Fixes part of CVE-2011-3936

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Regression introduced in 550f7c43ec

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Inspired by: 5af569aa30 by alex
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

CC: libav-stable@libav.org
(cherry picked from commit d2ee8c1779)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

The field frame_size isn't written to the output anywhere except
than in mov.

This facilitates stream copy from formats that don't set frame_size.

Signed-off-by: Martin Storsjö <martin@martin.st>

Also add some space around operators and wrap a comment
that extends past the 80 char "limit"/guideline.

Signed-off-by: Martin Storsjö <martin@martin.st>

Fixes part2 of CVE-2011-3929

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Reviewed-by: Roman Shaposhnik <roman@shaposhnik.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes part1 of CVE-2011-3929
Possibly fixes part of CVE-2011-3936

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Reviewed-by: Roman Shaposhnik <roman@shaposhnik.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

It can also optionally split the file into individual fragments,
which allows it to be served from any web server without any
server side support.

Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Martin Storsjö <martin@martin.st>

For ismv/isma, the time scale might not be the same as the sample
rate.

Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Martin Storsjö <martin@martin.st>

This fixes calculation of trackDuration if the MOVIentry array
is cleared. This is required by the fragmentation support in the
next patch.

Signed-off-by: Martin Storsjö <martin@martin.st>

This commit makes the check specific to the case that needs it.

Regression was introduced by
commit 62adc60b97
Author: Michael Niedermayer <michaelni@gmx.at>
Date:   Fri Dec 16 06:13:04 2011 +0100

    avidec: Check that the header chunks fit in the available filesize.
    Fixes Ticket771
    Bug found by: Diana Elena Muscalu

    Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes CVE-2011-3940 (Out of bounds read resulting in out of bounds write)

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Based on a work-around by Alex Zhukov.

Fixes ticket #935

There is only one stream, so it will always be index 0.
This also allows for removal of the private context.

also allows for removing some unused context fields

also allows for removing some unused context fields

Time stamps are not read from the bitstream, so no wrapping is needed.

Fixes decoding of the handful of "death scream" samples from
"Command and Conquer" that use SND1. e.g.
http://samples.libav.org/game-formats/westwood-aud/nuyell1.aud
http://samples.libav.org/game-formats/westwood-aud/nuyell7.aud

Stereo ADPCM IMA WS is planar for VQA version 3 and 2-sample interleaved for
VQA version 2.

The stereo layout and extradata is significantly different from that in
Westwood IMA ADPCM, so a separate codec_id is warranted.

Fix setting of bit_rate and bits_per_coded_sample.
Ask for sample for unsupported VQA versions.

According to Multimedia Wiki documentation, the frame rate is not always 15,
and the actual value can be found in the header.

Also remove unused context field, audio_frame_counter.

The format has no coded timestamps and must use packet durations to generate
them.

It has been deprecated only recently.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Accumulating into an int would cause overflow for files with essence
containers larger than 2 GiB.

These are common with audio atoms. Without this the demuxer would read two
bytes at a time for a mono 16-bit file.

This reduces the delay when opening the video with quicktime.

Idea-by: Maksym Veremeyenko <verem@m1stereo.tv>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>

They have no code in common.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

This reverts commit 8e8c51318c.

Fixes Ticket873

Conflicts:

	tests/ref/acodec/pcm_s16be
	tests/ref/acodec/pcm_s24be
	tests/ref/acodec/pcm_s32be
	tests/ref/acodec/pcm_s8
	tests/ref/lavf/mov

Approved-by: Baptiste Coudurier <baptiste.coudurier@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>