Merge version 6:11.12-1~deb8u1+rpi1 and 6:11.12-1~deb8u4 to produce 6:11.12-1~deb8u4+rpi1

Merge libav (6:11.12-1~deb8u4) import into refs/heads/workingbranch

CVE-2017-14057

Origin: https://github.com/FFmpeg/FFmpeg/commit/7f9ec5593e04827249e7aeb466da06a98a0d7329

Gbp-Pq: Name CVE-2017-14057.patch

avio_feof

This function is needed for several of the CVE-2017-140xx flaws.

Gbp-Pq: Name avio_feof.patch

CVE-2017-14171

Origin: https://github.com/FFmpeg/FFmpeg/commit/c24bcb553650b91e9eff15ef6e54ca73de2453b7

Gbp-Pq: Name CVE-2017-14171.patch

CVE-2017-14170

Origin: https://github.com/FFmpeg/FFmpeg/commit/900f39692ca0337a98a7cf047e4e2611071810c2

Gbp-Pq: Name CVE-2017-14170.patch

CVE-2017-14056

Origin: https://github.com/FFmpeg/FFmpeg/commit/96f24d1bee7fe7bac08e2b7c74db1a046c9dc0de

Gbp-Pq: Name CVE-2017-14056.patch

CVE-2017-14055

Origin: https://github.com/FFmpeg/FFmpeg/commit/4f05e2e2dc1a89f38cd9f0960a6561083d714f1e

Gbp-Pq: Name CVE-2017-14055.patch

CVE-2017-14767

Origin: https://github.com/FFmpeg/FFmpeg/commit/c42a1388a6d1bfd8001bf6a4241d8ca27e49326d

Gbp-Pq: Name CVE-2017-14767.patch

CVE-2017-15672

Origin: http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=c20f4fcb74da2d0432c7b54499bb98f48236b904

Gbp-Pq: Name CVE-2017-15672.patch

CVE-2017-17130

Origin: https://github.com/libav/libav/commit/49cf72b3ac77140cf4715c18fe7c7610d918d912

Gbp-Pq: Name CVE-2017-17130.patch

CVE-2017-9993

Origin: https://github.com/FFmpeg/FFmpeg/commit/a5d849b149ca67ced2d271dc84db0bc95a548abb

Gbp-Pq: Name CVE-2017-9993.patch

CVE-2017-9994

Origin: https://github.com/FFmpeg/FFmpeg/commit/6b5d3fb26fb4be48e4966e4b1d97c2165538d4ef

Gbp-Pq: Name CVE-2017-9994.patch

CVE-2018-14394

Origin: https://github.com/FFmpeg/FFmpeg/commit/3a2d21bc5f97aa0161db3ae731fc2732be6108b8

Gbp-Pq: Name CVE-2018-14394.patch

CVE-2018-1999010

Origin: https://github.com/FFmpeg/FFmpeg/commit/cced03dd667a5df6df8fd40d8de0bff477ee02e

Gbp-Pq: Name CVE-2018-1999010.patch

CVE-2018-6621

Origin: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/118e1b0b3370dd1c0da442901b486689efd1654b

Gbp-Pq: Name CVE-2018-6621.patch

CVE-2018-7557

Origin: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/7414d0bda7763f9bd69c26c068e482ab297c1c96

Gbp-Pq: Name CVE-2018-7557.patch

avformat/rtmppkt: Check for packet size mismatches

Fixes out of array access

Found-by: Paul Cher <paulcher@icloud.com>
Reviewed-by: Paul Cher <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2016-10191.patch

http: make length/offset-related variables unsigned.

Fixes #5992, reported and found by Paul Cher <paulcher@icloud.com>.

Gbp-Pq: Name CVE-2016-10190.patch

CVE-2016-10190-pre3-strtoull

Gbp-Pq: Name CVE-2016-10190-pre3-strtoull.patch

lavf/http: fix incorrect warning in range requests

Gbp-Pq: Name CVE-2016-10190-pre2-362c17e6.patch

avformat/http: Return an error in case of prematurely ending data

Fixes Ticket 4039

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Gbp-Pq: Name CVE-2016-10190-pre1-3668701f.patch

avcodec/utils: Clear dimensions in ff_get_buffer() on failure

avcodec/utils: Clear dimensions in ff_get_buffer() on failure

Fixes out of array access
Fixes: 482d8f2fd17c9f532b586458a33f267c/asan_heap-oob_4a52b6_7417_1d08d477736d66cdadd833d146bb8bae.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
[sunweaver] - manually adapted for Debian jessie's libav version which lacks the get_internal_buffer() symbol.

Gbp-Pq: Name CVE-2015-8663.patch

avcodec/jpeg2000dwt: Check ndeclevels before calling dwt_decode*()

avcodec/jpeg2000dwt: Check ndeclevels before calling dwt_decode*()

Fixes out of array access
Fixes: 01859c9a9ac6cd60a008274123275574/asan_heap-oob_1dff571_8250_50d3d1611e294c3519fd1fa82198b69b.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-8662.patch

avcodec/h264_slice: Limit max_contexts when slice_context_count is initialized

avcodec/h264_slice: Limit max_contexts when slice_context_count is initialized

Fixes out of array access
Fixes: 1430e9c43fae47a24c179c7c54f94918/signal_sigsegv_421427_2049_f2192b6829ab6e0eefcb035329c03c60.264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-8661.patch

avcodec/ivi: Check image dimensions

avcodec/ivi: Check image dimensions

Fixes integer overflow
Fixes: 1e32c6c591d940337c20b197ec1c4d3d/asan_heap-oob_4a52e5_8946_0bb0d9e863def56005e49f1d89bdc94d.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-8364.patch

avcodec/jpeg2000dec: Check for duplicate SIZ marker

avcodec/jpeg2000dec: Check for duplicate SIZ marker

Fixes: 0231a17345734228011c6f35a64e4594/asan_heap-oob_1d92a72_3218_1213809a9e3affec77e4c191fdfdc0a9.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-8363.patch

avcodec/hevc_ps: Check chroma_format_idc

avcodec/hevc_ps: Check chroma_format_idc

Fixes out of array access
Fixes: 24d05e8b84676799c735c9e27d97895e/asan_heap-oob_1b70f6a_2955_7c3652a7f370f9f3ef40642bc2c99bb2.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
[sunweaver] Ported to libav 11.12 in Debian jessie LTS.

Gbp-Pq: Name CVE-2015-8217.patch

avcodec/mjpegdec: Check index in ljpeg_decode_yuv_scan() before using it

avcodec/mjpegdec: Check index in ljpeg_decode_yuv_scan() before using it

Fixes: 04715144ba237443010554be0d05343f/asan_heap-oob_1eafc76_1737_c685b48041a563461839e4e7ab97abb8.jpg
Fixes out of array access

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
[sunweaver] Re-based for libav 11.12 in Debian jessie LTS.

Gbp-Pq: Name CVE-2015-8216.patch

avcodec/rv34: Clear pointers in ff_rv34_decode_init_thread_copy()

avcodec/rv34: Clear pointers in ff_rv34_decode_init_thread_copy()

Avoids leaving stale pointers
Fixes: signal_sigabrt_7ffff70eccc9_819_sabtriple.rm with memlimit 536870912
Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-6826.patch

avcodec/pthread_frame: clear priv_data, avoid stale pointer in error case

avcodec/pthread_frame: clear priv_data, avoid stale pointer in error case

Fixes: b4b47bc2b3fb7ca710bfffe5aa969e37_signal_sigabrt_7ffff70eccc9_744_nc_sample2.avi with memlimit of 4194304
Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-6825.patch

swscale/utils: Clear pix buffers

swscale/utils: Clear pix buffers

Fixes use of uninitialized memory
Fixes: a96874b9466b6edc660a519c7ad47977_signal_sigsegv_7ffff713351a_744_nc_sample.avi with memlimit 2147483648
Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-6824.patch

avcodec/alac: Clear pointers in allocate_buffers()

avcodec/alac: Clear pointers in allocate_buffers()

Fixes: 06a4edb39ad8a9883175f9bd428334a2_signal_sigsegv_7ffff713351a_706_mov__alac__ALAC_6ch.mov
Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-6823.patch

avcodec/sanm: Reset sizes in destroy_buffers()

avcodec/sanm: Reset sizes in destroy_buffers()

Fixes crash in 1288a2fe8e9ae6b00ca40e089d08ca65_signal_sigsegv_7ffff71426a7_354_accident.san with allocation limit 65536

Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-6822.patch

avcodec/mpegvideo: Clear pointers in ff_mpv_common_init()

avcodec/mpegvideo: Clear pointers in ff_mpv_common_init()

This ensures that no stale pointers leak through on any path

Fixes: signal_sigsegv_c3097a_991_xtrem_e2_m64q15_a32sxx.3gp
Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Gbp-Pq: Name CVE-2015-6821.patch

avcodec/aacsbr: check that the element type matches before applying SBR

avcodec/aacsbr: check that the element type matches before applying SBR

Fixes out of array access
Fixes: signal_sigsegv_3670fc0_2818_cov_2307326154_moon.mux
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Gbp-Pq: Name CVE-2015-6820.patch

avcodec/pngdec: Only allow one IHDR chunk

avcodec/pngdec: Only allow one IHDR chunk

Multiple IHDR chunks are forbidden in PNG
Fixes inconsistency and out of array accesses

Fixes: asan_heap-oob_4d5c5a_1738_cov_2638287726_c-m2-8f2b481b7fd9bd745e620b7c01a18df2.png
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Gbp-Pq: Name CVE-2015-6818.patch

avcodec/pngdec: Check IHDR/IDAT order

avcodec/pngdec: Check IHDR/IDAT order

Fixes out of array access
Fixes: asan_heap-oob_20a6c26_2690_cov_3434532168_mail.png
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
[sunweaver] - Port this commit to libav in Debian jessie.

Gbp-Pq: Name CVE-2014-9317.patch

avcodec/vp8: Do not use num_coeff_partitions in thread/buffer setup

avcodec/vp8: Do not use num_coeff_partitions in thread/buffer setup

The variable is not a constant and can lead to race conditions

Fixes: repro.webm (not reproducable with FFmpeg alone)
Found-by: Dale Curtis <dalecurtis@google.com>
Tested-by: Dale Curtis <dalecurtis@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-6761.patch

disable-configuration-warnings

Gbp-Pq: Name 03-disable-configuration-warnings.patch

configure-disable-ebx-gcc-4.9

Gbp-Pq: Name 02-configure-disable-ebx-gcc-4.9.patch

libav (6:11.12-1~deb8u4) jessie-security; urgency=high

  * Non-maintainer upload by the LTS team.
  * Fix the following security vulnerabilities:
  * CVE-2017-14055: a DoS in mv_read_header() due to lack of an EOF (End of
    File) check might cause huge CPU and memory consumption.
  * CVE-2017-14056: a DoS in rl2_read_header() due to lack of an EOF (End of
    File) check might cause huge CPU and memory consumption.
  * CVE-2017-14057: a DoS in asf_read_marker() due to lack of an EOF (End of
    File) check might cause huge CPU and memory consumption.
  * CVE-2017-14170: a DoS in mxf_read_index_entry_array() due to lack of an EOF
    (End of File) check might cause huge CPU consumption.
  * CVE-2017-14171: a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End
    of File) check might cause huge CPU consumption.
  * CVE-2017-14767: The sdp_parse_fmtp_config_h264 function in
    libavformat/rtpdec_h264.c mishandles empty sprop-parameter-sets values, which
    allows remote attackers to cause a denial of service (heap buffer overflow)
    or possibly have unspecified other impact via a crafted sdp file.
  * CVE-2017-15672: The read_header function in libavcodec/ffv1dec.c allows
    remote attackers to have unspecified impact via a crafted MP4 file, which
    triggers an out-of-bounds read.
  * CVE-2017-17130: The ff_free_picture_tables function in
    libavcodec/mpegpicture.c allows remote attackers to cause a denial of service
    (heap-based buffer overflow and application crash) or possibly have
    unspecified other impact via a crafted file, related to
    vc1_decode_i_blocks_adv.
  * CVE-2017-9993: Libav does not properly restrict HTTP Live Streaming
    filename extensions and demuxer names, which allows attackers to read
    arbitrary files via crafted playlist data.
  * CVE-2017-9994: libavcodec/webp.c in Libav before does not ensure that
    pix_fmt is set, which allows remote attackers to cause a denial of service
    (heap-based buffer overflow and application crash) or possibly have
    unspecified other impact via a crafted file, related to the
    vp8_decode_mb_row_no_filter and pred8x8_128_dc_8_c functions.
  * CVE-2018-14394: libavformat/movenc.c in Libav allows attackers to cause a
    denial of service (application crash caused by a divide-by-zero error) with a
    user crafted Waveform audio file.
  * CVE-2018-1999010: Libav contains multiple out of array access
    vulnerabilities in the mms protocol that can result in attackers accessing
    out of bound data.
  * CVE-2018-6621: The decode_frame function in libavcodec/utvideodec.c in
    Libav allows remote attackers to cause a denial of service (out of array
    read) via a crafted AVI file.
  * CVE-2018-7557: The decode_init function in libavcodec/utvideodec.c in
    Libav allows remote attackers to cause a denial of service (Out of array
    read) via an AVI file with crafted dimensions within chroma subsampling
    data.

[dgit import unpatched libav 6:11.12-1~deb8u4]

Import libav_11.12-1~deb8u4.debian.tar.xz

[dgit import tarball libav 6:11.12-1~deb8u4 libav_11.12-1~deb8u4.debian.tar.xz]

Merge libav (6:11.12-1~deb8u3) import into refs/heads/workingbranch

avformat/rtmppkt: Check for packet size mismatches

Fixes out of array access

Found-by: Paul Cher <paulcher@icloud.com>
Reviewed-by: Paul Cher <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2016-10191.patch

http: make length/offset-related variables unsigned.

Fixes #5992, reported and found by Paul Cher <paulcher@icloud.com>.

Gbp-Pq: Name CVE-2016-10190.patch

CVE-2016-10190-pre3-strtoull

Gbp-Pq: Name CVE-2016-10190-pre3-strtoull.patch

lavf/http: fix incorrect warning in range requests

Gbp-Pq: Name CVE-2016-10190-pre2-362c17e6.patch

avformat/http: Return an error in case of prematurely ending data

Fixes Ticket 4039

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Gbp-Pq: Name CVE-2016-10190-pre1-3668701f.patch

avcodec/utils: Clear dimensions in ff_get_buffer() on failure

avcodec/utils: Clear dimensions in ff_get_buffer() on failure

Fixes out of array access
Fixes: 482d8f2fd17c9f532b586458a33f267c/asan_heap-oob_4a52b6_7417_1d08d477736d66cdadd833d146bb8bae.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
[sunweaver] - manually adapted for Debian jessie's libav version which lacks the get_internal_buffer() symbol.

Gbp-Pq: Name CVE-2015-8663.patch

avcodec/jpeg2000dwt: Check ndeclevels before calling dwt_decode*()

avcodec/jpeg2000dwt: Check ndeclevels before calling dwt_decode*()

Fixes out of array access
Fixes: 01859c9a9ac6cd60a008274123275574/asan_heap-oob_1dff571_8250_50d3d1611e294c3519fd1fa82198b69b.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-8662.patch

avcodec/h264_slice: Limit max_contexts when slice_context_count is initialized

avcodec/h264_slice: Limit max_contexts when slice_context_count is initialized

Fixes out of array access
Fixes: 1430e9c43fae47a24c179c7c54f94918/signal_sigsegv_421427_2049_f2192b6829ab6e0eefcb035329c03c60.264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-8661.patch

avcodec/ivi: Check image dimensions

avcodec/ivi: Check image dimensions

Fixes integer overflow
Fixes: 1e32c6c591d940337c20b197ec1c4d3d/asan_heap-oob_4a52e5_8946_0bb0d9e863def56005e49f1d89bdc94d.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-8364.patch

avcodec/jpeg2000dec: Check for duplicate SIZ marker

avcodec/jpeg2000dec: Check for duplicate SIZ marker

Fixes: 0231a17345734228011c6f35a64e4594/asan_heap-oob_1d92a72_3218_1213809a9e3affec77e4c191fdfdc0a9.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-8363.patch

avcodec/hevc_ps: Check chroma_format_idc

avcodec/hevc_ps: Check chroma_format_idc

Fixes out of array access
Fixes: 24d05e8b84676799c735c9e27d97895e/asan_heap-oob_1b70f6a_2955_7c3652a7f370f9f3ef40642bc2c99bb2.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
[sunweaver] Ported to libav 11.12 in Debian jessie LTS.

Gbp-Pq: Name CVE-2015-8217.patch

avcodec/mjpegdec: Check index in ljpeg_decode_yuv_scan() before using it

avcodec/mjpegdec: Check index in ljpeg_decode_yuv_scan() before using it

Fixes: 04715144ba237443010554be0d05343f/asan_heap-oob_1eafc76_1737_c685b48041a563461839e4e7ab97abb8.jpg
Fixes out of array access

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
[sunweaver] Re-based for libav 11.12 in Debian jessie LTS.

Gbp-Pq: Name CVE-2015-8216.patch

avcodec/rv34: Clear pointers in ff_rv34_decode_init_thread_copy()

avcodec/rv34: Clear pointers in ff_rv34_decode_init_thread_copy()

Avoids leaving stale pointers
Fixes: signal_sigabrt_7ffff70eccc9_819_sabtriple.rm with memlimit 536870912
Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-6826.patch

avcodec/pthread_frame: clear priv_data, avoid stale pointer in error case

avcodec/pthread_frame: clear priv_data, avoid stale pointer in error case

Fixes: b4b47bc2b3fb7ca710bfffe5aa969e37_signal_sigabrt_7ffff70eccc9_744_nc_sample2.avi with memlimit of 4194304
Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-6825.patch

swscale/utils: Clear pix buffers

swscale/utils: Clear pix buffers

Fixes use of uninitialized memory
Fixes: a96874b9466b6edc660a519c7ad47977_signal_sigsegv_7ffff713351a_744_nc_sample.avi with memlimit 2147483648
Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-6824.patch

avcodec/alac: Clear pointers in allocate_buffers()

avcodec/alac: Clear pointers in allocate_buffers()

Fixes: 06a4edb39ad8a9883175f9bd428334a2_signal_sigsegv_7ffff713351a_706_mov__alac__ALAC_6ch.mov
Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-6823.patch

avcodec/sanm: Reset sizes in destroy_buffers()

avcodec/sanm: Reset sizes in destroy_buffers()

Fixes crash in 1288a2fe8e9ae6b00ca40e089d08ca65_signal_sigsegv_7ffff71426a7_354_accident.san with allocation limit 65536

Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-6822.patch

avcodec/mpegvideo: Clear pointers in ff_mpv_common_init()

avcodec/mpegvideo: Clear pointers in ff_mpv_common_init()

This ensures that no stale pointers leak through on any path

Fixes: signal_sigsegv_c3097a_991_xtrem_e2_m64q15_a32sxx.3gp
Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Gbp-Pq: Name CVE-2015-6821.patch

avcodec/aacsbr: check that the element type matches before applying SBR

avcodec/aacsbr: check that the element type matches before applying SBR

Fixes out of array access
Fixes: signal_sigsegv_3670fc0_2818_cov_2307326154_moon.mux
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Gbp-Pq: Name CVE-2015-6820.patch

avcodec/pngdec: Only allow one IHDR chunk

avcodec/pngdec: Only allow one IHDR chunk

Multiple IHDR chunks are forbidden in PNG
Fixes inconsistency and out of array accesses

Fixes: asan_heap-oob_4d5c5a_1738_cov_2638287726_c-m2-8f2b481b7fd9bd745e620b7c01a18df2.png
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Gbp-Pq: Name CVE-2015-6818.patch

avcodec/pngdec: Check IHDR/IDAT order

avcodec/pngdec: Check IHDR/IDAT order

Fixes out of array access
Fixes: asan_heap-oob_20a6c26_2690_cov_3434532168_mail.png
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
[sunweaver] - Port this commit to libav in Debian jessie.

Gbp-Pq: Name CVE-2014-9317.patch

avcodec/vp8: Do not use num_coeff_partitions in thread/buffer setup

avcodec/vp8: Do not use num_coeff_partitions in thread/buffer setup

The variable is not a constant and can lead to race conditions

Fixes: repro.webm (not reproducable with FFmpeg alone)
Found-by: Dale Curtis <dalecurtis@google.com>
Tested-by: Dale Curtis <dalecurtis@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-6761.patch

disable-configuration-warnings

Gbp-Pq: Name 03-disable-configuration-warnings.patch

configure-disable-ebx-gcc-4.9

Gbp-Pq: Name 02-configure-disable-ebx-gcc-4.9.patch

libav (6:11.12-1~deb8u3) jessie-security; urgency=medium

  * Non-maintainer upload by the Debian LTS Team.
  * debian/patches:
    + Rename CVE-2015-6822+6823+6824.patch to CVE-2015-6822.patch..
  * CVE-2015-6823: avcodec/alac: Clear pointers in allocate_buffers().
  * CVE-2015-6824: swscale/utils: Clear pix buffers. Fixes use of
    uninitialized memory.

[dgit import unpatched libav 6:11.12-1~deb8u3]

Import libav_11.12-1~deb8u3.debian.tar.xz

[dgit import tarball libav 6:11.12-1~deb8u3 libav_11.12-1~deb8u3.debian.tar.xz]

Merge version 6:11.11-1~deb8u1+rpi1 and 6:11.12-1~deb8u1 to produce 6:11.12-1~deb8u1+rpi1

Import libav_11.12.orig.tar.xz

[dgit import orig libav_11.12.orig.tar.xz]

Merge libav (6:11.12-1~deb8u1) import into refs/heads/workingbranch

disable-configuration-warnings

Gbp-Pq: Name 03-disable-configuration-warnings.patch

configure-disable-ebx-gcc-4.9

Gbp-Pq: Name 02-configure-disable-ebx-gcc-4.9.patch

libav (6:11.12-1~deb8u1) jessie-security; urgency=medium

  * New upstream release.
    - smacker: add sanity check for length in smacker_decode_tree()
      (CVE-2017-16803)

[dgit import unpatched libav 6:11.12-1~deb8u1]

Import libav_11.12-1~deb8u1.debian.tar.xz

[dgit import tarball libav 6:11.12-1~deb8u1 libav_11.12-1~deb8u1.debian.tar.xz]

Merge version 6:11.9-1~deb8u1+rpi1 and 6:11.11-1~deb8u1 to produce 6:11.11-1~deb8u1+rpi1

Merge libav (6:11.11-1~deb8u1) import into refs/heads/workingbranch

disable-configuration-warnings

Gbp-Pq: Name 03-disable-configuration-warnings.patch

configure-disable-ebx-gcc-4.9

Gbp-Pq: Name 02-configure-disable-ebx-gcc-4.9.patch

libav (6:11.11-1~deb8u1) jessie-security; urgency=medium

  * Non-maintainer upload by the Security Team.
  * New upstream release fixing multiple security issues.
    - dfa: Disallow odd width/height and add proper bounds check for DDS1 chunks
      (CVE-2017-9992)
    - pictor: Correctly check frame dimensions (CVE-2017-7862)
    - h264_cavlc: check the value of run_before
    - dvbsubdec: improve error checking
    - dvbsubdec: Fixed segfault when decoding subtitles
    - rmdec: don't ignore the return value of av_get_packet()
    - caf: add an Opus tag
    - yadif: Account for the buffer alignment while processing the frame edges
    - mov: log and return early on non-positive stsd entry counts
    - arm: Fix SIGBUS on ARM when compiled with binutils 2.29
    - smacker: return meaningful error codes on failure
    - smacker: fix integer overflow with pts_inc
    - mm: Skip unexpected audio packets
    - aacsbr: Turnoff in the event of over read.
    - smacker: Check that the data size is a multiple of a sample vector
      (CVE-2015-8365)
    - build: Add an option for passing linker flags to the shared library build
    - flv: Validate the packet size
    - mjpeg: Report non-3 component rgb lossless as not supported
    - vc1dec: raise an error if sprite picture data is missing
    - doc: Drop the legacy symlink to README

[dgit import unpatched libav 6:11.11-1~deb8u1]

Import libav_11.11.orig.tar.gz

[dgit import orig libav_11.11.orig.tar.gz]

Import libav_11.11-1~deb8u1.debian.tar.xz

[dgit import tarball libav 6:11.11-1~deb8u1 libav_11.11-1~deb8u1.debian.tar.xz]

Merge libav (6:11.9-1~deb8u1+rpi1) import into refs/heads/workingbranch

disable-configuration-warnings

Gbp-Pq: Name 03-disable-configuration-warnings.patch

configure-disable-ebx-gcc-4.9

Gbp-Pq: Name 02-configure-disable-ebx-gcc-4.9.patch

libav (6:11.9-1~deb8u1+rpi1) jessie-staging; urgency=medium

  [changes brought forward from 6:11.3-1+rpi1 by Peter Michael Green <plugwash@raspbian.org> at Sun, 29 Mar 2015 02:07:33 +0000]
  * Add special case handling for Raspbian (and any derivatives thereof) (Closes: 738760)
    + Disable armv6t2
      - note: the thumb2 variant of arv6 seems to be very rare, the Pi certainly
        doesn't have it.
    + Disable neon in the main build.
    + Don't build a seperate neon flavour either.

  [changes brought forward from 6:11.4-1~deb8u1+rpi2 by Peter Michael Green <plugwash@raspbian.org> at Thu, 11 Feb 2016 15:58:25 +0000]
  * Re-enable specific neon build.
  * Move armv6t2 and neon disabling from overall configure flags to static
    and shared configure flags so they don't impact the neon-specific build.

[dgit import unpatched libav 6:11.9-1~deb8u1+rpi1]

Import libav_11.9-1~deb8u1+rpi1.debian.tar.xz

[dgit import tarball libav 6:11.9-1~deb8u1+rpi1 libav_11.9-1~deb8u1+rpi1.debian.tar.xz]

Merge libav (6:11.9-1~deb8u1) import into refs/heads/workingbranch

Import libav_11.9.orig.tar.xz

[dgit import orig libav_11.9.orig.tar.xz]

disable-configuration-warnings

Gbp-Pq: Name 03-disable-configuration-warnings.patch

configure-disable-ebx-gcc-4.9

Gbp-Pq: Name 02-configure-disable-ebx-gcc-4.9.patch

libav (6:11.9-1~deb8u1) jessie-security; urgency=medium

  * New upstream release.
    - mpegvideo_parser: avoid signed overflow in bitrate calculation.
      (CVE-2016-9821)
    - mpeg12dec: avoid signed overflow in bitrate calculation. (CVE-2016-9822)
  * debian/patches/mpegvideo_motion-Handle-edge-emulation-even-without-.patch:
    Removed, included upstream.

[dgit import unpatched libav 6:11.9-1~deb8u1]

Import libav_11.9-1~deb8u1.debian.tar.xz

[dgit import tarball libav 6:11.9-1~deb8u1 libav_11.9-1~deb8u1.debian.tar.xz]

mpegvideo_motion: Handle edge emulation even without unrestricted_mv

Fix out of bounds read.

Bug-Id: 959
Found by: F4B3CD@STARLAB and Agostino Sarubbo
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
(cherry picked from commit 136f55207521f0b03194ef5b55ba70f1635d6aee)
Signed-off-by: Diego Biurrun <diego@biurrun.de>
Gbp-Pq: Name mpegvideo_motion-Handle-edge-emulation-even-without-.patch

disable-configuration-warnings

Gbp-Pq: Name 03-disable-configuration-warnings.patch

configure-disable-ebx-gcc-4.9

Gbp-Pq: Name 02-configure-disable-ebx-gcc-4.9.patch

libav (6:11.8-1~deb8u1) jessie-security; urgency=medium

  * New upstream release.
  * debian/upstream-signing-key.pgp: Update upstream signing key.
  * debian/patches/mpegvideo_motion-Handle-edge-emulation-even-without-.patch:
    Fix NULL pointer dereference in put_no_rnd_pixels8_xy2_mmx. (CVE-2016-7424)

[dgit import unpatched libav 6:11.8-1~deb8u1]

Import libav_11.8.orig.tar.xz

[dgit import orig libav_11.8.orig.tar.xz]