lzo: Handle integer overflow

get_len can overflow for specially crafted payload.

Reported-By: Don A. Baley <donb@securitymouse.com>
CC: libav-stable@libav.org
(cherry picked from commit ccda51b14c0fcae2fad73a24872dce75a7964996)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Check if an mp3 header is using a reserved sample rate.

Fixes an invalid read past the end of avpriv_mpa_freq_tab.
Fixes divide-by-zero due to sample_rate being set to 0.

Bug-Id: 705

CC:libav-stable@libav.org
(cherry picked from commit 44127546b0a81dc9dd6190739a62d48f0044c6f3)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Check mp3 header before calling avpriv_mpegaudio_decode_header().

As indicated in the function documentation, the header MUST be
checked prior to calling it because no consistency check is done
there.

CC:libav-stable@libav.org
(cherry picked from commit f2f2e7627f0c878d13275af5d166ec5932665e28)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
jpeg2000: fix dereferencing invalid pointers during cleanup

CC: libav-stable@libav.org
Found-by: Laurent Butti <laurentb@gmail.com>
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
avpacket: fix copying side data in av_packet_copy_props()

Side data count is incremented by by calling av_packet_new_side_data()
in the following loop, setting it explicitly results in the resulting
value being twice what it should be.

CC: libav-stable@libav.org
(cherry picked from commit cdf58f0599c39852ee3beafe5f64af7d57d4215b)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
oggenc: Set the right AVOption size for the pref_duration option

On big endian machines, the default value set via the faulty
AVOption ended up as 2^32 times too big.

This fixes the fate-lavf-ogg test which currently is broken on
big endian machines, broken since 3831362. Since that commit,
a final zero-sized packet is written to the ogg muxer in that test,
which caused different flushing behaviour on little and big endian
depending on whether the pref_duration option was handled as it
should or not.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 103243ca649cc305129ed0352bf4d97e5ddf4d80)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
adpcm: Avoid reading out of bounds in the IMA QT trellis encoder

This was broken in 095be4fb - samples+ch (for the previous
non-planar case) equals &samples_p[ch][0]. The confusion
probably stemmed from the IMA WAV case where it originally
was &samples[avctx->channels + ch], which was correctly
changed into &samples_p[ch][1].

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 3d79d0c93e5b37a35b1b22d6c18699c233aad1ba)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
adpcm: Write the proper predictor in trellis mode in IMA QT

The actual predictor value, set by the trellis code, never
was written back into the variable that was written into
the block header. This was accidentally removed in b304244b.

This significantly improves the audio quality of the trellis
case, which was plain broken since b304244b.

Encoding IMA QT with trellis still actually gives a slightly
worse quality than without trellis, since the trellis encoder
doesn't use the exact same way of rounding as in
adpcm_ima_qt_compress_sample and adpcm_ima_qt_expand_nibble.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 0776e0ef6ba4160281ef3fabea43e670f3792b4a)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Update Changelog for v10.2
Prepare for 10.2 Release
af_compand: make sure request_frame always outputs at least one frame

This fixes a segmentation fault because request_frame in fifo.c assumes
that the call to ff_request_frame will populate fifo->root.next.
Before, it was possible for request_frame in af_compand to not do this,
resulting in a null pointer access. Now, request_frame in af_compand
always will return at least one frame or an error, as per the API
specifications in avfilter.h for request_frame.

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit d3cfd7aff86ee3d449ca68aba21d67b9b2136a9b)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Merge commit '6d899d0206e91a3a74680b47ec06ef1dbc151c21' into release/2.2

* commit '6d899d0206e91a3a74680b47ec06ef1dbc151c21':
  lzo: Handle integer overflow

Conflicts:
	libavutil/lzo.c

This is basically not merging changes due to this being fixed differently
in FFmpeg

See: d6af26c55c1ea30f85a7d9edbc373f53be1743ee
See: cf2b7c01f81c1fb3283a1390c0ca9a2f81f4f4a8

Merged-by: Michael Niedermayer <michaelni@gmx.at>
Merge commit 'fcbcc561e0fdc95a7dd48b92db53846726aec27e' into release/2.2

* commit 'fcbcc561e0fdc95a7dd48b92db53846726aec27e':
  Check if an mp3 header is using a reserved sample rate.

Merged-by: Michael Niedermayer <michaelni@gmx.at>
Merge commit '46c477c2a14b04a63ab11d31003b48fab6146a96' into release/2.2

* commit '46c477c2a14b04a63ab11d31003b48fab6146a96':
  Check mp3 header before calling avpriv_mpegaudio_decode_header().

Conflicts:
	libavformat/mp3enc.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
Merge commit '74f6df745a05d3d8b3dcfc28992c69a70ae87957' into release/2.2

* commit '74f6df745a05d3d8b3dcfc28992c69a70ae87957':
  jpeg2000: fix dereferencing invalid pointers during cleanup

Conflicts:
	libavcodec/jpeg2000.c

See: 09927f3eaa93e31dd90ab8ee66dc1ad867b3365f
See: 912ce9dd2080c5837285a471d750fa311e09b555
See: 9e477a37703318cb86d8ed1d426929235aa02b67
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Merge commit '4ec1acc6e4f4d0bd28617bbb30ebfb779ce7df92' into release/2.2

* commit '4ec1acc6e4f4d0bd28617bbb30ebfb779ce7df92':
  avpacket: fix copying side data in av_packet_copy_props()

Merged-by: Michael Niedermayer <michaelni@gmx.at>
Merge commit '16f7cbef5610a878317596134607d2a89da66ecf' into release/2.2

* commit '16f7cbef5610a878317596134607d2a89da66ecf':
  oggenc: Set the right AVOption size for the pref_duration option

See: 536baf6cc5d1db789c9f903776dccb7a41b62a6e
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Merge commit '771564945aa9aebe2f30192b925fcf4909225eca' into release/2.2

* commit '771564945aa9aebe2f30192b925fcf4909225eca':
  adpcm: Avoid reading out of bounds in the IMA QT trellis encoder

See: a32765c4252eb106a2ade543026ef6f59e699bfa
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Merge commit '564c023eba807b162527b17af40424de275fc795' into release/2.2

* commit '564c023eba807b162527b17af40424de275fc795':
  adpcm: Write the proper predictor in trellis mode in IMA QT

See: fa8f060b75bf9074792a0f9ff4ed002652ef62b8
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Merge commit '40dd29653ab85812d21fa64e9a665ceb316701ad' into release/2.2

* commit '40dd29653ab85812d21fa64e9a665ceb316701ad':
  Prepare for 10.2 Release
  Update Changelog for v10.2

Conflicts:
	Changelog
	RELEASE

Not merged as these dont align with our releases

Merged-by: Michael Niedermayer <michaelni@gmx.at>