Merge remote-tracking branch 'qatar/master'

* qatar/master:
  dsicinvideo: validate buffer offset before copying pixels.
  cook: error out on quant_index values outside [-63, 63] range.
  mpc: pad mpc_CC/SCF[] tables to allow for negative indices.

Conflicts:
	libavcodec/cook.c
	libavcodec/dsicinav.c
	libavcodec/mpc.c
	libavcodec/mpc7.c
	libavcodec/mpcdata.h

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 24 insertions, 21 deletions

diff --git a/libavcodec/cook.c b/libavcodec/cook.c
index 775cff5b91..31b0f1f8b0 100644
--- a/libavcodec/cook.c
+++ b/libavcodec/cook.c
@@ -367,7 +367,7 @@ static void decode_gain_info(GetBitContext *gb, int *gaininfo)
  * @param quant_index_table pointer to the array
  */
 static int decode_envelope(COOKContext *q, COOKSubpacket *p,
-                            int *quant_index_table)
+                           int *quant_index_table)
 {
     int i, j, vlc_index;
 
@@ -388,9 +388,10 @@ static int decode_envelope(COOKContext *q, COOKSubpacket *p,
         j = get_vlc2(&q->gb, q->envelope_quant_index[vlc_index - 1].table,
                      q->envelope_quant_index[vlc_index - 1].bits, 2);
         quant_index_table[i] = quant_index_table[i - 1] + j - 12; // differential encoding
-
-        if (quant_index_table[i] < -63 || quant_index_table[i] > 63) {
-            av_log(NULL, AV_LOG_ERROR, "quant_index_table value out of bounds\n");
+        if (quant_index_table[i] > 63 || quant_index_table[i] < -63) {
+            av_log(q->avctx, AV_LOG_ERROR,
+                   "Invalid quantizer %d at position %d, outside [-63, 63] range\n",
+                   quant_index_table[i], i);
             return AVERROR_INVALIDDATA;
         }
     }
@@ -651,13 +652,13 @@ static int mono_decode(COOKContext *q, COOKSubpacket *p, float *mlt_buffer)
     int category_index[128];
     int quant_index_table[102];
     int category[128];
-    int ret, i;
+    int res, i;
 
     memset(&category,       0, sizeof(category));
     memset(&category_index, 0, sizeof(category_index));
 
-    if ((ret = decode_envelope(q, p, quant_index_table)) < 0)
-        return ret;
+    if ((res = decode_envelope(q, p, quant_index_table)) < 0)
+        return res;
     q->num_vectors = get_bits(&q->gb, p->log2_numvector_size);
     categorize(q, p, quant_index_table, category, category_index);
     expand_category(q, category, category_index);
@@ -825,9 +826,9 @@ static void decouple_float(COOKContext *q,
  * @param mlt_buffer2       pointer to right channel mlt coefficients
  */
 static int joint_decode(COOKContext *q, COOKSubpacket *p, float *mlt_buffer1,
-                         float *mlt_buffer2)
+                        float *mlt_buffer2)
 {
-    int i, j, ret;
+    int i, j, res;
     int decouple_tab[SUBBAND_SIZE];
     float *decode_buffer = q->decode_buffer_0;
     int idx, cpl_tmp;
@@ -840,10 +841,10 @@ static int joint_decode(COOKContext *q, COOKSubpacket *p, float *mlt_buffer1,
     /* Make sure the buffers are zeroed out. */
     memset(mlt_buffer1, 0, 1024 * sizeof(*mlt_buffer1));
     memset(mlt_buffer2, 0, 1024 * sizeof(*mlt_buffer2));
-    if ((ret = decouple_info(q, p, decouple_tab)) < 0)
-        return ret;
-    if ((ret = mono_decode(q, p, decode_buffer)) < 0)
-        return ret;
+    if ((res = decouple_info(q, p, decouple_tab)) < 0)
+        return res;
+    if ((res = mono_decode(q, p, decode_buffer)) < 0)
+        return res;
     /* The two channels are stored interleaved in decode_buffer. */
     for (i = 0; i < p->js_subband_start; i++) {
         for (j = 0; j < SUBBAND_SIZE; j++) {
@@ -864,6 +865,7 @@ static int joint_decode(COOKContext *q, COOKSubpacket *p, float *mlt_buffer1,
         q->decouple(q, p, i, f1, f2, decode_buffer, mlt_buffer1, mlt_buffer2);
         idx = (1 << p->js_vlc_bits) - 1;
     }
+
     return 0;
 }
 
@@ -938,10 +940,10 @@ static inline void mlt_compensate_output(COOKContext *q, float *decode_buffer,
  * @param outbuffer         pointer to the outbuffer
  */
 static int decode_subpacket(COOKContext *q, COOKSubpacket *p,
-                             const uint8_t *inbuffer, float *outbuffer)
+                            const uint8_t *inbuffer, float *outbuffer)
 {
     int sub_packet_size = p->size;
-    int ret;
+    int res;
     /* packet dump */
     // for (i = 0; i < sub_packet_size ; i++)
     //     av_log(q->avctx, AV_LOG_ERROR, "%02x", inbuffer[i]);
@@ -950,16 +952,16 @@ static int decode_subpacket(COOKContext *q, COOKSubpacket *p,
     decode_bytes_and_gain(q, p, inbuffer, &p->gains1);
 
     if (p->joint_stereo) {
-        if ((ret = joint_decode(q, p, q->decode_buffer_1, q->decode_buffer_2)) < 0)
-            return ret;
+        if ((res = joint_decode(q, p, q->decode_buffer_1, q->decode_buffer_2)) < 0)
+            return res;
     } else {
-        if ((ret = mono_decode(q, p, q->decode_buffer_1)) < 0)
-            return ret;
+        if ((res = mono_decode(q, p, q->decode_buffer_1)) < 0)
+            return res;
 
         if (p->num_channels == 2) {
             decode_bytes_and_gain(q, p, inbuffer + sub_packet_size / 2, &p->gains2);
-            if ((ret = mono_decode(q, p, q->decode_buffer_2)) < 0)
-                return ret;
+            if ((res = mono_decode(q, p, q->decode_buffer_2)) < 0)
+                return res;
         }
     }
 
@@ -973,6 +975,7 @@ static int decode_subpacket(COOKContext *q, COOKSubpacket *p,
         else
             mlt_compensate_output(q, q->decode_buffer_2, &p->gains2,
                                   p->mono_previous_buffer2, outbuffer, p->ch_idx + 1);
+
     return 0;
 }