Merge remote-tracking branch 'qatar/master'

* qatar/master:
  movenc: Simplify code by using avio_wb24
  bfin: unbreak compilation

Merged-by: Michael Niedermayer <michaelni@gmx.at>
mpegvideo_enc: factor expression out

Fixes "warning: dc[0..5] may be used uninitialized in this function"

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
msrledec: move output pointer test up

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
msrledec: move loop into switch

speeds up code and allows more simplifications

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
msrledec: merge switches

More speedup and fixes 'may be used uninitialized in this function' warnings

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avstring: fix "warning: return discards const qualifier from pointer target type"

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
mss3: prevent AC state from becoming invalid in rac_normalise()

Fixes division by zero

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
dnxhddec: fix integer overflow / index check

Fixes out of array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
oggparsevorbis: use av_realloc consistently

Memory passed to av_realloc cannot be allocated using memalign.

From realloc(3):

The realloc() function changes the size of the memory block pointed to
by ptr to size bytes. (...) Unless ptr is NULL, it must have been returned
by an earlier call to malloc(), calloc() or realloc().

The issue has been found by debugallocation, a part of google-perftools:
http://code.google.com/p/gperftools/ .

Signed-off-by: Paweł Hajdan, Jr <phajdan@google.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
fixup_vorbis_headers: add missing malloc failure check

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
wma: check byte_offset_bits

Fixes assertion failure

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
auenc: remove put_au_header() and merge its code into au_write_header

Such level of abstraction is pointless.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
auenc: strict check for supported codec

Also check number of streams and give error message why muxing failed.
This prevents muxing unsupported codec with known and supported tag.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
flashsv: clear blocks array on reallocation

Fixes use of uninitialized data

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
loco: fix rgba on big-endian

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
interplayvideo: Free previous frames on resolution changes.

Fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
mips: optimization for float aac decoder (core module)

Signed-off-by: Mirjana Vulin <mvulin@mips.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
asfdec: fix integer overflow in packet_replic_size check

Fixes assertion failure

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
h264/cabac: check loop index

fix out of array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
mpegvideo: Do REBASE_PICTURE with byte pointers

REBASE_PICTURE (more specifically, this half of it) takes a Picture
pointer that points into one larger struct, finds the offset of
that Picture within the struct and finds the corresponding field
within another instance of a similar struct.

The pointer difference "pic - (Picture*)old_ctx" is a value given
in sizeof(Picture) units, and when applied back on
(Picture*)new_ctx gets multiplied back with sizeof(Picture). Many
compilers seem to optimize out this division/multiplication, but
not all do.

GCC 4.2 on OS X doesn't seem to remove the division/multiplication,
therefore the new pointer didn't turn out to point to exactly
the right place in the new struct since it only had sizeof(Picture)
granularity (and the Picture is not aligned on a sizeof(Picture)
boundary within the encompassing struct). This bug has been present
before 47318953d as well - with H264, pointers to h->ref_list[0][0]
pointed to 88 bytes before h->ref_list[0][0] after the rebase. After
shrinking Picture, the difference ended up even larger, making
writes via such a Picture pointer overwrite other fields at random
in H264Context, ending up in crashes later.

This fixes H264 multithreaded decoding on OS X with GCC 4.2.

Signed-off-by: Martin Storsjö <martin@martin.st>