The fate reference is updated because the previous test skipped a sample in
each encode() call due each input frame having an odd number of samples.

Found by: Alexander Strasser

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

Decode to the correct output buffer.

Signed-off-by: Martin Storsjö <martin@martin.st>

Also call avcodec_set_dimensions on dimension param change packets.

Signed-off-by: Martin Storsjö <martin@martin.st>

This is in preparation to calling it from avcodec_decode_video2.

Signed-off-by: Martin Storsjö <martin@martin.st>

Fixes null pointer dereferences in fuzzed files found by Oana Stratulat.

Signed-off-by: Janne Grunau <janne-libav@jannau.net>

Bug found by: Oana Stratulat

Signed-off-by: Janne Grunau <janne-libav@jannau.net>

Fixes 2nd half of Ticket889

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixed first half of ticket889

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Prevent invalid reads using bytestream2 functions.
Fixes bug #126.

Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>

Fixes Bug: #190
Chromium Bug: #100543
Related to CVE-2011-3893

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Fixes --disable-everything --enable-decoder=h264 --disable-optimizations.

This fixes some timecode probing in MOV.

The mpeg4 video, H264 and VC-1 parser hold (directly or indirectly)
a MpegEncContext in their private context. Since they do not call the
common mpegvideo init function slice_context_count has explicitly set
to 1.
Prevents a null pointer dereference in the h264 parser and fixes
bug 193.

removed in 98df93c, this makes the documentation correct again.

Found-by:  j@v2v.cc

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Author: Mans Rullgard <mans@mansr.com>
	Date:   Sun Dec 11 21:41:59 2011 +0000

    	x86: cabac: replace explicit memory references with "m" operands

    	This replaces the explicit offset(reg) memory references with
    	"m" operands for the same locations.  As a result, one fewer
    	register operand is needed for these inline asm statements.

This change appears to have broken compilation on darwin, and subsequent
fixes by martin (which did not fix compilation) removed the register
advantage, thus this change seems not a good idea to keep.
See: http://fate.ffmpeg.org/log.cgi?time=20120103122446&log=compile&slot=i386-darwin-llvm-gcc-4.2.1

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes ticket #883

FourCC CYUV can be Creative YUV and uyvy422 rawvideo.

Avoid unsupported pix_fmts by upscaling chroma.

Fixes ticket #878.

Prevents null ptr derefence for negative sizes.

This issue was discovered while decoding the FATE sample vqa/ws_snd.vqa.
For some unknown reason only audio decoding is tested by FATE for that file,
but not video.

Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>

Not all applications (e.g. MPlayer) set block_align, and
when using a different demuxer it might not even be
easily available.
So fall back to selecting mode based on bit rate as before
if block_align has not useful value.
It can't be worse than failing to decode completely.

Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>

Fixes ticket #882.

Fixes ticket #881.

Found-by:  j@v2v.cc
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

4xm decoder while decoding i2 frames can overread the buffer if proper checks
are not made.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

Check explicitly if enough bits are left to prevent an infinite loop
when the bitstream buffer is not followed by zero-padding.

Based on patches by Michael Niedermayer <michaelni@gmx.at>.

Fixes a regression introduced in 8b94df0f20.

This fixes an infinite loop in the decoder on specially
crafted files, and fixes bug 151.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

This reverts commit 295a7c0238. The
patch breaks decoding of regular files (e.g. fate-4xm-2).

4xm decoder while decoding i2 frames can overread the buffer if proper checks
are not made.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

frame_size is the number of bytes left in the packet, so if we are passing
buf-4 we can safely read frame_size+4 bytes.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

The current code doesn't work unless width is an exact multiple of 16.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

This possibly makes part of the CVE-2011-3895 fix unneeded.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

BUG=101458
Review URL: http://codereview.chromium.org/8414025

Fixes second part of CVE-2011-3895

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

BUG=101458
Review URL: http://codereview.chromium.org/8413019

This fixes part of 2011-3895

bigned-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

decoding.

BUG=100543
Review URL: http://codereview.chromium.org/8365014
This fixes 25% of CVE-2011-3893

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Reviewed-by: Thilo Borgmann