Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>

Based on observations made by Jakub Stachowski <qbast@go2.pl>
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>

assert is a no-op if DEBUG isn't defined.
Signed-off-by: Martin Storsjö <martin@martin.st>

RTCP is handled elsewhere, not in the depacketizer for an
individual format.
Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Martin Storsjö <martin@martin.st>

This makes sure the length is checked for STAP-A type packets.
Signed-off-by: Martin Storsjö <martin@martin.st>

This fixes crashes if given too short data packets.
Signed-off-by: Martin Storsjö <martin@martin.st>

Wrong bit depth can lead to invalid rowsize values, which crashes the
decoder further down.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

CC: libav-stable@libav.org

Also merge POWER3 and POWER4 configuration together with the additions.
Signed-off-by: Mans Rullgard <mans@mansr.com>

Commit adebad07 "arm: intreadwrite: fix inline asm constraints for gcc
4.6 and later" caused some older gcc versions to miscompile code.
This reverts to the old version of the code for these compilers.
Signed-off-by: Mans Rullgard <mans@mansr.com>

The decoder assumes in various places that the image size
is a multiple of the block size, and there is no obvious
way to support odd sizes.  Bailing out early if the header
specifies a bad size avoids various errors later on.

Fixes CVE-2012-0947.
Signed-off-by: Mans Rullgard <mans@mansr.com>

This avoids returning duplicate timestamps for multiple packets when the
demuxer does not provide all timestamps and packet duration is not known.

This modifies pts in situations other than what was intended, leading to
invalid timestamps.

Reverts commit 90bb394d

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>

Prevents illegal reads on truncated and malformed input.

CC: libav-stable@libav.org

Progressive data is allocated later in decode_sof(), not allocating
that data leads to NULL dereferences.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

Prevents crashes because the old check was incomplete.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Fixes crashes in codepaths not covered by original checks.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

This prevents sample_rate/data_length from going negative, which
caused various crashes and undefined behaviour further down.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

It was to signal that allocations are 16-byte aligned, but AVX requires
32-byte alignment, thus the check is no longer useful (and causes
crashes).

This properly synchronizes frame size changes between threads if
subsequent threads abort decoding before frame size is initialized, i.e.
it prevents the thread after that from ping-ponging back to the original
value.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

Fixes a compile error with clang at -O0.

Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>

Starting with version 4.7, gcc properly supports unaligned
memory accesses on ARM.  Not using the inline asm with these
compilers results in better code.
Signed-off-by: Mans Rullgard <mans@mansr.com>

With a dereferenced type-cast pointer as memory operand, gcc 4.6
and later will sometimes copy the data to a temporary location,
the address of which is used as the operand value, if it thinks
the target address might be misaligned.  Using a pointer to a
packed struct type instead does the right thing.

The 16-bit case is special since the ldrh instruction addressing
modes are limited compared to ldr.  The "Uq" constraint produces a
memory reference suitable for an ldrsb instruction, which supports
the same addressing modes as ldrh.  However, the restrictions appear
to apply only when the operand addresses a single byte.  The memory
reference must thus be split into two operands each targeting one
byte.  Finally, the "Uq" constraint is only available in ARM mode.
The Thumb-2 ldrh instruction supports most addressing modes so the
normal "m" constraint can be used there.
Signed-off-by: Mans Rullgard <mans@mansr.com>

The index of the motion vector has to be checked before being
multiplied by 2 for the array index.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>

ModeTab.fmode has only 3 elements, so indexing it with ftype
in the initialier for 'size' is invalid when ftype == FT_PPC.

This fixes crashes with gcc 4.8.
Signed-off-by: Mans Rullgard <mans@mansr.com>

SDL only supports s16 sample format and a limited number of channel layouts.
Some versions of SDL on some systems support 4-channel and 6-channel output,
but it's safer overall to downmix any layout with more than 2 channels to
stereo.

Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>