Merge remote-tracking branch 'qatar/master'

* qatar/master:
  adpcm: Clip step_index values read from the bitstream at the beginning of each frame.
  oma: don't read beyond end of leaf_table.
  doxygen: Remove documentation for non-existing parameters; misc small fixes.
  Indeo3: fix crashes on corrupt bitstreams.
  msmpeg4: Replace forward declaration by proper #include.
  segment: implement wrap around
  avf: reorder AVStream and AVFormatContext
  aacdec: Remove erroneous reference to global gain from the out of bounds scalefactor error message.

Conflicts:
	libavcodec/indeo3.c
	libavformat/avformat.h
	libavutil/avutil.h

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 8 insertions, 2 deletions

diff --git a/libavcodec/indeo3.c b/libavcodec/indeo3.c
index dce75fe116..83effae859 100644
--- a/libavcodec/indeo3.c
+++ b/libavcodec/indeo3.c
@@ -727,6 +727,8 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
         SPLIT_CELL(ref_cell->height, curr_cell.height);
         ref_cell->ypos   += curr_cell.height;
         ref_cell->height -= curr_cell.height;
+        if (ref_cell->height <= 0 || curr_cell.height <= 0)
+            return AVERROR_INVALIDDATA;
     } else if (code == V_SPLIT) {
         if (curr_cell.width > strip_width) {
             /* split strip */
@@ -735,6 +737,8 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
             SPLIT_CELL(ref_cell->width, curr_cell.width);
         ref_cell->xpos  += curr_cell.width;
         ref_cell->width -= curr_cell.width;
+        if (ref_cell->width <= 0 || curr_cell.width <= 0)
+            return AVERROR_INVALIDDATA;
     }
 
     while (get_bits_left(&ctx->gb) >= 2) { /* loop until return */
@@ -890,14 +894,16 @@ static int decode_frame_headers(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
         return AVERROR_INVALIDDATA;
 
     if (width != ctx->width || height != ctx->height) {
+        int res;
+
         av_dlog(avctx, "Frame dimensions changed!\n");
 
         ctx->width  = width;
         ctx->height = height;
 
         free_frame_buffers(ctx);
-        if(allocate_frame_buffers(ctx, avctx) < 0)
-            return AVERROR_INVALIDDATA;
+        if ((res = allocate_frame_buffers(ctx, avctx)) < 0)
+             return res;
         avcodec_set_dimensions(avctx, width, height);
     }