Merge commit '993977032a0adb47eb70e7fef6ce0d5370027e83' into release/0.10
authorMichael Niedermayer <michaelni@gmx.at>
Thu, 16 Jan 2014 21:31:18 +0000 (22:31 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Thu, 16 Jan 2014 21:31:18 +0000 (22:31 +0100)
* commit '993977032a0adb47eb70e7fef6ce0d5370027e83':
  xan: Use bytestream2 to limit reading to within the buffer
  pcx: Consume the whole packet if giving up due to missing palette
  pngdec: Stop trying to decode once inflate returns Z_STREAM_END
  mov: Make sure the read sample count is nonnegative
  bfi: Add some very basic sanity checks for input packet sizes

Conflicts:
libavformat/mov.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
1  2 
libavcodec/pcx.c
libavcodec/pngdec.c
libavcodec/xan.c
libavformat/bfi.c
libavformat/mov.c

Simple merge
Simple merge
Simple merge
Simple merge
@@@ -1706,11 -1642,10 +1706,15 @@@ static int mov_read_stts(MOVContext *c
  
          sample_count=avio_rb32(pb);
          sample_duration = avio_rb32(pb);
 +        /* sample_duration < 0 is invalid based on the spec */
 +        if (sample_duration < 0) {
 +            av_log(c->fc, AV_LOG_ERROR, "Invalid SampleDelta in STTS %d\n", sample_duration);
 +            sample_duration = 1;
 +        }
+         if (sample_count < 0) {
+             av_log(c->fc, AV_LOG_ERROR, "Invalid sample_count=%d\n", sample_count);
+             return AVERROR_INVALIDDATA;
+         }
          sc->stts_data[i].count= sample_count;
          sc->stts_data[i].duration= sample_duration;