* commit 'e191aaca':
  alsdec: limit avctx->bits_per_raw_sample to 32

See: 4c2b8867Merged-by: Michael Niedermayer <michaelni@gmx.at>

* commit '8fc8024e':
  aasc: return correct buffer size from aasc_decode_frame

See: 0be54ad2Merged-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

buf_idx + data_unit_size can overflow, causing the '> buf_size' check to
wrongly fail.

This causes a segmentation fault.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

This can happen after an intra-only frame. For reference, see:
https://groups.google.com/a/webmproject.org/forum/#!msg/webm-discuss/zaoTxREZjq8/v5Enht87AhcJSigned-off-by: Michael Niedermayer <michaelni@gmx.at>

This reduces the number of cases where timestamps need to be shifted

Fixes Ticket4487
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

This allows using pts instead of dts for negative TS avoidance
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Found-by: jamrial
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avctx->bits_per_raw_sample is used in get_sbits_long, which only
supports up to 32 bits.

CC: libav-stable@libav.org
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>

CC: libav-stable@libav.org
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Fixes compilation of fftools without libavdevice
Signed-off-by: James Almer <jamrial@gmail.com>

Signed-off-by: James Almer <jamrial@gmail.com>

Fixes Ticket4533
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

If max in clean_index is set to a negative ast->sample_size, the
following loop never ends:
        while (max < 1024)
            max += max;

Thus set ast->sample_size to 0 if it would otherwise be negative.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Reviewed-by: Ronald S. Bultje <rsbultje@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

If bit_rate is negative, it can trigger an av_assert2 in av_rescale_rnd.

Since av_rescale returns int64_t, but st->codec_bit_rate is int, it can
also overflow into a negative value.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

* cehoyos/master:
  lavfi/cropdetect: Fix cropdetect for > 8 bit input.
  lavf/apngenc: Fix png remuxing by using default extension apng.
  lavf/mxfenc: Write correct interlaced flag when muxing dnxhd.
Merged-by: Michael Niedermayer <michaelni@gmx.at>

Reported and early patch version tested by forum user gridtank.
Reviewed-by: Tomas Härdin

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

The later is not correct
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

This fixes a segmentation fault.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

index_scale is set to matroska->time_scale of type uint64_t.

When index_scale is int, the assignment can overflow and e.g. result
in index_scale = 0. This causes a floating point exception due to the
division by index_scale.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

This unifies the rotation extraction code between ffplay and ffmpeg
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Anshul Maheshwari <er.anshul.maheshwari@gmail.com>
Reviewed-by: Clément Bœsch <u@pkh.me>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

AV_PIX_FMT_MONOBLACK has the AV_PIX_FMT_FLAG_BITSTREAM flag, i.e.
linesize can be smaller than width.

Since x_offset is only check against the width, this can lead to
x_offset * bpp >= image_linesize.

In this case ptr could be set to a position outside the image_buf in
png_handle_row, leading to memory corruption and thus crashes.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

During the loop ret can get changed. Since it is not set on all failure
paths, decode_frame_common can return 0 even though an error occurred.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

This check was removed in commit 08aec6f6, but
s->last_picture.f->data[0] is still used in handle_p_frame_apng
unconditionally.

This fixes a segmentation fault.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avcodec/wavpack: Check L/R values before use to avoid harmless integer overflow and undefined behavior in fate
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

benchmark (on intel core2 duo, gcc 4.9.1)
input samples duration 00:03:39.59
command: time -p ffmpeg -f f32le -ac 2 -ar 44100 -i input.pcm \
         -filter_complex showcqt=fullhd=0:gamma=$gamma \
         -f rawvideo -y /dev/null
gamma  previous  modified
  1    48.49 s   45.38 s
  2    49.33 s   48.11 s
  3    80.86 s   59.80 s
  4    80.84 s   51.25 s
  5    80.75 s   61.06 s
  6    80.93 s   61.80 s
  7    80.03 s   61.56 s
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>