Merge Libav 0.8.6-1 from unstable

[Reinhard Tartler]

The package 0.8.6 from unstable fixes 4 CVEs:

h264: check for luma and chroma bit depth being equal (CVE-2013-2277)
iff: validate CMAP palette size (CVE-2013-2495)
msrledec: convert to bytestream2 API and add proper bounds checking (CVE-2013-2496)
vorbisdec: Error on bark_map_size equal to 0 (CVE-2013-0894)

[Reinhard Tartler (siretart)]

I've pushed my work in progress branch. The package at least builds locally, but I have yet to test it. Moreover, debian/changelog needs improvement.

[Launchpad Janitor (janitor)]

This bug was fixed in the package libav - 6:0.8.6-1ubuntu1

---------------
libav (6:0.8.6-1ubuntu1) raring; urgency=low

  * Merge from debian/unstable, LP: #1160734, remaining changes:
    - don't build against libdirac, lame, libopenjpeg, librtmp, frei0r,
      vo-aacenc, vo-amrenc, x264, and xvid (all in universe)
    - do not build libav-extra-dbg, it is build from the libav-extra source
      package in ubuntu.
    - drop libav-regular-dbg, not necessary in ubuntu
    - Adjust LIB_PKGS/LIB_PKGS2 lists in debian/rules
    - several ifdefs in debian/rules that allow the use of the same file
      in libav and libav-extra (most of this can be merged into the debian
      package)
  * Tested that co-instability of libavcodec-dev with libavcodec-extra-53 works.
    LP: #1143929, #1101829
  * Remove all debug packages. In ubuntu, we provide debug symbols via the
    .ddeb infrastructure.

libav (6:0.8.6-1) unstable; urgency=low

  * Imported Upstream version 0.8.6, new releases fixes:
    - h264: check for luma and chroma bit depth being equal (CVE-2013-2277)
    - iff: validate CMAP palette size (CVE-2013-2495)
    - msrledec: convert to bytestream2 API and add proper bounds checking (CVE-2013-2496)
    - vorbisdec: Error on bark_map_size equal to 0 (CVE-2013-0894)
    - Thus, closes: #703200

libav (6:0.8.5-1) unstable; urgency=low

  * New upstream security/bugfix release. New releases fixes
    (bug numbers reference http://bugzilla.libav.org, Closes: #694483)
    - Indeo 4 (CVE-2012-2791)
    - VP5/VP6 (CVE-2012-2783)
    - Indeo 3 (CVE-2012-2804)
    - MPEG-1/2 (CVE-2012-2803)
    - MP3 (CVE-2012-2797)
    - AAC (CVE-2012-5144)
    - AC-3 (CVE-2012-2802)
    - AVS (CVE-2012-2801)
    - DFA (CVE-2012-2798)
    - ID3v2 (Bug 395)
    - Serious Memory leaks on broken Ogg files
  * drop recordshow script. This clearly undermaintained script has
    unclear copyright status and is unlikely to work properly anyway.
 -- Reinhard Tartler <email address hidden> Wed, 27 Mar 2013 07:57:15 +0100