* commit 'ff07ec14':
  pcx: Return an error on broken palette if err_detect is set to 'explode'

Conflicts:
	libavcodec/pcx.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'd1d99e3b':
  pcx: Check the packet size before assuming it fits a palette
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '7ba0cedb':
  rpza: Fix a buffer size check
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'aa0dd524':
  xxan: Disallow odd width

See: 77693c54
See: 8ad9b48cMerged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'fc739b3e':
  xan: Only read within the data that actually was initialized

Conflicts:
	libavcodec/xan.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '30db94dc':
  xan: Use bytestream2 to limit reading to within the buffer

Conflicts:
	libavcodec/xan.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '9fb0de86':
  pcx: Consume the whole packet if giving up due to missing palette

Conflicts:
	libavcodec/pcx.c

See: b4e516e3Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'a81cad8f':
  pngdec: Stop trying to decode once inflate returns Z_STREAM_END

Conflicts:
	libavcodec/pngdec.c

See: 65bf9a44Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'c2319876':
  mov: Make sure the read sample count is nonnegative

Conflicts:
	libavformat/mov.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '640a2427':
  bfi: Add some very basic sanity checks for input packet sizes
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '9fc7184d':
  bfi: Avoid divisions by zero

See: 99a8552dMerged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'a9221e39':
  electronicarts: Add more sanity checking for the number of channels

Note: This check is probably unnecessary
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'd07aa3f0':
  riffdec: Add sanity checks for the sample rate
Merged-by: Michael Niedermayer <michaelni@gmx.at>

CSS should take care of this.

Link is dead.

* commit '28ff439e':
  mvi: Add sanity checking for the audio frame size

Conflicts:
	libavformat/mvi.c

See: ea1d8465Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '59480abc':
  alac: Do bounds checking of lpc_order read from the bitstream

See: fd4f4923Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit 'adc09136':
  xwma: Avoid division by zero

Conflicts:
	libavformat/xwma.c

See: a3cb7f99Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '8d07258b':
  avidec: Make sure a packet is large enough before reading its data

Conflicts:
	libavformat/avidec.c

See: 028cc42a
Note: data!=NULL implies that the allocated array is at least FF_INPUT_BUFFER_PADDING_SIZE large
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '68ff9981':
  vqf: Make sure the bitrate is in the valid range
Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '9277050e':
  vqf: Make sure sample_rate is set to a valid value

See: e481ba2eMerged-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Output plane height used horizontal instead of vertical subsampling.
This is just cosmetic change as filter does not support formats where
vertical subsampling does not match horizontal one.
Signed-off-by: Paul B Mahol <onemda@gmail.com>

Signed-off-by: Martin Storsjö <martin@martin.st>

This fixes reads out of bounds.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

We read 2 bytes for 15 out of 16 pixels, therefore we need to
have at least 30 bytes, not 16.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

Decoded data is always written in pairs within this decoder.
This fixes writes out of bounds.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

Previously, we returned 0, meaning successful decoding but 0
bytes consumed, leading to an infinite loop.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

If the input buffer contains more data after the deflate stream,
the loop previously left running infinitely, with inflate returning
Z_STREAM_END.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

This avoids setting a negative number of frames, ending up with a
negative average frame rate.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

If a zero-length video packet is to be returned, just return
AVERROR(EAGAIN) and switch back to the audio stream.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

This avoids a division by zero for G726.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

This avoids a division by zero.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>