Merge remote-tracking branch 'qatar/master'

* qatar/master:
  ttadec: unbreak playback of matroska files
  vorbisdec: avoid invalid memory access
  Fix uninitialized reads on malformed ogg files.
  huffyuv: add padding to classic (v1) huffman tables.
  png: convert to bytestream2 API.
  dca: include libavutil/mathematics.h for possibly missing M_SQRT1_2
  avs: fix infinite loop on end-of-stream.
  tiffdec: Prevent illegal memory access caused by recycled pointers.
  rtpenc: Fix the AVRational used for av_rescale_q_rnd
  wma: fix off-by-one in array bounds check.

Conflicts:
	libavcodec/huffyuv.c
	libavcodec/pngdec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

diff --cc libavcodec/cavsdec.c
Simple merge

diff --cc libavcodec/dca.c
Simple merge

diff --cc libavcodec/huffyuv.c
index ff52eaac733f669330e31b19facc3301b4c58adf,278948d195c91f08a9cb7199732d97b43b451839..81144a1c4234e3ed796a05fc060053753e76394e
--- 1/libavcodec/huffyuv.c
--- 2/libavcodec/huffyuv.c
+++ b/libavcodec/huffyuv.c
@@@ -82,18 -82,18 +82,20 @@@ typedef struct HYuvContext
      DSPContext dsp;
  }HYuvContext;
  
- static const unsigned char classic_shift_luma[] = {
+ #define classic_shift_luma_table_size 42
+ static const unsigned char classic_shift_luma[classic_shift_luma_table_size + FF_INPUT_BUFFER_PADDING_SIZE] = {
    34,36,35,69,135,232,9,16,10,24,11,23,12,16,13,10,14,8,15,8,
    16,8,17,20,16,10,207,206,205,236,11,8,10,21,9,23,8,8,199,70,
 -  69,68, 0
 +  69,68, 0,
 +  0,0,0,0,0,0,0,0,
  };
  
- static const unsigned char classic_shift_chroma[] = {
+ #define classic_shift_chroma_table_size 59
+ static const unsigned char classic_shift_chroma[classic_shift_chroma_table_size + FF_INPUT_BUFFER_PADDING_SIZE] = {
    66,36,37,38,39,40,41,75,76,77,110,239,144,81,82,83,84,85,118,183,
    56,57,88,89,56,89,154,57,58,57,26,141,57,56,58,57,58,57,184,119,
 -  214,245,116,83,82,49,80,79,78,77,44,75,41,40,39,38,37,36,34, 0
 +  214,245,116,83,82,49,80,79,78,77,44,75,41,40,39,38,37,36,34, 0,
 +  0,0,0,0,0,0,0,0,
  };
  
  static const unsigned char classic_add_luma[256] = {

diff --cc libavcodec/pngdec.c
index 55df8b0a576ebb25e5e8793d3fa3d9515f2a7ea5,56bda7c300958be3c18b1d626894726782f304ae..398c48b41964adaa89ebe687cdc42e25e88761de
--- 1/libavcodec/pngdec.c
--- 2/libavcodec/pngdec.c
+++ b/libavcodec/pngdec.c
@@@ -401,17 -398,13 +396,15 @@@ static int decode_frame(AVCodecContext 
      avctx->coded_frame= s->current_picture;
      p = s->current_picture;
  
-     s->bytestream_start=
-     s->bytestream= buf;
-     s->bytestream_end= buf + buf_size;
- 
      /* check signature */
-     if (memcmp(s->bytestream, ff_pngsig, 8) != 0 &&
-         memcmp(s->bytestream, ff_mngsig, 8) != 0) {
+     if (buf_size < 8 ||
+         memcmp(buf, ff_pngsig, 8) != 0 &&
 -        memcmp(buf, ff_mngsig, 8) != 0)
++        memcmp(buf, ff_mngsig, 8) != 0) {
 +        av_log(avctx, AV_LOG_ERROR, "Missing png signature\n");
          return -1;
-     s->bytestream+= 8;
 +    }
+ 
+     bytestream2_init(&s->gb, buf + 8, buf_size - 8);
      s->y=
      s->state=0;
  //    memset(s, 0, sizeof(PNGDecContext));
@@@ -423,16 -416,13 +416,15 @@@
      if (ret != Z_OK)
          return -1;
      for(;;) {
-         int tag32;
-         if (s->bytestream >= s->bytestream_end)
+         if (bytestream2_get_bytes_left(&s->gb) <= 0)
              goto fail;
-         length = bytestream_get_be32(&s->bytestream);
-         if (length > 0x7fffffff || length > s->bytestream_end - s->bytestream)
++
+         length = bytestream2_get_be32(&s->gb);
 -        if (length > 0x7fffffff)
++        if (length > 0x7fffffff || length > bytestream2_get_bytes_left(&s->gb))
              goto fail;
-         tag32 = bytestream_get_be32(&s->bytestream);
-         tag = av_bswap32(tag32);
+         tag = bytestream2_get_le32(&s->gb);
 -        av_dlog(avctx, "png: tag=%c%c%c%c length=%u\n",
 +        if (avctx->debug & FF_DEBUG_STARTCODE)
 +            av_log(avctx, AV_LOG_DEBUG, "png: tag=%c%c%c%c length=%u\n",
                  (tag & 0xff),
                  ((tag >> 8) & 0xff),
                  ((tag >> 16) & 0xff),
@@@ -447,15 -437,14 +439,15 @@@
                  s->width= s->height= 0;
                  goto fail;
              }
-             s->bit_depth = *s->bytestream++;
-             s->color_type = *s->bytestream++;
-             s->compression_type = *s->bytestream++;
-             s->filter_type = *s->bytestream++;
-             s->interlace_type = *s->bytestream++;
-             s->bytestream += 4; /* crc */
+             s->bit_depth        = bytestream2_get_byte(&s->gb);
+             s->color_type       = bytestream2_get_byte(&s->gb);
+             s->compression_type = bytestream2_get_byte(&s->gb);
+             s->filter_type      = bytestream2_get_byte(&s->gb);
+             s->interlace_type   = bytestream2_get_byte(&s->gb);
+             bytestream2_skip(&s->gb, 4); /* crc */
              s->state |= PNG_IHDR;
 -            av_dlog(avctx, "width=%d height=%d depth=%d color_type=%d compression_type=%d filter_type=%d interlace_type=%d\n",
 +            if (avctx->debug & FF_DEBUG_PICT_INFO)
 +                av_log(avctx, AV_LOG_DEBUG, "width=%d height=%d depth=%d color_type=%d compression_type=%d filter_type=%d interlace_type=%d\n",
                      s->width, s->height, s->bit_depth, s->color_type,
                      s->compression_type, s->filter_type, s->interlace_type);
              break;

diff --cc libavcodec/tiff.c
Simple merge

diff --cc libavcodec/tta.c
Simple merge

diff --cc libavcodec/vorbisdec.c
Simple merge

diff --cc libavformat/oggdec.c
Simple merge

diff --cc libavformat/rtpenc.c
Simple merge