ac3dec: validate channel output mode against channel count

Damaged frames can lead to a mismatch, which can cause a segfault
due to using an incorrect channel mapping.

CC:libav-stable@libav.org
(cherry picked from commit d7c450436fcb9d3ecf59884a574e7684183e753d)

Conflicts:

	libavcodec/ac3dec.c
vorbisdec: Add missing checks

Rate and order must not be 0 even if the specification does not say that
explicitly.
(cherry picked from commit 5b47c19bfda92273ae49e83db26a565afcaed80a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
vorbisdec: Error on bark_map_size equal to 0.

The value is used to calculate output LSP curve and a division by zero
and out of array accesses would occur.

CVE-2013-0894

CC: libav-stable@libav.org

Reported-by: Dale Curtis <dalecurtis@chromium.org>
Found-by: inferno@chromium.org
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 11dcecfcca0eca1a571792c4fa3c21fb2cfddddc)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
vorbisdec: Accept 0 amplitude_bits

The specification does not prevent an encoder to write the amplitude 0
as 0 amplitude_bits.

Our get_bits() implementation might not support a zero sized read
properly, thus the additional branch.
(cherry picked from commit 23bd9ef4b209c789d5473d75f89a2e411d343d80)

Conflicts:

	libavcodec/vorbisdec.c
lavf/avio: check for : in filenames for protocols.

If the first "special" character in a filename is a comma,
it can introduce protocol options, but only if there is a
colon at the end. Otherwise, it is just a filename with a
comma.

Fix trac ticket #2303.
(cherry picked from commit d9fad53f4b447db1e436dcf3fc4a57e604616e6c)
Require at least three frames to autodetect loas.
(cherry picked from commit a60530e3ee1d9532c026a52b03661f88e163d647)
flvdec: Don't read the VP6 header byte when setting codec type based on metadata

This header byte is only present when actually reading a VP6 frame,
not when reading the codec type field in the metadata. This
potential bug has been present since 5b54a90c.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit c91c63b5380bf79655c09320774a022f84d76fd5)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
flvdec: Check the return value of a malloc

The callers of this function can't report errors sanely. If this
one malloc fails, don't write the extradata byte, make sure we
try to malloc it the next time we're called instead, and make sure
we still consume the input data byte.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit c5a738ca4e9789b4678b10240777d931e7dc24c9)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
h264: on reference overflow, reset the reference count to 0, not 1.

Since decode_slice_header() returns before the reference lists are
constructed, there are zero valid references.

CC:libav-stable@libav.org
(cherry picked from commit 668e16a0dd1ff56d4beeff5c658d8a2a08dbfac8)

Conflicts:

	libavcodec/h264.c
h264: set ref_count to 0 for intra slices.

CC:libav-stable@libav.org
(cherry picked from commit 437211ae73ef1ed8285b4fed7620502ea4999e11)

Fixes deadlocks waiting for non-existing references with some fuzzed files.

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
update Changelog
rtmpproto: Check APP_MAX_LENGTH

Fixes Ticket2292

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 02ac3398eb52679301028c2fd3ebad1b6261b4da)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Merge commit '1b0082eabcc98e079d33c61da4d30ded89de68a9' into release/1.1

* commit '1b0082eabcc98e079d33c61da4d30ded89de68a9':
  flvdec: Don't read the VP6 header byte when setting codec type based on metadata
  vorbisdec: Accept 0 amplitude_bits
  vorbisdec: Error on bark_map_size equal to 0.
  vorbisdec: Add missing checks
  ac3dec: validate channel output mode against channel count

Conflicts:
	libavcodec/ac3dec.c
	libavformat/flvdec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
Merge remote-tracking branch 'qatar/release/9' into release/1.1

* qatar/release/9:
  update Changelog
  h264: set ref_count to 0 for intra slices.
  h264: on reference overflow, reset the reference count to 0, not 1.
  flvdec: Check the return value of a malloc

Conflicts:
	Changelog
	libavcodec/h264.c
	libavformat/flvdec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
buildsys: only include log2_tab per library for shared builds

Fix linking failures with -all_load due to multiple log2_tabs

Signed-off-by: Carl Eugen Hoyos <cehoyos@ag.or.at>
(cherry picked from commit 03148fd1743fca98c2f4b5920b796f381e820045)
hls: fix timebase

Fixes Ticket1733

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a12a618aa9c6d84ec3c01695fb5aec9796453a6d)
avformat: Fix apics with aac

Fixes Ticket2318

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cada996528422907b8b818e99029a8e3b97cf08d)
psymodel: dont apply lowpass filters with a cutoff close to the nyquist

The IIR filter numerically diverges in such cases, this could easily be
fixed but would make the filter slower on some platforms

Fixes Ticket2246

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fee5da6b0a79bed9dc849f216b6da1e03132b668)
aacsbr: Check for envelope scalefactors overflowing

This prevents various values from becoming stuck at NAN and
output to become silent
If someone knows a cleaner solution, thats welcome!

Fixes Ticket2335

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8978c743fb1d1f5a0d6dbdd83ff05817f8a41230)
Prepare for 9.4 Release