Fixes a regression introduced in 8b94df0f20.

Also document the function somewhat.

This fixes an infinite loop in the decoder on specially
crafted files, and fixes bug 151.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

This reverts commit 295a7c0238. The
patch breaks decoding of regular files (e.g. fate-4xm-2).

4xm decoder while decoding i2 frames can overread the buffer if proper checks
are not made.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

frame_size is the number of bytes left in the packet, so if we are passing
buf-4 we can safely read frame_size+4 bytes.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

The current code doesn't work unless width is an exact multiple of 16.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

* qatar/master: (46 commits)
  mtv: Make sure audio_subsegments is not 0
  v4l2: use V4L2_FMT_FLAG_EMULATED only if it is defined
  avconv: add symbolic names for -vsync parameters
  flvdec: Fix compiler warning for uninitialized variables
  rtsp: Fix compiler warning for uninitialized variable
  ulti: convert to new bytestream API.
  swscale: Use standard multiple inclusion guards in ppc/ header files.
  Place some START_TIMER invocations in separate blocks.
  v4l2: list available formats
  v4l2: set the proper codec_tag
  v4l2: refactor device_open
  v4l2: simplify away io_method
  v4l2: cosmetics
  v4l2: uniform and format options
  v4l2: do not force interlaced mode
  avio: exit early in fill_buffer without read_packet
  vc1dec: fix invalid memory access for small video dimensions
  rv34: fix invalid memory access for small video dimensions
  rv34: joint coefficient decoding and dequantization
  avplay: Don't call avio_set_interrupt_cb(NULL)
  ...

Conflicts:
	Changelog
	avconv.c
	doc/APIchanges
	doc/indevs.texi
	libavcodec/adxenc.c
	libavcodec/dnxhdenc.c
	libavcodec/h264.c
	libavdevice/v4l2.c
	libavformat/flvdec.c
	libavformat/mtv.c
	libswscale/utils.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

This reverts commit 66f71f3b5e.

This causes regressions with RDT.

qatar does this too but clobbers the AVPacket.duration by approximate
values.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Author: Michael Niedermayer <michaelni@gmx.at>
	Date:   Thu Nov 3 22:38:10 2011 +0100

	    lavf: fix null pointer dereference in rdt

	    Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

This is no longer needed and causes various problems with RTSP

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

audio_subsegments would be 0 and cause floating point exceptions
Fixes bugzilla #144

Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>

This possibly makes part of the CVE-2011-3895 fix unneeded.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

BUG=101458
Review URL: http://codereview.chromium.org/8414025

Fixes second part of CVE-2011-3895

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

BUG=101458
Review URL: http://codereview.chromium.org/8413019

This fixes part of 2011-3895

bigned-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

decoding.

BUG=100543
Review URL: http://codereview.chromium.org/8365014
This fixes 25% of CVE-2011-3893

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

a realloc()

BUG=100492
Review URL: http://codereview.chromium.org/8366004
Fixes: 1 of 2 for CVE-2011-3893

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

V4L2_FMT_FLAG_EMULATED was added in 2.6.32.

These can't be used uninitialized in practice, but the
compiler doesn't realize it.

Signed-off-by: Martin Storsjö <martin@martin.st>

This one won't ever be used uninitialized in practice, but
the compiler doesn't realize it.

Signed-off-by: Martin Storsjö <martin@martin.st>

Reviewed-by: Thilo Borgmann

Found-by: Paul B Mahol

Reviewed-by: Derek Buitenhuis
Reviewed-by: Paul B Mahol

Reviewed-by: Derek Buitenhuis
Reviewed-by: Paul B Mahol

Fixes ticket #525.

Reviewed-by: Paul B Mahol

This fixes compilation failures related to START_TIMER/STOP_TIMER macros and
-Werror=declaration-after-statement.  START_TIMER declares variables and thus
may not be placed after statements outside of a new block.

Make use of the experimental framesize enumeration ioctl if available.

Unbreak direct streamcopy.

Check capabilities directly in the function, further simplify the code.

Only mmap is supported.

Video4linux2 supports both interlaced and non-interlaced mode, do not
ask for interlaced if not necessary.

Fixes an invalid free() with ass in avi. The sample in bug 98 passes
parts of AVPacket.data as buffer for the AVIOContext. Since the packet
is quite large fill_buffer tries to reallocate the buffer before doing
nothing. Fixes bug 98.

For small video dimensions, these calculations of the upper bound
for pixel access may have a negative result. Using an unsigned
comparison to bound a potentially negative value only works if
the greater operand is non-negative. Fixed by doing edge emulation
when the upper bound is probably negative, everywhere that this
pattern appears.

Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>

For small video dimensions calculations of the upper bound for pixel
access may result in negative value. Using an unsigned comparison
works only if the greater operand is non-negative. This is fixed by
doing edge emulation explicitly for such conditions.

Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>

Perform dequantization while decoding coefficients instead of performing it
on the entire coefficients buffer.

Since quantized coefficients are very sparse, this usually causes a small
speedup. Speedup of around 1% on Panda board compared to the removed here
neon code. Global speedup is probably around 3%.

Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>

Since we don't use avio_set_interrupt_cb for interrupt callbacks,
we don't need to call it to reset the interrupt cb either.

This avoids a warning about use of deprecated functions.

Signed-off-by: Martin Storsjö <martin@martin.st>