Merge from 1.1.

--HG--
rename : src/libfaad/Makefile.am => contrib/libfaad/Makefile.am
rename : src/libfaad/analysis.h => contrib/libfaad/analysis.h
rename : src/libfaad/bits.c => contrib/libfaad/bits.c
rename : src/libfaad/bits.h => contrib/libfaad/bits.h
rename : src/libfaad/cfft.c => contrib/libfaad/cfft.c
rename : src/libfaad/cfft.h => contrib/libfaad/cfft.h
rename : src/libfaad/cfft_tab.h => contrib/libfaad/cfft_tab.h
rename : src/libfaad/codebook/hcb.h => contrib/libfaad/codebook/hcb.h
rename : src/libfaad/codebook/hcb_1.h => contrib/libfaad/codebook/hcb_1.h
rename : src/libfaad/codebook/hcb_10.h => contrib/libfaad/codebook/hcb_10.h
rename : src/libfaad/codebook/hcb_11.h => contrib/libfaad/codebook/hcb_11.h
rename : src/libfaad/codebook/hcb_2.h => contrib/libfaad/codebook/hcb_2.h
rename : src/libfaad/codebook/hcb_3.h => contrib/libfaad/codebook/hcb_3.h
rename : src/libfaad/codebook/hcb_4.h => contrib/libfaad/codebook/hcb_4.h
rename : src/libfaad/codebook/hcb_5.h => contrib/libfaad/codebook/hcb_5.h
rename : src/libfaad/codebook/hcb_6.h => contrib/libfaad/codebook/hcb_6.h
rename : src/libfaad/codebook/hcb_7.h => contrib/libfaad/codebook/hcb_7.h
rename : src/libfaad/codebook/hcb_8.h => contrib/libfaad/codebook/hcb_8.h
rename : src/libfaad/codebook/hcb_9.h => contrib/libfaad/codebook/hcb_9.h
rename : src/libfaad/codebook/hcb_sf.h => contrib/libfaad/codebook/hcb_sf.h
rename : src/libfaad/common.c => contrib/libfaad/common.c
rename : src/libfaad/common.h => contrib/libfaad/common.h
rename : src/libfaad/decoder.c => contrib/libfaad/decoder.c
rename : src/libfaad/decoder.h => contrib/libfaad/decoder.h
rename : src/libfaad/drc.c => contrib/libfaad/drc.c
rename : src/libfaad/drc.h => contrib/libfaad/drc.h
rename : src/libfaad/drm_dec.c => contrib/libfaad/drm_dec.c
rename : src/libfaad/drm_dec.h => contrib/libfaad/drm_dec.h
rename : src/libfaad/error.c => contrib/libfaad/error.c
rename : src/libfaad/error.h => contrib/libfaad/error.h
rename : src/libfaad/filtbank.c => contrib/libfaad/filtbank.c
rename : src/libfaad/filtbank.h => contrib/libfaad/filtbank.h
rename : src/libfaad/fixed.h => contrib/libfaad/fixed.h
rename : src/libfaad/hcr.c => contrib/libfaad/hcr.c
rename : src/libfaad/huffman.c => contrib/libfaad/huffman.c
rename : src/libfaad/huffman.h => contrib/libfaad/huffman.h
rename : src/libfaad/ic_predict.c => contrib/libfaad/ic_predict.c
rename : src/libfaad/ic_predict.h => contrib/libfaad/ic_predict.h
rename : src/libfaad/iq_table.h => contrib/libfaad/iq_table.h
rename : src/libfaad/is.c => contrib/libfaad/is.c
rename : src/libfaad/is.h => contrib/libfaad/is.h
rename : src/libfaad/kbd_win.h => contrib/libfaad/kbd_win.h
rename : src/libfaad/lt_predict.c => contrib/libfaad/lt_predict.c
rename : src/libfaad/lt_predict.h => contrib/libfaad/lt_predict.h
rename : src/libfaad/mdct.c => contrib/libfaad/mdct.c
rename : src/libfaad/mdct.h => contrib/libfaad/mdct.h
rename : src/libfaad/mdct_tab.h => contrib/libfaad/mdct_tab.h
rename : src/libfaad/mp4.c => contrib/libfaad/mp4.c
rename : src/libfaad/mp4.h => contrib/libfaad/mp4.h
rename : src/libfaad/ms.c => contrib/libfaad/ms.c
rename : src/libfaad/ms.h => contrib/libfaad/ms.h
rename : src/libfaad/output.c => contrib/libfaad/output.c
rename : src/libfaad/output.h => contrib/libfaad/output.h
rename : src/libfaad/pns.c => contrib/libfaad/pns.c
rename : src/libfaad/pns.h => contrib/libfaad/pns.h
rename : src/libfaad/ps_dec.c => contrib/libfaad/ps_dec.c
rename : src/libfaad/ps_dec.h => contrib/libfaad/ps_dec.h
rename : src/libfaad/ps_syntax.c => contrib/libfaad/ps_syntax.c
rename : src/libfaad/ps_tables.h => contrib/libfaad/ps_tables.h
rename : src/libfaad/pulse.c => contrib/libfaad/pulse.c
rename : src/libfaad/pulse.h => contrib/libfaad/pulse.h
rename : src/libfaad/rvlc.c => contrib/libfaad/rvlc.c
rename : src/libfaad/rvlc.h => contrib/libfaad/rvlc.h
rename : src/libfaad/sbr_dct.c => contrib/libfaad/sbr_dct.c
rename : src/libfaad/sbr_dct.h => contrib/libfaad/sbr_dct.h
rename : src/libfaad/sbr_dec.c => contrib/libfaad/sbr_dec.c
rename : src/libfaad/sbr_dec.h => contrib/libfaad/sbr_dec.h
rename : src/libfaad/sbr_e_nf.c => contrib/libfaad/sbr_e_nf.c
rename : src/libfaad/sbr_e_nf.h => contrib/libfaad/sbr_e_nf.h
rename : src/libfaad/sbr_fbt.c => contrib/libfaad/sbr_fbt.c
rename : src/libfaad/sbr_fbt.h => contrib/libfaad/sbr_fbt.h
rename : src/libfaad/sbr_hfadj.c => contrib/libfaad/sbr_hfadj.c
rename : src/libfaad/sbr_hfadj.h => contrib/libfaad/sbr_hfadj.h
rename : src/libfaad/sbr_hfgen.c => contrib/libfaad/sbr_hfgen.c
rename : src/libfaad/sbr_hfgen.h => contrib/libfaad/sbr_hfgen.h
rename : src/libfaad/sbr_huff.c => contrib/libfaad/sbr_huff.c
rename : src/libfaad/sbr_huff.h => contrib/libfaad/sbr_huff.h
rename : src/libfaad/sbr_noise.h => contrib/libfaad/sbr_noise.h
rename : src/libfaad/sbr_qmf.c => contrib/libfaad/sbr_qmf.c
rename : src/libfaad/sbr_qmf.h => contrib/libfaad/sbr_qmf.h
rename : src/libfaad/sbr_qmf_c.h => contrib/libfaad/sbr_qmf_c.h
rename : src/libfaad/sbr_syntax.c => contrib/libfaad/sbr_syntax.c
rename : src/libfaad/sbr_syntax.h => contrib/libfaad/sbr_syntax.h
rename : src/libfaad/sbr_tf_grid.c => contrib/libfaad/sbr_tf_grid.c
rename : src/libfaad/sbr_tf_grid.h => contrib/libfaad/sbr_tf_grid.h
rename : src/libfaad/sine_win.h => contrib/libfaad/sine_win.h
rename : src/libfaad/specrec.c => contrib/libfaad/specrec.c
rename : src/libfaad/specrec.h => contrib/libfaad/specrec.h
rename : src/libfaad/ssr.c => contrib/libfaad/ssr.c
rename : src/libfaad/ssr.h => contrib/libfaad/ssr.h
rename : src/libfaad/ssr_fb.c => contrib/libfaad/ssr_fb.c
rename : src/libfaad/ssr_fb.h => contrib/libfaad/ssr_fb.h
rename : src/libfaad/ssr_ipqf.c => contrib/libfaad/ssr_ipqf.c
rename : src/libfaad/ssr_ipqf.h => contrib/libfaad/ssr_ipqf.h
rename : src/libfaad/ssr_win.h => contrib/libfaad/ssr_win.h
rename : src/libfaad/structs.h => contrib/libfaad/structs.h
rename : src/libfaad/syntax.c => contrib/libfaad/syntax.c
rename : src/libfaad/syntax.h => contrib/libfaad/syntax.h
rename : src/libfaad/tns.c => contrib/libfaad/tns.c
rename : src/libfaad/tns.h => contrib/libfaad/tns.h
rename : src/libfaad/xine_faad_decoder.c => src/audio_dec/xine_faad_decoder.c
rename : src/demuxers/demux_ogg.c => src/combined/xine_ogg_demuxer.c

20 files changed, 141 insertions, 304 deletions

diff --git a/.hgignore b/.hgignore
index 73e070a4a..66cdc714c 100644
--- a/.hgignore
+++ b/.hgignore
@@ -18,6 +18,7 @@ Makefile
 Makefile.in
 
 ABOUT-NLS
+INSTALL
 aclocal.m4
 compile
 configure
diff --git a/ChangeLog b/ChangeLog
index daaede4fd..c93e19af5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -69,10 +69,21 @@ xine-lib (1.1.90) (Unreleased)
     colour controls, zooming, colour keying.
 
 xine-lib (1.1.15) 2008-??-??
-  * Use external ffmpeg by default.
-  * V4L: Don't segfault if asked for an input that doesn't exist
+  * Security fixes:
+    - Fix crashes with various corrupted media files, including Ogg.
+      (CVE-2008-3231)
+      This includes a libfaad update from the 1.2 branch.
+    - Delay V4L video frame preallocation until we know how large they'll be.
+  * Use external ffmpeg and libfaad by default.
+  * V4L: Don't segfault if asked for an input that doesn't exist.
   * Recognise AMR audio (normally found in 3GP files).
   * Recognise Snow video.
+  * Xv deinterlacing didn't take the size of the deinterlaced image into
+    account; on some chipsets, this would cause image corruption, while on
+    others, there would be no problem.
+  * V4L: only try and set the tuner if we're going to use it. Setting the tuner
+    when using baseband video (CVBS, S-Video) breaks the input.
+  * Fix crashes with MP3 files with metadata consisting only of separators.
 
 xine-lib (1.1.14) 2008-06-29
   * DVB changes:
diff --git a/INSTALL b/INSTALL
deleted file mode 100644
index 5458714e1..000000000
--- a/INSTALL
+++ /dev/null
@@ -1,234 +0,0 @@
-Installation Instructions
-*************************
-
-Copyright (C) 1994, 1995, 1996, 1999, 2000, 2001, 2002, 2004, 2005,
-2006 Free Software Foundation, Inc.
-
-This file is free documentation; the Free Software Foundation gives
-unlimited permission to copy, distribute and modify it.
-
-Basic Installation
-==================
-
-Briefly, the shell commands `./configure; make; make install' should
-configure, build, and install this package.  The following
-more-detailed instructions are generic; see the `README' file for
-instructions specific to this package.
-
-   The `configure' shell script attempts to guess correct values for
-various system-dependent variables used during compilation.  It uses
-those values to create a `Makefile' in each directory of the package.
-It may also create one or more `.h' files containing system-dependent
-definitions.  Finally, it creates a shell script `config.status' that
-you can run in the future to recreate the current configuration, and a
-file `config.log' containing compiler output (useful mainly for
-debugging `configure').
-
-   It can also use an optional file (typically called `config.cache'
-and enabled with `--cache-file=config.cache' or simply `-C') that saves
-the results of its tests to speed up reconfiguring.  Caching is
-disabled by default to prevent problems with accidental use of stale
-cache files.
-
-   If you need to do unusual things to compile the package, please try
-to figure out how `configure' could check whether to do them, and mail
-diffs or instructions to the address given in the `README' so they can
-be considered for the next release.  If you are using the cache, and at
-some point `config.cache' contains results you don't want to keep, you
-may remove or edit it.
-
-   The file `configure.ac' (or `configure.in') is used to create
-`configure' by a program called `autoconf'.  You need `configure.ac' if
-you want to change it or regenerate `configure' using a newer version
-of `autoconf'.
-
-The simplest way to compile this package is:
-
-  1. `cd' to the directory containing the package's source code and type
-     `./configure' to configure the package for your system.
-
-     Running `configure' might take a while.  While running, it prints
-     some messages telling which features it is checking for.
-
-  2. Type `make' to compile the package.
-
-  3. Optionally, type `make check' to run any self-tests that come with
-     the package.
-
-  4. Type `make install' to install the programs and any data files and
-     documentation.
-
-  5. You can remove the program binaries and object files from the
-     source code directory by typing `make clean'.  To also remove the
-     files that `configure' created (so you can compile the package for
-     a different kind of computer), type `make distclean'.  There is
-     also a `make maintainer-clean' target, but that is intended mainly
-     for the package's developers.  If you use it, you may have to get
-     all sorts of other programs in order to regenerate files that came
-     with the distribution.
-
-Compilers and Options
-=====================
-
-Some systems require unusual options for compilation or linking that the
-`configure' script does not know about.  Run `./configure --help' for
-details on some of the pertinent environment variables.
-
-   You can give `configure' initial values for configuration parameters
-by setting variables in the command line or in the environment.  Here
-is an example:
-
-     ./configure CC=c99 CFLAGS=-g LIBS=-lposix
-
-   *Note Defining Variables::, for more details.
-
-Compiling For Multiple Architectures
-====================================
-
-You can compile the package for more than one kind of computer at the
-same time, by placing the object files for each architecture in their
-own directory.  To do this, you can use GNU `make'.  `cd' to the
-directory where you want the object files and executables to go and run
-the `configure' script.  `configure' automatically checks for the
-source code in the directory that `configure' is in and in `..'.
-
-   With a non-GNU `make', it is safer to compile the package for one
-architecture at a time in the source code directory.  After you have
-installed the package for one architecture, use `make distclean' before
-reconfiguring for another architecture.
-
-Installation Names
-==================
-
-By default, `make install' installs the package's commands under
-`/usr/local/bin', include files under `/usr/local/include', etc.  You
-can specify an installation prefix other than `/usr/local' by giving
-`configure' the option `--prefix=PREFIX'.
-
-   You can specify separate installation prefixes for
-architecture-specific files and architecture-independent files.  If you
-pass the option `--exec-prefix=PREFIX' to `configure', the package uses
-PREFIX as the prefix for installing programs and libraries.
-Documentation and other data files still use the regular prefix.
-
-   In addition, if you use an unusual directory layout you can give
-options like `--bindir=DIR' to specify different values for particular
-kinds of files.  Run `configure --help' for a list of the directories
-you can set and what kinds of files go in them.
-
-   If the package supports it, you can cause programs to be installed
-with an extra prefix or suffix on their names by giving `configure' the
-option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'.
-
-Optional Features
-=================
-
-Some packages pay attention to `--enable-FEATURE' options to
-`configure', where FEATURE indicates an optional part of the package.
-They may also pay attention to `--with-PACKAGE' options, where PACKAGE
-is something like `gnu-as' or `x' (for the X Window System).  The
-`README' should mention any `--enable-' and `--with-' options that the
-package recognizes.
-
-   For packages that use the X Window System, `configure' can usually
-find the X include and library files automatically, but if it doesn't,
-you can use the `configure' options `--x-includes=DIR' and
-`--x-libraries=DIR' to specify their locations.
-
-Specifying the System Type
-==========================
-
-There may be some features `configure' cannot figure out automatically,
-but needs to determine by the type of machine the package will run on.
-Usually, assuming the package is built to be run on the _same_
-architectures, `configure' can figure that out, but if it prints a
-message saying it cannot guess the machine type, give it the
-`--build=TYPE' option.  TYPE can either be a short name for the system
-type, such as `sun4', or a canonical name which has the form:
-
-     CPU-COMPANY-SYSTEM
-
-where SYSTEM can have one of these forms:
-
-     OS KERNEL-OS
-
-   See the file `config.sub' for the possible values of each field.  If
-`config.sub' isn't included in this package, then this package doesn't
-need to know the machine type.
-
-   If you are _building_ compiler tools for cross-compiling, you should
-use the option `--target=TYPE' to select the type of system they will
-produce code for.
-
-   If you want to _use_ a cross compiler, that generates code for a
-platform different from the build platform, you should specify the
-"host" platform (i.e., that on which the generated programs will
-eventually be run) with `--host=TYPE'.
-
-Sharing Defaults
-================
-
-If you want to set default values for `configure' scripts to share, you
-can create a site shell script called `config.site' that gives default
-values for variables like `CC', `cache_file', and `prefix'.
-`configure' looks for `PREFIX/share/config.site' if it exists, then
-`PREFIX/etc/config.site' if it exists.  Or, you can set the
-`CONFIG_SITE' environment variable to the location of the site script.
-A warning: not all `configure' scripts look for a site script.
-
-Defining Variables
-==================
-
-Variables not defined in a site shell script can be set in the
-environment passed to `configure'.  However, some packages may run
-configure again during the build, and the customized values of these
-variables may be lost.  In order to avoid this problem, you should set
-them in the `configure' command line, using `VAR=value'.  For example:
-
-     ./configure CC=/usr/local2/bin/gcc
-
-causes the specified `gcc' to be used as the C compiler (unless it is
-overridden in the site shell script).
-
-Unfortunately, this technique does not work for `CONFIG_SHELL' due to
-an Autoconf bug.  Until the bug is fixed you can use this workaround:
-
-     CONFIG_SHELL=/bin/bash /bin/bash ./configure CONFIG_SHELL=/bin/bash
-
-`configure' Invocation
-======================
-
-`configure' recognizes the following options to control how it operates.
-
-`--help'
-`-h'
-     Print a summary of the options to `configure', and exit.
-
-`--version'
-`-V'
-     Print the version of Autoconf used to generate the `configure'
-     script, and exit.
-
-`--cache-file=FILE'
-     Enable the cache: use and save the results of the tests in FILE,
-     traditionally `config.cache'.  FILE defaults to `/dev/null' to
-     disable caching.
-
-`--config-cache'
-`-C'
-     Alias for `--cache-file=config.cache'.
-
-`--quiet'
-`--silent'
-`-q'
-     Do not print messages saying which checks are being made.  To
-     suppress all normal output, redirect it to `/dev/null' (any error
-     messages will still be shown).
-
-`--srcdir=DIR'
-     Look for the package's source code in directory DIR.  Usually
-     `configure' can determine that directory automatically.
-
-`configure' also accepts some other, not widely useful, options.  Run
-`configure --help' for more details.
-
diff --git a/m4/attributes.m4 b/m4/attributes.m4
index 3fee49ab5..9c4a0c89a 100644
--- a/m4/attributes.m4
+++ b/m4/attributes.m4
@@ -42,7 +42,7 @@ AC_DEFUN([CC_CHECK_CFLAGS_SILENT], [
      CFLAGS="$ac_save_CFLAGS"
     ])
 
-  AS_IF([test x$]AS_TR_SH([cc_cv_cflags_$1])[ = xyes],
+  AS_IF([eval test x$]AS_TR_SH([cc_cv_cflags_$1])[ = xyes],
     [$2], [$3])
 ])
 
@@ -52,7 +52,7 @@ AC_DEFUN([CC_CHECK_CFLAGS], [
     CC_CHECK_CFLAGS_SILENT([$1]) dnl Don't execute actions here!
   )
 
-  AS_IF([test x$]AS_TR_SH([cc_cv_cflags_$1])[ = xyes],
+  AS_IF([eval test x$]AS_TR_SH([cc_cv_cflags_$1])[ = xyes],
     [$2], [$3])
 ])
 
@@ -67,7 +67,7 @@ AC_DEFUN([CC_CHECK_LDFLAGS], [
      LDFLAGS="$ac_save_LDFLAGS"
     ])
 
-  AS_IF([test x$]AS_TR_SH([cc_cv_ldflags_$1])[ = xyes],
+  AS_IF([eval test x$]AS_TR_SH([cc_cv_ldflags_$1])[ = xyes],
     [$2], [$3])
 ])
 
@@ -100,7 +100,7 @@ AC_DEFUN([CC_CHECK_ATTRIBUTE], [
      CFLAGS="$ac_save_CFLAGS"
     ])
 
-  AS_IF([test x$]AS_TR_SH([cc_cv_attribute_$1])[ = xyes],
+  AS_IF([eval test x$]AS_TR_SH([cc_cv_attribute_$1])[ = xyes],
     [AC_DEFINE(
        AS_TR_CPP([SUPPORT_ATTRIBUTE_$1]), 1,
          [Define this if the compiler supports __attribute__(( ifelse([$2], , [$1], [$2]) ))]
diff --git a/src/combined/xine_ogg_demuxer.c b/src/combined/xine_ogg_demuxer.c
index 670c19781..036d2f0fc 100644
--- a/src/combined/xine_ogg_demuxer.c
+++ b/src/combined/xine_ogg_demuxer.c
@@ -1373,7 +1373,7 @@ static void send_header (demux_ogg_t *this) {
   this->ignore_keyframes = 0;
 
   while (!done) {
-    if (!read_ogg_packet(this)) {
+    if (!read_ogg_packet(this) || !this->og.header || !this->og.body) {
       return;
     }
     /* now we've got at least one new page */
@@ -1499,6 +1499,12 @@ static int demux_ogg_send_chunk (demux_plugin_t *this_gen) {
     return this->status;
   }
 
+  if (!this->og.header || !this->og.body) {
+    this->status = DEMUX_FINISHED;
+    lprintf ("EOF\n");
+    return this->status;
+  }
+
   /* now we've got one new page */
 
   cur_serno = ogg_page_serialno (&this->og);
diff --git a/src/demuxers/asfheader.c b/src/demuxers/asfheader.c
index ebc739073..9639ea4f7 100644
--- a/src/demuxers/asfheader.c
+++ b/src/demuxers/asfheader.c
@@ -540,12 +540,12 @@ static int asf_header_parse_metadata(asf_header_t *header_pub, uint8_t *buffer,
     if (data_len >= 4)

     {

       char *name = asf_reader_get_string (&reader, name_len, iconv_cd);

-      if (!strcmp (name, "AspectRatioX"))

+      if (name && !strcmp (name, "AspectRatioX"))

       {

         asf_reader_get_32 (&reader, &header->pub.aspect_ratios[stream_id].x);

         data_len -= 4;

       }

-      else if (!strcmp (name, "AspectRatioY"))

+      else if (name && !strcmp (name, "AspectRatioY"))

       {

         asf_reader_get_32 (&reader, &header->pub.aspect_ratios[stream_id].y);

         data_len -= 4;

diff --git a/src/demuxers/demux_asf.c b/src/demuxers/demux_asf.c
index e361579b0..ff2d1e6a8 100644
--- a/src/demuxers/demux_asf.c
+++ b/src/demuxers/demux_asf.c
@@ -70,6 +70,7 @@
 #define ASF_MODE_HTTP_REF          2
 #define ASF_MODE_ASF_REF           3
 #define ASF_MODE_ENCRYPTED_CONTENT 4
+#define ASF_MODE_NO_CONTENT        5
 
 typedef struct {
   int                 seq;
@@ -443,6 +444,17 @@ static int asf_read_header (demux_asf_t *this) {
     asf_stream_t *asf_stream = this->asf_header->streams[i];
     asf_demux_stream_t *demux_stream = &this->streams[i];
 
+    if (!asf_stream) {
+      if (this->mode != ASF_MODE_NO_CONTENT) {
+	xine_log(this->stream->xine, XINE_LOG_MSG,
+		 _("demux_asf: warning: A stream appears to be missing.\n"));
+	_x_message(this->stream, XINE_MSG_READ_ERROR,
+		   _("Media stream missing?"), NULL);
+	this->mode = ASF_MODE_NO_CONTENT;
+      }
+      return 0;
+    }
+
     if (asf_stream->encrypted_flag) {
       if (this->mode != ASF_MODE_ENCRYPTED_CONTENT) {
 	xine_log(this->stream->xine, XINE_LOG_MSG,
@@ -1675,6 +1687,7 @@ static int demux_asf_send_chunk (demux_plugin_t *this_gen) {
       return demux_asf_parse_asf_references(this);
 
     case ASF_MODE_ENCRYPTED_CONTENT:
+    case ASF_MODE_NO_CONTENT:
       this->status = DEMUX_FINISHED;
       return this->status;
 
diff --git a/src/demuxers/demux_avi.c b/src/demuxers/demux_avi.c
index 0f1735f96..3c1c8491a 100644
--- a/src/demuxers/demux_avi.c
+++ b/src/demuxers/demux_avi.c
@@ -317,6 +317,8 @@ typedef struct {
                                       getIndex==0, but an operation has been
                                       performed that needs an index */
 
+#define AVI_ERR_BAD_SIZE    14     /* A chunk has an invalid size */
+
 #define AVI_HEADER_UNKNOWN  -1
 #define AVI_HEADER_AUDIO     0
 #define AVI_HEADER_VIDEO     1
@@ -780,7 +782,7 @@ static avi_t *XINE_MALLOC AVI_init(demux_avi_t *this) {
     lprintf("chunk: %c%c%c%c, size: %" PRId64 "\n",
             data[0], data[1], data[2], data[3], (int64_t)n);
     
-    if((strncasecmp(data,"LIST",4) == 0) && (n >= 4)) {
+    if (n >= 4 && strncasecmp(data,"LIST",4) == 0) {
       if( this->input->read(this->input, data,4) != 4 ) ERR_EXIT(AVI_ERR_READ);
       n -= 4;
       
@@ -835,6 +837,8 @@ static avi_t *XINE_MALLOC AVI_init(demux_avi_t *this) {
   /* Interpret the header list */
 
   for (i = 0; i < hdrl_len;) {
+    const int old_i = i;
+
     /* List tags are completly ignored */
     lprintf("tag: %c%c%c%c\n",
             hdrl_data[i], hdrl_data[i+1], hdrl_data[i+2], hdrl_data[i+3]);
@@ -1081,6 +1085,8 @@ static avi_t *XINE_MALLOC AVI_init(demux_avi_t *this) {
       lasttag = 0;
     }
     i += n;
+    if (i <= old_i)
+      ERR_EXIT(AVI_ERR_BAD_SIZE);
   }
 
   if( hdrl_data )
diff --git a/src/demuxers/demux_matroska.c b/src/demuxers/demux_matroska.c
index b0919036f..9bba40155 100644
--- a/src/demuxers/demux_matroska.c
+++ b/src/demuxers/demux_matroska.c
@@ -106,7 +106,7 @@ typedef struct {
 
   /* block */
   uint8_t             *block_data;
-  int                  block_data_size;
+  size_t               block_data_size;
 
   /* current tracks */
   matroska_track_t    *video_track;   /* to remove */
@@ -875,7 +875,7 @@ static void init_codec_vobsub(demux_matroska_t *this,
 
 static void handle_realvideo (demux_plugin_t *this_gen, matroska_track_t *track,
                               int decoder_flags,
-                              uint8_t *data, int data_len,
+                              uint8_t *data, size_t data_len,
                               int64_t data_pts, int data_duration,
                               int input_normpos, int input_time) {
   demux_matroska_t *this = (demux_matroska_t *) this_gen;
@@ -924,7 +924,7 @@ static void handle_realvideo (demux_plugin_t *this_gen, matroska_track_t *track,
 
 static void handle_sub_ssa (demux_plugin_t *this_gen, matroska_track_t *track,
                             int decoder_flags,
-                            uint8_t *data, int data_len,
+                            uint8_t *data, size_t data_len,
                             int64_t data_pts, int data_duration,
                             int input_normpos, int input_time) {
   buf_element_t *buf;
@@ -999,7 +999,7 @@ static void handle_sub_ssa (demux_plugin_t *this_gen, matroska_track_t *track,
 
 static void handle_sub_utf8 (demux_plugin_t *this_gen, matroska_track_t *track,
                              int decoder_flags,
-                             uint8_t *data, int data_len,
+                             uint8_t *data, size_t data_len,
                              int64_t data_pts, int data_duration,
                              int input_normpos, int input_time) {
   demux_matroska_t *this = (demux_matroska_t *) this_gen;
@@ -1046,7 +1046,7 @@ static void handle_sub_utf8 (demux_plugin_t *this_gen, matroska_track_t *track,
  */
 static void handle_vobsub (demux_plugin_t *this_gen, matroska_track_t *track,
                            int decoder_flags,
-                           uint8_t *data, int data_len,
+                           uint8_t *data, size_t data_len,
                            int64_t data_pts, int data_duration,
                            int input_normpos, int input_time) {
   demux_matroska_t *this = (demux_matroska_t *) this_gen;
@@ -1735,7 +1735,7 @@ static int parse_tags(demux_matroska_t *this) {
   return 1;
 }
 
-static void alloc_block_data (demux_matroska_t *this, int len) {
+static void alloc_block_data (demux_matroska_t *this, size_t len) {
   /* memory management */
   if (this->block_data_size < len) {
     this->block_data = realloc(this->block_data, len);
@@ -1804,7 +1804,7 @@ static int find_track_by_id(demux_matroska_t *this, int track_num,
 }
 
 
-static int read_block_data (demux_matroska_t *this, int len) {
+static int read_block_data (demux_matroska_t *this, size_t len) {
   alloc_block_data(this, len);
 
   /* block datas */
@@ -1827,7 +1827,7 @@ static int parse_int16(uint8_t *data) {
   return value;
 }
 
-static int parse_block (demux_matroska_t *this, uint64_t block_size,
+static int parse_block (demux_matroska_t *this, size_t block_size,
                         uint64_t cluster_timecode, uint64_t block_duration,
                         int normpos, int is_key) {
   matroska_track_t *track;
@@ -1893,7 +1893,7 @@ static int parse_block (demux_matroska_t *this, uint64_t block_size,
   }
 
   if (lacing == MATROSKA_NO_LACING) {
-    int block_size_left;
+    size_t block_size_left;
     lprintf("no lacing\n");
 
     block_size_left = (this->block_data + block_size) - data;
@@ -1913,9 +1913,9 @@ static int parse_block (demux_matroska_t *this, uint64_t block_size,
     }
   } else {
 
-    int block_size_left;
+    size_t block_size_left;
     uint8_t lace_num;
-    int frame[MAX_FRAMES];
+    size_t frame[MAX_FRAMES];
     int i;
 
     /* number of laced frames */
@@ -2056,7 +2056,7 @@ static int parse_block_group(demux_matroska_t *this,
   off_t block_pos         = 0;
   off_t file_len          = 0;
   int normpos             = 0;
-  int block_len           = 0;
+  size_t block_len        = 0;
   int is_key              = 1;
 
   while (next_level == 3) {
diff --git a/src/demuxers/demux_mng.c b/src/demuxers/demux_mng.c
index f54245744..499811d54 100644
--- a/src/demuxers/demux_mng.c
+++ b/src/demuxers/demux_mng.c
@@ -116,7 +116,9 @@ static mng_bool mymng_process_header(mng_handle mngh, mng_uint32 width, mng_uint
   this->bih.biHeight = height;
   this->left_edge = (this->bih.biWidth - width) / 2;
 
-  this->image = malloc(this->bih.biWidth * height * 3);
+  this->image = malloc((mng_size_t)this->bih.biWidth * (mng_size_t)height * 3);
+  if (!this->image)
+    return MNG_FALSE;
 
   mng_set_canvasstyle(mngh, MNG_CANVAS_RGB8);
 
diff --git a/src/demuxers/demux_mod.c b/src/demuxers/demux_mod.c
index c424ffc81..ab5157531 100644
--- a/src/demuxers/demux_mod.c
+++ b/src/demuxers/demux_mod.c
@@ -70,7 +70,7 @@ typedef struct {
   char                *title;
   char                *artist;
   char                *copyright;
-  off_t                filesize;
+  size_t               filesize;
   
   char                *buffer;
 
@@ -131,7 +131,11 @@ static int open_mod_file(demux_mod_t *this) {
   /* Get size and create buffer */
   this->filesize = this->input->get_length(this->input);
   this->buffer = (char *)malloc(this->filesize);
-  
+  if(!this->buffer) {
+    xine_log(this->stream->xine, XINE_LOG_PLUGIN, "modplug - allocation failure\n");
+    return 0;
+  }
+
   /* Seek to beginning */
   this->input->seek(this->input, 0, SEEK_SET);
   
diff --git a/src/demuxers/demux_real.c b/src/demuxers/demux_real.c
index 105dc60a5..00e5f49fe 100644
--- a/src/demuxers/demux_real.c
+++ b/src/demuxers/demux_real.c
@@ -90,11 +90,11 @@ typedef struct {
   uint32_t   start_time;
   uint32_t   preroll;
   uint32_t   duration;
-  char       stream_name_size;
+  size_t     stream_name_size;
   char      *stream_name;
-  char       mime_type_size;
+  size_t     mime_type_size;
   char      *mime_type;
-  uint32_t   type_specific_len;
+  size_t     type_specific_len;
   char      *type_specific_data;
 } mdpr_t;
 
@@ -115,7 +115,7 @@ typedef struct {
   mdpr_t              *mdpr;
   int                  sps, cfs, w, h;
   int                  block_align;
-  int                  frame_size;
+  size_t               frame_size;
   uint8_t             *frame_buffer;
   uint32_t             frame_num_bytes;
   uint32_t             sub_packet_cnt;
@@ -359,8 +359,12 @@ static void real_parse_audio_specific_data (demux_real_t *this,
   stream->frame_num_bytes = 0;
   stream->sub_packet_cnt = 0;
 
+  if (!stream->frame_buffer)
+    xprintf (this->stream->xine, XINE_VERBOSITY_LOG,
+	     "demux_real: failed to allocate the audio frame buffer!\n");
+
   xprintf (this->stream->xine, XINE_VERBOSITY_LOG,
-           "demux_real: buf type 0x%08x frame size %dblock align %d\n", stream->buf_type,
+           "demux_real: buf type 0x%08x frame size %zu block align %d\n", stream->buf_type,
 	   stream->frame_size, stream->block_align);
 
 }
@@ -1370,13 +1374,20 @@ static int demux_real_send_chunk(demux_plugin_t *this_gen) {
       int cfs = this->audio_stream->cfs;
       int w = this->audio_stream->w;
       int spc = this->audio_stream->sub_packet_cnt;
-      int x, pos;
+      int x;
+      off_t pos;
+      const size_t fs = this->audio_stream->frame_size;
+
+      if (!buffer) {
+        this->status = DEMUX_FINISHED;
+        return this->status;
+      }
 
       switch (this->audio_stream->buf_type) {
       case BUF_AUDIO_28_8:
 	for (x = 0; x < sph / 2; x++) {
 	  pos = x * 2 * w + spc * cfs;
-	  if(this->input->read(this->input, buffer + pos, cfs) < cfs) {
+	  if(pos + cfs > fs || this->input->read(this->input, buffer + pos, cfs) < cfs) {
 	    xprintf(this->stream->xine, XINE_VERBOSITY_DEBUG, 
 		    "demux_real: failed to read audio chunk\n");
 	    
@@ -1389,7 +1400,7 @@ static int demux_real_send_chunk(demux_plugin_t *this_gen) {
       case BUF_AUDIO_ATRK:
 	for (x = 0; x < w / sps; x++) {
 	  pos = sps * (sph * x + ((sph + 1) / 2) * (spc & 1) + (spc >> 1));
-	  if(this->input->read(this->input, buffer + pos, sps) < sps) {
+	  if(pos + sps > fs || this->input->read(this->input, buffer + pos, sps) < sps) {
 	    xprintf(this->stream->xine, XINE_VERBOSITY_DEBUG, 
 		    "demux_real: failed to read audio chunk\n");
 	    
@@ -1400,7 +1411,7 @@ static int demux_real_send_chunk(demux_plugin_t *this_gen) {
 	break;
       case BUF_AUDIO_SIPRO:
 	pos = spc * w;
-	if(this->input->read(this->input, buffer + pos, w) < w) {
+	if(pos + w > fs || this->input->read(this->input, buffer + pos, w) < w) {
 	  xprintf(this->stream->xine, XINE_VERBOSITY_DEBUG, 
 		  "demux_real: failed to read audio chunk\n");
 	    
diff --git a/src/demuxers/demux_realaudio.c b/src/demuxers/demux_realaudio.c
index 1040d42bc..75c20d61f 100644
--- a/src/demuxers/demux_realaudio.c
+++ b/src/demuxers/demux_realaudio.c
@@ -67,7 +67,7 @@ typedef struct {
   uint32_t             cfs;
   uint16_t             w, h;
   int                  frame_len;
-  int                  frame_size;
+  size_t               frame_size;
   uint8_t             *frame_buffer;
 
   unsigned char       *header;
diff --git a/src/demuxers/id3.h b/src/demuxers/id3.h
index 837d8243f..d69642f4a 100644
--- a/src/demuxers/id3.h
+++ b/src/demuxers/id3.h
@@ -104,22 +104,22 @@ typedef struct {
   uint32_t  id;
   uint8_t   revision;
   uint8_t   flags;
-  uint32_t  size;
+  size_t    size;
 } id3v2_header_t;
 
 typedef struct {
   uint32_t  id;
-  uint32_t  size;
+  size_t    size;
 } id3v22_frame_header_t;
 
 typedef struct {
   uint32_t  id;
-  uint32_t  size;
+  size_t    size;
   uint16_t  flags;
 } id3v23_frame_header_t;
 
 typedef struct {
-  uint32_t  size;
+  size_t    size;
   uint16_t  flags;
   uint32_t  padding_size;
   uint32_t  crc;
@@ -129,12 +129,12 @@ typedef id3v2_header_t id3v24_footer_t;
 
 typedef struct {
   uint32_t  id;
-  uint32_t  size;
+  size_t    size;
   uint16_t  flags;
 } id3v24_frame_header_t;
 
 typedef struct {
-  uint32_t  size;
+  size_t    size;
   uint8_t   flags;
   uint32_t  crc;
   uint8_t   restrictions;
diff --git a/src/demuxers/iff.h b/src/demuxers/iff.h
index fcfc54f16..921963c08 100644
--- a/src/demuxers/iff.h
+++ b/src/demuxers/iff.h
@@ -27,8 +27,8 @@
 #define IFFP_IFF_H
 
 #define IFF_OKAY                        0L
-#define CLIENT_ERROR                    1L
-#define NOFILE                          5L
+#define IFF_CLIENT_ERROR                1L
+#define IFF_NOFILE                      5L
 
 #define FOURCC_CHUNK BE_FOURCC
 #define IFF_16SV_CHUNK FOURCC_CHUNK('1', '6', 'S', 'V')
diff --git a/src/input/input_cdda.c b/src/input/input_cdda.c
index 1d4665273..ff14b5790 100644
--- a/src/input/input_cdda.c
+++ b/src/input/input_cdda.c
@@ -1454,7 +1454,7 @@ static int _cdda_load_cached_cddb_infos(cdda_input_plugin_t *this) {
 	    if (sscanf(buffer, "DTITLE=%s", &buf[0]) == 1) {
 	      char *pt, *artist, *title;
 
-	      pt = strrchr(buffer, '=');
+	      pt = strchr(buffer, '=');
 	      if (pt) {
 		pt++;
 
@@ -1494,7 +1494,7 @@ static int _cdda_load_cached_cddb_infos(cdda_input_plugin_t *this) {
 	    else if (sscanf(buffer, "TTITLE%d=%s", &tnum, &buf[0]) == 2) {
 	      char *pt;
 
-	      pt = strrchr(buffer, '=');
+	      pt = strchr(buffer, '=');
 	      if (pt)
 		pt++;
 	      if (this->cddb.track[tnum].title == NULL)
@@ -2438,15 +2438,31 @@ static int cdda_plugin_open (input_plugin_t *this_gen ) {
   }
 
   if(this->cddb.track[this->track].title) {
-    lprintf("Track %d Title: %s\n", this->track+1, this->cddb.track[this->track].title);
-
-    _x_meta_info_set_utf8(this->stream, XINE_META_INFO_TITLE, this->cddb.track[this->track].title);
-  }
+    /* Check for track 'titles' of the form <artist> / <title>. */ 
+    char *pt;
+    pt = strstr(this->cddb.track[this->track].title, " / ");
+    if (pt != NULL) {
+      char *track_artist;
+      track_artist = strdup(this->cddb.track[this->track].title);
+      track_artist[pt - this->cddb.track[this->track].title] = 0;
+      lprintf("Track %d Artist: %s\n", this->track+1, track_artist);
+
+      _x_meta_info_set_utf8(this->stream, XINE_META_INFO_ARTIST, track_artist);
+      free(track_artist);
+      pt += 3;
+    }
+    else {
+      if(this->cddb.disc_artist) {
+	lprintf("Disc Artist: %s\n", this->cddb.disc_artist);
+	
+	_x_meta_info_set_utf8(this->stream, XINE_META_INFO_ARTIST, this->cddb.disc_artist);
+      }
   
-  if(this->cddb.disc_artist) {
-    lprintf("Disc Artist: %s\n", this->cddb.disc_artist);
+      pt = this->cddb.track[this->track].title;
+    }
+    lprintf("Track %d Title: %s\n", this->track+1, pt);
 
-    _x_meta_info_set_utf8(this->stream, XINE_META_INFO_ARTIST, this->cddb.disc_artist);
+    _x_meta_info_set_utf8(this->stream, XINE_META_INFO_TITLE, pt);
   }
   
   if(this->cddb.disc_category) {
diff --git a/src/input/input_dvb.c b/src/input/input_dvb.c
index bf62a0ff0..03ab71bd9 100644
--- a/src/input/input_dvb.c
+++ b/src/input/input_dvb.c
@@ -1650,21 +1650,22 @@ static void load_epg_data(dvb_input_plugin_t *this)
 }
 
 /* Prints text to an area, tries to cut the lines in between words. */
-static void render_text_area(osd_renderer_t* renderer, osd_object_t* osd, char* text,
+static void render_text_area(osd_renderer_t* renderer, osd_object_t* osd, const char* text,
 			     int x, int y, int row_space, 
 			     int max_x, int max_y, int* height, int color_base) {
 
   /* The position of the text to be printed. */
-  char* cursor = text;
+  const char* cursor = text;
+  const char *const text_end = text + strlen(text);
 
   /* The line to be printed next. */
   char text_line[512];
   int text_width, text_height;
   size_t old_line_length, line_cursor;
-  char* bound, *old_bound;
+  const char* bound, *old_bound;
   
   *height = 0;
-  while (cursor < text + strlen(text)) {
+  while (cursor < text_end) {
     bound = cursor;
     line_cursor = 0;
     text_line[0] = '\0';
@@ -1721,7 +1722,7 @@ static void render_text_area(osd_renderer_t* renderer, osd_object_t* osd, char*
       }
   
       /* OK, it did fit, let's try to fit some more. */
-    } while (bound < text + strlen(text));
+    } while (bound < text_end);
     
     if (y + text_height + row_space > max_y) {
 	break;
diff --git a/src/input/input_v4l.c b/src/input/input_v4l.c
index 93725167f..753c99543 100644
--- a/src/input/input_v4l.c
+++ b/src/input/input_v4l.c
@@ -569,6 +569,12 @@ static int set_frequency(v4l_input_plugin_t *this, unsigned long frequency)
     fd = this->radio_fd;
   
   if (frequency != 0) {
+    /* FIXME: Don't assume tuner 0 ? */
+    this->tuner = 0;
+    ret = ioctl(fd, VIDIOCSTUNER, &this->tuner);
+    lprintf("(%d) Response on set tuner to %d\n", ret, this->tuner);
+    this->video_tuner.tuner = this->tuner;
+
     if (this->video_tuner.flags & VIDEO_TUNER_LOW) {
       this->calc_frequency = frequency * 16;
     } else {
@@ -704,16 +710,6 @@ static int search_by_channel(v4l_input_plugin_t *this, char *input_source)
         ret = ioctl(fd, VIDIOCSCHAN, &this->input);
     
     lprintf("(%d) Set channel to %d\n", ret, this->input);
-
-    /* FIXME: Don't assume tuner 0 ? */
-    
-    this->tuner = 0;
-    
-    ret = ioctl(fd, VIDIOCSTUNER, &this->tuner);
-    
-    lprintf("(%d) Response on set tuner to %d\n", ret, this->tuner);
-    
-    this->video_tuner.tuner = this->tuner;
   } else {
     xprintf(this->stream->xine, XINE_VERBOSITY_LOG, 
             "input_v4l: Not setting video source. No source given\n");
@@ -1025,7 +1021,11 @@ static int open_video_capture_device(v4l_input_plugin_t *this)
   
   xine_set_param(this->stream, XINE_PARAM_VO_ZOOM_X, 103);
   xine_set_param(this->stream, XINE_PARAM_VO_ZOOM_Y, 103);
-  
+
+  /* Pre-allocate some frames for audio and video so it doesn't have to be 
+   * done during capture */
+  allocate_frames(this, 1);
+
   /* If we made it here, everything went ok */ 
   this->audio_only = 0;
   if (tuner_found)
diff --git a/src/post/goom/convolve_fx.c b/src/post/goom/convolve_fx.c
index e86bb3723..c394f3bf8 100644
--- a/src/post/goom/convolve_fx.c
+++ b/src/post/goom/convolve_fx.c
@@ -20,7 +20,7 @@ typedef char Motif[CONV_MOTIF_W][CONV_MOTIF_W];
 
 #define NB_THETA 512
 
-#define MAX 2.0f
+//#define MAX 2.0f
 
 typedef struct _CONV_DATA{
   PluginParam light;
diff --git a/src/xine-engine/info_helper.c b/src/xine-engine/info_helper.c
index 2665502f2..b4a4bca83 100644
--- a/src/xine-engine/info_helper.c
+++ b/src/xine-engine/info_helper.c
@@ -131,7 +131,7 @@ uint32_t _x_stream_info_get_public(xine_stream_t *stream, int info) {
  * at the end of the string
  */
 static void meta_info_chomp(char *str) {
-  size_t i, len;
+  ssize_t i, len;
 
   len = strlen(str);
   if (!len)