This fixes speex decoding, which was broken in 85469f1c.

Fixes Bug #265

Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>

Also drop the now unnecessary ff_ prefix from its name.

SHOW_UBITS() is only defined up to n_bits is 25, therefore forbid
values larger than this in get_vlc2() (max_bits). tokens[][] can be
used as an index in deltas[], which has a size of 64, so ensure the
values are smaller than that.

This prevents crashes on corrupt bitstreams.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Looks like some LAME versions produce dual stereo mode MP3s with
flags for intensity and middle stereo set. In this mode those flags
should be ignored like the reference decoder and derived ones do.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

A call to decode_packet() does not always decode a complete WMA packet.
Moreover, this is not the correct place to document calls that are part
of the public API.

Signed-off-by: Diego Biurrun <diego@biurrun.de>

Also use correct buffer sizes in calls to tm2_read_stream(). Together,
this prevents overreads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

dvdec.c uses nothing from dv_tablegen.h.  As a welcome side-effect, this
fixes compilation of that file with hardcoded tables enabled.

Also remove one pointless zero initialization in rangecoder.c.

It is not a user-accessible option and unlikely to ever be changed.

Otherwise realloc would free it, which would result in double free
later.

Version from vqa header does not dictate which sound chunks may
appear in file.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

Also remove some write-only variables or write-only variable
assignments, remove internal colorspace conversion to native
endianness (that can be done by swscale much more efficiently),
and some cosmetics.

Prevents running error resilience on a previous frame which will write
to the pic->mb_type[] array of the previous image. The array might
already be re-used for a new image in a subsequent thread, thus cause
two threads to write to the same pic->mb_type[] array, causing a race
condition which can crash in rv34_decode_cbp(), called by
rv34_decode_inter_mb_header() (which accesses mb_type[] twice,
assuming values are maintained, which the race condition breaks).

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

This allows simplifying the Makefiles; it is no longer necessary to register
arch subdirectory Makefiles, just putting them in place is enough.

This makes them safe to use in non-fully braced if-blocks and similar.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

Before this, they were only added to the delayed release queue and not
freed until later. This could lead to unnecessary memory use or buffer
exhaustion.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

Fixes a crash when FF_DEBUG_PICT_INFO is used.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

Fixes crash during slice size reading if slice_end goes negative.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Else we run out of progress variables after a few failed buffer
allocations.

Signed-off-by: Anton Khirnov <anton@khirnov.net>

Signed-off-by: Anton Khirnov <anton@khirnov.net>