Merge remote-tracking branch 'qatar/master'

* qatar/master:
  prores: Reject negative run and level values

See: 93c220e895a417e88a6be7df85e250c5c3f675b6
Merged-by: Michael Niedermayer <michaelni@gmx.at>

diff --combined libavcodec/proresdec_lgpl.c
index 627f98f,144fa26..a57429d
--- 1/libavcodec/proresdec_lgpl.c
--- 2/libavcodec/proresdec.c
+++ b/libavcodec/proresdec_lgpl.c
@@@ -3,20 -3,20 +3,20 @@@
   *
   * Copyright (c) 2010-2011 Maxim Poliakovski
   *
 - * This file is part of Libav.
 + * This file is part of FFmpeg.
   *
 - * Libav is free software; you can redistribute it and/or
 + * FFmpeg is free software; you can redistribute it and/or
   * modify it under the terms of the GNU Lesser General Public
   * License as published by the Free Software Foundation; either
   * version 2.1 of the License, or (at your option) any later version.
   *
 - * Libav is distributed in the hope that it will be useful,
 + * FFmpeg is distributed in the hope that it will be useful,
   * but WITHOUT ANY WARRANTY; without even the implied warranty of
   * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   * Lesser General Public License for more details.
   *
   * You should have received a copy of the GNU Lesser General Public
 - * License along with Libav; if not, write to the Free Software
 + * License along with FFmpeg; if not, write to the Free Software
   * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
   */
  
@@@ -86,7 -86,7 +86,7 @@@ static av_cold int decode_init(AVCodecC
      ctx->slice_data       = NULL;
  
      avctx->bits_per_raw_sample = PRORES_BITS_PER_SAMPLE;
 -    ff_proresdsp_init(&ctx->dsp);
 +    ff_proresdsp_init(&ctx->dsp, avctx);
  
      ctx->scantable_type = -1;   // set scantable type to uninitialized
      memset(ctx->qmat_luma, 4, 64);
@@@ -140,7 -140,6 +140,7 @@@ static int decode_frame_header(ProresCo
          av_log(avctx, AV_LOG_ERROR, "Invalid alpha mode %d\n", ctx->alpha_info);
          return AVERROR_INVALIDDATA;
      }
 +    if (avctx->skip_alpha) ctx->alpha_info = 0;
  
      switch (ctx->chroma_factor) {
      case 2:
@@@ -394,12 -393,16 +394,16 @@@ static inline int decode_ac_coeffs(GetB
              return 0;
  
          run = decode_vlc_codeword(gb, ff_prores_ac_codebook[run_cb_index]);
+         if (run < 0)
+             return AVERROR_INVALIDDATA;
  
          bits_left = get_bits_left(gb);
          if (bits_left <= 0 || (bits_left <= 8 && !show_bits(gb, bits_left)))
              return AVERROR_INVALIDDATA;
  
          level = decode_vlc_codeword(gb, ff_prores_ac_codebook[lev_cb_index]) + 1;
+         if (level < 0)
+             return AVERROR_INVALIDDATA;
  
          pos += run + 1;
          if (pos >= max_coeffs)
@@@ -502,9 -505,8 +506,9 @@@ static void unpack_alpha(GetBitContext 
                  dst[idx++] = alpha_val >> 6;
              else
                  dst[idx++] = (alpha_val << 2) | (alpha_val >> 6);
 -            if (idx >= num_coeffs - 1)
 +            if (idx >= num_coeffs) {
                  break;
 +            }
          } while (get_bits1(gb));
          val = get_bits(gb, 4);
          if (!val)
@@@ -616,7 -618,7 +620,7 @@@ static int decode_slice(AVCodecContext 
      coff[2]     = coff[1] + u_data_size;
      v_data_size = hdr_size > 7 ? AV_RB16(buf + 6) : slice_data_size - coff[2];
      coff[3]     = coff[2] + v_data_size;
 -    a_data_size = slice_data_size - coff[3];
 +    a_data_size = ctx->alpha_info ? slice_data_size - coff[3] : 0;
  
      /* if V or alpha component size is negative that means that previous
         component sizes are too large */
@@@ -766,8 -768,8 +770,8 @@@ static av_cold int decode_close(AVCodec
  }
  
  
 -AVCodec ff_prores_decoder = {
 -    .name           = "prores",
 +AVCodec ff_prores_lgpl_decoder = {
 +    .name           = "prores_lgpl",
      .long_name      = NULL_IF_CONFIG_SMALL("Apple ProRes (iCodec Pro)"),
      .type           = AVMEDIA_TYPE_VIDEO,
      .id             = AV_CODEC_ID_PRORES,