Merge commit 'd05f72c75445969cd7bdb1d860635c9880c67fb6'

* commit 'd05f72c75445969cd7bdb1d860635c9880c67fb6':
  dfa: improve boundary checks in decode_dds1()
  wmalosslessdec: Fix reading too many bits in decode_channel_residues()
  wmalosslessdec: fix a get_bits(0) in decode_ac_filter
  wmalosslessdec: make MCLMS arrays big enough for what is written into them.
  indeo4/5: check empty tile size in decode_mb_info().
  ivi_common: make ff_ivi_process_empty_tile() static.
  indeo5: check tile size in decode_mb_info().
  indeo3: fix out of cell write.

Conflicts:
	libavcodec/dfa.c
	libavcodec/indeo3.c
	libavcodec/indeo5.c
	libavcodec/ivi_common.c
	libavcodec/wmalosslessdec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 20 insertions, 6 deletions

diff --git a/libavcodec/ivi_common.c b/libavcodec/ivi_common.c
index f0c81be6cb..9ecf9cdf2c 100644
--- a/libavcodec/ivi_common.c
+++ b/libavcodec/ivi_common.c
@@ -495,8 +495,17 @@ int ff_ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, IVITile *tile)
     return 0;
 }
 
-void ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
-                               IVITile *tile, int32_t mv_scale)
+/**
+ *  Handle empty tiles by performing data copying and motion
+ *  compensation respectively.
+ *
+ *  @param[in]  avctx     ptr to the AVCodecContext
+ *  @param[in]  band      pointer to the band descriptor
+ *  @param[in]  tile      pointer to the tile descriptor
+ *  @param[in]  mv_scale  scaling factor for motion vectors
+ */
+static int ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
+                                  IVITile *tile, int32_t mv_scale)
 {
     int             x, y, need_mc, mbn, blk, num_blocks, mv_x, mv_y, mc_type;
     int             offs, mb_offset, row_offset;
@@ -506,10 +515,11 @@ void ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
     void (*mc_no_delta_func)(int16_t *buf, const int16_t *ref_buf, uint32_t pitch,
                              int mc_type);
 
-    if( tile->num_MBs != IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size) ){
-        av_log(avctx, AV_LOG_ERROR, "allocated tile size %d mismatches parameters %d in ff_ivi_process_empty_tile()\n",
+    if (tile->num_MBs != IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size)) {
+        av_log(avctx, AV_LOG_ERROR, "Allocated tile size %d mismatches "
+               "parameters %d in ivi_process_empty_tile()\n",
                tile->num_MBs, IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size));
-        return;
+        return AVERROR_INVALIDDATA;
     }
 
     offs       = tile->ypos * band->pitch + tile->xpos;
@@ -592,6 +602,8 @@ void ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
             dst += band->pitch;
         }
     }
+
+    return 0;
 }
 
 
@@ -689,8 +701,10 @@ static int decode_band(IVI45DecContext *ctx, int plane_num,
         }
         tile->is_empty = get_bits1(&ctx->gb);
         if (tile->is_empty) {
-            ff_ivi_process_empty_tile(avctx, band, tile,
+            result = ivi_process_empty_tile(avctx, band, tile,
                                       (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3));
+            if (result < 0)
+                break;
             av_dlog(avctx, "Empty tile encountered!\n");
         } else {
             tile->data_size = ff_ivi_dec_tile_data_size(&ctx->gb);