Fixes infinite loop
Fixes Ticket3086

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cc0e47b5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes Ticket2982

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f31011e9)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

* qatar/release/0.6:
  arm: Don't clobber callee saved registers in scalarproduct

See: a94d12b6
Merged-by: Michael Niedermayer <michaelni@gmx.at>

q4-q7/d8-d15 are supposed to not be clobbered by the callee.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit d307e408)

q4-q7/d8-d15 are supposed to not be clobbered by the callee.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit d307e408)

Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3728603f)

Conflicts:

	libavcodec/ffv1enc.c
(cherry picked from commit c900c6e5c26cd86cf34f9c8d4347cedbd01f3935)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 454a11a1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Might fix Ticket1907 (I have no testcase so i cant test)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4758e32a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes out of array accesses
Fixes Ticket2850

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3819db74)

Conflicts:

	libavcodec/rpza.c
(cherry picked from commit edba432b8b01d68c22e70a508f47553359f59fb5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

These warnings have no false positives and point to serious bugs.
(cherry picked from commit 99853cb8)

Conflicts:

	configure

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes vlc decoding for hypothetical files that would contain such cases.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0dfc01c2)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5ff41ffeb4cb9ea6df49757dc859619dc3d3ab4f)

Conflicts:

	libavcodec/huffyuv.c
(cherry picked from commit 9bc70fe1ae50fd2faa0b9429d47cfbda01a92ebc)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Prevents out of array writes

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f67a0d11)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 95ab8d33e1a680f30a5a9605175112008ab81afc)

Conflicts:

	libavcodec/huffyuv.c
(cherry picked from commit 277def59fce10d91e3113e5c0f63e22bc4abfa88)

Conflicts:

	libavcodec/huffyuv.c
(cherry picked from commit adf022f458d75e2c8041262e1906a249366ad518)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

A negative `size' will bypass FFMIN().  In the subsequent memcpy() call,
`size' will be considered as a large positive value, leading to a buffer
overflow.

Change the type of `size' to unsigned int to avoid buffer overflow, and
simplify overflow checks accordingly.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4e692374)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Sanity checks like `data + size >= data_end || data + size < data' are
broken, because `data + size < data' assumes pointer overflow, which is
undefined behavior in C.  Many compilers such as gcc/clang optimize such
checks away.

Use `size < 0 || size >= data_end - data' instead.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 902cfe2f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

* qatar/release/0.6:
  vorbis: Validate that the floor 1 X values contain no duplicates.
  lavfi: avfilter_merge_formats: handle case where inputs are same
  mpegvideo: Don't use ff_mspel_motion() for vc1
  imgconvert: avoid undefined left shift in avcodec_find_best_pix_fmt
  nuv: check RTjpeg header for validity
  vc1dec: add flush function for WMV9 and VC-1 decoders
  mov: set AVCodecContext.width/height for h264
  h264: allow cropping to AVCodecContext.width/height

Merged-by: Michael Niedermayer <michaelni@gmx.at>

Duplicate values in this vector are explicitly banned by the Vorbis I spec
and cause divide-by-zero crashes later on.
(cherry picked from commit ecf79c4d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 9aaaeba4)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit d6e250ab)

Signed-off-by: Anton Khirnov <anton@khirnov.net>

This fixes a double-free crash if lists are the same due to the two
merge_ref() calls at the end of the (useless) merging that happens.

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 11b6a824)

Conflicts:

	libavfilter/formats.c

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit e5f4e249)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit b6c5848a)

Signed-off-by: Anton Khirnov <anton@khirnov.net>

Using ff_mspel_motion assumes that s (a MpegEncContext
poiinter) really is a Wmv2Context.

This fixes crashes in error resilience on vc1/wmv3 videos.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 18f2d5cb)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit da0c4576)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 899d95ef)

Signed-off-by: Anton Khirnov <anton@khirnov.net>

CC: libav-stable@libav.org
(cherry picked from commit 39bb27bf)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 7a7229b5)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 8812b5f1)

Signed-off-by: Anton Khirnov <anton@khirnov.net>

CC: libav-stable@libav.org
(cherry picked from commit 859a579e)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 6704522c)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit f31170d4)

Signed-off-by: Anton Khirnov <anton@khirnov.net>

CC: libav-stable@libav.org
(cherry picked from commit 4dc8c838)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 02b72394)

Conflicts:
	libavcodec/vc1dec.c

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 0173a796)

Signed-off-by: Anton Khirnov <anton@khirnov.net>

Apparently, some build environments require dxva.h even for dxva2,
while others lack this header entirely.  Including it conditionally
allows building in both cases.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit fa845061)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

This is required for correct cropping of files from Canon
cameras.

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 8aa93e90)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 2fb4be9a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 0054d70f)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Override the frame size from the SPS with AVCodecContext values
if the latter specify a size smaller by less than one macroblock.
This is required for correct cropping of MOV files from Canon cameras.

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 30f51509)

Conflicts:

	libavcodec/h264.c
(cherry picked from commit e1608014)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit b102d5d9)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Fixes ticket1212

Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cc229d4e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes null ptr deref
Fixes Ticket1367

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f23a2418)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes Ticket1365

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit febc013d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b6fdf8de)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fd4c1c0b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes null ptr derefernce
Fixes Ticket1363

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 50122084)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes null ptr deref
Fixes Ticket1361

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 77a4c8b9)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes Ticket1359

Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1e5c7376)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

* qatar/release/0.6:
  Release notes for 0.6.6
  Update changelog for 0.6.6 release

Merged-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>

* qatar/release/0.6: (32 commits)
  Bump version number for 0.6.6 release.
  tqi: Pass errors from the MB decoder
  ea: check chunk_size for validity.
  png: check bit depth for PAL8/Y400A pixel formats.
  dxva2: define required feature selection macros
  mingw32: merge checks for mingw-w64 and mingw32-runtime >= 3.15 into one
  mingw32: properly check if vfw capture is supported by the system headers
  configure: properly check for mingw-w64 through installed headers. mingw-w64 can also target 32-bit code.
  qdm2: clip array indices returned by qdm2_get_vlc().
  kmvc: Check palsize.
  shorten: Use separate pointers for the allocated memory for decoded samples.
  shorten: check for realloc failure
  shorten: Fix out of bound writes in fix_bitshift()
  shorten: Prevent block size from increasing
  shorten: remove VLA and check for buffer overflow
  adpcm: ADPCM Electronic Arts has always two channels
  h264: Add check for invalid chroma_format_idc
  aacsbr: prevent out of bounds memcpy().
  dpcm: ignore extra unpaired bytes in stereo streams.
  vqavideo: return error if image size is not a multiple of block size
  ...

Conflicts:
	libavcodec/atrac3.c
	libavcodec/h264_ps.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

This silences some valgrind warnings.
CC: libav-stable@libav.org

Fixes second half of http://ffmpeg.org/trac/ffmpeg/ticket/794


Bug found by: Oana Stratulat

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit f85334f5)
(cherry picked from commit 90290a51)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 5872580e)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 2f2fd8c6)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>