avcodec/hevc_ps: check that VPS referenced from SPS exists

This matches how its done for SPS/PPS.
An alternative to this is to check it when its used.

Fixes null pointer dereference
Fixes: signal_sigsegv_e30a43_1437_CIP_A_Panasonic_3.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d66bab0a69ac1860e78dd951ad8db1a507e75642)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avcodec/hevc: Fix modulo operations

Fixes qp fields becoming out of range
Fixes: asan_static-oob_e393a3_6998_WPP_A_ericsson_MAIN10_2.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4ced5d7780fea2ea49444d6686d26f26b3a2160f)

Conflicts:

	libavcodec/hevc_filter.c
Revert "Merge remote-tracking branch 'qatar/master'" (43dec5ef9a360c9ffac3278f464832bd99af0cb0)

Fixes out of array accesses
Fixes asan_static-oob_eb9812_5961_iv41.avi
This reverts the merge of c9ef6b09326a24010bf86d6b0d19cfa42df4d546

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit c3d5cd1ebfba8fe36a0da7fad47df7fdf9c4ccd0)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avcodec/ac3dec: check bap before use.

Fixes out of array read
Fixes assertion failure
Fixes asan_static-oob_16431c0_8036_rio_bravo_mono_64_spx.ac3

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4782c4284fa3856a9b6910fe5ff6e4fb1c65b58c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avcodec/g2meet: check available space before copying palette

Fixes out of array read
Fixes: asan_heap-uaf_ae6067_5415_g2m4.wmv

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6d9dad6a7cb5d544d540abf941fedbd34c14d2bd)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avutil/log: check that len is within the buffer before reading it

Fixes out of array read
Fixes: asan_heap-oob_19d6979_6857_mmw_deadzy.ogg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 808c10e728db2d92ccbb0f8b3bcd4a2f4305a2cf)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avcodec/hevc: clear HEVClc when its deallocated in hevc_decode_free()

Fixes reading freed memory
Fixes: asan_heap-uaf_1abf8ef_3987_NUT_A_ericsson_4.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 21a2fb7e0579703fdea96f659498ef8b1f243289)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avformat/avidec: Dont assert the existence of an index for video streams.

Its possible in various rare cases that an index cannot be created or allocated.
Fixes assertion failure
Fixes: signal_sigabrt_7ffff7126425_7712_pokem.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7865759409b27089b444bc029b2b76b06161b2cf)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avcodec/mjpegdec: check len in mjpeg_decode_app() more completely

Avoids len from becoming negative and causing assertion failure

Fixes: signal_sigabrt_7ffff7126425_5140_fd44dc63fa7bdd12ee34fc602231ef02.jpg

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6060234d43dcf0b5200cdd7dbd2f1542146827eb)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avformat/ipmovie: check OPCODE_INIT_VIDEO_BUFFERS size more completely

Fixes use of uninitialized data

Fixes: signal_sigsegv_1571228_5930_ipmovie_interplayvideo_interplay_dpcm__bislogo.mve

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2e97e244097c309571b383dd107252404ebb3326)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avformat/mov: Check that we have a stream before accessing it in mov_read_ares()

Fixes out of array read
Fixes: signal_sigsegv_6f1855_3910_avid_test_alpha.mov

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a7f27453f64d9020b92b01687baeb5909c6cdad0)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>