Merge remote-tracking branch 'qatar/master'

* qatar/master: (51 commits)
  cin audio: use sign_extend() instead of casting to int16_t
  cin audio: restructure decoding loop to avoid a separate counter variable
  cin audio: use local variable for delta value
  cin audio: remove unneeded cast from void*
  cin audio: validate the channel count
  cin audio: remove unneeded AVCodecContext pointer from CinAudioContext
  dsicin: fix several audio-related fields in the CIN demuxer
  flacdec: use av_get_bytes_per_sample() to get sample size
  dca: handle errors from dca_decode_block()
  dca: return error if the frame header is invalid
  dca: return proper error codes instead of -1
  utvideo: handle empty Huffman trees
  binkaudio: change short to int16_t
  binkaudio: only decode one block at a time.
  binkaudio: store interleaved overlap samples in BinkAudioContext.
  binkaudio: pre-calculate quantization factors
  binkaudio: add some buffer overread checks.
  atrac3: support float or int16 output using request_sample_fmt
  atrac3: add CODEC_CAP_SUBFRAMES capability
  atrac3: return appropriate error codes instead of -1
  ...

Conflicts:
	libavcodec/atrac1.c
	libavcodec/dca.c
	libavformat/mov.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 27 insertions, 17 deletions

diff --git a/libavcodec/dsicinav.c b/libavcodec/dsicinav.c
index 05d9e4cc14..53d4f90d2e 100644
--- a/libavcodec/dsicinav.c
+++ b/libavcodec/dsicinav.c
@@ -26,6 +26,7 @@
 
 #include "avcodec.h"
 #include "bytestream.h"
+#include "mathops.h"
 
 
 typedef enum CinVideoBitmapIndex {
@@ -43,7 +44,6 @@ typedef struct CinVideoContext {
 } CinVideoContext;
 
 typedef struct CinAudioContext {
-    AVCodecContext *avctx;
     int initial_decode_frame;
     int delta;
 } CinAudioContext;
@@ -309,7 +309,11 @@ static av_cold int cinaudio_decode_init(AVCodecContext *avctx)
 {
     CinAudioContext *cin = avctx->priv_data;
 
-    cin->avctx = avctx;
+    if (avctx->channels != 1) {
+        av_log_ask_for_sample(avctx, "Number of channels is not supported\n");
+        return AVERROR_PATCHWELCOME;
+    }
+
     cin->initial_decode_frame = 1;
     cin->delta = 0;
     avctx->sample_fmt = AV_SAMPLE_FMT_S16;
@@ -322,29 +326,35 @@ static int cinaudio_decode_frame(AVCodecContext *avctx,
                                  AVPacket *avpkt)
 {
     const uint8_t *buf = avpkt->data;
-    int buf_size = avpkt->size;
     CinAudioContext *cin = avctx->priv_data;
-    const uint8_t *src = buf;
-    int16_t *samples = (int16_t *)data;
-
-    buf_size = FFMIN(buf_size, *data_size/2);
+    const uint8_t *buf_end = buf + avpkt->size;
+    int16_t *samples = data;
+    int delta, out_size;
+
+    out_size = (avpkt->size - cin->initial_decode_frame) *
+               av_get_bytes_per_sample(avctx->sample_fmt);
+    if (*data_size < out_size) {
+        av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\n");
+        return AVERROR(EINVAL);
+    }
 
+    delta = cin->delta;
     if (cin->initial_decode_frame) {
         cin->initial_decode_frame = 0;
-        cin->delta = (int16_t)AV_RL16(src); src += 2;
-        *samples++ = cin->delta;
-        buf_size -= 2;
+        delta = sign_extend(AV_RL16(buf), 16);
+        buf += 2;
+        *samples++ = delta;
     }
-    while (buf_size > 0) {
-        cin->delta += cinaudio_delta16_table[*src++];
-        cin->delta = av_clip_int16(cin->delta);
-        *samples++ = cin->delta;
-        --buf_size;
+    while (buf < buf_end) {
+        delta += cinaudio_delta16_table[*buf++];
+        delta = av_clip_int16(delta);
+        *samples++ = delta;
     }
+    cin->delta = delta;
 
-    *data_size = (uint8_t *)samples - (uint8_t *)data;
+    *data_size = out_size;
 
-    return src - buf;
+    return avpkt->size;
 }