Fixes: infinite loop
Fixes: 27834/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5694930919620608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: NMichael Niedermayer <michael@niedermayer.cc>

Fixes: Infinite loop
Fixes: 27292/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5731168991051776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: NMichael Niedermayer <michael@niedermayer.cc>

Bigger sizes are misinterpreted as negative numbers by the API
Fixes: infinite loop
Fixes: 26611/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4890614975692800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: NMichael Niedermayer <michael@niedermayer.cc>

Fixes: infinite loop
Fixes: 26485/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5126561373880320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: NMichael Niedermayer <michael@niedermayer.cc>

Fixes: Infinite loop
Fixes: 25844/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5660803318153216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by: NPeter Ross <pross@xvid.org>
Signed-off-by: NMichael Niedermayer <michael@niedermayer.cc>

ff_id3v2_parse_apic/chapters/priv/priv_dict all had a parameter
extra_meta of type ID3v2ExtraMeta ** as if the functions wanted to make
*extra_meta point to something else. But they don't, so just use an
ID3v2ExtraMeta *.
Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>

Besides improved readability it also zeroes the padding which has been
forgotten here.
Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: NMichael Niedermayer <michael@niedermayer.cc>

Reviewed-by: NPaul B Mahol <onemda@gmail.com>
Signed-off-by: NSteven Liu <lq@chinaffmpeg.org>

Reviewed-by: Lauri Kasanen
Reviewed-by: Tomas Härdin

These changes store id3 chapter data in ID3v2ExtraMeta and introduce
ff_id3v2_parse_chapters to parse them into the format context if needed.

Encoders using ff_id3v2_read, which previously parsed chapters into the
format context automatically, were adjusted to call
ff_id3v2_parse_chapters.
Signed-off-by: Nwm4 <nfxjfg@googlemail.com>

The bit_rate field has type int64_t since commit
7404f3bd.
Reviewed-by: NPaul B Mahol <onemda@gmail.com>
Signed-off-by: NAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>

Signed-off-by: NPaul B Mahol <onemda@gmail.com>

Signed-off-by: NPaul B Mahol <onemda@gmail.com>

Signed-off-by: NPaul B Mahol <onemda@gmail.com>

Signed-off-by: NPaul B Mahol <onemda@gmail.com>

Signed-off-by: NDiego Biurrun <diego@biurrun.de>

Signed-off-by: NPaul B Mahol <onemda@gmail.com>

Currently, AVStream contains an embedded AVCodecContext instance, which
is used by demuxers to export stream parameters to the caller and by
muxers to receive stream parameters from the caller. It is also used
internally as the codec context that is passed to parsers.

In addition, it is also widely used by the callers as the decoding (when
demuxer) or encoding (when muxing) context, though this has been
officially discouraged since Libav 11.

There are multiple important problems with this approach:
    - the fields in AVCodecContext are in general one of
        * stream parameters
        * codec options
        * codec state
      However, it's not clear which ones are which. It is consequently
      unclear which fields are a demuxer allowed to set or a muxer allowed to
      read. This leads to erratic behaviour depending on whether decoding or
      encoding is being performed or not (and whether it uses the AVStream
      embedded codec context).
    - various synchronization issues arising from the fact that the same
      context is used by several different APIs (muxers/demuxers,
      parsers, bitstream filters and encoders/decoders) simultaneously, with
      there being no clear rules for who can modify what and the different
      processes being typically delayed with respect to each other.
    - avformat_find_stream_info() making it necessary to support opening
      and closing a single codec context multiple times, thus
      complicating the semantics of freeing various allocated objects in the
      codec context.

Those problems are resolved by replacing the AVStream embedded codec
context with a newly added AVCodecParameters instance, which stores only
the stream parameters exported by the demuxers or read by the muxers.

Signed-off-by: NPaul B Mahol <onemda@gmail.com>

Signed-off-by: NPeter Ross <pross@xvid.org>
Signed-off-by: NMichael Niedermayer <michaelni@gmx.at>

For now only first frame is decoded.
Signed-off-by: NPaul B Mahol <onemda@gmail.com>

Signed-off-by: NJames Almer <jamrial@gmail.com>
Signed-off-by: NMichael Niedermayer <michaelni@gmx.at>

Signed-off-by: NMichael Niedermayer <michaelni@gmx.at>

Signed-off-by: NPeter Ross <pross@xvid.org>
Signed-off-by: NMichael Niedermayer <michaelni@gmx.at>

Signed-off-by: NPeter Ross <pross@xvid.org>
Signed-off-by: NMichael Niedermayer <michaelni@gmx.at>

bits_per_coded_sample and block_align are calculated again at end of if() block
Signed-off-by: NPeter Ross <pross@xvid.org>
Signed-off-by: NMichael Niedermayer <michaelni@gmx.at>

Fixes: msan_uninit-mem_7f9539ba8461_4760_dasboot_in_compressed
Fixes use of uninitialized memory
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: NMichael Niedermayer <michaelni@gmx.at>

Fixes: msan_uninit-mem_7f65b9788da6_388_24.iff
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: NMichael Niedermayer <michaelni@gmx.at>

Fixes use of uninitialized data
Fixes: msan_uninit-mem_7f65b9788da6_388_24.iff
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: NMichael Niedermayer <michaelni@gmx.at>

Fixes Ticket2194
Signed-off-by: NMichael Niedermayer <michaelni@gmx.at>

Fixes CVE-2013-2495

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: NLuca Barbato <lu_zero@gentoo.org>

CC: libav-stable@libav.org

Signed-off-by: NPaul B Mahol <onemda@gmail.com>

Fixes out of array accesses

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: NMichael Niedermayer <michaelni@gmx.at>

Signed-off-by: NPaul B Mahol <onemda@gmail.com>

Signed-off-by: NPeter Ross <pross@xvid.org>