Merge remote-tracking branch 'qatar/release/0.8' into release/0.10
authorMichael Niedermayer <michaelni@gmx.at>
Thu, 17 Jan 2013 01:33:07 +0000 (02:33 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Thu, 17 Jan 2013 01:33:07 +0000 (02:33 +0100)
* qatar/release/0.8:
  Update Changelog
  h264: check ref_count validity for num_ref_idx_active_override_flag
  h264: check context state before decoding slice data partitions
  oggdec: free the ogg streams on read_header failure
  oggdec: check memory allocation
  Fix uninitialized reads on malformed ogg files.
  rtsp: Recheck the reordering queue if getting a new packet
  opt: avoid segfault in av_opt_next() if the class does not have an option list
  alacdec: do not be too strict about the extradata size

Conflicts:
Changelog

Merged-by: Michael Niedermayer <michaelni@gmx.at>
1  2 
libavcodec/alac.c
libavcodec/h264.c
libavformat/oggdec.c
libavformat/rtsp.c
libavutil/opt.c

Simple merge
@@@ -3127,11 -3121,16 +3127,16 @@@ static int decode_slice_header(H264Cont
  
          if(num_ref_idx_active_override_flag){
              h->ref_count[0]= get_ue_golomb(&s->gb) + 1;
-             if(h->slice_type_nos==AV_PICTURE_TYPE_B)
+             if (h->ref_count[0] < 1)
+                 return AVERROR_INVALIDDATA;
+             if (h->slice_type_nos == AV_PICTURE_TYPE_B) {
                  h->ref_count[1]= get_ue_golomb(&s->gb) + 1;
+                 if (h->ref_count[1] < 1)
+                     return AVERROR_INVALIDDATA;
+             }
          }
  
 -        if (h->ref_count[0] > max_refs || h->ref_count[1] > max_refs) {
 +        if (h->ref_count[0]-1 > max || h->ref_count[1]-1 > max){
              av_log(h->s.avctx, AV_LOG_ERROR, "reference overflow\n");
              h->ref_count[0] = h->ref_count[1] = 1;
              return AVERROR_INVALIDDATA;
Simple merge
Simple merge
diff --cc libavutil/opt.c
Simple merge