matroskadec: Fix read-after-free in matroska_read_seek()

In matroska_read_seek(), |tracks| is assigned at the begining of the
function. However, functions like matroska_parse_cues() could reallocate
the tracks and invalidate |tracks|.

This assigns |tracks| only before using it, so that it will not get
invalidated elsewhere.

Bug-Id: chromium/427266
prores: Evaluate all the quantizers

Prevent an uninitialized data access.

CC: libav-stable@libav.org
Bug-Id: CID 703824 / CID 703825
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
tiff: Check the check_size() return value and forward it

Also use the same type for add_entry and check_size.

Bug-Id: CID 700699
CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Signed-off-by: Vittorio Giovara <vittorio.giovarao@gmail.com>
tiff: set the correct return value when check_size() fails

Only one instance affected and solved as other occurences.
Merge commit '490a3ebf36821b81f73e34ad3f554cb523dd2682'

* commit '490a3ebf36821b81f73e34ad3f554cb523dd2682':
  matroskadec: Fix read-after-free in matroska_read_seek()

See: 33301f001747d7a542073c634cc81da5eff051cf
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Merge commit '4690e01c3aaf495c87127e5dc74aa347197dbc0b'

* commit '4690e01c3aaf495c87127e5dc74aa347197dbc0b':
  prores: Evaluate all the quantizers

Merged-by: Michael Niedermayer <michaelni@gmx.at>
Merge commit '3c27275c1309190f2d6ed69140b67d014215b6c9'

* commit '3c27275c1309190f2d6ed69140b67d014215b6c9':
  tiff: Check the check_size() return value and forward it

Conflicts:
	libavcodec/tiffenc.c

See: d50aa006fb3430bedc3872ba10e028a714499625
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Merge commit '10d4c5e55e5b23e165aa4c7723073ebe2c2e7da0'

* commit '10d4c5e55e5b23e165aa4c7723073ebe2c2e7da0':
  tiff: set the correct return value when check_size() fails

Merged-by: Michael Niedermayer <michaelni@gmx.at>
mov: Fix handling of zero-length metadata values

Since 3cec81f4d4, a zero-length metadata value would try to
allocate 2*0 bytes, where av_malloc() returns NULL.

Always add one to the allocated length, to allow space for
a null terminator in the zero-length case.

Incidentally, this fixes fate-alac on RVCT 4.0, where a compiler
bug seems to mess up the mov muxer to the point that it writes
the wrong sort of metadata. Previously this bug was undetected,
but since 3cec81f4d4 such mov files started returning
AVERROR(ENOMEM) in the mov demuxer.

Signed-off-by: Martin Storsjö <martin@martin.st>
avcodec/tiffenc: Consistently use ADD_ENTRY1()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
ffmpeg: Check for subtitle_out malloc failure

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Merge commit '6f4364aba9d70dc5fd9f1c88b9c03bf9ea893d40'

* commit '6f4364aba9d70dc5fd9f1c88b9c03bf9ea893d40':
  mov: Fix handling of zero-length metadata values

Conflicts:
	libavformat/mov.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
vp9/x86: save one register on 32bit idct32x32.

Fixes build on win32.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
snow_dwt: Don't try and free members of non-existent arrays

If allocation fails earlier on, and the next frame is processed,
the slice buffer could be left in a state where line and data_stack
have already been freed, or are otherwise null pointers.

Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
avformat/hlsenc: fix hls_write_trailer() on hls_start() failure

Close segment I/O context and append segment in hls_write_trailer() only
when segment I/O context is allocated.

Signed-off-by: Christian Suloway <csuloway@globaleagleent.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
lavfi: add colorlevels filter

Signed-off-by: Paul B Mahol <onemda@gmail.com>
avformat/hdsenc: Use av_freep() avoid leaving stale pointers in memory

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avformat/flvdec: Use av_freep() avoid leaving stale pointers in memory

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avformat/hlsenc: Use av_freep() to avoid leaving stale pointers in memory

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avcodec/vmdvideo: Check len before using it in method 3

Fixes out of array access
Fixes: asan_heap-oob_4d23ba_91_cov_3853393937_128.vmd

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>