cdgraphics: switch to bytestream2

Fixes possible invalid memory accesses on corrupted data.

CC:libav-stable@libav.org
Bug-ID: CVE-2013-3674
(cherry picked from commit a1599f3f7ea8478d1f6a95e59e3bc6bc86d5f812)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
cdgraphics: do not return 0 from the decode function

0 means no data consumed, so it can trigger an infinite loop in the
caller.

CC:libav-stable@libav.org
(cherry picked from commit c7d9b473e28238d4a4ef1b7e8b42c1cca256da36)
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Conflicts:
	libavcodec/cdgraphics.c
svq1: do not modify the input packet

The input data must remain constant, make a copy instead. This is in
theory a performance hit, but since I failed to find any samples
using this feature, this should not matter in practice.

Also, check the size of the header, avoiding invalid reads on truncated
data.

CC:libav-stable@libav.org
(cherry picked from commit 7b588bb691644e1b3c168b99accf74248a24e3cf)
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Conflicts:
	libavcodec/svq1dec.c
error_concealment: avoid using the picture if not fully setup

Fixes state becoming inconsistent and a null pointer dereference.

CC: libav-stable@libav.org
Bug-Id: CVE-2013-0860
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Prepare for 0.8.14 Release
Update Changelog for v0.8.14
mpegts: Define the section length with a constant

The specification says the value is expressed in 10 bits including
the 4-byte CRC.

(cherry picked from commit 694b7cd873f8b06af109036eff1ccd741afdd28e)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavformat/mpegtsenc.c
mpegts: Do not try to write a PMT larger than SECTION_SIZE

Prevent out of array write.

Similar to what Michael Niedermayer did to address the same issue.

Bug-Id: CVE-2014-2263
CC: libav-stable@libav.org
(cherry picked from commit addbaf134836aea4e14f73add8c6d753a1373257)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
vp3: Copy all 3 frames for thread updates

Fixes a double release of the current frame on deinit.

Bug-Id: CVE-2011-3934
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Update Changelog for v0.8.14
avcodec: Introduce ff_get_buffer

Validate the image size there as is done in the other release
branches.

Bug-Id: CVE-2011-3935
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
configure: Check for -Werror parameters on clang

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 9eded0fe412e610ee8944681d5c554b723463e96)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
lavf: Fix leftovers from the ff_get_buffer patch

The automated script did not perfectly replace all the instances nor
added internal.h in all the files requiring it.
Prepare for 0.8.15 Release
avcodec: Add more missing #includes for ff_get_buffer()
ffv1dec: check that global parameters do not change in version 0/1

Such changes are neither allowed nor supported

Found-by: ami_stuff
Bug-Id: CVE-2013-7020
CC: libav-stable@libav.org
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit da7d839a0d3ec40423a665dc85e0cfaed3f92eb8)
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Conflicts:
	libavcodec/ffv1dec.c
Merge commit '3aebdffb010df025728d6c2af89642f9634aa806' into release/0.10

* commit '3aebdffb010df025728d6c2af89642f9634aa806':
  cdgraphics: switch to bytestream2

Conflicts:
	libavcodec/cdgraphics.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
Merge commit 'cf6b2a0ad2b06aabf04bec4c7b19e78a560cd904' into release/0.10

* commit 'cf6b2a0ad2b06aabf04bec4c7b19e78a560cd904':
  cdgraphics: do not return 0 from the decode function

Merged-by: Michael Niedermayer <michaelni@gmx.at>
Merge commit '9d5f4f025304ac7c69775179044e6f69f370441a' into release/0.10

* commit '9d5f4f025304ac7c69775179044e6f69f370441a':
  svq1: do not modify the input packet

Merged-by: Michael Niedermayer <michaelni@gmx.at>
avcodec/svq1dec: Fix multiple bugs from "svq1: do not modify the input packet"

Add padding, clear size, use the correct pointer.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4213fc5b9eebec53c7d22b770c3f1ceecca1c113)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>