avformat/vobsub: fix NULL dereference

(cherry picked from commit d86cf4a91de2aa9e167a73b56fb59962230e3a32)
wavpack: report if there is no bits left

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 11a39bdf534a4ead634b4a593c66ebf756910b9b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
wavpackenc: proper buffer allocation

The allocation didn't account for headers, that can be easily 79 bytes.
As a result, buffers allocated for a few samples (e.g. 5 in the original
bug) could be undersized.

Fixed ticket #2881.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2ba58bec20b0039ccc40cfba59af6d56de16e8b1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avcodec: fix aac/ac3 parser bitstream buffer size

Buffers containing copies of the AAC and AC3 header bits were not padded
before parsing, violating init_get_bits() buffer padding requirement,
leading to potential buffer read overflows.
This change adds FF_INPUT_BUFFER_PADDING_SIZE bytes to the bit buffer
for parsing the header in each of aac_parser.c and ac3_parser.c.

Based on patch by: Matt Wolenetz <wolenetz@chromium.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fccd85b9f30525f88692f53134eba41f1f2d90db)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avcodec/utils: add GBRP16 to avcodec_align_dimensions2()

Fixes Ticket3869

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3fe9e7be4c70c8fccdcd56fd19276e668cfb7de8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avcodec/vc1dec: fix null pointer dereference

Fixes Ticket3860

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 30f680ee0a2707af9a649a0aa3fd951d18a25c05)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
ffmpeg: Fix missing {} in Stream to Packet side data code

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 31f9c228c042e7f0a017670e7eb18d9b27a71a10)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avcodec/snow: check coeffs for validity

Fixes deadlock
Fixes integer overflow
Fixes Ticket 3892

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 596636a474ab201badaae269f3a2cef4824b8c1f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
oggdec: fix invalid free on error

The read_packet callback passes a pointer to a stack-allocated AVPacket.
Attempting to free it with av_free() makes no sense.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b173f5c15572cc82f68128599722e689df4ff137)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avcodec/mjpegdec: fix green vertical line at the right with upscale h

Fixes Ticket3891

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 63a52ca134dc4ee648a547c7c410d547f371b481)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avcodec/mjpegdec: fix green line at the bottom with upscale v

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f0d4f00f24d41441ebd63694df57ab203a764aa5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
doc/filters.texi: fix filter name in examples

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1b3a98f137900b6c3eb9a4c177d0b25684d6d144)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
segment: don't access outside seg->frames array

Fixes wrong number of segments output and undefined memory access.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 58e0402e02ae5e466c33b9465c1465fdee68d342)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avformat/swfdec: Use side data to communicate w/h changes to the decoder

Fixes reading from freed data
Fixes part of Ticket3539

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1c55d0ff3202a04ebc67a72d72391104e9bdb633)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avformat/swfdec: Do not change the pixel format

This is currently not supported
Fixes part of Ticket 3539

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c2430304dfb3cc0e3a59ce6d1b59ebdcc934a0c2)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avcodec/h264: Allow partial escaping

Fixes Ticket3923

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 033a5334badd8af48f13c6fd1e6827f8e3f2c2f3)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avcodec/mpegvideo: Use "goto fail" for all error paths in ff_mpv_common_frame_size_change()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2762323c37511fbbc98b164c07620b9ebc59ec68)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avcodec/mpegvideo: check that the context is initialized in ff_mpv_common_frame_size_change()

The function otherwise would initialize the context without setting context_initialized
alternatively we could set context_initialized

Fixes valgrind anomalies related to ticket 3928

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0d0f7f0ba43f64312ae4a05d97afecf1b7b1330c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avcodec/mpegvideo: Set err on failure in ff_mpv_common_frame_size_change()

Found-by: ubitux
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cfce6f7efd28130bf0dd409b2367ca0f8c9b2417)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avformat/m4vdec: Check for non startcode 00 00 00 sequences in probe

Fixes miss detection of PCM as m4v
Fixes Ticket 3928

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7c1835c52a4be2e4e996f83c91a8d5a147b01100)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>