Merge remote-tracking branch 'qatar/release/9' into release/1.1

* qatar/release/9:
  Fix top-level description
  update Changelog

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 72 insertions, 2 deletions

diff --git a/Changelog b/Changelog
index 7dc42e2851..6c67dd9541 100644
--- a/Changelog
+++ b/Changelog
@@ -1,7 +1,77 @@
-Entries are sorted chronologically from oldest to youngest within each release,
-releases are sorted from youngest to oldest.
+Releases are sorted from youngest to oldest.
+
 
 version <next>:
+- alac: Do bounds checking of lpc_order read from the bitstream
+- ape: Don't allow the seektable to be omitted
+- asfdec: Check the return value of asf_read_stream_properties
+- asvdec: Verify the amount of extradata
+- avidec: Make sure a packet is large enough before reading its data
+- bfi: Add some very basic sanity checks for input packet sizes
+- bfi: Avoid divisions by zero
+- cavsdec: Make sure a sequence header has been decoded before decoding pictures
+- dcadec: Validate the lfe parameter
+- dsicin: Add some basic sanity checks for fields read from the file
+- eacmv: Make sure a reference frame exists before referencing it
+- electronicarts: Add more sanity checking for the number of channels
+- electronicarts: Check packet sizes before reading
+- ffv1: Make sure at least one slice context is initialized
+- fraps: Make the input buffer size checks more strict
+- h263dec: Remove a hack that can cause infinite loops
+- idroqdec: Make sure a video stream has been allocated before returning packets
+- ivi_common: Make sure color planes have been initialized
+- lavf: Avoid setting avg_frame_rate if delta_dts is negative
+- mace: Make sure that the channel count is set to a valid value
+- matroskadec: Verify realaudio codec parameters
+- mov: Don't use a negative duration for setting other fields
+- mov: Make sure the read sample count is nonnegative
+- mpc8: Check the seek table size parsed from the bitstream
+- mpc8: Make sure the first stream exists before parsing the seek table
+- mpeg4videodec: Check the width/height in mpeg4_decode_sprite_trajectory
+- mpegaudiodec: Validate that the number of channels fits at the given offset
+- mpegvideo: Initialize chroma_*_shift and codec_tag even if the size is 0
+- mvi: Add sanity checking for the audio frame size
+- mxfdec: set audio timebase to 1/samplerate
+- oggparseogm: Convert to use bytestream2
+- omadec: Properly check lengths before incrementing the position
+- pcx: Check the packet size before assuming it fits a palette
+- pcx: Consume the whole packet if giving up due to missing palette
+- pngdec: Stop trying to decode once inflate returns Z_STREAM_END
+- qpeg: Add checks for running out of rows in qpeg_decode_inter
+- r3d: Add more input value validation
+- riffdec: Add sanity checks for the sample rate
+- rl2: Avoid a division by zero
+- rmdec: Validate the fps value
+- rpza: Fix a buffer size check
+- rv10: Validate the dimensions set from the container
+- rv34: Check the return value from ff_rv34_decode_init
+- segafilm: Validate the number of audio channels
+- shorten: Break out of loop looking for fmt chunk if none is found
+- shorten: Use a checked bytestream reader for the wave header
+- sierravmd: Do sanity checking of frame sizes
+- smacker: Avoid integer overflow when allocating packets
+- smacker: Don't return packets in unallocated streams
+- smacker: Make sure we don't fill in huffman codes out of range
+- svq3: Avoid a division by zero
+- svq3: Check for any negative return value from ff_h264_check_intra_pred_mode
+- truemotion2: Use av_freep properly in an error path
+- twinvqdec: Check the ibps parameter separately
+- vc1dec: Don't decode slices when the latest slice header failed to decode
+- vc1dec: Fix leaks in ff_vc1_decode_init_alloc_tables on errors
+- vc1dec: Make sure last_picture is initialized in vc1_decode_skip_blocks
+- vc1dec: Undo mpegvideo initialization if unable to allocate tables
+- vocdec: Don't update codec parameters mid-stream
+- vp3: Check the framerate for validity
+- vqf: Make sure sample_rate is set to a valid value
+- vqf: Make sure the bitrate is in the valid range
+- wnv1: Make sure the input packet is large enough
+- wtv: Add more sanity checks for a length read from the file
+- xan: Only read within the data that actually was initialized
+- xan: Use bytestream2 to limit reading to within the buffer
+- xmv: Add more sanity checks for parameters read from the bitstream
+- xwma: Avoid division by zero
+- xxan: Disallow odd width
+- zmbvdec: Check the buffer size for uncompressed data
 - 4xm: check that bits per sample is strictly positive
 - 4xm: Check that the read track value is non-negative
 - 4xm: Reject not a multiple of 16 dimension