Merge remote-tracking branch 'qatar/master'

* qatar/master:
  indeo4: Check the inherited quant_mat

Conflicts:
	libavcodec/indeo4.c

See: 884efd4e09696b201457feebdef684aee30be99d
Merged-by: Michael Niedermayer <michaelni@gmx.at>

diff --cc libavcodec/indeo4.c
index 0774f82,6a19955..df878c5
--- 1/libavcodec/indeo4.c
--- 2/libavcodec/indeo4.c
+++ b/libavcodec/indeo4.c
@@@ -371,29 -362,25 +370,30 @@@ static int decode_band_hdr(IVI45DecCont
                  return AVERROR_INVALIDDATA;
              }
              if (scan_indx > 4 && scan_indx < 10) {
 -                if (band->blk_size != 4)
 +                if (band->blk_size != 4) {
 +                    av_log(avctx, AV_LOG_ERROR, "mismatching scan table!\n");
                      return AVERROR_INVALIDDATA;
 -            } else if (band->blk_size != 8)
 +                }
 +            } else if (band->blk_size != 8) {
 +                av_log(avctx, AV_LOG_ERROR, "mismatching scan table!\n");
                  return AVERROR_INVALIDDATA;
 +            }
  
              band->scan = scan_index_to_tab[scan_indx];
 +            band->scan_size = band->blk_size;
  
-             quant_mat = get_bits(&ctx->gb, 5);
-             if (quant_mat == 31) {
-                 av_log(avctx, AV_LOG_ERROR, "Custom quant matrix encountered!\n");
-                 return AVERROR_INVALIDDATA;
-             }
-             if (quant_mat >= FF_ARRAY_ELEMS(quant_index_to_tab)) {
-                 avpriv_request_sample(avctx, "Quantization matrix %d",
-                                       quant_mat);
+             band->quant_mat = get_bits(&ctx->gb, 5);
+             if (band->quant_mat >= FF_ARRAY_ELEMS(quant_index_to_tab)) {
+ 
+                 if (band->quant_mat == 31)
+                     av_log(avctx, AV_LOG_ERROR,
+                            "Custom quant matrix encountered!\n");
+                 else
+                     avpriv_request_sample(avctx, "Quantization matrix %d",
+                                           band->quant_mat);
+                 band->quant_mat = -1;
                  return AVERROR_INVALIDDATA;
              }
-             band->quant_mat = quant_mat;
          } else {
              if (old_blk_size != band->blk_size) {
                  av_log(avctx, AV_LOG_ERROR,
@@@ -401,20 -388,11 +401,24 @@@
                         "inherited\n");
                  return AVERROR_INVALIDDATA;
              }
+             if (band->quant_mat < 0) {
+                 av_log(avctx, AV_LOG_ERROR, "Invalid quant_mat inherited\n");
+                 return AVERROR_INVALIDDATA;
+             }
          }
 +        if (quant_index_to_tab[band->quant_mat] > 4 && band->blk_size == 4) {
 +            av_log(avctx, AV_LOG_ERROR, "Invalid quant matrix for 4x4 block encountered!\n");
 +            band->quant_mat = 0;
 +            return AVERROR_INVALIDDATA;
 +        }
 +        if (band->scan_size != band->blk_size) {
 +            av_log(avctx, AV_LOG_ERROR, "mismatching scan table!\n");
 +            return AVERROR_INVALIDDATA;
 +        }
 +        if (band->transform_size == 8 && band->blk_size < 8) {
 +            av_log(avctx, AV_LOG_ERROR, "mismatching transform_size!\n");
 +            return AVERROR_INVALIDDATA;
 +        }
  
          /* decode block huffman codebook */
          if (!get_bits1(&ctx->gb))