Merge remote-tracking branch 'qatar/master'

* qatar/master: (44 commits)
  replacement Indeo 3 decoder
  gsm demuxer: do not allocate packet twice.
  flvenc: use first packet delay as global delay.
  ac3enc: doxygen update.
  imc: return error codes instead of 0 for error conditions.
  imc: return meaningful error codes instead of -1
  imc: do not set channel layout for stereo
  imc: validate channel count
  imc: check for ff_fft_init() failure
  imc: check output buffer size before decoding
  imc: use DSPContext.bswap16_buf() to byte-swap packet data
  rtsp: add allowed_media_types option
  libgsm: add flush function to reset the decoder state when seeking
  libgsm: simplify decoding by using a loop
  gsm: log error message when packet is too small
  libgsmdec: do not needlessly set *data_size to 0
  gsmdec: do not needlessly set *data_size to 0
  gsmdec: add flush function to reset the decoder state when seeking
  libgsmdec: check output buffer size before decoding
  gsmdec: log error message when output buffer is too small.
  ...

Conflicts:
	Changelog
	ffplay.c
	libavcodec/indeo3.c
	libavcodec/mjpeg_parser.c
	libavcodec/vp3.c
	libavformat/cutils.c
	libavformat/id3v2.c
	libavutil/parseutils.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 18 insertions, 5 deletions

diff --git a/libavcodec/gsmdec.c b/libavcodec/gsmdec.c
index a3f67d3b52..2d1dee8384 100644
--- a/libavcodec/gsmdec.c
+++ b/libavcodec/gsmdec.c
@@ -58,13 +58,18 @@ static int gsm_decode_frame(AVCodecContext *avctx, void *data,
     const uint8_t *buf = avpkt->data;
     int buf_size = avpkt->size;
     int16_t *samples = data;
-    int frame_bytes = 2 * avctx->frame_size;
+    int frame_bytes = avctx->frame_size *
+                      av_get_bytes_per_sample(avctx->sample_fmt);
 
-    if (*data_size < frame_bytes)
-        return -1;
-    *data_size = 0;
-    if(buf_size < avctx->block_align)
+    if (*data_size < frame_bytes) {
+        av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\n");
+        return AVERROR(EINVAL);
+    }
+
+    if (buf_size < avctx->block_align) {
+        av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
         return AVERROR_INVALIDDATA;
+    }
 
     switch (avctx->codec_id) {
     case CODEC_ID_GSM:
@@ -84,6 +89,12 @@ static int gsm_decode_frame(AVCodecContext *avctx, void *data,
     return avctx->block_align;
 }
 
+static void gsm_flush(AVCodecContext *avctx)
+{
+    GSMContext *s = avctx->priv_data;
+    memset(s, 0, sizeof(*s));
+}
+
 AVCodec ff_gsm_decoder = {
     .name           = "gsm",
     .type           = AVMEDIA_TYPE_AUDIO,
@@ -91,6 +102,7 @@ AVCodec ff_gsm_decoder = {
     .priv_data_size = sizeof(GSMContext),
     .init           = gsm_init,
     .decode         = gsm_decode_frame,
+    .flush          = gsm_flush,
     .long_name = NULL_IF_CONFIG_SMALL("GSM"),
 };
 
@@ -101,5 +113,6 @@ AVCodec ff_gsm_ms_decoder = {
     .priv_data_size = sizeof(GSMContext),
     .init           = gsm_init,
     .decode         = gsm_decode_frame,
+    .flush          = gsm_flush,
     .long_name = NULL_IF_CONFIG_SMALL("GSM Microsoft variant"),
 };