demux: mp4: fix buffer overflow in parsing of string boxes.

We ensure that pbox->i_size is never smaller than 8 to avoid an
integer underflow in the third argument of the subsequent call to
memcpy. We also make sure no truncation occurs when passing values
derived from the 64 bit integer p_box->i_size to arguments of malloc
and memcpy that may be 32 bit integers on 32 bit platforms.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
stream_out: rtp: fix invalid memory access (write)

When streaming ogg-files via rtp, the ogg-file can trigger an invalid
write access using an overly long 'configuration' string. The original
code attemps to allocate space to hold the string on the stack and
hence, cannot verify if allocation succeeds. Instead, we now allocate
the buffer on the heap and return if allocation fails.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
service_discovery: sap: fix potential invalid write.

A buffer depending on the length of psz_sdp was allocated on the
stack, and therefore, allocation failure would not be
detected. Allocate the buffer on the heap instead and check for
allocation failure to avoid a potential invalid memory access in the
subsequent memcpy operation.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
access: ftp: fix potential invalid write.

A buffer based on the length of the string to be sent via ftp was
allocated on the stack and hence, it could not be verified whether the
allocation succeeded. Allocate the buffer on the heap instead to avoid
a potential invalid write in a subsequent memcpy.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
codec: schroedinger: fix potential buffer overflow.

The variable len is a raw 32 bit value read using GetDWBE. If this
value is larger than UINT32_MAX - sizeof(eos), this will cause an
integer overflow in the subsequent call to malloc, and finally a
buffer overflow when calling memcpy. We fix this by checking len
accordingly.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
codec: dmo: avoid null-pointer dereference.

Check the return value of malloc to avoid a null-pointer dereference.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
RTP: remove trailing spaces