible and
use a signed integer to check get_vlc2 return values.

CC: libav-stable@libav.org

Makes the code a little simpler.

This prevents a memcpy if segmentation.update_map == false.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Suggested-by: Nicolas George
Signed-off-by: Paul B Mahol <onemda@gmail.com>

* commit '0f9f7969':
  rmdec: Improve message for demux error

See: 3880b454Merged-by: Michael Niedermayer <michaelni@gmx.at>

Use correct context, reduce log level, don't assume it is a video stream,
and print the tag of the unknown stream.
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>

Test results:

before:
  fate-suite/vc1/SA10091.vc1: 1062 decicycles in ff_vc1_mc_4mv_chroma's get mv, 4089 runs, 7 skips
  fate-suite/vc1/SA10143.vc1: 1112 decicycles in ff_vc1_mc_4mv_luma's get mv, 4096 runs, 0 skips
  fate-suite/vc1/SA20021.vc1: 991 decicycles in ff_vc1_mc_4mv_chroma get mv, 8192 runs, 0 skips

after:
  fate-suite/vc1/SA10091.vc1: 940 decicycles in ff_vc1_mc_4mv_chroma's get mv, 4096 runs, 0 skips
  fate-suite/vc1/SA10143.vc1: 786 decicycles in ff_vc1_mc_4mv_luma's get mv, 4096 runs, 0 skips
  fate-suite/vc1/SA20021.vc1: 876 decicycles in ff_vc1_mc_4mv_chroma get mv, 8189 runs, 3 skips
Signed-off-by: Zeng Zhaoxiu <zhaoxiu.zeng@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

No testcase available
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes Ticket4299
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes out of array access
Fixes: ffmpeg_opus_crash1.ogg

This solution is likely not optimal in terms of error concealment but
its simple and fixes the out of array access.
Found-by: Thomas Lindroth <thomas.lindroth@gmail.com>
Tested-by: Thomas Lindroth <thomas.lindroth@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

This is safer than to assume that all error pathes cleared them and
nothing will use uncleared pointers.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes out of array accesses
Fixes: ffmpeg_mjpeg_crash2.avi
Found-by: Thomas Lindroth <thomas.lindroth@gmail.com>
Tested-by: Thomas Lindroth <thomas.lindroth@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Zeng Zhaoxiu <zhaoxiu.zeng@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>