h264: disallow constrained intra prediction modes for luma.

Conversion of the luma intra prediction mode to one of the constrained
("alzheimer") ones can happen by crafting special bitstreams, causing
a crash because we'll call a NULL function pointer for 16x16 block intra
prediction, since constrained intra prediction functions are only
implemented for chroma (8x8 blocks).

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 45b7bd7c53b41bc5ff6fc2158831f2b1b1256113)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 248d4e461578ff327a2fd75fd0db4f38c270918a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
rv34: Check for invalid slices offsets

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit fe476e5a9b5a1e56e53f1fa62374778fa00ec1fd)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
mp4: Don't read an empty Decoder Config Descriptor

(cherry picked from commit 1c2e07b8111b24f62b8d1bda62907848e34dfbcb)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
mpegps: Handle buffer exhaustion when reading packets.

(cherry picked from commit 9fba8ebe0acdc28193d37b5e1f4c0d73c589ede2)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
fft: avoid a signed overflow

As a signed integer, 1<<31 overflows, so force it to unsigned.

Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit c2d3f561072132044114588a5f56b8e1974a2af7)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
Fix input buffer size check in adpcm_ea decoder.

Unfortunately the output buffer size check assumes that the
input buffer is never over-consumed, thus this actually
also allowed to write outside the output buffer if "lucky".

Based on:
git.videolan.org/ffmpeg.git
commit 701d0eb185192542c4a17f296e39e37cedf7abc6
(cherry picked from commit ffe92ff9f0c7f390d895de12c8ffef959ced3cd8)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
permit decoding of multichannel ADPCM_EA_XAS

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3a549eb82be709d633a0ba964b037ee2f700e0c9)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
flvdec: Fix invalid pointer deferences when parsing index

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 2b4e49d4281690db67073ba644ad2ffc17767cdf)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
sol: return error if av_get_packet() fails.

This prevents sending a packet with data=NULL size=AVERROR_EOF.
(cherry picked from commit b15a9888a8f8e8cc9784ffd8d5d0307900fb78bb)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
flacdec: fix buffer size checking in get_metadata_size()

Adds an additional check before reading the next block header and avoids a
potential integer overflow when checking the metadata size against the
remaining buffer size.
(cherry picked from commit 4c5e7b27d57dd2be777780e840eef9be63242158)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
avfiltergraph: use meaningful error codes

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 59cef18c24ab21de4e652e130ac25905c1141f62)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
lavf: Avoid using av_malloc(0) in av_dump_format

On OS X, av_malloc(0) returns pointers that cause crashes when
freed.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit e81e5e8ad2bb5746df0c343c396019aca165cf66)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
nellymoser: check output buffer size before decoding

(cherry picked from commit 8b31c086b6065084644b86a63c9171f3094cf6ad)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
mpc7: check output buffer size before decoding

(cherry picked from commit c8b5c4d27409dfdcec80868686b173ba446c998b)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
mpc7: return error if packet is too small.

(cherry picked from commit 8290d1f38b438f1b070de67645c8b4a42014c7ac)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
mpc8: check output buffer size before decoding

(cherry picked from commit 5674d4b0a35a34b75e3533a8580e0b5a0a8895a7)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
sipr: fix the output data size check and only calculate it once.

(cherry picked from commit 1b5a189f06879338088809b3049ea7620f4e7e78)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
qcelpdec: fix the return value of qcelp_decode_frame().

Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
(cherry picked from commit bde25700134b98068e2ad21c1f92955a4b489cdc)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
mpegvideo: fix position of bottom edge.

It was wrong in colorspaces where horizontal and vertical chroma
subsampling are not the same, e.g. 422.
(cherry picked from commit 0884dd5a1b87aff6c8a06e6492dece5cef8f3978)

Conflicts:

	libavcodec/mpegvideo.c

Signed-off-by: Anton Khirnov <anton@khirnov.net>
mpegvideo: set correct offset for edge emulation buffer.

Using the old code, half of it was unused and the other half was too
small for e.g. >8bpp interlaced data, causing random buffer overruns.
(cherry picked from commit 330deb75923675224fb9aed311d3d6ce3ec52420)

Signed-off-by: Anton Khirnov <anton@khirnov.net>