Koreus: improve description parsing (support spoilers) and https
Koreus: fix lua escaping
H.264 packetizer: Drop unused variable

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
libmp4: Move variable declaration to avoid unused variable warning

demux/mp4/libmp4.c:858:12: warning: variable ‘translate’ set but not used [-Wunused-but-set-variable]

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
lib/media player: inherit vbi-page to achieve correct variable value on first use
dsm: don't use netbios struct members directly

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
contrib: fix libdsm and libtasn1 rules

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
contrib: update libdsm to 0.0.3

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
Require libdsm >= 0.0.3

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
dsm/sd: discover in a separate thread

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
misc: update: fix buffer overflow in updater

On 32 bit builds, parsing of update status files with a size of
4294967295 or more lead to an integer truncation in a call to malloc
and a subsequent buffer overflow. This happened prior to checking the
files' signature. The commit fixes this by disallowing overly large
status files (above 65k in practice)

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
stream_out: rtp: don't use VLA for user controlled data

It should fix a possible invalid memory access

When streaming ogg-files via rtp, an ogg-file can trigger an invalid
write access using an overly long 'configuration' string.

The original code attemps to allocate space to hold the string on the stack
and hence, cannot verify if allocation succeeds. Instead, we now allocate the
buffer on the heap and return if allocation fails.

In detail, rtp_packetize_xiph_config allocates a buffer on the stack at (1) where
the size depends on the local variable 'len'. The variable 'len' is
calculated at (0) to be the length of a string contained in a specially
crafted Ogg Vorbis file, and therefore, it is attacker-controlled.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
Contribs: fix zvbi compilation for Android
dsm: refactor

Move browser.c to common.c. This new file contains common dsm browing functions
used by access.c.
dsm: only one function to browse share and directory
dsm: add "smb://" if not present
dsm: use NETBIOS_FILESERVER define
lib: change libvlc_media_discoverer_t creation

libvlc_media_discoverer_new_from_name was creating a services_discovery_t and
was starting it, so libvlc_MediaDiscovererStarted event (or any other events)
could not be received.

To fix that, Split libvlc_media_discoverer_new_from_name into
libvlc_media_discoverer_new and libvlc_media_discoverer_start. That way, we can
attach events between create and start.

libvlc_media_discoverer_new_from_name is now deprecated, but it still works
like before.