Signed-off-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes decoding of Ticket952
Tested-by: Nicolas George <nicolas.george@normalesup.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes the hang with Ticket952
Tested-by: Nicolas George <nicolas.george@normalesup.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

* qatar/master: (26 commits)
  avconv: deprecate the -deinterlace option
  doc: Fix the name of the new function
  aacenc: make sure to encode enough frames to cover all input samples.
  aacenc: only use the number of input samples provided by the user.
  wmadec: Verify bitstream size makes sense before calling init_get_bits.
  kmvc: Log into a context at a log level constant.
  mpeg12: Pad framerate tab to 16 entries.
  kgv1dec: Increase offsets array size so it is large enough.
  kmvc: Check palsize.
  nsvdec: Propagate errors
  nsvdec: Be more careful with av_malloc().
  nsvdec: Fix use of uninitialized streams.
  movenc: cosmetics: Get rid of camelCase identifiers
  swscale: more generic check for planar destination formats with alpha
  doc: Document mov/mp4 fragmentation options
  build: Use order-only prerequisites for creating FATE reference file dirs.
  x86 dsputil: provide SSE2/SSSE3 versions of bswap_buf
  rtsp: Remove some unused variables from ff_rtsp_connect().
  avutil: make intfloat api public
  avformat_write_header(): detail error message
  ...

Conflicts:
	doc/APIchanges
	doc/ffmpeg.texi
	doc/muxers.texi
	ffmpeg.c
	libavcodec/kmvc.c
	libavcodec/x86/Makefile
	libavcodec/x86/dsputil_yasm.asm
	libavcodec/x86/pngdsp-init.c
	libavformat/movenc.c
	libavformat/movenc.h
	libavformat/mpegtsenc.c
	libavformat/nsvdec.c
	libavformat/utils.c
	libavutil/avutil.h
	libswscale/swscale.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes a part of ticket #639.

The MP3 demuxer split the data in packets of 1024B which are later split
in MP3 frames by the MPEG audio parser. The last read is "truncated",
but this should not raise any error.

Solution-by: Michael Niedermayer

Its quality is horrible, yadif should always be used instead.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Martin Storsjö <martin@martin.st>

Currently, any samples in the final frame are not decoded because they are
only represented by one frame instead of two. So we encode two final frames to
cover both the analysis delay and the MDCT delay.

Fixes handling of CODEC_CAP_SMALL_LAST_FRAME.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

There are many places where we read an unchecked 4-bit index into it.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

Fixes CVE-2011-3945

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 807a045a)
Signed-off-by: Alex Converse <alex.converse@gmail.com>

Fixes: CVE-2011-3952

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Based on fix by Michael Niedermayer

Related to CVE-2011-3940.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

Check results for av_malloc() and fix an overflow in one call.

Related to CVE-2011-3940.

Based in part on work from Michael Niedermayer.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

Fixes CVE-2011-3940 (Out of bounds read resulting in out of bounds write)

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5c011706)
Signed-off-by: Alex Converse <alex.converse@gmail.com>

Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>

I have no idea what the idea was behind the original code,
but the new code is equivalent to it.
In that loop that places the new node nodes[j] contains
always the data of the new node (since the steps are always
in order: FFSWAP copies node[j] to node[j-1], j is decremented).
Thus nodes[j].no == i and nodes[j].sym == HNODE.
make fate still passes and contains VP6 samples which use
FF_HUFFMAN_FLAG_HNODE_FIRST.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>

Also add spacing around operators on touched lines, and split
one line to match the common style.
Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

Signed-off-by: Martin Storsjö <martin@martin.st>

Reviewed-by: Paul B Mahol

While pshufb allows emulating bswap on XMM registers for SSSE3, more
shuffling is needed for SSE2. Alignment is critical, so specific codepaths
are provided for this case.

For the huffyuv sequence "angels_480-huffyuvcompress.avi":
C (using bswap instruction): ~ 55k cycles
SSE2:                        ~ 40k cycles
SSSE3 using unaligned loads: ~ 35k cycles
SSSE3 using aligned loads:   ~ 30k cycles
Signed-off-by: Diego Biurrun <diego@biurrun.de>

The functions are already av_ prefixed and intfloat header is already provided.
Install libavutil/intfloat.h
Signed-off-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>