176 files changed, 18022 insertions, 0 deletions

diff --git a/meta/recipes-multimedia/alsa/alsa-fpu.inc b/meta/recipes-multimedia/alsa/alsa-fpu.inc
new file mode 100644
index 0000000..5040230
--- /dev/null
+++ b/meta/recipes-multimedia/alsa/alsa-fpu.inc
@@ -0,0 +1,6 @@
+
+def get_alsa_fpu_setting(bb, d):
+        if d.getVar('TARGET_FPU', True) in [ 'soft' ]:
+                return "--with-softfloat"
+        return ""
+
diff --git a/meta/recipes-multimedia/alsa/alsa-lib/0001-pcm-pcm_local.h-include-time.h-to-enable-CLOCK_MONOT.patch b/meta/recipes-multimedia/alsa/alsa-lib/0001-pcm-pcm_local.h-include-time.h-to-enable-CLOCK_MONOT.patch
new file mode 100755
index 0000000..06cdcb9
--- /dev/null
+++ b/meta/recipes-multimedia/alsa/alsa-lib/0001-pcm-pcm_local.h-include-time.h-to-enable-CLOCK_MONOT.patch
@@ -0,0 +1,32 @@
+From f6b879e7cc87d83343f5004369146881d1d1e335 Mon Sep 17 00:00:00 2001
+From: Shengjiu Wang <shengjiu.wang@freescale.com>
+Date: Wed, 23 Jul 2014 15:09:58 +0800
+Subject: [PATCH] pcm: pcm_local.h: include <time.h> to enable CLOCK_MONOTONIC
+
+CLOCK_MONITONIC is defined in <bits/time.h>, add <time.h> before <sys/time.h>.
+
+Commit f6b879e7cc87d83343f5004369146881d1d1e335 in master branch
+
+Upstream Status: Backported
+
+Signed-off-by: Shengjiu Wang <shengjiu.wang@freescale.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+---
+ src/pcm/pcm_local.h |    1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/pcm/pcm_local.h b/src/pcm/pcm_local.h
+index 2206afe..80bbe59 100644
+--- a/src/pcm/pcm_local.h
++++ b/src/pcm/pcm_local.h
+@@ -24,6 +24,7 @@
+ #include <stdlib.h>
+ #include <limits.h>
+ #include <sys/uio.h>
++#include <time.h>
+ #include <sys/time.h>
+ 
+ #define _snd_mask sndrv_mask
+-- 
+1.7.9.5
+
diff --git a/meta/recipes-multimedia/alsa/alsa-lib/0001-pcm-rate-fix-hw_ptr-exceed-the-boundary.patch b/meta/recipes-multimedia/alsa/alsa-lib/0001-pcm-rate-fix-hw_ptr-exceed-the-boundary.patch
new file mode 100755
index 0000000..8be3d75
--- /dev/null
+++ b/meta/recipes-multimedia/alsa/alsa-lib/0001-pcm-rate-fix-hw_ptr-exceed-the-boundary.patch
@@ -0,0 +1,34 @@
+From 035f196bcdc1e9903ed52ad1859dc23d3aa74e72 Mon Sep 17 00:00:00 2001
+From: Shengjiu Wang <shengjiu.wang@freescale.com>
+Date: Mon, 14 Jul 2014 16:55:48 +0800
+Subject: [PATCH] pcm: rate: fix hw_ptr exceed the boundary
+
+For long time test case, the hw_ptr will exceed the boundary, then cause
+the avail size wrong.
+
+Commit is 035f196bcdc1e9903ed52ad1859dc23d3aa74e72 in master branch
+
+Upstream Status: Backported
+
+Signed-off-by: Shengjiu Wang <shengjiu.wang@freescale.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+---
+ src/pcm/pcm_rate.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/pcm/pcm_rate.c b/src/pcm/pcm_rate.c
+index 7f667d4..2563d82 100644
+--- a/src/pcm/pcm_rate.c
++++ b/src/pcm/pcm_rate.c
+@@ -574,6 +574,8 @@ static inline void snd_pcm_rate_sync_hwptr(snd_pcm_t *pcm)
+        rate->hw_ptr =
+                (slave_hw_ptr / rate->gen.slave->period_size) * pcm->period_size +
+                rate->ops.input_frames(rate->obj, slave_hw_ptr % rate->gen.slave->period_size);
++
++       rate->hw_ptr %= pcm->boundary;
+ }
+ 
+ static int snd_pcm_rate_hwsync(snd_pcm_t *pcm)
+-- 
+1.7.9.5
+
diff --git a/meta/recipes-multimedia/alsa/alsa-lib/0001-pcm-route-Use-get32-for-multi-source-route-calculati.patch b/meta/recipes-multimedia/alsa/alsa-lib/0001-pcm-route-Use-get32-for-multi-source-route-calculati.patch
new file mode 100755
index 0000000..89363d5
--- /dev/null
+++ b/meta/recipes-multimedia/alsa/alsa-lib/0001-pcm-route-Use-get32-for-multi-source-route-calculati.patch
@@ -0,0 +1,345 @@
+From 3f179d6cc7c222dfa42fe094b7ef1e21685a05bc Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 22 Jul 2014 11:55:40 +0200
+Subject: [PATCH] pcm: route: Use get32 for multi-source route calculation
+
+The PCM route plugin can assign the destination value from average of
+multiple sources with attenuation. This requires the read of each
+channel value, sums and writes the resultant value in the requested
+format.
+
+Currently, get_labels is used for reading source values while
+put32_labels is used for writing the dest value.  This is, however,
+a buggy implementation; get_labels gives the value as is only with
+endianness and signedness conversions, but put32_labels assumes that
+the value is normalized to 32bit int and it shifts down to the dest
+format.  In addition, the current code lacks get_labels entries for
+the 24bit formats, as Shengjiu Wang spotted out.
+
+For fixing these bugs, this patch replaces the read with
+get32_labels and use always 64bit int for sum.  This simplifies the
+code a lot and drops many lines.
+
+Commit fd84adc63e307572d05274be44c782a787087cda in master branch
+
+Upstream Status: Backported
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+---
+ src/pcm/pcm_route.c  |  128 +++++++++-----------------------------------------
+ src/pcm/plugin_ops.h |   81 --------------------------------
+ 2 files changed, 23 insertions(+), 186 deletions(-)
+
+diff --git a/src/pcm/pcm_route.c b/src/pcm/pcm_route.c
+index 2beedf6..1ed9c5f 100644
+--- a/src/pcm/pcm_route.c
++++ b/src/pcm/pcm_route.c
+@@ -60,7 +60,7 @@ typedef struct {
+ typedef struct snd_pcm_route_ttable_dst snd_pcm_route_ttable_dst_t;
+ 
+ typedef struct {
+-       enum {UINT32=0, UINT64=1, FLOAT=2} sum_idx;
++       enum {UINT64, FLOAT} sum_idx;
+        unsigned int get_idx;
+        unsigned int put_idx;
+        unsigned int conv_idx;
+@@ -232,55 +232,34 @@ static void snd_pcm_route_convert1_many(const snd_pcm_channel_area_t *dst_area,
+                                        const snd_pcm_route_ttable_dst_t* ttable,
+                                        const snd_pcm_route_params_t *params)
+ {
+-#define GETS_LABELS
++#define GET32_LABELS
+ #define PUT32_LABELS
+ #include "plugin_ops.h"
+-#undef GETS_LABELS
++#undef GET32_LABELS
+ #undef PUT32_LABELS
+-       static void *const zero_labels[3] = {
+-               &&zero_int32, &&zero_int64,
++       static void *const zero_labels[2] = {
++               &&zero_int64,
+ #if SND_PCM_PLUGIN_ROUTE_FLOAT
+                &&zero_float
+ #endif
+        };
+        /* sum_type att */
+-       static void *const add_labels[3 * 2] = {
+-               &&add_int32_noatt, &&add_int32_att,
++       static void *const add_labels[2 * 2] = {
+                &&add_int64_noatt, &&add_int64_att,
+ #if SND_PCM_PLUGIN_ROUTE_FLOAT
+                &&add_float_noatt, &&add_float_att
+ #endif
+        };
+-       /* sum_type att shift */
+-       static void *const norm_labels[3 * 2 * 4] = {
+-               0,
+-               &&norm_int32_8_noatt,
+-               &&norm_int32_16_noatt,
+-               &&norm_int32_24_noatt,
+-               0,
+-               &&norm_int32_8_att,
+-               &&norm_int32_16_att,
+-               &&norm_int32_24_att,
+-               &&norm_int64_0_noatt,
+-               &&norm_int64_8_noatt,
+-               &&norm_int64_16_noatt,
+-               &&norm_int64_24_noatt,
+-               &&norm_int64_0_att,
+-               &&norm_int64_8_att,
+-               &&norm_int64_16_att,
+-               &&norm_int64_24_att,
++       /* sum_type att */
++       static void *const norm_labels[2 * 2] = {
++               &&norm_int64_noatt,
++               &&norm_int64_att,
+ #if SND_PCM_PLUGIN_ROUTE_FLOAT
+-               &&norm_float_0,
+-               &&norm_float_8,
+-               &&norm_float_16,
+-               &&norm_float_24,
+-               &&norm_float_0,
+-               &&norm_float_8,
+-               &&norm_float_16,
+-               &&norm_float_24,
++               &&norm_float,
++               &&norm_float,
+ #endif
+        };
+-       void *zero, *get, *add, *norm, *put32;
++       void *zero, *get32, *add, *norm, *put32;
+        int nsrcs = ttable->nsrcs;
+        char *dst;
+        int dst_step;
+@@ -322,9 +301,9 @@ static void snd_pcm_route_convert1_many(const snd_pcm_channel_area_t *dst_area,
+        }
+ 
+        zero = zero_labels[params->sum_idx];
+-       get = gets_labels[params->get_idx];
++       get32 = get32_labels[params->get_idx];
+        add = add_labels[params->sum_idx * 2 + ttable->att];
+-       norm = norm_labels[params->sum_idx * 8 + ttable->att * 4 + 4 - params->src_size];
++       norm = norm_labels[params->sum_idx * 2 + ttable->att];
+        put32 = put32_labels[params->put_idx];
+        dst = snd_pcm_channel_area_addr(dst_area, dst_offset);
+        dst_step = snd_pcm_channel_area_step(dst_area);
+@@ -335,9 +314,6 @@ static void snd_pcm_route_convert1_many(const snd_pcm_channel_area_t *dst_area,
+ 
+                /* Zero sum */
+                goto *zero;
+-       zero_int32:
+-               sum.as_sint32 = 0;
+-               goto zero_end;
+        zero_int64: 
+                sum.as_sint64 = 0;
+                goto zero_end;
+@@ -351,21 +327,14 @@ static void snd_pcm_route_convert1_many(const snd_pcm_channel_area_t *dst_area,
+                        const char *src = srcs[srcidx];
+                        
+                        /* Get sample */
+-                       goto *get;
+-#define GETS_END after_get
++                       goto *get32;
++#define GET32_END after_get
+ #include "plugin_ops.h"
+-#undef GETS_END
++#undef GET32_END
+                after_get:
+ 
+                        /* Sum */
+                        goto *add;
+-               add_int32_att:
+-                       sum.as_sint32 += sample * ttp->as_int;
+-                       goto after_sum;
+-               add_int32_noatt:
+-                       if (ttp->as_int)
+-                               sum.as_sint32 += sample;
+-                       goto after_sum;
+                add_int64_att:
+                        sum.as_sint64 += (int64_t) sample * ttp->as_int;
+                        goto after_sum;
+@@ -389,48 +358,10 @@ static void snd_pcm_route_convert1_many(const snd_pcm_channel_area_t *dst_area,
+                
+                /* Normalization */
+                goto *norm;
+-       norm_int32_8_att:
+-               sum.as_sint64 = sum.as_sint32;
+-       norm_int64_8_att:
+-               sum.as_sint64 <<= 8;
+-       norm_int64_0_att:
+-               div(sum.as_sint64);
+-               goto norm_int;
+-
+-       norm_int32_16_att:
+-               sum.as_sint64 = sum.as_sint32;
+-       norm_int64_16_att:
+-               sum.as_sint64 <<= 16;
++       norm_int64_att:
+                div(sum.as_sint64);
+-               goto norm_int;
+-
+-       norm_int32_24_att:
+-               sum.as_sint64 = sum.as_sint32;
+-       norm_int64_24_att:
+-               sum.as_sint64 <<= 24;
+-               div(sum.as_sint64);
+-               goto norm_int;
+-
+-       norm_int32_8_noatt:
+-               sum.as_sint64 = sum.as_sint32;
+-       norm_int64_8_noatt:
+-               sum.as_sint64 <<= 8;
+-               goto norm_int;
+-
+-       norm_int32_16_noatt:
+-               sum.as_sint64 = sum.as_sint32;
+-       norm_int64_16_noatt:
+-               sum.as_sint64 <<= 16;
+-               goto norm_int;
+-
+-       norm_int32_24_noatt:
+-               sum.as_sint64 = sum.as_sint32;
+-       norm_int64_24_noatt:
+-               sum.as_sint64 <<= 24;
+-               goto norm_int;
+-
+-       norm_int64_0_noatt:
+-       norm_int:
++               /* fallthru */
++       norm_int64_noatt:
+                if (sum.as_sint64 > (int64_t)0x7fffffff)
+                        sample = 0x7fffffff;    /* maximum positive value */
+                else if (sum.as_sint64 < -(int64_t)0x80000000)
+@@ -440,16 +371,6 @@ static void snd_pcm_route_convert1_many(const snd_pcm_channel_area_t *dst_area,
+                goto after_norm;
+ 
+ #if SND_PCM_PLUGIN_ROUTE_FLOAT
+-       norm_float_8:
+-               sum.as_float *= 1 << 8;
+-               goto norm_float;
+-       norm_float_16:
+-               sum.as_float *= 1 << 16;
+-               goto norm_float;
+-       norm_float_24:
+-               sum.as_float *= 1 << 24;
+-               goto norm_float;
+-       norm_float_0:
+        norm_float:
+                sum.as_float = rint(sum.as_float);
+                if (sum.as_float > (int64_t)0x7fffffff)
+@@ -644,7 +565,7 @@ static int snd_pcm_route_hw_params(snd_pcm_t *pcm, snd_pcm_hw_params_t * params)
+                return err;
+        route->params.use_getput = snd_pcm_format_physical_width(src_format) == 24 ||
+                snd_pcm_format_physical_width(dst_format) == 24;
+-       route->params.get_idx = snd_pcm_linear_get_index(src_format, SND_PCM_FORMAT_S16);
++       route->params.get_idx = snd_pcm_linear_get32_index(src_format, SND_PCM_FORMAT_S32);
+        route->params.put_idx = snd_pcm_linear_put32_index(SND_PCM_FORMAT_S32, dst_format);
+        route->params.conv_idx = snd_pcm_linear_convert_index(src_format, dst_format);
+        route->params.src_size = snd_pcm_format_width(src_format) / 8;
+@@ -652,10 +573,7 @@ static int snd_pcm_route_hw_params(snd_pcm_t *pcm, snd_pcm_hw_params_t * params)
+ #if SND_PCM_PLUGIN_ROUTE_FLOAT
+        route->params.sum_idx = FLOAT;
+ #else
+-       if (snd_pcm_format_width(src_format) == 32)
+-               route->params.sum_idx = UINT64;
+-       else
+-               route->params.sum_idx = UINT32;
++       route->params.sum_idx = UINT64;
+ #endif
+        return 0;
+ }
+diff --git a/src/pcm/plugin_ops.h b/src/pcm/plugin_ops.h
+index 21535c9..eb8c2c4 100644
+--- a/src/pcm/plugin_ops.h
++++ b/src/pcm/plugin_ops.h
+@@ -668,87 +668,6 @@ getu_1234_C321: sample = bswap_32(as_u32c(src) ^ 0x80); goto GETU_END;
+ }
+ #endif
+ 
+-#ifdef GETS_LABELS
+-/* width endswap sign_toggle */
+-static void *const gets_labels[4 * 2 * 2] = {
+-       &&gets_1_1,             /*  8h ->  8h */
+-       &&gets_1_9,             /*  8h ^>  8h */
+-       &&gets_1_1,             /*  8s ->  8h */
+-       &&gets_1_9,             /*  8s ^>  8h */
+-       &&gets_12_12,           /* 16h -> 16h */
+-       &&gets_12_92,           /* 16h ^> 16h */
+-       &&gets_12_21,           /* 16s -> 16h */
+-       &&gets_12_A1,           /* 16s ^> 16h */
+-       &&gets_0123_0123,       /* 24h -> 24h */
+-       &&gets_0123_0923,       /* 24h ^> 24h */
+-       &&gets_1230_0321,       /* 24s -> 24h */
+-       &&gets_1230_0B21,       /* 24s ^> 24h */
+-       &&gets_1234_1234,       /* 32h -> 32h */
+-       &&gets_1234_9234,       /* 32h ^> 32h */
+-       &&gets_1234_4321,       /* 32s -> 32h */
+-       &&gets_1234_C321,       /* 32s ^> 32h */
+-};
+-#endif
+-
+-#ifdef GETS_END
+-while (0) {
+-gets_1_1: sample = as_s8c(src); goto GETS_END;
+-gets_1_9: sample = (int8_t)(as_s8c(src) ^ 0x80); goto GETS_END;
+-gets_12_12: sample = as_s16c(src); goto GETS_END;
+-gets_12_92: sample = (int16_t)(as_s16c(src) ^ 0x8000); goto GETS_END;
+-gets_12_21: sample = (int16_t)bswap_16(as_s16c(src)); goto GETS_END;
+-gets_12_A1: sample = (int16_t)bswap_16(as_s16c(src) ^ 0x80); goto GETS_END;
+-gets_0123_0123: sample = sx24((int32_t)(as_s32c(src) << 8) >> 8); goto GETS_END;
+-gets_0123_0923: sample = sx24((int32_t)((as_s32c(src) ^ 0x800000) << 8) >> 8); goto GETS_END;
+-gets_1230_0321: sample = sx24((int32_t)(bswap_32(as_s32c(src)) << 8) >> 8); goto GETS_END;
+-gets_1230_0B21: sample = sx24((int32_t)(bswap_32(as_s32c(src) ^ 0x8000) << 8) >> 8); goto GETS_END;
+-gets_1234_1234: sample = as_s32c(src); goto GETS_END;
+-gets_1234_9234: sample = (int32_t)(as_s32c(src) ^ 0x80000000); goto GETS_END;
+-gets_1234_4321: sample = (int32_t)bswap_32(as_s32c(src)); goto GETS_END;
+-gets_1234_C321: sample = (int32_t)bswap_32(as_s32c(src) ^ 0x80); goto GETS_END;
+-}
+-#endif
+-
+-#ifdef PUT_LABELS
+-/* width endswap sign_toggle */
+-static void *const put_labels[4 * 2 * 2] = {
+-       &&put_1_1,              /*  8h ->  8h */
+-       &&put_1_9,              /*  8h ^>  8h */
+-       &&put_1_1,              /*  8h ->  8s */
+-       &&put_1_9,              /*  8h ^>  8s */
+-       &&put_12_12,            /* 16h -> 16h */
+-       &&put_12_92,            /* 16h ^> 16h */
+-       &&put_12_21,            /* 16h -> 16s */
+-       &&put_12_29,            /* 16h ^> 16s */
+-       &&put_0123_0123,        /* 24h -> 24h */
+-       &&put_0123_0923,        /* 24h ^> 24h */
+-       &&put_0123_3210,        /* 24h -> 24s */
+-       &&put_0123_3290,        /* 24h ^> 24s */
+-       &&put_1234_1234,        /* 32h -> 32h */
+-       &&put_1234_9234,        /* 32h ^> 32h */
+-       &&put_1234_4321,        /* 32h -> 32s */
+-       &&put_1234_4329,        /* 32h ^> 32s */
+-};
+-#endif
+-
+-#ifdef PUT_END
+-put_1_1: as_s8(dst) = sample; goto PUT_END;
+-put_1_9: as_u8(dst) = sample ^ 0x80; goto PUT_END;
+-put_12_12: as_s16(dst) = sample; goto PUT_END;
+-put_12_92: as_u16(dst) = sample ^ 0x8000; goto PUT_END;
+-put_12_21: as_s16(dst) = bswap_16(sample); goto PUT_END;
+-put_12_29: as_u16(dst) = bswap_16(sample) ^ 0x80; goto PUT_END;
+-/* this always writes the unused byte in 24-bit formats as 0x00 */
+-put_0123_0123: as_s32(dst) = sx24(sample & 0x00ffffff); goto PUT_END;
+-put_0123_0923: as_u32(dst) = sx24((sample & 0x00ffffff) ^ 0x800000); goto PUT_END;
+-put_0123_3210: as_s32(dst) = sx24s(bswap_32(sample) & 0xffffff00); goto PUT_END;
+-put_0123_3290: as_u32(dst) = sx24s((bswap_32(sample) & 0xffffff00) ^ 0x8000); goto PUT_END;
+-put_1234_1234: as_s32(dst) = sample; goto PUT_END;
+-put_1234_9234: as_u32(dst) = sample ^ 0x80000000; goto PUT_END;
+-put_1234_4321: as_s32(dst) = bswap_32(sample); goto PUT_END;
+-put_1234_4329: as_u32(dst) = bswap_32(sample) ^ 0x80; goto PUT_END;
+-#endif
+-
+ #ifdef PUT32F_LABELS
+ /* type (0 = float, 1 = float64), endswap */
+ static void *const put32float_labels[2 * 2] = {
+-- 
+1.7.9.5
+
diff --git a/meta/recipes-multimedia/alsa/alsa-lib/Check-if-wordexp-function-is-supported.patch b/meta/recipes-multimedia/alsa/alsa-lib/Check-if-wordexp-function-is-supported.patch
new file mode 100644
index 0000000..75a6eb8
--- /dev/null
+++ b/meta/recipes-multimedia/alsa/alsa-lib/Check-if-wordexp-function-is-supported.patch
@@ -0,0 +1,51 @@
+From e33357b59a10d44e9bec5d24100ce23ca300cc79 Mon Sep 17 00:00:00 2001
+From: "Hong H. Pham" <hong.pham@windriver.com>
+Date: Fri, 29 Aug 2014 17:13:55 +0300
+Subject: [PATCH] Check if wordexp function is supported
+
+eglibc could be configured to build without wordexp, so it is not enough
+to check if wordexp.h exists (the header file could be installed, but it's
+possible that the wordexp() function is not supported).  An additional
+check if wordexp() is supported by the system C library is needed.
+
+Upstream-Status: Inappropriate [configuration]
+
+Signed-off-by: Hong H. Pham <hong.pham@windriver.com>
+Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
+---
+ configure.ac   | 5 ++++-
+ src/userfile.c | 2 +-
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index b8353a0..773b72f 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -311,7 +311,10 @@ fi
+ AC_SUBST(ALSA_DEPLIBS)
+ 
+ dnl Check for headers
+-AC_CHECK_HEADERS([wordexp.h endian.h sys/endian.h])
++AC_CHECK_HEADERS([wordexp.h endian.h sys/endian.h],
++  dnl Make sure wordexp is supported by the C library
++  AC_CHECK_FUNCS([wordexp])
++)
+ 
+ dnl Check for resmgr support...
+ AC_MSG_CHECKING(for resmgr support)
+diff --git a/src/userfile.c b/src/userfile.c
+index 3a73836..b8ce809 100644
+--- a/src/userfile.c
++++ b/src/userfile.c
+@@ -32,7 +32,7 @@
+  * stores the first matchine one.  The returned string is strdup'ed.
+  */
+ 
+-#ifdef HAVE_WORDEXP_H
++#if (defined(HAVE_WORDEXP_H) && defined(HAVE_WORDEXP))
+ #include <wordexp.h>
+ #include <assert.h>
+ int snd_user_file(const char *file, char **result)
+-- 
+1.9.1
+
diff --git a/meta/recipes-multimedia/alsa/alsa-lib/fix-tstamp-declaration.patch b/meta/recipes-multimedia/alsa/alsa-lib/fix-tstamp-declaration.patch
new file mode 100644
index 0000000..32b84b7
--- /dev/null
+++ b/meta/recipes-multimedia/alsa/alsa-lib/fix-tstamp-declaration.patch
@@ -0,0 +1,21 @@
+# Author: Michael Lauer <mickey@vanille-media.de>
+# Date:   Thu Jan 18 00:27:21 2007 +0000
+# alsa-lib: fix "error: field 'tstamp' has incomplete type" when including alsa headers with strict compilation options
+#
+# Acquired from OpenEmbedded
+
+Upstream-Status: Pending
+
+Index: alsa-lib-1.0.13/include/global.h
+===================================================================
+--- alsa-lib-1.0.13.orig/include/global.h
++++ alsa-lib-1.0.13/include/global.h
+@@ -29,6 +29,8 @@
+ #define __ALSA_GLOBAL_H_
+ 
+ /* for timeval and timespec */
++#define __need_timeval
++#define __need_timespec
+ #include <time.h>
+ 
+ #ifdef __cplusplus
diff --git a/meta/recipes-multimedia/alsa/alsa-lib_1.0.28.bb b/meta/recipes-multimedia/alsa/alsa-lib_1.0.28.bb
new file mode 100644
index 0000000..9a4aab4
--- /dev/null
+++ b/meta/recipes-multimedia/alsa/alsa-lib_1.0.28.bb
@@ -0,0 +1,54 @@
+SUMMARY = "ALSA sound library"
+HOMEPAGE = "http://www.alsa-project.org"
+BUGTRACKER = "https://bugtrack.alsa-project.org/alsa-bug/login_page.php"
+SECTION = "libs/multimedia"
+LICENSE = "LGPLv2.1 & GPLv2+"
+LIC_FILES_CHKSUM = "file://COPYING;md5=7fbc338309ac38fefcd64b04bb903e34 \
+                    file://src/socket.c;beginline=1;endline=26;md5=11ff89a8a7a4a690a5c78effe8159545"
+
+BBCLASSEXTEND = "native nativesdk"
+
+# configure.in sets -D__arm__ on the command line for any arm system
+# (not just those with the ARM instruction set), this should be removed,
+# (or replaced by a permitted #define).
+#FIXME: remove the following
+ARM_INSTRUCTION_SET = "arm"
+
+SRC_URI = "ftp://ftp.alsa-project.org/pub/lib/${BP}.tar.bz2 \
+           file://Check-if-wordexp-function-is-supported.patch \
+           file://fix-tstamp-declaration.patch \
+           file://0001-pcm-route-Use-get32-for-multi-source-route-calculati.patch \
+           file://0001-pcm-rate-fix-hw_ptr-exceed-the-boundary.patch \
+           file://0001-pcm-pcm_local.h-include-time.h-to-enable-CLOCK_MONOT.patch \
+"
+SRC_URI[md5sum] = "c9e21b88a2b3e6e12ea7ba0f3b271fc3"
+SRC_URI[sha256sum] = "3c074b85dde1b30e78ef4995579765833e5b693fbbd8f834c335e080cb734a6d"
+
+inherit autotools pkgconfig
+
+require alsa-fpu.inc
+EXTRA_OECONF += "${@get_alsa_fpu_setting(bb, d)} "
+
+EXTRA_OECONF = "--disable-python"
+
+EXTRA_OECONF_append_libc-uclibc = " --with-versioned=no "
+
+PACKAGES =+ "alsa-server libasound alsa-conf-base alsa-conf alsa-doc"
+FILES_${PN} += "${libdir}/${BPN}/smixer/*.so"
+FILES_${PN}-dbg += "${libdir}/${BPN}/smixer/.debug"
+FILES_${PN}-dev += "${libdir}/${BPN}/smixer/*.la"
+FILES_libasound = "${libdir}/libasound.so.*"
+FILES_alsa-server = "${bindir}/*"
+FILES_alsa-conf = "${datadir}/alsa/"
+FILES_alsa-conf-base = "\
+${datadir}/alsa/alsa.conf \
+${datadir}/alsa/cards/aliases.conf \
+${datadir}/alsa/pcm/default.conf \
+${datadir}/alsa/pcm/dmix.conf \
+${datadir}/alsa/pcm/dsnoop.conf"
+
+RDEPENDS_libasound = "alsa-conf-base alsa-conf"
+# upgrade path
+RPROVIDES_${PN}-dev = "alsa-dev"
+RREPLACES_${PN}-dev = "alsa-dev"
+RCONFLICTS_${PN}-dev = "alsa-dev"
diff --git a/meta/recipes-multimedia/alsa/alsa-tools/autotools.patch b/meta/recipes-multimedia/alsa/alsa-tools/autotools.patch
new file mode 100644
index 0000000..5aec84c
--- /dev/null
+++ b/meta/recipes-multimedia/alsa/alsa-tools/autotools.patch
@@ -0,0 +1,32 @@
+Add parameters to autoreconf to support cross compile.
+Remove some sub-components which needs further recipe support.
+
+Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
+
+Upstream-Status: Inappropriate [configuration]
+
+diff -ruN alsa-tools-1.0.24.1-orig//ld10k1/gitcompile alsa-tools-1.0.24.1/ld10k1/gitcompile
+--- alsa-tools-1.0.24.1-orig//ld10k1/gitcompile 2011-07-06 11:27:40.227665002 +0800
++++ alsa-tools-1.0.24.1/ld10k1/gitcompile       2011-07-14 13:26:18.017665004 +0800
+@@ -1,6 +1,6 @@
+ #!/bin/bash
+ 
+-autoreconf -fi || exit 1
++autoreconf $ACLOCAL_FLAGS -fi || exit 1
+ export CFLAGS='-O2 -Wall -pipe -g'
+ echo "CFLAGS=$CFLAGS"
+ echo "./configure $@"
+diff -ruN alsa-tools-1.0.24.1-orig//Makefile alsa-tools-1.0.24.1/Makefile
+--- alsa-tools-1.0.24.1-orig//Makefile  2011-07-06 11:27:40.207665000 +0800
++++ alsa-tools-1.0.24.1/Makefile        2011-07-14 15:08:08.877665009 +0800
+@@ -1,8 +1,8 @@
+ VERSION = 1.0.27
+ TOP = .
+-SUBDIRS = as10k1 envy24control hdsploader hdspconf hdspmixer \
++SUBDIRS = as10k1 envy24control \
+          mixartloader pcxhrloader rmedigicontrol sb16_csp seq sscape_ctl \
+-         us428control usx2yloader vxloader echomixer ld10k1 qlo10k1 \
++         us428control usx2yloader vxloader echomixer \
+          hwmixvolume hdajackretask hda-verb
+ 
+ all:
diff --git a/meta/recipes-multimedia/alsa/alsa-tools/makefile_no_gtk.patch b/meta/recipes-multimedia/alsa/alsa-tools/makefile_no_gtk.patch
new file mode 100644
index 0000000..2665726
--- /dev/null
+++ b/meta/recipes-multimedia/alsa/alsa-tools/makefile_no_gtk.patch
@@ -0,0 +1,25 @@
+Remove some sub-components which need gtk+.
+
+Upstream-Status: Inappropriate [configuration]
+
+Signed-off-by: Rogerio Nunes <ronunes@gmail.com>
+Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
+
+diff --git a/Makefile b/Makefile
+index 2457a1c..72346d9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,9 +1,9 @@
+ VERSION = 1.0.27
+ TOP = .
+-SUBDIRS = as10k1 envy24control \
+-         mixartloader pcxhrloader rmedigicontrol sb16_csp seq sscape_ctl \
+-         us428control usx2yloader vxloader echomixer \
+-         hwmixvolume hdajackretask hda-verb
++SUBDIRS = as10k1 \
++         mixartloader pcxhrloader sb16_csp seq sscape_ctl \
++         us428control usx2yloader vxloader \
++         hwmixvolume hda-verb
+ 
+ all:
+        @for i in $(SUBDIRS); do \
diff --git a/meta/recipes-multimedia/alsa/alsa-tools_1.0.28.bb b/meta/recipes-multimedia/alsa/alsa-tools_1.0.28.bb
new file mode 100644
index 0000000..4b9509e
--- /dev/null
+++ b/meta/recipes-multimedia/alsa/alsa-tools_1.0.28.bb
@@ -0,0 +1,35 @@
+SUMMARY = "Advanced tools for certain ALSA sound card drivers"
+HOMEPAGE = "http://www.alsa-project.org"
+BUGTRACKER = "https://bugtrack.alsa-project.org/alsa-bug/login_page.php"
+SECTION = "console/utils"
+LICENSE = "GPLv2 & LGPLv2+"
+DEPENDS = "alsa-lib ncurses"
+
+LIC_FILES_CHKSUM = "file://hdsploader/COPYING;md5=94d55d512a9ba36caa9b7df079bae19f \
+                    file://ld10k1/COPYING.LIB;md5=7fbc338309ac38fefcd64b04bb903e34"
+
+SRC_URI = "ftp://ftp.alsa-project.org/pub/tools/${BP}.tar.bz2 \
+           file://autotools.patch \
+           ${@bb.utils.contains('DISTRO_FEATURES', 'x11', '', \
+                                'file://makefile_no_gtk.patch', d)}"
+
+SRC_URI[md5sum] = "e6c929175d8ee729c06d49b51439bad6"
+SRC_URI[sha256sum] = "76e59711c6d0f39cbddce83ce1ed8da00bad112fee021f94fa990d8685cc3761"
+
+inherit autotools-brokensep pkgconfig
+
+EXTRA_OEMAKE += "GITCOMPILE_ARGS='--host=${HOST_SYS} --build=${BUILD_SYS} --target=${TARGET_SYS} --with-libtool-sysroot=${STAGING_DIR_HOST} --prefix=${prefix}'"
+
+PACKAGECONFIG ??= "${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'gtk+', '', d)}"
+PACKAGECONFIG[gtk+] = ",,gtk+ gtk+3,"
+
+# configure.ac/.in doesn't exist so force copy
+AUTOTOOLS_COPYACLOCAL = "1"
+
+do_compile_prepend () {
+    #Automake dir is not correctly detected in cross compilation case
+    export AUTOMAKE_DIR="$(automake --print-libdir)"
+    export ACLOCAL_FLAGS="--system-acdir=${ACLOCALDIR}/"
+}
+
+FILES_${PN} += "${datadir}/ld10k1"
diff --git a/meta/recipes-multimedia/alsa/alsa-utils-alsaconf_1.0.28.bb b/meta/recipes-multimedia/alsa/alsa-utils-alsaconf_1.0.28.bb
new file mode 100644
index 0000000..968c81e
--- /dev/null
+++ b/meta/recipes-multimedia/alsa/alsa-utils-alsaconf_1.0.28.bb
@@ -0,0 +1,17 @@
+require alsa-utils_${PV}.bb
+
+SUMMARY = "Shell script that creates ALSA configuration files"
+
+FILESEXTRAPATHS_prepend := "${THISDIR}/alsa-utils:"
+
+PACKAGES = "${PN}"
+RDEPENDS_${PN} += "bash"
+
+FILES_${PN} = "${sbindir}/alsaconf"
+
+S = "${WORKDIR}/alsa-utils-${PV}"
+
+do_install() {
+        install -d ${D}${sbindir}
+        install -m 0755 ${S}/alsaconf/alsaconf ${D}${sbindir}/
+}
diff --git a/meta/recipes-multimedia/alsa/alsa-utils/0001-alsactl-don-t-let-systemd-unit-restore-the-volume-wh.patch b/meta/recipes-multimedia/alsa/alsa-utils/0001-alsactl-don-t-let-systemd-unit-restore-the-volume-wh.patch
new file mode 100644
index 0000000..e99dd51
--- /dev/null
+++ b/meta/recipes-multimedia/alsa/alsa-utils/0001-alsactl-don-t-let-systemd-unit-restore-the-volume-wh.patch
@@ -0,0 +1,52 @@
+From 43a56fa36a12f09ccd78b3cf5e6ae197fcab501f Mon Sep 17 00:00:00 2001
+From: Koen Kooi <koen@dominion.thruhere.net>
+Date: Fri, 29 Aug 2014 18:58:56 +0300
+Subject: [PATCH] alsactl: don't let systemd unit restore the volume when
+ asound.state is missing
+
+This avoids an error on bootup
+
+Filed as https://bugtrack.alsa-project.org/alsa-bug/view.php?id=5459
+
+Upstream-Status: Pending
+
+Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
+Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
+---
+ alsactl/Makefile.am             | 7 ++++---
+ alsactl/alsa-restore.service.in | 1 +
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/alsactl/Makefile.am b/alsactl/Makefile.am
+index 47f06e9..b728c06 100644
+--- a/alsactl/Makefile.am
++++ b/alsactl/Makefile.am
+@@ -43,9 +43,10 @@ install-data-hook:
+ endif
+ 
+ edit = \
+-       $(SED) -r -e 's,@sbindir\@,$(sbindir),g' \
+-                 -e 's,@mydatadir\@,$(mydatadir),g' \
+-                 -e 's,@daemonswitch\@,$(ALSACTL_DAEMONSWITCH),g' \
++       $(SED) -e 's,@localstatedir\@,$(localstatedir),g' \
++              -e 's,@sbindir\@,$(sbindir),g' \
++              -e 's,@mydatadir\@,$(mydatadir),g' \
++              -e 's,@daemonswitch\@,$(ALSACTL_DAEMONSWITCH),g' \
+                                                        < $< > $@ || rm $@
+ 
+ alsa-state.service: alsa-state.service.in
+diff --git a/alsactl/alsa-restore.service.in b/alsactl/alsa-restore.service.in
+index 245a439..b017854 100644
+--- a/alsactl/alsa-restore.service.in
++++ b/alsactl/alsa-restore.service.in
+@@ -10,6 +10,7 @@ DefaultDependencies=no
+ After=alsa-state.service
+ Before=shutdown.target
+ Conflicts=shutdown.target
++ConditionPathExists=@localstatedir@/lib/alsa/asound.state
+ 
+ [Service]
+ Type=oneshot
+-- 
+1.9.1
+
diff --git a/meta/recipes-multimedia/alsa/alsa-utils/alsa-utils-aplay-interrupt-signal-handling.patch b/meta/recipes-multimedia/alsa/alsa-utils/alsa-utils-aplay-interrupt-signal-handling.patch
new file mode 100644
index 0000000..5df004a
--- /dev/null
+++ b/meta/recipes-multimedia/alsa/alsa-utils/alsa-utils-aplay-interrupt-signal-handling.patch
@@ -0,0 +1,48 @@
+Upstream-Status: Pending
+
+aplay/arecord (alsa-utils v1.0.28) cannot interrupt streaming
+via CTRL-C. Fixed the issue by reverting buggy patches and
+properly handling 'in_aborting' flag in appropriate functions.
+
+Signed-off-by: Anant Agrawal <Anant_Agrawal@mentor.com>
+Signed-off-by: Mikhail Durnev <mikhail_durnev@mentor.com>
+
+--- a/aplay/aplay.c     2014-05-19 16:25:14.000000000 +0530
++++ b/aplay/aplay.c     2014-05-20 15:17:14.364823007 +0530
+@@ -392,14 +392,22 @@
+                putchar('\n');
+        if (!quiet_mode)
+                fprintf(stderr, _("Aborted by signal %s...\n"), strsignal(sig));
+-       if (handle)
++       if (stream == SND_PCM_STREAM_CAPTURE) {
++               if (fmt_rec_table[file_type].end) {
++                       fmt_rec_table[file_type].end(fd);
++                       fd = -1;
++               }
++               stream = -1;
++       }
++       if (fd > 1) {
++               close(fd);
++               fd = -1;
++       }
++       if (handle && sig != SIGABRT) {
+                snd_pcm_abort(handle);
+-       if (sig == SIGABRT) {
+-               /* do not call snd_pcm_close() and abort immediately */
+                handle = NULL;
+-               prg_exit(EXIT_FAILURE);
+        }
+-       signal(sig, signal_handler);
++       prg_exit(EXIT_FAILURE);
+ }
+ 
+ /* call on SIGUSR1 signal. */
+@@ -2096,7 +2104,7 @@
+        ssize_t result = count, r;
+        size_t size;
+ 
+-       while (count > 0) {
++       while (count > 0 && !in_aborting) {
+                size = count;
+                if (size > chunk_bytes - buffer_pos)
+                        size = chunk_bytes - buffer_pos;
diff --git a/meta/recipes-multimedia/alsa/alsa-utils_1.0.28.bb b/meta/recipes-multimedia/alsa/alsa-utils_1.0.28.bb
new file mode 100644
index 0000000..5f35d76
--- /dev/null
+++ b/meta/recipes-multimedia/alsa/alsa-utils_1.0.28.bb
@@ -0,0 +1,95 @@
+SUMMARY = "ALSA sound utilities"
+HOMEPAGE = "http://www.alsa-project.org"
+BUGTRACKER = "https://bugtrack.alsa-project.org/alsa-bug/login_page.php"
+SECTION = "console/utils"
+LICENSE = "GPLv2+"
+LIC_FILES_CHKSUM = "file://COPYING;md5=59530bdf33659b29e73d4adb9f9f6552 \
+                    file://alsactl/utils.c;beginline=1;endline=20;md5=fe9526b055e246b5558809a5ae25c0b9"
+DEPENDS = "alsa-lib ncurses libsamplerate0 udev"
+
+PACKAGECONFIG ??= "udev"
+PACKAGECONFIG[udev] = "--with-udev-rules-dir=`pkg-config --variable=udevdir udev`/rules.d,,udev"
+PACKAGECONFIG[xmlto] = "--enable-xmlto, --disable-xmlto, xmlto-native docbook-xml-dtd4-native docbook-xsl-stylesheets-native"
+
+SRC_URI = "ftp://ftp.alsa-project.org/pub/utils/alsa-utils-${PV}.tar.bz2 \
+           file://0001-alsactl-don-t-let-systemd-unit-restore-the-volume-wh.patch \
+           file://alsa-utils-aplay-interrupt-signal-handling.patch \
+          "
+
+SRC_URI[md5sum] = "361552d5b1cacd0a1e7ba09e69990211"
+SRC_URI[sha256sum] = "f3ff4c89b0125a7797b1b13cd094cc92276e655458274967386e812d03642acc"
+
+# lazy hack. needs proper fixing in gettext.m4, see
+# http://bugs.openembedded.org/show_bug.cgi?id=2348
+# please close bug and remove this comment when properly fixed
+#
+EXTRA_OECONF_append_libc-uclibc = " --disable-nls"
+
+inherit autotools-brokensep gettext pkgconfig
+
+# This are all packages that we need to make. Also, the now empty alsa-utils
+# ipk depends on them.
+
+ALSA_UTILS_PKGS = "\
+             alsa-utils-alsamixer \
+             alsa-utils-midi \
+             alsa-utils-aplay \
+             alsa-utils-amixer \
+             alsa-utils-aconnect \
+             alsa-utils-iecset \
+             alsa-utils-speakertest \
+             alsa-utils-aseqnet \
+             alsa-utils-aseqdump \
+             alsa-utils-alsactl \
+             alsa-utils-alsaloop \
+             alsa-utils-alsaucm \
+            "
+
+PACKAGES += "${ALSA_UTILS_PKGS}"
+RDEPENDS_${PN} += "${ALSA_UTILS_PKGS}"
+
+FILES_${PN} = ""
+FILES_alsa-utils-aplay       = "${bindir}/aplay ${bindir}/arecord"
+FILES_alsa-utils-amixer      = "${bindir}/amixer"
+FILES_alsa-utils-alsamixer   = "${bindir}/alsamixer"
+FILES_alsa-utils-speakertest = "${bindir}/speaker-test ${datadir}/sounds/alsa/ ${datadir}/alsa/speaker-test/"
+FILES_alsa-utils-midi        = "${bindir}/aplaymidi ${bindir}/arecordmidi ${bindir}/amidi"
+FILES_alsa-utils-aconnect    = "${bindir}/aconnect"
+FILES_alsa-utils-aseqnet     = "${bindir}/aseqnet"
+FILES_alsa-utils-iecset      = "${bindir}/iecset"
+FILES_alsa-utils-alsactl     = "${sbindir}/alsactl */udev/rules.d ${systemd_unitdir} ${localstatedir}/lib/alsa ${datadir}/alsa/init/"
+FILES_alsa-utils-aseqdump    = "${bindir}/aseqdump"
+FILES_alsa-utils-alsaloop    = "${bindir}/alsaloop"
+FILES_alsa-utils-alsaucm     = "${bindir}/alsaucm"
+
+
+SUMMARY_alsa-utils-aplay        = "Play (and record) sound files using ALSA"
+SUMMARY_alsa-utils-amixer       = "Command-line control for ALSA mixer and settings"
+SUMMARY_alsa-utils-alsamixer    = "ncurses-based control for ALSA mixer and settings"
+SUMMARY_alsa-utils-speakertest  = "ALSA surround speaker test utility"
+SUMMARY_alsa-utils-midi         = "Miscellaneous MIDI utilities for ALSA"
+SUMMARY_alsa-utils-aconnect     = "ALSA sequencer connection manager"
+SUMMARY_alsa-utils-aseqnet      = "Network client/server for ALSA sequencer"
+SUMMARY_alsa-utils-iecset       = "ALSA utility for setting/showing IEC958 (S/PDIF) status bits"
+SUMMARY_alsa-utils-alsactl      = "Saves/restores ALSA-settings in /etc/asound.state"
+SUMMARY_alsa-utils-aseqdump     = "Shows the events received at an ALSA sequencer port"
+SUMMARY_alsa-utils-alsaloop     = "ALSA PCM loopback utility"
+SUMMARY_alsa-utils-alsaucm      = "ALSA Use Case Manager"
+
+RRECOMMENDS_alsa-utils-alsactl = "alsa-states"
+
+ALLOW_EMPTY_alsa-utils = "1"
+
+do_install() {
+        autotools_do_install
+
+        # We don't ship this here because it requires a dependency on bash.
+        # See alsa-utils-alsaconf_${PV}.bb
+        rm ${D}${sbindir}/alsaconf
+
+        if ${@bb.utils.contains('PACKAGECONFIG', 'udev', 'false', 'true', d)}; then
+           # This is where alsa-utils will install its rules if we don't tell it anything else.
+           rm -rf ${D}/lib/udev
+           rmdir --ignore-fail-on-non-empty ${D}/lib
+        fi
+}
diff --git a/meta/recipes-multimedia/flac/flac-1.3.0/0001-Fix-Makefile.am-altivec-logic.patch b/meta/recipes-multimedia/flac/flac-1.3.0/0001-Fix-Makefile.am-altivec-logic.patch
new file mode 100644
index 0000000..d086cc9
--- /dev/null
+++ b/meta/recipes-multimedia/flac/flac-1.3.0/0001-Fix-Makefile.am-altivec-logic.patch
@@ -0,0 +1,35 @@
+From 1b3597cdc7b5e604ea37db29b2a65aab91e263e6 Mon Sep 17 00:00:00 2001
+From: Gustavo Zacarias <gustavo@zacarias.com.ar>
+Date: Wed, 4 Dec 2013 13:31:28 -0300
+Subject: [PATCH] Fix Makefile.am altivec logic
+
+Upstream-Status: Backport
+
+Besides SPE (FSL e500v? cores) there are other powerpc processors
+that don't support altivec instructions so only enable them when it's
+100% sure that the target has it.
+
+Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
+Signed-off-by: Erik de Castro Lopo <erikd@mega-nerd.com>
+Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
+---
+ src/libFLAC/Makefile.am | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/src/libFLAC/Makefile.am b/src/libFLAC/Makefile.am
+index 247e33c..258de40 100644
+--- a/src/libFLAC/Makefile.am
++++ b/src/libFLAC/Makefile.am
+@@ -47,8 +47,7 @@ CPUCFLAGS = -faltivec -force_cpusubtype_ALL -DFLAC__NO_ASM
+ else
+ # Linux-gcc for PPC does not have -force_cpusubtype_ALL, it is Darwin-specific
+ CPUCFLAGS =
+-if FLaC__CPU_PPC_SPE
+-else
++if FLaC__USE_ALTIVEC
+ CPUCFLAGS += -maltivec -mabi=altivec
+ endif
+ #@@@ PPC optimizations temporarily disabled
+-- 
+1.8.3.2
+
diff --git a/meta/recipes-multimedia/flac/flac_1.3.0.bb b/meta/recipes-multimedia/flac/flac_1.3.0.bb
new file mode 100644
index 0000000..fdf38e9
--- /dev/null
+++ b/meta/recipes-multimedia/flac/flac_1.3.0.bb
@@ -0,0 +1,44 @@
+SUMMARY = "Free Lossless Audio Codec"
+DESCRIPTION = "FLAC stands for Free Lossless Audio Codec, a lossless audio compression format."
+HOMEPAGE = "https://xiph.org/flac/"
+BUGTRACKER = "http://sourceforge.net/p/flac/bugs/"
+SECTION = "libs"
+LICENSE = "GFDL-1.2 & GPLv2+ & LGPLv2.1+ & BSD"
+LIC_FILES_CHKSUM = "file://COPYING.FDL;md5=ad1419ecc56e060eccf8184a87c4285f \
+                    file://src/Makefile.am;beginline=1;endline=17;md5=59575c1aa8f5f70d9361b776c2e2bdb5 \
+                    file://COPYING.GPL;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
+                    file://src/flac/main.c;beginline=1;endline=18;md5=d36a16abc38d5ffd346ac4ba1be1932b \
+                    file://COPYING.LGPL;md5=fbc093901857fcd118f065f900982c24 \
+                    file://src/plugin_common/all.h;beginline=1;endline=18;md5=e33e281151e7f40db2d3d170d9b0c1bb \
+                    file://COPYING.Xiph;md5=755582d124a03e3001afea59fc02b61b \
+                    file://include/FLAC/all.h;beginline=65;endline=70;md5=64474f2b22e9e77b28d8b8b25c983a48"
+DEPENDS = "libogg"
+
+SRC_URI = "http://downloads.xiph.org/releases/flac/${BP}.tar.xz \
+           file://0001-Fix-Makefile.am-altivec-logic.patch \
+          "
+
+SRC_URI[md5sum] = "13b5c214cee8373464d3d65dee362cdd"
+SRC_URI[sha256sum] = "fa2d64aac1f77e31dfbb270aeb08f5b32e27036a52ad15e69a77e309528010dc"
+
+inherit autotools-brokensep gettext
+
+EXTRA_OECONF = "--disable-oggtest \
+                --with-ogg-libraries=${STAGING_LIBDIR} \
+                --with-ogg-includes=${STAGING_INCDIR} \
+                --disable-xmms-plugin \
+                --without-libiconv-prefix \
+                ac_cv_prog_NASM="" \
+                "
+
+EXTRA_OECONF += "${@bb.utils.contains("TUNE_FEATURES", "altivec", " --enable-altivec", " --disable-altivec", d)}"
+EXTRA_OECONF += "${@bb.utils.contains("TUNE_FEATURES", "core2", " --enable-sse", "", d)}"
+EXTRA_OECONF += "${@bb.utils.contains("TUNE_FEATURES", "corei7", " --enable-sse", "", d)}"
+
+PACKAGES += "libflac libflac++ liboggflac liboggflac++"
+FILES_${PN} = "${bindir}/*"
+FILES_libflac = "${libdir}/libFLAC.so.*"
+FILES_libflac++ = "${libdir}/libFLAC++.so.*"
+FILES_liboggflac = "${libdir}/libOggFLAC.so.*"
+FILES_liboggflac++ = "${libdir}/libOggFLAC++.so.*"
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-aacdec-check-channel-count.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-aacdec-check-channel-count.patch
new file mode 100644
index 0000000..7da0e14
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-aacdec-check-channel-count.patch
@@ -0,0 +1,34 @@
+gst-ffmpeg: aacdec: check channel count
+
+Prevent out of array accesses
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+(cherry picked from commit 96f452ac647dae33c53c242ef3266b65a9beafb6)
+
+Upstream-Status: Backport 
+
+Signed-off-by: Yue Tao <yue.tao@windriver.com>
+---
+ libavcodec/aacdec.c |    5 +++++
+ 1 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c
+index 239153a..6c17c33 100644
+--- a/gst-libs/ext/libav/libavcodec/aacdec.c
++++ b/gst-libs/ext/libav/libavcodec/aacdec.c
+@@ -914,6 +914,11 @@ static av_cold int aac_decode_init(AVCodecContext *avctx)
+         }
+     }
+ 
++    if (avctx->channels > MAX_CHANNELS) {
++        av_log(avctx, AV_LOG_ERROR, "Too many channels\n");
++        return AVERROR_INVALIDDATA;
++    }
++
+     AAC_INIT_VLC_STATIC( 0, 304);
+     AAC_INIT_VLC_STATIC( 1, 270);
+     AAC_INIT_VLC_STATIC( 2, 550);
+-- 
+1.7.5.4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alac-fix-nb_samples-order-case.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alac-fix-nb_samples-order-case.patch
new file mode 100644
index 0000000..10ce0f3
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alac-fix-nb_samples-order-case.patch
@@ -0,0 +1,30 @@
+From e0884eadf6a15e93142131b695f48776f9a0ac31 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michaelni@gmx.at>
+Date: Sat, 10 Nov 2012 17:14:04 +0100
+Subject: [PATCH] alac: fix nb_samples < order case
+
+Upstream-Status: Backport
+
+Commit e0884eadf6a15e93142131b695f48776f9a0ac31 release/1.0
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+(cherry picked from commit fd4f4923cce6a2cbf4f48640b4ac706e614a1594)
+---
+ libavcodec/alac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libavcodec/alac.c b/libavcodec/alac.c
+index 9cd1737..e8e844a 100644
+--- a/gst-libs/ext/libav/libavcodec/alac.c
++++ b/gst-libs/ext/libav/libavcodec/alac.c
+@@ -278,7 +278,7 @@ static void predictor_decompress_fir_ada
+ 
+     /* read warm-up samples */
+     if (predictor_coef_num > 0)
+-        for (i = 0; i < predictor_coef_num; i++) {
++        for (i = 0; i < predictor_coef_num && i < output_size; i++) {
+             int32_t val;
+ 
+             val = buffer_out[i] + error_buffer[i+1];
+-- 
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alsdec-check-block-length.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alsdec-check-block-length.patch
new file mode 100644
index 0000000..73980f4
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alsdec-check-block-length.patch
@@ -0,0 +1,61 @@
+From 6df0d3e2916c223dbe4262bf1b876dff1cb3f980 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michaelni@gmx.at>
+Date: Wed, 12 Dec 2012 12:28:45 +0100
+Subject: [PATCH] alsdec: check block length
+
+Upstream-Status: Backport
+
+Commit 6df0d3e2916c223dbe4262bf1b876dff1cb3f980 release/1.0
+
+Fix writing over the end
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+(cherry picked from commit 0ceca269b66ec12a23bf0907bd2c220513cdbf16)
+
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+---
+ libavcodec/alsdec.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c
+index 46dd0b4..1095b01 100644
+--- a/gst-libs/ext/libav/libavcodec/alsdec.c
++++ b/gst-libs/ext/libav/libavcodec/alsdec.c
+@@ -552,12 +552,15 @@ static void get_block_sizes(ALSDecContext *ctx, unsigned int *div_blocks,
+ 
+ /** Read the block data for a constant block
+  */
+-static void read_const_block_data(ALSDecContext *ctx, ALSBlockData *bd)
++static int read_const_block_data(ALSDecContext *ctx, ALSBlockData *bd)
+ {
+     ALSSpecificConfig *sconf = &ctx->sconf;
+     AVCodecContext *avctx    = ctx->avctx;
+     GetBitContext *gb        = &ctx->gb;
+ 
++    if (bd->block_length <= 0)
++        return -1;
++
+     *bd->raw_samples = 0;
+     *bd->const_block = get_bits1(gb);    // 1 = constant value, 0 = zero block (silence)
+     bd->js_blocks    = get_bits1(gb);
+@@ -572,6 +575,8 @@ static void read_const_block_data(ALSDecContext *ctx, ALSBlockData *bd)
+ 
+     // ensure constant block decoding by reusing this field
+     *bd->const_block = 1;
++
++    return 0;
+ }
+ 
+ 
+@@ -971,7 +976,8 @@ static int read_block(ALSDecContext *ctx, ALSBlockData *bd)
+         if (read_var_block_data(ctx, bd))
+             return -1;
+     } else {
+-        read_const_block_data(ctx, bd);
++        if (read_const_block_data(ctx, bd) < 0)
++            return -1;
+     }
+ 
+     return 0;
+-- 
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-atrac3dec-Check-coding-mode-against-channels.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-atrac3dec-Check-coding-mode-against-channels.patch
new file mode 100644
index 0000000..42cb5f4
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-atrac3dec-Check-coding-mode-against-channels.patch
@@ -0,0 +1,37 @@
+From 2502914c5f8eb77659d7c0868396862557a63245 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michaelni@gmx.at>
+Date: Fri, 9 Nov 2012 13:26:20 +0100
+Subject: [PATCH] atrac3dec: Check coding mode against channels.
+
+Upstream-Status: Backport
+
+Commit 2502914c5f8eb77659d7c0868396862557a63245 release/1.0
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+(cherry picked from commit 13451f5520ce6b0afde861b2285dda659f8d4fb4)
+
+Conflicts:
+
+        libavcodec/atrac3.c
+---
+ libavcodec/atrac3.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/libavcodec/atrac3.c b/libavcodec/atrac3.c
+index 7d076be..1da4c78 100644
+--- a/gst-libs/ext/libav/libavcodec/atrac3.c
++++ b/gst-libs/ext/libav/libavcodec/atrac3.c
+@@ -955,6 +955,11 @@ static av_cold int atrac3_decode_init(AVCodecContext *avctx)
+     }
+     /* Check the extradata. */
+ 
++    if (q->codingMode == JOINT_STEREO && avctx->channels < 2) {
++        av_log(avctx, AV_LOG_ERROR, "Invalid coding mode\n");
++        return AVERROR_INVALIDDATA;
++    }
++
+     if (q->atrac3version != 4) {
+         av_log(avctx,AV_LOG_ERROR,"Version %d != 4.\n",q->atrac3version);
+         return AVERROR_INVALIDDATA;
+-- 
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-dsputil-fix-signedness-in-sizeof-comparissio.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-dsputil-fix-signedness-in-sizeof-comparissio.patch
new file mode 100644
index 0000000..31fa51a
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-dsputil-fix-signedness-in-sizeof-comparissio.patch
@@ -0,0 +1,40 @@
+From a99aff4e4bbef8e64b51f267cd1769214e1b4e80 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michaelni@gmx.at>
+Date: Fri, 30 Aug 2013 23:40:47 +0200
+Subject: [PATCH] avcodec/dsputil: fix signedness in sizeof() comparissions
+
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+(cherry picked from commit 454a11a1c9c686c78aa97954306fb63453299760)
+
+Upstream-Status: Backport
+
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+---
+ libavcodec/dsputil.c |    4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/libavcodec/dsputil.c b/libavcodec/dsputil.c
+index 53dc2eb..6264832 100644
+--- a/gst-libs/ext/libav/libavcodec/dsputil.c
++++ b/gst-libs/ext/libav/libavcodec/dsputil.c
+@@ -1912,7 +1912,7 @@ void ff_set_cmp(DSPContext* c, me_cmp_func *cmp, int type){
+ 
+ static void add_bytes_c(uint8_t *dst, uint8_t *src, int w){
+     long i;
+-    for(i=0; i<=w-sizeof(long); i+=sizeof(long)){
++    for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){
+         long a = *(long*)(src+i);
+         long b = *(long*)(dst+i);
+         *(long*)(dst+i) = ((a&pb_7f) + (b&pb_7f)) ^ ((a^b)&pb_80);
+@@ -1937,7 +1937,7 @@ static void diff_bytes_c(uint8_t *dst, uint8_t *src1, uint8_t *src2, int w){
+         }
+     }else
+ #endif
+-    for(i=0; i<=w-sizeof(long); i+=sizeof(long)){
++    for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){
+         long a = *(long*)(src1+i);
+         long b = *(long*)(src2+i);
+         *(long*)(dst+i) = ((a|pb_80) - (b&pb_7f)) ^ ((a^b^pb_80)&pb_80);
+-- 
+1.7.5.4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-msrle-use-av_image_get_linesize-to-calculate.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-msrle-use-av_image_get_linesize-to-calculate.patch
new file mode 100644
index 0000000..b0a3fb1
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-msrle-use-av_image_get_linesize-to-calculate.patch
@@ -0,0 +1,50 @@
+From 573d5fdedae72bf59d8c0b0766fdee171063d36f Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michaelni@gmx.at>
+Date: Sun, 16 Feb 2014 23:08:52 +0100
+Subject: [PATCH] avcodec/msrle: use av_image_get_linesize() to calculate the
+ linesize
+
+Upstream-Status: Backport
+
+Commit 573d5fdedae72bf59d8c0b0766fdee171063d36f release/0.9
+
+Fixes out of array access
+Fixes: 14a74a0a2dc67ede543f0e35d834fbbe-asan_heap-oob_49572c_556_cov_215466444_44_001_engine_room.mov
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+(cherry picked from commit c919e1ca2ecfc47d796382973ba0e48b8f6f92a2)
+
+Conflicts:
+
+        libavcodec/msrle.c
+(cherry picked from commit bc1c8ec5e65098fd2ccd8456f667151dfc9cda42)
+
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+---
+ libavcodec/msrle.c |    3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/libavcodec/msrle.c b/libavcodec/msrle.c
+index 30159bb..c39ae7b 100644
+--- a/gst-libs/ext/libav/libavcodec/msrle.c
++++ b/gst-libs/ext/libav/libavcodec/msrle.c
+@@ -35,6 +35,7 @@
+ #include "avcodec.h"
+ #include "dsputil.h"
+ #include "msrledec.h"
++#include "libavutil/imgutils.h"
+ 
+ typedef struct MsrleContext {
+     AVCodecContext *avctx;
+@@ -107,7 +108,7 @@ static int msrle_decode_frame(AVCodecContext *avctx,
+ 
+     /* FIXME how to correctly detect RLE ??? */
+     if (avctx->height * istride == avpkt->size) { /* assume uncompressed */
+-        int linesize = avctx->width * avctx->bits_per_coded_sample / 8;
++        int linesize = av_image_get_linesize(avctx->pix_fmt, avctx->width, 0);
+         uint8_t *ptr = s->frame.data[0];
+         uint8_t *buf = avpkt->data + (avctx->height-1)*istride;
+         int i, j;
+-- 
+1.7.5.4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-parser-reset-indexes-on-realloc-failure.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-parser-reset-indexes-on-realloc-failure.patch
new file mode 100644
index 0000000..5ff6583
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-parser-reset-indexes-on-realloc-failure.patch
@@ -0,0 +1,50 @@
+gst-ffmpeg: avcodec/parser: reset indexes on realloc failure
+
+Fixes Ticket2982
+
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+(cherry picked from commit f31011e9abfb2ae75bb32bc44e2c34194c8dc40a)
+
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+
+Upstream-Status: Backport 
+
+Signed-off-by: Yue Tao <yue.tao@windriver.com>
+
+---
+ libavcodec/parser.c |   10 +++++++---
+ 1 files changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/libavcodec/parser.c b/libavcodec/parser.c
+index 2c6de6e..66eca06 100644
+--- a/gst-libs/ext/libav/libavcodec/parser.c
++++ b/gst-libs/ext/libav/libavcodec/parser.c
+@@ -241,8 +241,10 @@ int ff_combine_frame(ParseContext *pc, int next, const uint8_t **buf, int *buf_s
+     if(next == END_NOT_FOUND){
+         void* new_buffer = av_fast_realloc(pc->buffer, &pc->buffer_size, (*buf_size) + pc->index + FF_INPUT_BUFFER_PADDING_SIZE);
+ 
+-        if(!new_buffer)
++        if(!new_buffer) {
++            pc->index = 0;
+             return AVERROR(ENOMEM);
++        }
+         pc->buffer = new_buffer;
+         memcpy(&pc->buffer[pc->index], *buf, *buf_size);
+         pc->index += *buf_size;
+@@ -255,9 +257,11 @@ int ff_combine_frame(ParseContext *pc, int next, const uint8_t **buf, int *buf_s
+     /* append to buffer */
+     if(pc->index){
+         void* new_buffer = av_fast_realloc(pc->buffer, &pc->buffer_size, next + pc->index + FF_INPUT_BUFFER_PADDING_SIZE);
+-
+-        if(!new_buffer)
++        if(!new_buffer) {
++            pc->overread_index =
++            pc->index = 0;
+             return AVERROR(ENOMEM);
++        }
+         pc->buffer = new_buffer;
+         if (next > -FF_INPUT_BUFFER_PADDING_SIZE)
+             memcpy(&pc->buffer[pc->index], *buf,
+-- 
+1.7.5.4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-rpza-Perform-pointer-advance-and-checks-befo.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-rpza-Perform-pointer-advance-and-checks-befo.patch
new file mode 100644
index 0000000..7f6eb48
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-rpza-Perform-pointer-advance-and-checks-befo.patch
@@ -0,0 +1,81 @@
+gst-ffmpeg: avcodec/rpza: Perform pointer advance and checks before
+ using the pointers
+
+Fixes out of array accesses
+Fixes Ticket2850
+
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+(cherry picked from commit 3819db745da2ac7fb3faacb116788c32f4753f34)
+
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+
+Upstream-Status: Backport 
+
+Singed-off-by: Yue Tao <yue.tao@windriver.com>
+
+---
+ libavcodec/rpza.c |    8 ++++----
+ 1 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/libavcodec/rpza.c b/libavcodec/rpza.c
+index 635b406..f291a95 100644
+--- a/gst-libs/ext/libav/libavcodec/rpza.c
++++ b/gst-libs/ext/libav/libavcodec/rpza.c
+@@ -83,7 +83,7 @@ static void rpza_decode_stream(RpzaContext *s)
+     unsigned short *pixels = (unsigned short *)s->frame.data[0];
+ 
+     int row_ptr = 0;
+-    int pixel_ptr = 0;
++    int pixel_ptr = -4;
+     int block_ptr;
+     int pixel_x, pixel_y;
+     int total_blocks;
+@@ -139,6 +139,7 @@ static void rpza_decode_stream(RpzaContext *s)
+             colorA = AV_RB16 (&s->buf[stream_ptr]);
+             stream_ptr += 2;
+             while (n_blocks--) {
++                ADVANCE_BLOCK()
+                 block_ptr = row_ptr + pixel_ptr;
+                 for (pixel_y = 0; pixel_y < 4; pixel_y++) {
+                     for (pixel_x = 0; pixel_x < 4; pixel_x++){
+@@ -147,7 +148,6 @@ static void rpza_decode_stream(RpzaContext *s)
+                     }
+                     block_ptr += row_inc;
+                 }
+-                ADVANCE_BLOCK();
+             }
+             break;
+ 
+@@ -184,6 +184,7 @@ static void rpza_decode_stream(RpzaContext *s)
+             color4[2] |= ((21 * ta + 11 * tb) >> 5);
+ 
+             while (n_blocks--) {
++                ADVANCE_BLOCK();
+                 block_ptr = row_ptr + pixel_ptr;
+                 for (pixel_y = 0; pixel_y < 4; pixel_y++) {
+                     index = s->buf[stream_ptr++];
+@@ -194,12 +195,12 @@ static void rpza_decode_stream(RpzaContext *s)
+                     }
+                     block_ptr += row_inc;
+                 }
+-                ADVANCE_BLOCK();
+             }
+             break;
+ 
+         /* Fill block with 16 colors */
+         case 0x00:
++            ADVANCE_BLOCK();
+             block_ptr = row_ptr + pixel_ptr;
+             for (pixel_y = 0; pixel_y < 4; pixel_y++) {
+                 for (pixel_x = 0; pixel_x < 4; pixel_x++){
+@@ -213,7 +214,6 @@ static void rpza_decode_stream(RpzaContext *s)
+                 }
+                 block_ptr += row_inc;
+             }
+-            ADVANCE_BLOCK();
+             break;
+ 
+         /* Unknown opcode */
+-- 
+1.7.5.4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-smc-fix-off-by-1-error.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-smc-fix-off-by-1-error.patch
new file mode 100644
index 0000000..3ca6fc4
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-smc-fix-off-by-1-error.patch
@@ -0,0 +1,32 @@
+From c17a0ad1df15a94d0b1239adc2afb593bdf0a153 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michaelni@gmx.at>
+Date: Fri, 3 Oct 2014 22:50:45 +0200
+Subject: [PATCH 1/2] avcodec/smc: fix off by 1 error
+
+Upstream-Status: Backport
+
+Fixes out of array access
+Fixes: asan_heap-oob_1685bf0_5_asan_heap-oob_1f35116_430_smc.mov
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+---
+ libavcodec/smc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/gst-libs/ext/libav/libavcodec/smc.c b/gst-libs/ext/libav/libavcodec/smc.c
+index 3cd5e53..dec9f71 100644
+--- a/gst-libs/ext/libav/libavcodec/smc.c
++++ b/gst-libs/ext/libav/libavcodec/smc.c
+@@ -69,7 +69,7 @@ typedef struct SmcContext {
+         row_ptr += stride * 4; \
+     } \
+     total_blocks--; \
+-    if (total_blocks < 0) \
++    if (total_blocks < 0 + !!n_blocks) \
+     { \
+         av_log(s->avctx, AV_LOG_INFO, "warning: block counter just went negative (this should not happen)\n"); \
+         return; \
+-- 
+2.1.0
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avformat-mpegtsenc-Check-data-array-size-in-mpegts_w.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avformat-mpegtsenc-Check-data-array-size-in-mpegts_w.patch
new file mode 100644
index 0000000..68bb66e
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avformat-mpegtsenc-Check-data-array-size-in-mpegts_w.patch
@@ -0,0 +1,69 @@
+From 12770701856a05b6b3cd706f708f8e9a4e8a1336 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michaelni@gmx.at>
+Date: Thu, 13 Feb 2014 13:59:51 +0100
+Subject: [PATCH] avformat/mpegtsenc: Check data array size in
+ mpegts_write_pmt()
+
+Upstream-Status: Backport
+
+COmmit 12770701856a05b6b3cd706f708f8e9a4e8a1336 release/0.11
+
+Prevents out of array writes
+
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+(cherry picked from commit 842b6c14bcfc1c5da1a2d288fd65386eb8c158ad)
+
+Conflicts:
+
+        libavformat/mpegtsenc.c
+(cherry picked from commit e87de3f50b765134588d0b048c32ed4b8acc16fb)
+
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+---
+ libavformat/mpegtsenc.c |    9 +++++++--
+ 1 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/libavformat/mpegtsenc.c b/libavformat/mpegtsenc.c
+index 793e205..a12d19f 100644
+--- a/gst-libs/ext/libav/libavformat/mpegtsenc.c
++++ b/gst-libs/ext/libav/libavformat/mpegtsenc.c
+@@ -240,7 +240,7 @@ static void mpegts_write_pat(AVFormatContext *s)
+                           data, q - data);
+ }
+ 
+-static void mpegts_write_pmt(AVFormatContext *s, MpegTSService *service)
++static int mpegts_write_pmt(AVFormatContext *s, MpegTSService *service)
+ {
+     //    MpegTSWrite *ts = s->priv_data;
+     uint8_t data[1012], *q, *desc_length_ptr, *program_info_length_ptr;
+@@ -293,6 +293,10 @@ static void mpegts_write_pmt(AVFormatContext *s, MpegTSService *service)
+             stream_type = STREAM_TYPE_PRIVATE_DATA;
+             break;
+         }
++
++        if (q - data > sizeof(data) - 32)
++            return AVERROR(EINVAL);
++
+         *q++ = stream_type;
+         put16(&q, 0xe000 | ts_st->pid);
+         desc_length_ptr = q;
+@@ -324,7 +328,7 @@ static void mpegts_write_pmt(AVFormatContext *s, MpegTSService *service)
+                 len_ptr = q++;
+                 *len_ptr = 0;
+ 
+-                for (p = lang->value; next && *len_ptr < 255 / 4 * 4; p = next + 1) {
++                for (p = lang->value; next && *len_ptr < 255 / 4 * 4 && q - data < sizeof(data) - 4; p = next + 1) {
+                     next = strchr(p, ',');
+                     if (strlen(p) != 3 && (!next || next != p + 3))
+                         continue; /* not a 3-letter code */
+@@ -386,6 +390,7 @@ static void mpegts_write_pmt(AVFormatContext *s, MpegTSService *service)
+     }
+     mpegts_write_section1(&service->pmt, PMT_TID, service->sid, 0, 0, 0,
+                           data, q - data);
++    return 0;
+ }
+ 
+ /* NOTE: str == NULL is accepted for an empty string */
+-- 
+1.7.5.4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-eamad-fix-out-of-array-accesses.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-eamad-fix-out-of-array-accesses.patch
new file mode 100644
index 0000000..f45e3fd
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-eamad-fix-out-of-array-accesses.patch
@@ -0,0 +1,29 @@
+From 63ac64864c6e0e84355aa3caa5b92208997a9a8d Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michaelni@gmx.at>
+Date: Sat, 17 Nov 2012 16:26:55 +0100
+Subject: [PATCH] eamad: fix out of array accesses
+
+Upstream-Status: Backport
+
+Commit 63ac64864c6e0e84355aa3caa5b92208997a9a8d release/1.1
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+---
+ libavcodec/eamad.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libavcodec/eamad.c b/libavcodec/eamad.c
+index 2805195..e38650e 100644
+--- a/gst-libs/ext/libav/libavcodec/eamad.c
++++ b/gst-libs/ext/libav/libavcodec/eamad.c
+@@ -237,7 +237,7 @@ static int decode_frame(AVCodecContext *avctx,
+     int chunk_type;
+     int inter;
+ 
+-    if (buf_size < 17) {
++    if (buf_size < 26) {
+         av_log(avctx, AV_LOG_ERROR, "Input buffer too small\n");
+         *data_size = 0;
+         return -1;
+-- 
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-error-concealment-initialize-block-index.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-error-concealment-initialize-block-index.patch
new file mode 100644
index 0000000..e0e4239
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-error-concealment-initialize-block-index.patch
@@ -0,0 +1,29 @@
+gst-ffmpeg: error concealment: initialize block index.
+
+Fixes CVE-2011-3941 (out of bounds write)
+
+Upstream-Status: Backport 
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+---
+ libavcodec/error_resilience.c |    3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/libavcodec/error_resilience.c b/libavcodec/error_resilience.c
+index 8bb5d0c..d55c000 100644
+--- a/gst-libs/ext/libav/libavcodec/error_resilience.c
++++ b/gst-libs/ext/libav/libavcodec/error_resilience.c
+@@ -45,6 +45,9 @@ static void decode_mb(MpegEncContext *s, int ref){
+     s->dest[1] = s->current_picture.data[1] + (s->mb_y * (16>>s->chroma_y_shift) * s->uvlinesize) + s->mb_x * (16>>s->chroma_x_shift);
+     s->dest[2] = s->current_picture.data[2] + (s->mb_y * (16>>s->chroma_y_shift) * s->uvlinesize) + s->mb_x * (16>>s->chroma_x_shift);
+ 
++    ff_init_block_index(s);
++    ff_update_block_index(s);
++
+     if(CONFIG_H264_DECODER && s->codec_id == CODEC_ID_H264){
+         H264Context *h= (void*)s;
+         h->mb_xy= s->mb_x + s->mb_y*s->mb_stride;
+-- 
+1.7.5.4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-error_concealment-Check-that-the-picture-is-not-in-a.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-error_concealment-Check-that-the-picture-is-not-in-a.patch
new file mode 100644
index 0000000..8eef6e9
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-error_concealment-Check-that-the-picture-is-not-in-a.patch
@@ -0,0 +1,37 @@
+gst-ffmpeg: error_concealment: Check that the picture is not in a half
+
+Fixes state becoming inconsistent
+Fixes a null pointer dereference
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+(cherry picked from commit 23318a57358358e7a4dc551e830e4503f0638cfe)
+
+Upstream-Status: Backport 
+
+Signed-off-by: Yue Tao <yue.tao@windriver.com>
+
+---
+ libavcodec/error_resilience.c |    6 ++++++
+ 1 files changed, 6 insertions(+), 0 deletions(-)
+
+diff --git a/libavcodec/error_resilience.c b/libavcodec/error_resilience.c
+index 01f7424..2b6bc42 100644
+--- a/gst-libs/ext/libav/libavcodec/error_resilience.c
++++ b/gst-libs/ext/libav/libavcodec/error_resilience.c
+@@ -793,6 +793,12 @@ void ff_er_frame_end(MpegEncContext *s){
+        s->picture_structure != PICT_FRAME || // we dont support ER of field pictures yet, though it should not crash if enabled
+        s->error_count==3*s->mb_width*(s->avctx->skip_top + s->avctx->skip_bottom)) return;
+ 
++    if (   s->picture_structure == PICT_FRAME
++        && s->current_picture.linesize[0] != s->current_picture_ptr->linesize[0]) {
++        av_log(s->avctx, AV_LOG_ERROR, "Error concealment not possible, frame not fully initialized\n");
++        return;
++    }
++
+     if(s->current_picture.motion_val[0] == NULL){
+         av_log(s->avctx, AV_LOG_ERROR, "Warning MVs not available\n");
+ 
+-- 
+1.7.5.4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-ffserver-set-oformat.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-ffserver-set-oformat.patch
new file mode 100644
index 0000000..80325db
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-ffserver-set-oformat.patch
@@ -0,0 +1,36 @@
+gst-ffmpeg: ffserver: set oformat
+
+Fix Ticket1986
+
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+(cherry picked from commit cbe43e62c9ac7d4aefdc13476f6f691bd626525f)
+
+Upstream-Status: Backport 
+
+---
+ ffserver.c |    4 +++-
+ 1 files changed, 3 insertions(+), 1 deletions(-)
+
+diff --git a/ffserver.c b/ffserver.c
+index 4044d0f..8740140 100644
+--- a/gst-libs/ext/libav/ffserver.c
++++ b/gst-libs/ext/libav/ffserver.c
+@@ -2937,12 +2937,14 @@ static int prepare_sdp_description(FFStream *stream, uint8_t **pbuffer,
+ {
+     AVFormatContext *avc;
+     AVStream *avs = NULL;
++    AVOutputFormat *rtp_format = av_guess_format("rtp", NULL, NULL);
+     int i;
+ 
+     avc =  avformat_alloc_context();
+-    if (avc == NULL) {
++    if (avc == NULL || !rtp_format) {
+         return -1;
+     }
++    avc->oformat = rtp_format;
+     av_dict_set(&avc->metadata, "title",
+                stream->title[0] ? stream->title : "No Title", 0);
+     avc->nb_streams = stream->nb_streams;
+-- 
+1.7.5.4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-correct-ref-count-check-and-limit-fix-out-of-ar.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-correct-ref-count-check-and-limit-fix-out-of-ar.patch
new file mode 100644
index 0000000..d4f55b2
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-correct-ref-count-check-and-limit-fix-out-of-ar.patch
@@ -0,0 +1,29 @@
+From d6c184880ee2e09fd68c0ae217173832cee5afc1 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michaelni@gmx.at>
+Date: Sun, 18 Nov 2012 16:29:04 +0100
+Subject: [PATCH] h264: correct ref count check and limit, fix out of array
+ accesses.
+
+Upstream-Status: Backport
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+---
+ libavcodec/h264.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libavcodec/h264.c b/libavcodec/h264.c
+index da43f1e..32cede5 100644
+--- a/gst-libs/ext/libav/libavcodec/h264.c
++++ b/gst-libs/ext/libav/libavcodec/h264.c
+@@ -2870,6 +2870,9 @@ static int decode_slice_header(H264Conte
+             h->ref_count[0]= get_ue_golomb(&s->gb) + 1;
+             if(h->slice_type_nos==AV_PICTURE_TYPE_B)
+                 h->ref_count[1]= get_ue_golomb(&s->gb) + 1;
++            else
++                // full range is spec-ok in this case, even for frames
++                h->ref_count[1] = 1;
+ 
+             if(h->ref_count[0]-1 > 32-1 || h->ref_count[1]-1 > 32-1){
+                 av_log(h->s.avctx, AV_LOG_ERROR, "reference overflow\n");
+-- 
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-set-parameters-from-SPS-whenever-it-changes.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-set-parameters-from-SPS-whenever-it-changes.patch
new file mode 100644
index 0000000..05a9de3
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-set-parameters-from-SPS-whenever-it-changes.patch
@@ -0,0 +1,145 @@
+gst-ffmpeg: h264: set parameters from SPS whenever it changes
+    
+Fixes a crash in the fuzzed sample sample_varPAR.avi_s26638 with
+alternating bit depths.
+
+Upstream-Status: Backport
+
+Signed-off-by: Yue Tao <yue.tao@windriver.com>
+
+diff --git a/gst-libs/ext/libav/libavcodec/h264.c.old b/gst-libs/ext/libav/libavcodec/h264.c
+index 3621f41..718906a 100644
+--- a/gst-libs/ext/libav/libavcodec/h264.c.old
++++ b/gst-libs/ext/libav/libavcodec/h264.c
+@@ -2491,6 +2491,34 @@ int ff_h264_get_profile(SPS *sps)
+     return profile;
+ }
+ 
++static int h264_set_parameter_from_sps(H264Context *h)
++{
++    MpegEncContext *s = &h->s;
++    AVCodecContext * avctx= s->avctx;
++
++    if (s->flags& CODEC_FLAG_LOW_DELAY ||
++        (h->sps.bitstream_restriction_flag && !h->sps.num_reorder_frames))
++        s->low_delay=1;
++
++    if(avctx->has_b_frames < 2)
++        avctx->has_b_frames= !s->low_delay;
++
++    if (avctx->bits_per_raw_sample != h->sps.bit_depth_luma) {
++        if (h->sps.bit_depth_luma >= 8 && h->sps.bit_depth_luma <= 10) {
++            avctx->bits_per_raw_sample = h->sps.bit_depth_luma;
++            h->pixel_shift = h->sps.bit_depth_luma > 8;
++
++            ff_h264dsp_init(&h->h264dsp, h->sps.bit_depth_luma);
++            ff_h264_pred_init(&h->hpc, s->codec_id, h->sps.bit_depth_luma);
++            dsputil_init(&s->dsp, s->avctx);
++        } else {
++            av_log(avctx, AV_LOG_DEBUG, "Unsupported bit depth: %d\n", h->sps.bit_depth_luma);
++            return -1;
++        }
++    }
++    return 0;
++}
++
+ /**
+  * decodes a slice header.
+  * This will also call MPV_common_init() and frame_start() as needed.
+@@ -2505,7 +2533,7 @@ static int decode_slice_header(H264Context *h, H264Context *h0){
+     MpegEncContext * const s0 = &h0->s;
+     unsigned int first_mb_in_slice;
+     unsigned int pps_id;
+-    int num_ref_idx_active_override_flag;
++    int num_ref_idx_active_override_flag, ret;
+     unsigned int slice_type, tmp, i, j;
+     int default_ref_list_done = 0;
+     int last_pic_structure;
+@@ -2569,7 +2597,17 @@ static int decode_slice_header(H264Context *h, H264Context *h0){
+         av_log(h->s.avctx, AV_LOG_ERROR, "non-existing SPS %u referenced\n", h->pps.sps_id);
+         return -1;
+     }
+-    h->sps = *h0->sps_buffers[h->pps.sps_id];
++
++    if (h->pps.sps_id != h->current_sps_id ||
++        h0->sps_buffers[h->pps.sps_id]->new) {
++        h0->sps_buffers[h->pps.sps_id]->new = 0;
++
++        h->current_sps_id = h->pps.sps_id;
++        h->sps            = *h0->sps_buffers[h->pps.sps_id];
++
++        if ((ret = h264_set_parameter_from_sps(h)) < 0)
++            return ret;
++    }
+ 
+     s->avctx->profile = ff_h264_get_profile(&h->sps);
+     s->avctx->level   = h->sps.level_idc;
+@@ -3811,26 +3811,8 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){
+         case NAL_SPS:
+             init_get_bits(&s->gb, ptr, bit_length);
+             ff_h264_decode_seq_parameter_set(h);
+-
+-            if (s->flags& CODEC_FLAG_LOW_DELAY ||
+-                (h->sps.bitstream_restriction_flag && !h->sps.num_reorder_frames))
+-                s->low_delay=1;
+-
+-            if(avctx->has_b_frames < 2)
+-                avctx->has_b_frames= !s->low_delay;
+-
+-            if (avctx->bits_per_raw_sample != h->sps.bit_depth_luma) {
+-                if (h->sps.bit_depth_luma >= 8 && h->sps.bit_depth_luma <= 10) {
+-                    avctx->bits_per_raw_sample = h->sps.bit_depth_luma;
+-                    h->pixel_shift = h->sps.bit_depth_luma > 8;
+-
+-                    ff_h264dsp_init(&h->h264dsp, h->sps.bit_depth_luma);
+-                    ff_h264_pred_init(&h->hpc, s->codec_id, h->sps.bit_depth_luma);
+-                    dsputil_init(&s->dsp, s->avctx);
+-                } else {
+-                    av_log(avctx, AV_LOG_DEBUG, "Unsupported bit depth: %d\n", h->sps.bit_depth_luma);
+-                    return -1;
+-                }
++            if (h264_set_parameter_from_sps(h) < 0) {
++                return -1;
+             }
+             break;
+         case NAL_PPS:
+diff --git a/gst-libs/ext/libav/libavcodec/h264.h.old b/gst-libs/ext/libav/libavcodec/h264.h
+index e3cc815..b77ad98 100644
+--- a/gst-libs/ext/libav/libavcodec/h264.h.old
++++ b/gst-libs/ext/libav/libavcodec/h264.h
+@@ -202,6 +202,7 @@ typedef struct SPS{
+     int bit_depth_chroma;              ///< bit_depth_chroma_minus8 + 8
+     int residual_color_transform_flag; ///< residual_colour_transform_flag
+     int constraint_set_flags;          ///< constraint_set[0-3]_flag
++    int new;                              ///< flag to keep track if the decoder context needs re-init due to changed SPS
+ }SPS;
+ 
+ /**
+@@ -333,6 +334,7 @@ typedef struct H264Context{
+     int emu_edge_width;
+     int emu_edge_height;
+ 
++    unsigned current_sps_id; ///< id of the current SPS
+     SPS sps; ///< current sps
+ 
+     /**
+diff --git a/gst-libs/ext/libav/libavcodec/h264_ps.c.old b/gst-libs/ext/libav/libavcodec/h264_ps.c
+index 7491807..0929098 100644
+--- a/gst-libs/ext/libav/libavcodec/h264_ps.c.old
++++ b/gst-libs/ext/libav/libavcodec/h264_ps.c
+@@ -438,10 +438,13 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){
+                sps->timing_info_present_flag ? sps->time_scale : 0
+                );
+     }
++    sps->new = 1;
+ 
+     av_free(h->sps_buffers[sps_id]);
+-    h->sps_buffers[sps_id]= sps;
+-    h->sps = *sps;
++    h->sps_buffers[sps_id] = sps;
++    h->sps                 = *sps;
++    h->current_sps_id      = sps_id;
++
+     return 0;
+ fail:
+     av_free(sps);
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-skip-error-concealment-when-SPS-and-slices-are-.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-skip-error-concealment-when-SPS-and-slices-are-.patch
new file mode 100644
index 0000000..5d45c1a
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-skip-error-concealment-when-SPS-and-slices-are-.patch
@@ -0,0 +1,33 @@
+gst-ffmpeg: h264: skip error concealment when SPS and slices are
+ mismatching
+
+Fixes out of array accesses
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+(cherry picked from commit 695af8eed642ff0104834495652d1ee784a4c14d)
+
+Upstream-Status: Backport
+
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+Signed-off-by: Yue Tao <yue.tao@windriver.com>
+---
+ libavcodec/h264.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/libavcodec/h264.c b/libavcodec/h264.c
+index da144db..0aab4e7 100644
+--- a/gst-libs/ext/libav/libavcodec/h264.c
++++ b/gst-libs/ext/libav/libavcodec/h264.c
+@@ -2351,7 +2351,7 @@ static int field_end(H264Context *h, int in_setup)
+      * past end by one (callers fault) and resync_mb_y != 0
+      * causes problems for the first MB line, too.
+      */
+-    if (!FIELD_PICTURE)
++    if (!FIELD_PICTURE && h->current_slice && !h->sps.new)
+         ff_er_frame_end(s);
+ 
+     ff_MPV_frame_end(s);
+-- 
+1.7.5.4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264_sei-Fix-infinite-loop.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264_sei-Fix-infinite-loop.patch
new file mode 100644
index 0000000..1e62b50
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264_sei-Fix-infinite-loop.patch
@@ -0,0 +1,39 @@
+gst-ffmpeg: h264_sei: Fix infinite loop.
+
+Fixsot yet fixed parts of CVE-2011-3946.
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+
+Upstream-Status: Backport 
+
+Signed-off-by: Yue Tao <yue.tao@windriver.com>
+
+---
+ libavcodec/h264_sei.c |    4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+
+diff --git a/libavcodec/h264_sei.c b/libavcodec/h264_sei.c
+index 374e53d..80d70e5 100644
+--- a/gst-libs/ext/libav/libavcodec/h264_sei.c
++++ b/gst-libs/ext/libav/libavcodec/h264_sei.c
+@@ -169,11 +169,15 @@ int ff_h264_decode_sei(H264Context *h){
+ 
+         type=0;
+         do{
++            if (get_bits_left(&s->gb) < 8)
++                return -1;
+             type+= show_bits(&s->gb, 8);
+         }while(get_bits(&s->gb, 8) == 255);
+ 
+         size=0;
+         do{
++            if (get_bits_left(&s->gb) < 8)
++                return -1;
+             size+= show_bits(&s->gb, 8);
+         }while(get_bits(&s->gb, 8) == 255);
+ 
+-- 
+1.7.5.4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-huffyuvdec-Check-init_vlc-return-codes.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-huffyuvdec-Check-init_vlc-return-codes.patch
new file mode 100644
index 0000000..e859e44
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-huffyuvdec-Check-init_vlc-return-codes.patch
@@ -0,0 +1,87 @@
+From b666debffec1fcbb19ef377635a53b9a58bca8a4 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michaelni@gmx.at>
+Date: Tue, 29 Jan 2013 18:29:41 +0100
+Subject: [PATCH] huffyuvdec: Check init_vlc() return codes.
+
+Upstream-Status: Backport
+
+Commit b666debffec1fcbb19ef377635a53b9a58bca8a4 release/1.0
+
+Prevents out of array writes
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+(cherry picked from commit f67a0d115254461649470452058fa3c28c0df294)
+
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+---
+ libavcodec/huffyuv.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/libavcodec/huffyuv.c b/libavcodec/huffyuv.c
+index 58da789..993e524 100644
+--- a/gst-libs/ext/libav/libavcodec/huffyuv.c
++++ b/gst-libs/ext/libav/libavcodec/huffyuv.c
+@@ -33,6 +33,7 @@
+ #include "put_bits.h"
+ #include "dsputil.h"
+ #include "thread.h"
++#include "libavutil/avassert.h"
+ 
+ #define VLC_BITS 11
+ 
+@@ -287,6 +287,7 @@ static void generate_joint_tables(HYuvCo
+                     int len1 = s->len[p][u];
+                     if (len1 > limit || !len1)
+                         continue;
++                    av_assert0(i < (1 << VLC_BITS));
+                     len[i] = len0 + len1;
+                     bits[i] = (s->bits[0][y] << len1) + s->bits[p][u];
+                     symbols[i] = (y<<8) + u;
+@@ -320,6 +321,7 @@ static void generate_joint_tables(HYuvCo
+                     int len2 = s->len[2][r&255];
+                     if (len2 > limit1 || !len2)
+                         continue;
++                    av_assert0(i < (1 << VLC_BITS));
+                     len[i] = len0 + len1 + len2;
+                     bits[i] = (code << len2) + s->bits[2][r&255];
+                     if(s->decorrelate){
+@@ -343,6 +345,7 @@ static void generate_joint_tables(HYuvCo
+ static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length){
+     GetBitContext gb;
+     int i;
++    int ret;
+ 
+     init_get_bits(&gb, src, length*8);
+ 
+@@ -353,7 +356,9 @@ static int read_huffman_tables(HYuvConte
+             return -1;
+         }
+         free_vlc(&s->vlc[i]);
+-        init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0);
++        if ((ret = init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1,
++                           s->bits[i], 4, 4, 0)) < 0)
++            return ret;
+     }
+ 
+     generate_joint_tables(s);
+@@ -365,6 +370,7 @@ static int read_old_huffman_tables(HYuvC
+ #if 1
+     GetBitContext gb;
+     int i;
++    int ret;
+ 
+     init_get_bits(&gb, classic_shift_luma, sizeof(classic_shift_luma)*8);
+     if(read_len_table(s->len[0], &gb)<0)
+@@ -385,7 +391,9 @@ static int read_old_huffman_tables(HYuvC
+ 
+     for(i=0; i<3; i++){
+         free_vlc(&s->vlc[i]);
+-        init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0);
++        if ((ret = init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1,
++                            s->bits[i], 4, 4, 0)) < 0)
++            return ret;
+     }
+ 
+     generate_joint_tables(s);
+-- 
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-huffyuvdec-Skip-len-0-cases.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-huffyuvdec-Skip-len-0-cases.patch
new file mode 100644
index 0000000..94bf4b6
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-huffyuvdec-Skip-len-0-cases.patch
@@ -0,0 +1,61 @@
+From db0f7f7394e1f994ed38db043f78ed0f10bde0da Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michaelni@gmx.at>
+Date: Tue, 29 Jan 2013 19:22:33 +0100
+Subject: [PATCH] huffyuvdec: Skip len==0 cases
+
+Upstream-Status: Backport
+
+Commit db0f7f7394e1f994ed38db043f78ed0f10bde0da release/1.0
+
+Fixes vlc decoding for hypothetical files that would contain such cases.
+
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+(cherry picked from commit 0dfc01c2bbf4b71bb56201bc4a393321e15d1b31)
+
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+---
+ libavcodec/huffyuv.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/libavcodec/huffyuv.c b/libavcodec/huffyuv.c
+index 993e524..72ed351 100644
+--- a/gst-libs/ext/libav/libavcodec/huffyuv.c
++++ b/gst-libs/ext/libav/libavcodec/huffyuv.c
+@@ -281,11 +281,11 @@ static void generate_joint_tables(HYuvCo
+             for(i=y=0; y<256; y++){
+                 int len0 = s->len[0][y];
+                 int limit = VLC_BITS - len0;
+-                if(limit <= 0)
++                if(limit <= 0 || !len0)
+                     continue;
+                 for(u=0; u<256; u++){
+                     int len1 = s->len[p][u];
+-                    if(len1 > limit)
++                    if (len1 > limit || !len1)
+                         continue;
+                     len[i] = len0 + len1;
+                     bits[i] = (s->bits[0][y] << len1) + s->bits[p][u];
+@@ -308,17 +308,17 @@ static void generate_joint_tables(HYuvCo
+         for(i=0, g=-16; g<16; g++){
+             int len0 = s->len[p0][g&255];
+             int limit0 = VLC_BITS - len0;
+-            if(limit0 < 2)
++            if (limit0 < 2 || !len0)
+                 continue;
+             for(b=-16; b<16; b++){
+                 int len1 = s->len[p1][b&255];
+                 int limit1 = limit0 - len1;
+-                if(limit1 < 1)
++                if (limit1 < 1 || !len1)
+                     continue;
+                 code = (s->bits[p0][g&255] << len1) + s->bits[p1][b&255];
+                 for(r=-16; r<16; r++){
+                     int len2 = s->len[2][r&255];
+-                    if(len2 > limit1)
++                    if (len2 > limit1 || !len2)
+                         continue;
+                     len[i] = len0 + len1 + len2;
+                     bits[i] = (code << len2) + s->bits[2][r&255];
+-- 
+1.8.5.2.233.g932f7e4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-huffyuvdec-check-width-more-completely-avoid-out-of-.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-huffyuvdec-check-width-more-completely-avoid-out-of-.patch
new file mode 100644
index 0000000..6b60d16
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-huffyuvdec-check-width-more-completely-avoid-out-of-.patch
@@ -0,0 +1,30 @@
+gst-ffmpeg: huffyuvdec: check width more completely, avoid out of array
+ accesses
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+
+Upstream-Status: Backport 
+
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+---
+ libavcodec/huffyuv.c |    5 ++++-
+ 1 files changed, 4 insertions(+), 1 deletions(-)
+
+diff --git a/libavcodec/huffyuv.c b/libavcodec/huffyuv.c
+index 6e88114..ca5bcd8 100644
+--- a/gst-libs/ext/libav/libavcodec/huffyuv.c
++++ b/gst-libs/ext/libav/libavcodec/huffyuv.c
+@@ -526,6 +526,10 @@ s->bgr32=1;
+         assert(0);
+     }
+ 
++    if (s->predictor == MEDIAN && avctx->pix_fmt == AV_PIX_FMT_YUV422P && avctx->width%4) {
++        av_log(avctx, AV_LOG_ERROR, "width must be a multiple of 4 this colorspace and predictor\n");
++        return AVERROR_INVALIDDATA;
++    }
+     alloc_temp(s);
+ 
+ //    av_log(NULL, AV_LOG_DEBUG, "pred:%d bpp:%d hbpp:%d il:%d\n", s->predictor, s->bitstream_bpp, avctx->bits_per_coded_sample, s->interlaced);
+-- 
+1.7.5.4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-lavf-compute-probe-buffer-size-more-reliably.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-lavf-compute-probe-buffer-size-more-reliably.patch
new file mode 100644
index 0000000..ea4aa22
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-lavf-compute-probe-buffer-size-more-reliably.patch
@@ -0,0 +1,45 @@
+gst-ffmpeg: lavf: compute probe buffer size more reliably.
+
+The previous code computes the offset by reversing the growth
+of the allocated buffer size: it is complex and did lead to
+inconsistencies when the size limit is reached.
+
+Fix trac ticket #1991.
+(cherry picked from commit 03847eb8259291b4ff1bd840bd779d0699d71f96)
+
+Conflicts:
+        libavformat/utils.c
+
+Upstream-Status: Backport
+
+Signed-off-by: Yue Tao <yue.tao@windriver.com>
+
+---
+ libavformat/utils.c |    4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/libavformat/utils.c b/libavformat/utils.c
+index 7940037..be73c4a 100644
+--- a/gst-libs/ext/libav/libavformat/utils.c
++++ b/gst-libs/ext/libav/libavformat/utils.c
+@@ -459,7 +459,7 @@ int av_probe_input_buffer(AVIOContext *pb, AVInputFormat **fmt,
+ {
+     AVProbeData pd = { filename ? filename : "", NULL, -offset };
+     unsigned char *buf = NULL;
+-    int ret = 0, probe_size;
++    int ret = 0, probe_size, buf_offset = 0;
+ 
+     if (!max_probe_size) {
+         max_probe_size = PROBE_BUF_MAX;
+@@ -499,7 +499,7 @@ int av_probe_input_buffer(AVIOContext *pb, AVInputFormat **fmt,
+             score = 0;
+             ret = 0;            /* error was end of file, nothing read */
+         }
+-        pd.buf_size += ret;
++        pd.buf_size = buf_offset += ret;
+         pd.buf = &buf[offset];
+ 
+         memset(pd.buf + pd.buf_size, 0, AVPROBE_PADDING_SIZE);
+-- 
+1.7.5.4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-mjpegdec-check-SE.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-mjpegdec-check-SE.patch
new file mode 100644
index 0000000..d90bafa
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-mjpegdec-check-SE.patch
@@ -0,0 +1,32 @@
+From 1f41cffe1e3e79620f587545bdfcbd7e6e68ed29 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michaelni@gmx.at>
+Date: Sun, 11 Nov 2012 00:01:24 +0100
+Subject: [PATCH] mjpegdec: check SE.
+
+Upstream-Status: Backport
+
+Commit 1f41cffe1e3e79620f587545bdfcbd7e6e68ed29 release/1.1
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+---
+ libavcodec/mjpegdec.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
+index 6b5266d..0a71a6f 100644
+--- a/gst-libs/ext/libav/libavcodec/mjpegdec.c
++++ b/gst-libs/ext/libav/libavcodec/mjpegdec.c
+@@ -905,6 +905,11 @@ static int mjpeg_decode_scan_progressive
+     int16_t *quant_matrix = s->quant_matrixes[ s->quant_index[c] ];
+     GetBitContext mb_bitmask_gb;
+ 
++    if (se > 63) {
++        av_log(s->avctx, AV_LOG_ERROR, "SE %d is too large\n", se);
++        return AVERROR_INVALIDDATA;
++    }
++
+     if (mb_bitmask) {
+         init_get_bits(&mb_bitmask_gb, mb_bitmask, s->mb_width*s->mb_height);
+     }
+-- 
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-pgssubdec-check-RLE-size-before-copying.-Fix-out-of-.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-pgssubdec-check-RLE-size-before-copying.-Fix-out-of-.patch
new file mode 100644
index 0000000..1041347
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-pgssubdec-check-RLE-size-before-copying.-Fix-out-of-.patch
@@ -0,0 +1,34 @@
+From 28bf685bfc6d0c744369cdf367f61a78d80d0b01 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michaelni@gmx.at>
+Date: Thu, 15 Nov 2012 16:41:28 +0100
+Subject: [PATCH] pgssubdec: check RLE size before copying. Fix out of array
+ accesses
+
+Upstream-Status: Backport
+
+Commit 28bf685bfc6d0c744369cdf367f61a78d80d0b01 release/1.1
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+(cherry picked from commit c0d68be555f5858703383040e04fcd6529777061)
+---
+ libavcodec/pgssubdec.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/libavcodec/pgssubdec.c b/libavcodec/pgssubdec.c
+index 728f178..26a3c2a 100644
+--- a/gst-libs/ext/libav/libavcodec/pgssubdec.c
++++ b/gst-libs/ext/libav/libavcodec/pgssubdec.c
+@@ -202,6 +202,11 @@ static int parse_picture_segment(AVCodec
+         return -1;
+     }
+ 
++    if (buf_size > rle_bitmap_len) {
++        av_log(avctx, AV_LOG_ERROR, "too much RLE data\n");
++        return AVERROR_INVALIDDATA;
++    }
++
+     ctx->picture.w = width;
+     ctx->picture.h = height;
+ 
+-- 
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-pngdec-filter-dont-access-out-of-array-elements-at-t.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-pngdec-filter-dont-access-out-of-array-elements-at-t.patch
new file mode 100644
index 0000000..1e5fb7d
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-pngdec-filter-dont-access-out-of-array-elements-at-t.patch
@@ -0,0 +1,44 @@
+gst-ffmpeg: pngdec/filter: dont access out of array elements at the end
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+
+Upstream-Status: Backport 
+
+Signed-off-by: Yue Tao <yue.tao@windriver.com>
+---
+ libavcodec/pngdec.c |   12 ++++--------
+ 1 files changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
+index 97c0ad1..193e35e 100644
+--- a/gst-libs/ext/libav/libavcodec/pngdec.c
++++ b/gst-libs/ext/libav/libavcodec/pngdec.c
+@@ -190,7 +190,7 @@ void ff_add_png_paeth_prediction(uint8_t *dst, uint8_t *src, uint8_t *top, int w
+     if(bpp >= 2) g = dst[1];\
+     if(bpp >= 3) b = dst[2];\
+     if(bpp >= 4) a = dst[3];\
+-    for(; i < size; i+=bpp) {\
++    for(; i <= size - bpp; i+=bpp) {\
+         dst[i+0] = r = op(r, src[i+0], last[i+0]);\
+         if(bpp == 1) continue;\
+         dst[i+1] = g = op(g, src[i+1], last[i+1]);\
+@@ -206,13 +206,9 @@ void ff_add_png_paeth_prediction(uint8_t *dst, uint8_t *src, uint8_t *top, int w
+     else if(bpp == 2) UNROLL1(2, op)\
+     else if(bpp == 3) UNROLL1(3, op)\
+     else if(bpp == 4) UNROLL1(4, op)\
+-    else {\
+-        for (; i < size; i += bpp) {\
+-            int j;\
+-            for (j = 0; j < bpp; j++)\
+-                dst[i+j] = op(dst[i+j-bpp], src[i+j], last[i+j]);\
+-        }\
+-    }
++    for (; i < size; i++) {\
++        dst[i] = op(dst[i-bpp], src[i], last[i]);\
++    }\
+ 
+ /* NOTE: 'dst' can be equal to 'last' */
+ static void png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type,
+-- 
+1.7.5.4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-qdm2-check-array-index-before-use-fix-out-of-array-a.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-qdm2-check-array-index-before-use-fix-out-of-array-a.patch
new file mode 100644
index 0000000..8c94232
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-qdm2-check-array-index-before-use-fix-out-of-array-a.patch
@@ -0,0 +1,30 @@
+gst-ffmpeg: qdm2: check array index before use, fix out of array
+ accesses
+
+Upstream-Status: Backport 
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+---
+ libavcodec/qdm2.c |    5 +++++
+ 1 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c
+index 4cf4b2f..1dfb8d5 100644
+--- a/gst-libs/ext/libav/libavcodec/qdm2.c
++++ b/gst-libs/ext/libav/libavcodec/qdm2.c
+@@ -1257,6 +1257,11 @@ static void qdm2_decode_super_block (QDM2Context *q)
+     for (i = 0; packet_bytes > 0; i++) {
+         int j;
+ 
++        if (i>=FF_ARRAY_ELEMS(q->sub_packet_list_A)) {
++            SAMPLES_NEEDED_2("too many packet bytes");
++            return;
++        }
++
+         q->sub_packet_list_A[i].next = NULL;
+ 
+         if (i > 0) {
+-- 
+1.7.5.4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-qdm2dec-fix-buffer-overflow.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-qdm2dec-fix-buffer-overflow.patch
new file mode 100644
index 0000000..43ffc03
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-qdm2dec-fix-buffer-overflow.patch
@@ -0,0 +1,58 @@
+gst-ffmpeg: qdm2dec: fix buffer overflow. Fixes NGS00144
+
+This also adds a few lines of code from master that are needed for this fix.
+
+Thanks to Phillip for suggestions to improve the patch.
+Found-by: Phillip Langlois
+
+Upstream-Status: Backport 
+
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+---
+ libavcodec/qdm2.c |    9 +++++++--
+ 1 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c
+index 3aa9e5b..e000df8 100644
+--- a/gst-libs/ext/libav/libavcodec/qdm2.c
++++ b/gst-libs/ext/libav/libavcodec/qdm2.c
+@@ -76,6 +76,7 @@ do { \
+ #define SAMPLES_NEEDED_2(why) \
+      av_log (NULL,AV_LOG_INFO,"This file triggers some missing code. Please contact the developers.\nPosition: %s\n",why);
+ 
++#define QDM2_MAX_FRAME_SIZE 512
+ 
+ typedef int8_t sb_int8_array[2][30][64];
+ 
+@@ -168,7 +169,7 @@ typedef struct {
+     /// I/O data
+     const uint8_t *compressed_data;
+     int compressed_size;
+-    float output_buffer[1024];
++    float output_buffer[QDM2_MAX_FRAME_SIZE * MPA_MAX_CHANNELS * 2];
+ 
+     /// Synthesis filter
+     MPADSPContext mpadsp;
+@@ -1819,6 +1820,9 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx)
+     s->group_order = av_log2(s->group_size) + 1;
+     s->frame_size = s->group_size / 16; // 16 iterations per super block
+ 
++    if (s->frame_size > QDM2_MAX_FRAME_SIZE)
++        return AVERROR_INVALIDDATA;
++
+     s->sub_sampling = s->fft_order - 7;
+     s->frequency_range = 255 / (1 << (2 - s->sub_sampling));
+ 
+@@ -1887,6 +1891,9 @@ static int qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out)
+     int ch, i;
+     const int frame_size = (q->frame_size * q->channels);
+ 
++    if((unsigned)frame_size > FF_ARRAY_ELEMS(q->output_buffer)/2)
++        return -1;
++
+     /* select input buffer */
+     q->compressed_data = in;
+     q->compressed_size = q->checksum_size;
+-- 
+1.7.5.4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-roqvideodec-check-dimensions-validity.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-roqvideodec-check-dimensions-validity.patch
new file mode 100644
index 0000000..7e58afc
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-roqvideodec-check-dimensions-validity.patch
@@ -0,0 +1,36 @@
+From 391e0fc6c90ced6656b74f50f3a487b6dc76ea63 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michaelni@gmx.at>
+Date: Thu, 29 Nov 2012 15:18:17 +0100
+Subject: [PATCH] roqvideodec: check dimensions validity
+
+Upstream-Status: Backport
+
+Commit 391e0fc6c90ced6656b74f50f3a487b6dc76ea63 release/0.7
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+(cherry picked from commit 3ae610451170cd5a28b33950006ff0bd23036845)
+
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+---
+ libavcodec/roqvideodec.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/libavcodec/roqvideodec.c b/libavcodec/roqvideodec.c
+index f0977f6..4e34231 100644
+--- a/gst-libs/ext/libav/libavcodec/roqvideodec.c
++++ b/gst-libs/ext/libav/libavcodec/roqvideodec.c
+@@ -157,6 +157,12 @@ static av_cold int roq_decode_init(AVCodecContext *avctx)
+     RoqContext *s = avctx->priv_data;
+ 
+     s->avctx = avctx;
++
++    if (avctx->width%16 || avctx->height%16) {
++         av_log_ask_for_sample(avctx, "dimensions not being a multiple of 16 are unsupported\n");
++         return AVERROR_PATCHWELCOME;
++    }
++
+     s->width = avctx->width;
+     s->height = avctx->height;
+     avcodec_get_frame_defaults(&s->frames[0]);
+-- 
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-smackerdec-Check-that-the-last-indexes-are-within-th.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-smackerdec-Check-that-the-last-indexes-are-within-th.patch
new file mode 100644
index 0000000..15b1614
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-smackerdec-Check-that-the-last-indexes-are-within-th.patch
@@ -0,0 +1,32 @@
+gst-ffmpeg: smackerdec: Check that the last indexes are within the
+ table.
+
+Fixes CVE-2011-3944
+
+Upstream-Status: Backport 
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+---
+ libavcodec/smacker.c |    5 +++++
+ 1 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/libavcodec/smacker.c b/libavcodec/smacker.c
+index 30f99b4..2a8bae8 100644
+--- a/gst-libs/ext/libav/libavcodec/smacker.c
++++ b/gst-libs/ext/libav/libavcodec/smacker.c
+@@ -259,6 +259,11 @@ static int smacker_decode_header_tree(SmackVContext *smk, GetBitContext *gb, int
+     if(ctx.last[0] == -1) ctx.last[0] = huff.current++;
+     if(ctx.last[1] == -1) ctx.last[1] = huff.current++;
+     if(ctx.last[2] == -1) ctx.last[2] = huff.current++;
++    if(huff.current > huff.length){
++        ctx.last[0] = ctx.last[1] = ctx.last[2] = 1;
++        av_log(smk->avctx, AV_LOG_ERROR, "bigtree damaged\n");
++        return -1;
++    }
+ 
+     *recodes = huff.values;
+ 
+-- 
+1.7.5.4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-vp3-Copy-all-3-frames-for-thread-updates.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-vp3-Copy-all-3-frames-for-thread-updates.patch
new file mode 100644
index 0000000..a1989cf
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-vp3-Copy-all-3-frames-for-thread-updates.patch
@@ -0,0 +1,32 @@
+gst-ffmpeg: vp3: Copy all 3 frames for thread updates.
+
+This fixes a double release of the current frame on deinit.
+Fixes CVE-2011-3934
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+
+Upstream-Status: Backport
+
+Signed-off-by: Yue.Tao <yue.tao@windriver.com>
+
+---
+ libavcodec/vp3.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
+index 738ae9f..b5daafc 100644
+--- a/gst-libs/ext/libav/libavcodec/vp3.c
++++ b/gst-libs/ext/libav/libavcodec/vp3.c
+@@ -1859,7 +1859,7 @@ static int vp3_update_thread_context(AVCodecContext *dst, const AVCodecContext *
+         ||s->width != s1->width
+         ||s->height!= s1->height) {
+         if (s != s1)
+-            copy_fields(s, s1, golden_frame, current_frame);
++            copy_fields(s, s1, golden_frame, keyframe);
+         return -1;
+     }
+ 
+-- 
+1.7.5.4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-vp3-fix-oob-read-for-negative-tokens-and-memleaks-on.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-vp3-fix-oob-read-for-negative-tokens-and-memleaks-on.patch
new file mode 100644
index 0000000..e83d8f4
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-vp3-fix-oob-read-for-negative-tokens-and-memleaks-on.patch
@@ -0,0 +1,183 @@
+gst-ffmpeg: vp3: fix oob read for negative tokens and memleaks on error.
+
+Upstream-Status: Backport 
+
+Signed-off-by: Yue.Tao <yue.tao@windriver.com>
+
+---
+ libavcodec/vp3.c |   59 +++++++++++++++++++++++++++++++++++++++++------------
+ 1 files changed, 45 insertions(+), 14 deletions(-)
+
+diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
+index 36715bb..ce14e63 100644
+--- a/gst-libs/ext/libav/libavcodec/vp3.c
++++ b/gst-libs/ext/libav/libavcodec/vp3.c
+@@ -45,6 +45,7 @@
+ #define FRAGMENT_PIXELS 8
+ 
+ static av_cold int vp3_decode_end(AVCodecContext *avctx);
++static void vp3_decode_flush(AVCodecContext *avctx);
+ 
+ //FIXME split things out into their own arrays
+ typedef struct Vp3Fragment {
+@@ -890,7 +891,7 @@ static int unpack_vlcs(Vp3DecodeContext *s, GetBitContext *gb,
+             /* decode a VLC into a token */
+             token = get_vlc2(gb, vlc_table, 11, 3);
+             /* use the token to get a zero run, a coefficient, and an eob run */
+-            if (token <= 6) {
++            if ((unsigned) token <= 6U) {
+                 eob_run = eob_run_base[token];
+                 if (eob_run_get_bits[token])
+                     eob_run += get_bits(gb, eob_run_get_bits[token]);
+@@ -908,7 +909,7 @@ static int unpack_vlcs(Vp3DecodeContext *s, GetBitContext *gb,
+                     coeff_i        += eob_run;
+                     eob_run = 0;
+                 }
+-            } else {
++            } else if (token >= 0) {
+                 bits_to_get = coeff_get_bits[token];
+                 if (bits_to_get)
+                     bits_to_get = get_bits(gb, bits_to_get);
+@@ -942,6 +943,10 @@ static int unpack_vlcs(Vp3DecodeContext *s, GetBitContext *gb,
+                 for (i = coeff_index+1; i <= coeff_index+zero_run; i++)
+                     s->num_coded_frags[plane][i]--;
+                 coeff_i++;
++            } else {
++                av_log(s->avctx, AV_LOG_ERROR,
++                       "Invalid token %d\n", token);
++                return -1;
+             }
+     }
+ 
+@@ -991,6 +996,8 @@ static int unpack_dct_coeffs(Vp3DecodeContext *s, GetBitContext *gb)
+     /* unpack the Y plane DC coefficients */
+     residual_eob_run = unpack_vlcs(s, gb, &s->dc_vlc[dc_y_table], 0,
+         0, residual_eob_run);
++    if (residual_eob_run < 0)
++        return residual_eob_run;
+ 
+     /* reverse prediction of the Y-plane DC coefficients */
+     reverse_dc_prediction(s, 0, s->fragment_width[0], s->fragment_height[0]);
+@@ -998,8 +1005,12 @@ static int unpack_dct_coeffs(Vp3DecodeContext *s, GetBitContext *gb)
+     /* unpack the C plane DC coefficients */
+     residual_eob_run = unpack_vlcs(s, gb, &s->dc_vlc[dc_c_table], 0,
+         1, residual_eob_run);
++    if (residual_eob_run < 0)
++        return residual_eob_run;
+     residual_eob_run = unpack_vlcs(s, gb, &s->dc_vlc[dc_c_table], 0,
+         2, residual_eob_run);
++    if (residual_eob_run < 0)
++        return residual_eob_run;
+ 
+     /* reverse prediction of the C-plane DC coefficients */
+     if (!(s->avctx->flags & CODEC_FLAG_GRAY))
+@@ -1036,11 +1047,17 @@ static int unpack_dct_coeffs(Vp3DecodeContext *s, GetBitContext *gb)
+     for (i = 1; i <= 63; i++) {
+             residual_eob_run = unpack_vlcs(s, gb, y_tables[i], i,
+                 0, residual_eob_run);
++            if (residual_eob_run < 0)
++                return residual_eob_run;
+ 
+             residual_eob_run = unpack_vlcs(s, gb, c_tables[i], i,
+                 1, residual_eob_run);
++            if (residual_eob_run < 0)
++                return residual_eob_run;
+             residual_eob_run = unpack_vlcs(s, gb, c_tables[i], i,
+                 2, residual_eob_run);
++            if (residual_eob_run < 0)
++                return residual_eob_run;
+     }
+ 
+     return 0;
+@@ -1777,10 +1794,15 @@ static int vp3_update_thread_context(AVCodecContext *dst, const AVCodecContext *
+     Vp3DecodeContext *s = dst->priv_data, *s1 = src->priv_data;
+     int qps_changed = 0, i, err;
+ 
++#define copy_fields(to, from, start_field, end_field) memcpy(&to->start_field, &from->start_field, (char*)&to->end_field - (char*)&to->start_field)
++
+     if (!s1->current_frame.data[0]
+         ||s->width != s1->width
+-        ||s->height!= s1->height)
++        ||s->height!= s1->height) {
++        if (s != s1)
++            copy_fields(s, s1, golden_frame, current_frame);
+         return -1;
++    }
+ 
+     if (s != s1) {
+         // init tables if the first frame hasn't been decoded
+@@ -1796,8 +1818,6 @@ static int vp3_update_thread_context(AVCodecContext *dst, const AVCodecContext *
+             memcpy(s->motion_val[1], s1->motion_val[1], c_fragment_count * sizeof(*s->motion_val[1]));
+         }
+ 
+-#define copy_fields(to, from, start_field, end_field) memcpy(&to->start_field, &from->start_field, (char*)&to->end_field - (char*)&to->start_field)
+-
+         // copy previous frame data
+         copy_fields(s, s1, golden_frame, dsp);
+ 
+@@ -1987,9 +2007,6 @@ static av_cold int vp3_decode_end(AVCodecContext *avctx)
+     Vp3DecodeContext *s = avctx->priv_data;
+     int i;
+ 
+-    if (avctx->is_copy && !s->current_frame.data[0])
+-        return 0;
+-
+     av_free(s->superblock_coding);
+     av_free(s->all_fragments);
+     av_free(s->coded_fragment_list[0]);
+@@ -2016,12 +2033,7 @@ static av_cold int vp3_decode_end(AVCodecContext *avctx)
+     free_vlc(&s->motion_vector_vlc);
+ 
+     /* release all frames */
+-    if (s->golden_frame.data[0])
+-        ff_thread_release_buffer(avctx, &s->golden_frame);
+-    if (s->last_frame.data[0] && s->last_frame.type != FF_BUFFER_TYPE_COPY)
+-        ff_thread_release_buffer(avctx, &s->last_frame);
+-    /* no need to release the current_frame since it will always be pointing
+-     * to the same frame as either the golden or last frame */
++    vp3_decode_flush(avctx);
+ 
+     return 0;
+ }
+@@ -2341,6 +2353,23 @@ static void vp3_decode_flush(AVCodecContext *avctx)
+         ff_thread_release_buffer(avctx, &s->current_frame);
+ }
+ 
++static int vp3_init_thread_copy(AVCodecContext *avctx)
++{
++    Vp3DecodeContext *s = avctx->priv_data;
++
++    s->superblock_coding      = NULL;
++    s->all_fragments          = NULL;
++    s->coded_fragment_list[0] = NULL;
++    s->dct_tokens_base        = NULL;
++    s->superblock_fragments   = NULL;
++    s->macroblock_coding      = NULL;
++    s->motion_val[0]          = NULL;
++    s->motion_val[1]          = NULL;
++    s->edge_emu_buffer        = NULL;
++
++    return 0;
++}
++
+ AVCodec ff_theora_decoder = {
+     .name           = "theora",
+     .type           = AVMEDIA_TYPE_VIDEO,
+@@ -2352,6 +2381,7 @@ AVCodec ff_theora_decoder = {
+     .capabilities   = CODEC_CAP_DR1 | CODEC_CAP_DRAW_HORIZ_BAND | CODEC_CAP_FRAME_THREADS,
+     .flush = vp3_decode_flush,
+     .long_name = NULL_IF_CONFIG_SMALL("Theora"),
++    .init_thread_copy      = ONLY_IF_THREADS_ENABLED(vp3_init_thread_copy),
+     .update_thread_context = ONLY_IF_THREADS_ENABLED(vp3_update_thread_context)
+ };
+ #endif
+@@ -2367,5 +2397,6 @@ AVCodec ff_vp3_decoder = {
+     .capabilities   = CODEC_CAP_DR1 | CODEC_CAP_DRAW_HORIZ_BAND | CODEC_CAP_FRAME_THREADS,
+     .flush = vp3_decode_flush,
+     .long_name = NULL_IF_CONFIG_SMALL("On2 VP3"),
++    .init_thread_copy      = ONLY_IF_THREADS_ENABLED(vp3_init_thread_copy),
+     .update_thread_context = ONLY_IF_THREADS_ENABLED(vp3_update_thread_context)
+ };
+-- 
+1.7.5.4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-vqavideo-check-chunk-sizes-before-reading-chunks.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-vqavideo-check-chunk-sizes-before-reading-chunks.patch
new file mode 100644
index 0000000..7e4f682
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-vqavideo-check-chunk-sizes-before-reading-chunks.patch
@@ -0,0 +1,51 @@
+From 2cac35086c9e103fa98960c546d5017e7363803a Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michaelni@gmx.at>
+Date: Fri, 25 Jan 2013 06:11:59 +0100
+Subject: [PATCH] vqavideo: check chunk sizes before reading chunks
+
+Upstream-Status: Backport
+
+Commit 2cac35086c9e103fa98960c546d5017e7363803a release/0.7
+
+Fixes out of array writes
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+(cherry picked from commit ab6c9332bfa1e20127a16392a0b85a4aa4840889)
+
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+---
+ libavcodec/vqavideo.c |   10 ++++++++++
+ 1 files changed, 10 insertions(+), 0 deletions(-)
+
+diff --git a/libavcodec/vqavideo.c b/libavcodec/vqavideo.c
+index d1eab5b..6e1ce6c 100644
+--- a/gst-libs/ext/libav/libavcodec/vqavideo.c
++++ b/gst-libs/ext/libav/libavcodec/vqavideo.c
+@@ -527,6 +527,11 @@ static void vqa_decode_chunk(VqaContext *s)
+         chunk_size = AV_RB32(&s->buf[cbp0_chunk + 4]);
+         cbp0_chunk += CHUNK_PREAMBLE_SIZE;
+ 
++        if (chunk_size > MAX_CODEBOOK_SIZE - s->next_codebook_buffer_index) {
++            av_log(s->avctx, AV_LOG_ERROR, "cbp0 chunk too large (0x%X bytes)\n", chunk_size);
++            return AVERROR_INVALIDDATA;
++        }
++
+         /* accumulate partial codebook */
+         memcpy(&s->next_codebook_buffer[s->next_codebook_buffer_index],
+             &s->buf[cbp0_chunk], chunk_size);
+@@ -550,6 +555,11 @@ static void vqa_decode_chunk(VqaContext *s)
+         chunk_size = AV_RB32(&s->buf[cbpz_chunk + 4]);
+         cbpz_chunk += CHUNK_PREAMBLE_SIZE;
+ 
++        if (chunk_size > MAX_CODEBOOK_SIZE - s->next_codebook_buffer_index) {
++            av_log(s->avctx, AV_LOG_ERROR, "cbpz chunk too large (0x%X bytes)\n", chunk_size);
++            return AVERROR_INVALIDDATA;
++        }
++
+         /* accumulate partial codebook */
+         memcpy(&s->next_codebook_buffer[s->next_codebook_buffer_index],
+             &s->buf[cbpz_chunk], chunk_size);
+-- 
+1.7.5.4
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0002-avcodec-mjpegdec-check-bits-per-pixel-for-changes-si.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0002-avcodec-mjpegdec-check-bits-per-pixel-for-changes-si.patch
new file mode 100644
index 0000000..c8bafd5
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0002-avcodec-mjpegdec-check-bits-per-pixel-for-changes-si.patch
@@ -0,0 +1,68 @@
+From 6043c431c97d55173f339fafbd033d3c0642e2e9 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michaelni@gmx.at>
+Date: Fri, 3 Oct 2014 01:50:27 +0200
+Subject: [PATCH 2/2] avcodec/mjpegdec: check bits per pixel for changes
+ similar to dimensions
+
+Upstream-Status: Backport
+
+Fixes out of array accesses
+Fixes: asan_heap-oob_16668e9_2_asan_heap-oob_16668e9_346_miss_congeniality_pegasus_mjpg.avi
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+
+Conflicts:
+        libavcodec/mjpegdec.c
+---
+ libavcodec/mjpegdec.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/gst-libs/ext/libav/libavcodec/mjpegdec.c b/gst-libs/ext/libav/libavcodec/mjpegdec.c
+index 84343c0..c0137d8 100644
+--- a/gst-libs/ext/libav/libavcodec/mjpegdec.c
++++ b/gst-libs/ext/libav/libavcodec/mjpegdec.c
+@@ -210,16 +210,16 @@ int ff_mjpeg_decode_dht(MJpegDecodeContext *s)
+ 
+ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
+ {
+-    int len, nb_components, i, width, height, pix_fmt_id;
++    int len, nb_components, i, bits, width, height, pix_fmt_id;
+ 
+     /* XXX: verify len field validity */
+     len = get_bits(&s->gb, 16);
+-    s->bits= get_bits(&s->gb, 8);
++    bits= get_bits(&s->gb, 8);
+ 
+-    if(s->pegasus_rct) s->bits=9;
+-    if(s->bits==9 && !s->pegasus_rct) s->rct=1;    //FIXME ugly
++    if(s->pegasus_rct) bits=9;
++    if(bits==9 && !s->pegasus_rct) s->rct=1;    //FIXME ugly
+ 
+-    if (s->bits != 8 && !s->lossless){
++    if (bits != 8 && !s->lossless){
+         av_log(s->avctx, AV_LOG_ERROR, "only 8 bits/component accepted\n");
+         return -1;
+     }
+@@ -239,7 +239,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
+     if (nb_components <= 0 ||
+         nb_components > MAX_COMPONENTS)
+         return -1;
+-    if (s->ls && !(s->bits <= 8 || nb_components == 1)){
++    if (s->ls && !(bits <= 8 || nb_components == 1)){
+         av_log(s->avctx, AV_LOG_ERROR, "only <= 8 bits/component or 16-bit gray accepted for JPEG-LS\n");
+         return -1;
+     }
+@@ -272,10 +272,11 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
+ 
+     /* if different size, realloc/alloc picture */
+     /* XXX: also check h_count and v_count */
+-    if (width != s->width || height != s->height) {
++    if (width != s->width || height != s->height || bits != s->bits) {
+         av_freep(&s->qscale_table);
+ 
+         s->width = width;
++        s->bits= bits;
+         s->height = height;
+         s->interlaced = 0;
+ 
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/configure-fix.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/configure-fix.patch
new file mode 100644
index 0000000..9ef6f7c
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/configure-fix.patch
@@ -0,0 +1,22 @@
+Disable yasm for libav when --disable-yasm
+
+Upstream-Status: Inappropriate [configuration]
+
+Signed-off-by: Shane Wang <shane.wang@intel.com>
+
+diff -r f2f8f74c6e30 configure.ac
+--- a/configure.ac      Thu Dec 22 23:56:09 2011 +0800
++++ b/configure.ac      Thu Dec 22 23:57:37 2011 +0800
+@@ -325,6 +325,12 @@
+         --enable-gpl"
+   fi
+ 
++ AC_ARG_ENABLE(yasm,
++              [AC_HELP_STRING([--disable-yasm], [disable use of yasm assembler])])
++  if test "x$enable_yasm" = "xno"; then
++    embffmpeg_configure_args="$embffmpeg_configure_args --disable-yasm"
++  fi
++
+   # if we are cross-compiling, tell ffmpeg so
+   target_os=`echo $host_os | sed 's/-gnu//'`
+   if test "x$cross_compiling" = xyes; then
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-CVE-2013-0855.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-CVE-2013-0855.patch
new file mode 100644
index 0000000..3c8d8e3
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-CVE-2013-0855.patch
@@ -0,0 +1,100 @@
+gst-ffmpeg: Security Advisory - ffmpeg - CVE-2013-0855
+
+Upstream-Status: Backport 
+
+Signed-off-by: Yue Tao <yue.tao@windriver.com>
+
+diff --git a/gst-libs/ext/libav/libavcodec/alac.c.old b/gst-libs/ext/libav/libavcodec/alac.c
+index 2a0df8c..bcbd56d 100644
+--- a/gst-libs/ext/libav/libavcodec/alac.c.old
++++ b/gst-libs/ext/libav/libavcodec/alac.c
+@@ -87,18 +87,44 @@ typedef struct {
+     int wasted_bits;
+ } ALACContext;
+ 
+-static void allocate_buffers(ALACContext *alac)
++static av_cold int alac_decode_close(AVCodecContext *avctx)
++{
++    ALACContext *alac = avctx->priv_data;
++
++    int chan;
++    for (chan = 0; chan < MAX_CHANNELS; chan++) {
++        av_freep(&alac->predicterror_buffer[chan]);
++        av_freep(&alac->outputsamples_buffer[chan]);
++        av_freep(&alac->wasted_bits_buffer[chan]);
++    }
++
++    return 0;
++}
++
++static int allocate_buffers(ALACContext *alac)
+ {
+     int chan;
++    int buf_size;
++
++    if (alac->setinfo_max_samples_per_frame > INT_MAX / sizeof(int32_t))
++        goto buf_alloc_fail;
++    buf_size = alac->setinfo_max_samples_per_frame * sizeof(int32_t);