matroskaenc: add codec_tag lists back.

This reverts 312645e :
"Do not set codec_tag property for matroska muxers."

Also adds dummy codec_tag lists with codecs
supported in mkv but not in wav / avi.

Fixes ticket #2169.
(cherry picked from commit df39c3ce385c02cbd8046298578ea7454c0a0f81)
wtvdec: demux thumbnail picture to AVStream.attached_pic

Fixes ticket #2133.

(cherry picked from commit 508836932fcbc3c109fcc4df7a2f2b0bf21bbece)
doc/muxers.texi: Fix mp3 picture attachment documentation.
(cherry picked from commit 99eedfc40086972987aa27df8b1259c8bf15b20c)
Do not change codec in flv streams if the user has forced a codec.

Fixes ticket #2218.
(cherry picked from commit 6a50e8a190bc1329fd3e76e8497bb7f870b6e69b)
movtextenc: fix pointer messup and out of array accesses

Fixes Ticket2213

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b0635e2fcf80717dd618ef75d3317d62ed85c300)
dvenc: dont fail hard if the timecode is invalid

Instead just dont store the timecode
Fixes Ticket2187

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f0eacbc760c8b27c2064cea5395e32971853c73c)
ffmpeg: dont allow -flags to override -pass

Fixes Ticket2154

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ccf9dd00da055e94117b56cead4af80ff331b00e)
lavf/mov: skip version and flags attributes in mov_read_chan function

Fixes ticket #1764.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 59d40fc7e66e6ebb2d89e25115492bfe13b07d95)
sanm: check image dimensions before using them

Avoids integer overflows and out of array accesses.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 49b729d3af8464de431362e6c5b3027102bc2f88)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
rtpenc: fix overflow checking in avc_mp4_find_startcode()

The check `start + res < start' is broken since pointer overflow is
undefined behavior in C.  Many compilers such as gcc/clang optimize
away this check.

Use `res > end - start' instead.  Also change `res' to unsigned int
to avoid signed left-shift overflow.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2f014567cfd63e58156f60666f1a61ba147276ab)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
rtmp: fix multiple broken overflow checks

Sanity checks like `data + size >= data_end || data + size < data' are
broken, because `data + size < data' assumes pointer overflow, which is
undefined behavior in C.  Many compilers such as gcc/clang optimize such
checks away.

Use `size < 0 || size >= data_end - data' instead.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 902cfe2f74d777a7dc20ac68f2393b9f84b790c1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
rtmp: fix buffer overflows in ff_amf_tag_contents()

A negative `size' will bypass FFMIN().  In the subsequent memcpy() call,
`size' will be considered as a large positive value, leading to a buffer
overflow.

Change the type of `size' to unsigned int to avoid buffer overflow, and
simplify overflow checks accordingly.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4e692374f7962ea358c329de38c380103f8991b6)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
huffyuvdec: Check init_vlc() return codes.

Prevents out of array writes

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f67a0d115254461649470452058fa3c28c0df294)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
huffyuvdec: Skip len==0 cases

Fixes vlc decoding for hypothetical files that would contain such cases.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0dfc01c2bbf4b71bb56201bc4a393321e15d1b31)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
adpcm: fix off by 1 error and out of array access in DK4

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f18c873ab5ee3c78d00fdcc2582b39c133faecb4)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
alsdec: check block length

Fix writing over the end

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0ceca269b66ec12a23bf0907bd2c220513cdbf16)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
atrac3dec: Check coding mode against channels.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 13451f5520ce6b0afde861b2285dda659f8d4fb4)

Conflicts:

	libavcodec/atrac3.c
error_concealment: Check that the picture is not in a half setup state.

Fixes state becoming inconsistent
Fixes a null pointer dereference

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 23318a57358358e7a4dc551e830e4503f0638cfe)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avcodec_decode_audio: do not trust the channel layout, use the channel count.

Fixes memory corruption

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d270c3202539e8364c46410e15f7570800e33343)

Conflicts:

	libavcodec/utils.c
sanm: Check decoded_size.

This prevents a buffer overflow in rle_decode()

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7357ca900efcf829de4cce4cec6ddc286526d417)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>