rv34: fix invalid memory access for small video dimensions

For small video dimensions calculations of the upper bound for pixel
access may result in negative value. Using an unsigned comparison
works only if the greater operand is non-negative. This is fixed by
doing edge emulation explicitly for such conditions.

Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>
(cherry picked from commit aacf6b3a2fd8bc8603e3deaa6e612ea03cf08707)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
vc1dec: fix invalid memory access for small video dimensions

For small video dimensions, these calculations of the upper bound
for pixel access may have a negative result. Using an unsigned
comparison to bound a potentially negative value only works if
the greater operand is non-negative. Fixed by doing edge emulation
when the upper bound is probably negative, everywhere that this
pattern appears.

Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>
(cherry picked from commit d209c27b09234cc40bbdbd680aa502b493edf595)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Update for 0.9.1

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fix compilation with yasm-0.6.2.
indeo4: fix LE reader define for backport

Fixes Ticket920

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
mxfdec: Only parse next partition pack if parsing forward

This fixes ticket #1099.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 393b81f0934866bd7fff0a2b113623dd9ee6808f)
smacker audio: sign-extend the initial 16-bit predicted value

Fixes Bug #265

Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
(cherry picked from commit 12cbbbb4abda2de0ea123282ccf7ebee61517f7d)
h264: fix seeking in low delay streams without IDR

Fixes Ticket1165

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3360b8517a1f478c4102072e5eadd8ba78be0538)
lavfi/fade: fix black level for non studio-level pixel formats

Fix trac ticket #1139, regression introduced in 8c1fb50d077d5f954.
(cherry picked from commit 95ce0ddcfe99182365e0e57f5f41d7f1a01c57eb)
Replace SSE2 instruction in scalarproduct_float_sse() by SSE equivalent.

Fixes an AAC decoding issue with the sample from ticket #213 on machines
with SSE but without SSE2.
Based on 89411a by Reimar.

(cherry picked from commit f6b78638086beae9bcab672d4c9de1790be5a928)
srtdec: fix a format string vulnerability.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit aaa1173de775b9b865a714abcc270816d2f59dff)
qpeg: Fix out of array writes.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
sonic: update to new API

Fixes Ticket1075

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6f9803e5e02c557e1003cface9f3084a7e1e43e4)

Conflicts:

	libavcodec/sonic.c

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
vqavideodev: Check image dimensions

Fixes out of heap array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3583c8706df0abbfa3ecdd6730f4f3d72a01fe6d)
Independently-Found-by: Fabian Yamaguchi
Fixes: CVE-2012-0947

Conflicts:

	libavcodec/vqavideo.c