This patch resolves two heap corruption vulnerabilities in the CDG
decoder for VLC media player.  In both cases, a failure to properly
validate indexes into statically-sized arrays on the heap could allow a
maliciously crafted CDG video to corrupt the heap in a controlled
manner, potentially leading to code execution.

The patch is against v1.1.5 from vlc git, but this decoder hasn't been
touched in awhile, so I'd expect it to cleanly apply to older versions.
I've tested it and confirmed it resolves the heap corruption issues and
does not break functionality.

(...)
Signed-off-by: Rémi Denis-Courmont <remi@remlab.net>
(cherry picked from commit f9b664eac0e1a7bceed9d7b5854fd9fc351b4aab)

Signed-off-by: Christophe Mutricy <xtophe@chewa.net>

Signed-off-by: Christophe Mutricy <xtophe@chewa.net>

6 new stings related to projectm module

(cherry picked from commit b656bb75375d33740e53821071199f9ae58e427a)

---
Sure, naming a static library *_static.a is _VERY_ useful
(and helps the linker find it... not)
And of course, installing .svn on make install is clever

Do not ask me why noone uses MPC these days...
(cherry picked from commit 10a05481f119a020742e235133cbd6f6593a05a2)
Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>

(cherry picked from commit baa2d2c3b3f658e90d7ddf66e0e9c0eaa1a88446)
Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>

(cherry picked from commit 04ac17066a619084dd40d89b032f6411cfd39b87)
Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>

(cherry picked from commit 3884bc644750dff5d9c29ca4d2c879ab9e8fd5eb)

(cherry picked from commit b4bfa0324c5ab04b957dbc258f3214c9e03612fb)
Signed-off-by: Rémi Duraffort <ivoire@videolan.org>

(cherry picked from commit d61f3b7fc6d02a117c53d89e74e42dbe809b697a)
Signed-off-by: Rémi Duraffort <ivoire@videolan.org>

This breaks the compilation with Xcode4 again, but that's okay for now.

(cherry picked from commit f5ac248b3ab9a70dc43ec8f8b9063aa200d94136)
Signed-off-by: Sébastien Escudier <sebastien-devel@celeos.eu>

3 setting to set meshx, meshy and texturesize
Fixed a crash if there is no available presets
Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
(cherry picked from commit 8beb6e0f0c7235349c0715b8de1d1844b65d9e53)
Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>

Malformatted files may have a zero i_subpackets value. In this case,
we cannot use the array, but we still have to free it (calloc(0)).

This should fix LP#690173.
Reported-by: Dan Rosenberg <drosenberg@vsecurity.com>
(cherry picked from commit 6568965770f906d34d4aef83237842a5376adb55)

(cherry picked from commit 5a7825ca8ae47062a3299864262dda853856183a)
Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>

(cherry picked from commit 86589cdbbcb1b661bf103e7b8fb311968f739658)
Signed-off-by: Konstantin Pavlov <thresh@videolan.org>

(cherry picked from commit 01dbb084e4d7d2b56856d3637aea9c4a9ae26e0a)
Signed-off-by: Konstantin Pavlov <thresh@videolan.org>

(cherry picked from commit e7e6ff45689e3b1d17e057b1701b72c70af250d2)
Signed-off-by: Konstantin Pavlov <thresh@videolan.org>

They applied it upstream, almost completly
As discussed at FOMS
(cherry picked from commit c03f74b690598a7fe51b1589b8dbeac07805ca0d)
Signed-off-by: Konstantin Pavlov <thresh@videolan.org>

Signed-off-by: Christophe Mutricy <xtophe@videolan.org>

(cherry picked from commit 875531f7c312b14d372827f8fa55ed7c0a182c2f)
Signed-off-by: Pierre Ynard <linkfanel@yahoo.fr>

Signed-off-by: Christophe Mutricy <xtophe@videolan.org>

Signed-off-by: Christophe Mutricy <xtophe@videolan.org>

Return a 413 error instead of crashing
(cherry picked from commit 2e1b9e44719618eb97b3850d05096753fd7d3617)
Signed-off-by: Pierre Ynard <linkfanel@yahoo.fr>

This caused genuine bugs like mangled bodies and corrupted requests
(usually leading to 501 errors), and possibly leaks of memory buffer
of the size of the Content-Length parameter. This is pretty bad since
crafted requests could easily exhaust the memory and/or trigger a crash.
Apart from the contents of the buffer of the involved request, there
doesn't seem to be any possible memory corruption.
(cherry picked from commit 8fae1e140a0bfc80666c41ce55255000c1fad440)
Signed-off-by: Pierre Ynard <linkfanel@yahoo.fr>

(cherry picked from commit 4c87b90bf458901e542e7d318ef4c58925421e76)
Signed-off-by: Pierre Ynard <linkfanel@yahoo.fr>