Merge remote-tracking branch 'qatar/master'

* qatar/master:
  adpcm: Clip step_index values read from the bitstream at the beginning of each frame.
  oma: don't read beyond end of leaf_table.
  doxygen: Remove documentation for non-existing parameters; misc small fixes.
  Indeo3: fix crashes on corrupt bitstreams.
  msmpeg4: Replace forward declaration by proper #include.
  segment: implement wrap around
  avf: reorder AVStream and AVFormatContext
  aacdec: Remove erroneous reference to global gain from the out of bounds scalefactor error message.

Conflicts:
	libavcodec/indeo3.c
	libavformat/avformat.h
	libavutil/avutil.h

Merged-by: Michael Niedermayer <michaelni@gmx.at>

14 files changed, 76 insertions, 77 deletions

diff --git a/doc/muxers.texi b/doc/muxers.texi
index a87adf40b9..ddce0e902c 100644
--- a/doc/muxers.texi
+++ b/doc/muxers.texi
@@ -362,6 +362,8 @@ Set segment duration to @var{t} seconds.
 Generate also a listfile named @var{name}.
 @item segment_list_size @var{size}
 Overwrite the listfile once it reaches @var{size} entries.
+@item segment_wrap @var{limit}
+Wrap around segment index once it reaches @var{limit}.
 @end table
 
 @example
diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c
index 5a0fc44129..3d38645599 100644
--- a/libavcodec/aacdec.c
+++ b/libavcodec/aacdec.c
@@ -399,8 +399,6 @@ static uint64_t sniff_channel_order(uint8_t (*layout_map)[3], int tags)
 /**
  * Configure output channel order based on the current program configuration element.
  *
- * @param   che_pos current channel position configuration
- *
  * @return  Returns error status. 0 - OK, !0 - error
  */
 static av_cold int output_configure(AACContext *ac,
@@ -459,8 +457,6 @@ static void flush(AVCodecContext *avctx)
 /**
  * Decode an array of 4 bit element IDs, optionally interleaved with a stereo/mono switching bit.
  *
- * @param cpe_map Stereo (Channel Pair Element) map, NULL if stereo bit is not present.
- * @param sce_map mono (Single Channel Element) map
  * @param type speaker type/position for these channels
  */
 static void decode_channel_map(uint8_t layout_map[][3],
@@ -1037,7 +1033,6 @@ static int decode_scalefactors(AACContext *ac, float sf[120], GetBitContext *gb,
     int offset[3] = { global_gain, global_gain - 90, 0 };
     int clipped_offset;
     int noise_flag = 1;
-    static const char *const sf_str[3] = { "Global gain", "Noise gain", "Intensity stereo position" };
     for (g = 0; g < ics->num_window_groups; g++) {
         for (i = 0; i < ics->max_sfb;) {
             int run_end = band_type_run_end[idx];
@@ -1076,7 +1071,7 @@ static int decode_scalefactors(AACContext *ac, float sf[120], GetBitContext *gb,
                     offset[0] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;
                     if (offset[0] > 255U) {
                         av_log(ac->avctx, AV_LOG_ERROR,
-                               "%s (%d) out of range.\n", sf_str[0], offset[0]);
+                               "Scalefactor (%d) out of range.\n", offset[0]);
                         return -1;
                     }
                     sf[idx] = -ff_aac_pow2sf_tab[offset[0] - 100 + POW_SF2_ZERO];
diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c
index 54c1dc6983..559eb293ce 100644
--- a/libavcodec/adpcm.c
+++ b/libavcodec/adpcm.c
@@ -707,7 +707,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
         for (channel = 0; channel < avctx->channels; channel++) {
             cs = &c->status[channel];
             cs->predictor  = (int16_t)bytestream_get_le16(&src);
-            cs->step_index = *src++;
+            cs->step_index = av_clip(*src++, 0, 88);
             src++;
             *samples++ = cs->predictor;
         }
@@ -730,8 +730,8 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
 
         c->status[0].predictor  = (int16_t)AV_RL16(src + 10);
         c->status[1].predictor  = (int16_t)AV_RL16(src + 12);
-        c->status[0].step_index = src[14];
-        c->status[1].step_index = src[15];
+        c->status[0].step_index = av_clip(src[14], 0, 88);
+        c->status[1].step_index = av_clip(src[15], 0, 88);
         /* sign extend the predictors */
         src += 16;
         diff_channel = c->status[1].predictor;
@@ -771,7 +771,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
         for (channel = 0; channel < avctx->channels; channel++) {
             cs = &c->status[channel];
             cs->predictor  = (int16_t)bytestream_get_le16(&src);
-            cs->step_index = *src++;
+            cs->step_index = av_clip(*src++, 0, 88);
             src++;
         }
 
@@ -834,7 +834,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
         src += 4; // skip sample count (already read)
 
         for (i=0; i<=st; i++)
-            c->status[i].step_index = bytestream_get_le32(&src);
+            c->status[i].step_index = av_clip(bytestream_get_le32(&src), 0, 88);
         for (i=0; i<=st; i++)
             c->status[i].predictor  = bytestream_get_le32(&src);
 
@@ -1051,11 +1051,11 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
     case CODEC_ID_ADPCM_IMA_SMJPEG:
         if (avctx->codec->id == CODEC_ID_ADPCM_IMA_AMV) {
             c->status[0].predictor = sign_extend(bytestream_get_le16(&src), 16);
-            c->status[0].step_index = bytestream_get_le16(&src);
+            c->status[0].step_index = av_clip(bytestream_get_le16(&src), 0, 88);
             src += 4;
         } else {
             c->status[0].predictor = sign_extend(bytestream_get_be16(&src), 16);
-            c->status[0].step_index = bytestream_get_byte(&src);
+            c->status[0].step_index = av_clip(bytestream_get_byte(&src), 0, 88);
             src += 1;
         }
 
diff --git a/libavcodec/indeo3.c b/libavcodec/indeo3.c
index dce75fe116..83effae859 100644
--- a/libavcodec/indeo3.c
+++ b/libavcodec/indeo3.c
@@ -727,6 +727,8 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
         SPLIT_CELL(ref_cell->height, curr_cell.height);
         ref_cell->ypos   += curr_cell.height;
         ref_cell->height -= curr_cell.height;
+        if (ref_cell->height <= 0 || curr_cell.height <= 0)
+            return AVERROR_INVALIDDATA;
     } else if (code == V_SPLIT) {
         if (curr_cell.width > strip_width) {
             /* split strip */
@@ -735,6 +737,8 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
             SPLIT_CELL(ref_cell->width, curr_cell.width);
         ref_cell->xpos  += curr_cell.width;
         ref_cell->width -= curr_cell.width;
+        if (ref_cell->width <= 0 || curr_cell.width <= 0)
+            return AVERROR_INVALIDDATA;
     }
 
     while (get_bits_left(&ctx->gb) >= 2) { /* loop until return */
@@ -890,14 +894,16 @@ static int decode_frame_headers(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
         return AVERROR_INVALIDDATA;
 
     if (width != ctx->width || height != ctx->height) {
+        int res;
+
         av_dlog(avctx, "Frame dimensions changed!\n");
 
         ctx->width  = width;
         ctx->height = height;
 
         free_frame_buffers(ctx);
-        if(allocate_frame_buffers(ctx, avctx) < 0)
-            return AVERROR_INVALIDDATA;
+        if ((res = allocate_frame_buffers(ctx, avctx)) < 0)
+             return res;
         avcodec_set_dimensions(avctx, width, height);
     }
 
diff --git a/libavcodec/msmpeg4.c b/libavcodec/msmpeg4.c
index 65604dbe6b..232b82b219 100644
--- a/libavcodec/msmpeg4.c
+++ b/libavcodec/msmpeg4.c
@@ -34,6 +34,7 @@
 #include "libavutil/x86_cpu.h"
 #include "h263.h"
 #include "mpeg4video.h"
+#include "vc1data.h"
 
 /*
  * You can also call this codec : MPEG4 with a twist !
@@ -59,9 +60,6 @@
 static uint32_t v2_dc_lum_table[512][2];
 static uint32_t v2_dc_chroma_table[512][2];
 
-/* vc1 externs */
-extern const uint8_t ff_wmv3_dc_scale_table[32];
-
 #include "msmpeg4data.h"
 
 #if CONFIG_ENCODERS //strangely gcc includes this even if it is not referenced
diff --git a/libavcodec/wmaprodec.c b/libavcodec/wmaprodec.c
index 3fd4836fd9..9b533145bd 100644
--- a/libavcodec/wmaprodec.c
+++ b/libavcodec/wmaprodec.c
@@ -1481,7 +1481,6 @@ static void save_bits(WMAProDecodeCtx *s, GetBitContext* gb, int len,
  *@brief Decode a single WMA packet.
  *@param avctx codec context
  *@param data the output buffer
- *@param data_size number of bytes that were written to the output buffer
  *@param avpkt input packet
  *@return number of bytes that were read from the input buffer
  */
diff --git a/libavcodec/wmavoice.c b/libavcodec/wmavoice.c
index 2be0cf25f2..d4b7a3e1cd 100644
--- a/libavcodec/wmavoice.c
+++ b/libavcodec/wmavoice.c
@@ -1725,9 +1725,6 @@ static int check_bits_for_superframe(GetBitContext *orig_gb,
  * (if less than 480), usually used to prevent blanks at track boundaries.
  *
  * @param ctx WMA Voice decoder context
- * @param samples pointer to output buffer for voice samples
- * @param data_size pointer containing the size of #samples on input, and the
- *                  amount of #samples filled on output
  * @return 0 on success, <0 on error or 1 if there was not enough data to
  *         fully parse the superframe
  */
diff --git a/libavdevice/x11grab.c b/libavdevice/x11grab.c
index 80a1baf653..0835fb2e44 100644
--- a/libavdevice/x11grab.c
+++ b/libavdevice/x11grab.c
@@ -146,7 +146,6 @@ x11grab_region_win_init(struct x11_grab *s)
  * Initialize the x11 grab device demuxer (public device demuxer API).
  *
  * @param s1 Context from avformat core
- * @param ap Parameters from avformat core
  * @return <ul>
  *          <li>AVERROR(ENOMEM) no memory left</li>
  *          <li>AVERROR(EIO) other failure case</li>
diff --git a/libavformat/avformat.h b/libavformat/avformat.h
index f92816f925..00a52e5da6 100644
--- a/libavformat/avformat.h
+++ b/libavformat/avformat.h
@@ -577,7 +577,6 @@ typedef struct AVStream {
      * encoding: set by libavformat in av_write_header
      */
     AVRational time_base;
-    enum AVDiscard discard; ///< Selects which packets can be discarded at will and do not need to be demuxed.
 
     /**
      * Decoding: pts of the first frame of the stream in presentation order, in stream time base.
@@ -600,6 +599,8 @@ typedef struct AVStream {
 
     int disposition; /**< AV_DISPOSITION_* bit field */
 
+    enum AVDiscard discard; ///< Selects which packets can be discarded at will and do not need to be demuxed.
+
     /**
      * sample aspect ratio (0 if unknown)
      * - encoding: Set by user.
@@ -623,21 +624,6 @@ typedef struct AVStream {
      */
 
     /**
-     * Number of frames that have been demuxed during av_find_stream_info()
-     */
-    int codec_info_nb_frames;
-
-    /**
-     * Stream Identifier
-     * This is the MPEG-TS stream identifier +1
-     * 0 means unknown
-     */
-    int stream_identifier;
-
-    int64_t interleaver_chunk_size;
-    int64_t interleaver_chunk_duration;
-
-    /**
      * Stream information used internally by av_find_stream_info()
      */
 #define MAX_STD_TIMEBASES (60*12+5)
@@ -649,9 +635,12 @@ typedef struct AVStream {
         int64_t codec_info_duration;
         int nb_decoded_frames;
     } *info;
+
+    AVPacket cur_pkt;
     const uint8_t *cur_ptr;
     int cur_len;
-    AVPacket cur_pkt;
+
+    int pts_wrap_bits; /**< number of bits in pts (used for wrapping control) */
 
     // Timestamp generation support:
     /**
@@ -664,8 +653,8 @@ typedef struct AVStream {
     int64_t reference_dts;
     int64_t first_dts;
     int64_t cur_dts;
-    int last_IP_duration;
     int64_t last_IP_pts;
+    int last_IP_duration;
 
     /**
      * Number of packets to buffer for codec probing
@@ -674,23 +663,37 @@ typedef struct AVStream {
     int probe_packets;
 
     /**
+     * Number of frames that have been demuxed during av_find_stream_info()
+     */
+    int codec_info_nb_frames;
+
+    /**
+     * Stream Identifier
+     * This is the MPEG-TS stream identifier +1
+     * 0 means unknown
+     */
+    int stream_identifier;
+
+    int64_t interleaver_chunk_size;
+    int64_t interleaver_chunk_duration;
+
+    /* av_read_frame() support */
+    enum AVStreamParseType need_parsing;
+    struct AVCodecParserContext *parser;
+
+    /**
      * last packet in packet_buffer for this stream when muxing.
      */
     struct AVPacketList *last_in_packet_buffer;
     AVProbeData probe_data;
 #define MAX_REORDER_DELAY 16
     int64_t pts_buffer[MAX_REORDER_DELAY+1];
-    /* av_read_frame() support */
-    enum AVStreamParseType need_parsing;
-    struct AVCodecParserContext *parser;
 
     AVIndexEntry *index_entries; /**< Only used if the format does not
                                     support seeking natively. */
     int nb_index_entries;
     unsigned int index_entries_allocated_size;
 
-    int pts_wrap_bits; /**< number of bits in pts (used for wrapping control) */
-
     /**
      * flag to indicate that probing is requested
      * NOT PART OF PUBLIC API
@@ -772,6 +775,9 @@ typedef struct AVFormatContext {
      */
     AVIOContext *pb;
 
+    /* stream info */
+    int ctx_flags; /**< Format-specific flags, see AVFMTCTX_xx */
+
     /**
      * A list of all streams in the file. New streams are created with
      * avformat_new_stream().
@@ -785,8 +791,6 @@ typedef struct AVFormatContext {
     AVStream **streams;
 
     char filename[1024]; /**< input or output filename */
-    /* stream info */
-    int ctx_flags; /**< Format-specific flags, see AVFMTCTX_xx */
 
     /**
      * Decoding: position of the first frame of the component, in
@@ -883,12 +887,6 @@ typedef struct AVFormatContext {
     unsigned int nb_chapters;
     AVChapter **chapters;
 
-    /**
-     * Flags to enable debugging.
-     */
-    int debug;
-#define FF_FDEBUG_TS        0x0001
-
     AVDictionary *metadata;
 
     /**
@@ -925,6 +923,12 @@ typedef struct AVFormatContext {
     AVIOInterruptCB interrupt_callback;
 
     /**
+     * Flags to enable debugging.
+     */
+    int debug;
+#define FF_FDEBUG_TS        0x0001
+
+    /**
      * Transport stream id.
      * This will be moved into demuxer private options. Thus no API/ABI compatibility
      */
@@ -961,19 +965,6 @@ typedef struct AVFormatContext {
      * New public fields should be added right above.
      *****************************************************************
      */
-    /**
-     * Raw packets from the demuxer, prior to parsing and decoding.
-     * This buffer is used for buffering packets until the codec can
-     * be identified, as parsing cannot be done without knowing the
-     * codec.
-     */
-    struct AVPacketList *raw_packet_buffer;
-    struct AVPacketList *raw_packet_buffer_end;
-    /**
-     * Remaining size available for raw_packet_buffer, in bytes.
-     */
-#define RAW_PACKET_BUFFER_SIZE 2500000
-    int raw_packet_buffer_remaining_size;
 
     /**
      * This buffer is only needed when packets were already buffered but
@@ -988,6 +979,20 @@ typedef struct AVFormatContext {
 
     /* av_seek_frame() support */
     int64_t data_offset; /**< offset of the first packet */
+
+    /**
+     * Raw packets from the demuxer, prior to parsing and decoding.
+     * This buffer is used for buffering packets until the codec can
+     * be identified, as parsing cannot be done without knowing the
+     * codec.
+     */
+    struct AVPacketList *raw_packet_buffer;
+    struct AVPacketList *raw_packet_buffer_end;
+    /**
+     * Remaining size available for raw_packet_buffer, in bytes.
+     */
+#define RAW_PACKET_BUFFER_SIZE 2500000
+    int raw_packet_buffer_remaining_size;
 } AVFormatContext;
 
 typedef struct AVPacketList {
diff --git a/libavformat/mov_chan.h b/libavformat/mov_chan.h
index abb6916144..bd6adf6ad4 100644
--- a/libavformat/mov_chan.h
+++ b/libavformat/mov_chan.h
@@ -40,9 +40,9 @@
 uint64_t ff_mov_get_channel_layout(uint32_t tag, uint32_t bitmap);
 
 /**
- * Get the channel layout for the specified channel layout tag.
+ * Get the channel layout for the specified channel label.
  *
- * @param[in]  tag     channel label
+ * @param[in]  label   channel label
  * @return             channel layout mask fragment
  */
 uint32_t ff_mov_get_channel_label(uint32_t label);
diff --git a/libavformat/mpegts.h b/libavformat/mpegts.h
index edec79ce2f..eae9d46ad4 100644
--- a/libavformat/mpegts.h
+++ b/libavformat/mpegts.h
@@ -96,10 +96,6 @@ typedef struct {
  * @param stream_type               STREAM_TYPE_xxx
  * @param pp                        Descriptor buffer pointer
  * @param desc_list_end             End of buffer
- * @param mp4_dec_config_descr_len  Length of 'mp4_dec_config_descr', or zero if not present
- * @param mp4_es_id
- * @param pid
- * @param mp4_dec_config_descr
  * @return <0 to stop processing
  */
 int ff_parse_mpeg2_descriptor(AVFormatContext *fc, AVStream *st, int stream_type,
diff --git a/libavformat/rl2.c b/libavformat/rl2.c
index 8692e22afa..fbf52f4660 100644
--- a/libavformat/rl2.c
+++ b/libavformat/rl2.c
@@ -69,7 +69,6 @@ static int rl2_probe(AVProbeData *p)
 /**
  * read rl2 header data and setup the avstreams
  * @param s demuxer context
- * @param ap format parameters
  * @return 0 on success, AVERROR otherwise
  */
 static av_cold int rl2_read_header(AVFormatContext *s)
diff --git a/libavformat/segment.c b/libavformat/segment.c
index c75dd9c216..1af412ad53 100644
--- a/libavformat/segment.c
+++ b/libavformat/segment.c
@@ -39,6 +39,7 @@ typedef struct {
     char *list;            /**< Set by a private option. */
     float time;            /**< Set by a private option. */
     int  size;             /**< Set by a private option. */
+    int  wrap;             /**< Set by a private option. */
     int64_t offset_time;
     int64_t recording_time;
     int has_video;
@@ -51,6 +52,9 @@ static int segment_start(AVFormatContext *s)
     AVFormatContext *oc = c->avf;
     int err = 0;
 
+    if (c->wrap)
+        c->number %= c->wrap;
+
     if (av_get_frame_filename(oc->filename, sizeof(oc->filename),
                               s->filename, c->number++) < 0)
         return AVERROR(EINVAL);
@@ -211,7 +215,6 @@ static int seg_write_packet(AVFormatContext *s, AVPacket *pkt)
                 if ((ret = avio_open2(&seg->pb, seg->list, AVIO_FLAG_WRITE,
                                       &s->interrupt_callback, NULL)) < 0)
                     goto fail;
-
             }
         }
     }
@@ -250,6 +253,7 @@ static const AVOption options[] = {
     { "segment_time",      "segment length in seconds",               OFFSET(time),    AV_OPT_TYPE_FLOAT,  {.dbl = 2},     0, FLT_MAX, E },
     { "segment_list",      "output the segment list",                 OFFSET(list),    AV_OPT_TYPE_STRING, {.str = NULL},  0, 0,       E },
     { "segment_list_size", "maximum number of playlist entries",      OFFSET(size),    AV_OPT_TYPE_INT,    {.dbl = 5},     0, INT_MAX, E },
+    { "segment_wrap",      "number after which the index wraps",      OFFSET(wrap),    AV_OPT_TYPE_INT,    {.dbl = 0},     0, INT_MAX, E },
     { NULL },
 };
 
diff --git a/libavutil/avutil.h b/libavutil/avutil.h
index fdd6cf141c..0f1fd0a6a6 100644
--- a/libavutil/avutil.h
+++ b/libavutil/avutil.h
@@ -31,7 +31,7 @@
  *
  * @section libav_intro Introduction
  *
- * This document describe the usage of the different libraries
+ * This document describes the usage of the different libraries
  * provided by FFmpeg.
  *
  * @li @ref libavc "libavcodec" encoding/decoding library
@@ -41,7 +41,6 @@
  * @li @ref lavu "libavutil" common utility library
  * @li @subpage libpostproc post processing library
  * @li @subpage libswscale  color conversion and scaling library
- *
  */
 
 /**