Merge remote-tracking branch 'qatar/master'

* qatar/master:
  asf: only set index_read if the index contained entries.
  cabac: add overread protection to BRANCHLESS_GET_CABAC().
  cabac: increment jump locations by one in callers of BRANCHLESS_GET_CABAC().
  cabac: remove unused argument from BRANCHLESS_GET_CABAC_UPDATE().
  cabac: use struct+offset instead of memory operand in BRANCHLESS_GET_CABAC().
  h264: add overread protection to get_cabac_bypass_sign_x86().
  h264: reindent get_cabac_bypass_sign_x86().
  h264: use struct offsets in get_cabac_bypass_sign_x86().
  h264: fix overreads in cabac reader.
  wmall: fix seeking.
  lagarith: fix buffer overreads.
  dvdec: drop unnecessary dv_tablegen.h #include
  build: fix doc generation errors in parallel builds
  Replace memset(0) by zero initializations.
  faandct: Remove FAAN_POSTSCALE define and related code.
  dvenc: print allowed profiles if the video doesn't conform to any of them.
  avcodec_encode_{audio,video}: only reallocate output packet when it has non-zero size.
  FATE: add a test for vp8 with changing frame size.
  fate: add kgv1 fate test.
  oggdec: calculate correct timestamps in Ogg/FLAC

Conflicts:
	libavcodec/4xm.c
	libavcodec/cook.c
	libavcodec/dvdata.c
	libavcodec/dvdsubdec.c
	libavcodec/lagarith.c
	libavcodec/lagarithrac.c
	libavcodec/utils.c
	tests/fate/video.mak

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 44 insertions, 27 deletions

diff --git a/libavcodec/lagarith.c b/libavcodec/lagarith.c
index ce8af649ab..eea5c81a8a 100644
--- a/libavcodec/lagarith.c
+++ b/libavcodec/lagarith.c
@@ -251,21 +251,22 @@ static void lag_pred_line(LagarithContext *l, uint8_t *buf,
         /* Left prediction only for first line */
         L = l->dsp.add_hfyu_left_prediction(buf + 1, buf + 1,
                                             width - 1, buf[0]);
-        return;
-    }
-    /* Left pixel is actually prev_row[width] */
-    L = buf[width - stride - 1];
-    if (line == 1) {
-        /* Second line, left predict first pixel, the rest of the line is median predicted
-         * NOTE: In the case of RGB this pixel is top predicted */
-        TL = l->avctx->pix_fmt == PIX_FMT_YUV420P ? buf[-stride] : L;
     } else {
-        /* Top left is 2 rows back, last pixel */
-        TL = buf[width - (2 * stride) - 1];
-    }
+        /* Left pixel is actually prev_row[width] */
+        L = buf[width - stride - 1];
+
+        if (line == 1) {
+            /* Second line, left predict first pixel, the rest of the line is median predicted
+             * NOTE: In the case of RGB this pixel is top predicted */
+            TL = l->avctx->pix_fmt == PIX_FMT_YUV420P ? buf[-stride] : L;
+        } else {
+            /* Top left is 2 rows back, last pixel */
+            TL = buf[width - (2 * stride) - 1];
+        }
 
-    add_lag_median_prediction(buf, buf - stride, buf,
-                              width, &L, &TL);
+        add_lag_median_prediction(buf, buf - stride, buf,
+                                  width, &L, &TL);
+    }
 }
 
 static int lag_decode_line(LagarithContext *l, lag_rac *rac,
@@ -311,13 +312,13 @@ handle_zeros:
 }
 
 static int lag_decode_zero_run_line(LagarithContext *l, uint8_t *dst,
-                                    const uint8_t *src, const uint8_t *srcend, int width,
-                                    int esc_count)
+                                    const uint8_t *src, const uint8_t *src_end,
+                                    int width, int esc_count)
 {
     int i = 0;
     int count;
     uint8_t zero_run = 0;
-    const uint8_t *start = src;
+    const uint8_t *src_start = src;
     uint8_t mask1 = -(esc_count < 2);
     uint8_t mask2 = -(esc_count < 3);
     uint8_t *end = dst + (width - 2);
@@ -334,8 +335,8 @@ output_zeros:
         i = 0;
         while (!zero_run && dst + i < end) {
             i++;
-            if (i+2 >= srcend - src)
-                return src - start;
+            if (i+2 >= src_end - src)
+                return AVERROR_INVALIDDATA;
             zero_run =
                 !(src[i] | (src[i + 1] & mask1) | (src[i + 2] & mask2));
         }
@@ -351,9 +352,10 @@ output_zeros:
         } else {
             memcpy(dst, src, i);
             src += i;
+            dst += i;
         }
     }
-    return  src - start;
+    return  src - src_start;
 }
 
 
@@ -369,7 +371,7 @@ static int lag_decode_arith_plane(LagarithContext *l, uint8_t *dst,
     int esc_count;
     GetBitContext gb;
     lag_rac rac;
-    const uint8_t *srcend = src + src_size;
+    const uint8_t *src_end = src + src_size;
 
     rac.avctx = l->avctx;
     l->zeros = 0;
@@ -406,12 +408,16 @@ static int lag_decode_arith_plane(LagarithContext *l, uint8_t *dst,
         esc_count -= 4;
         if (esc_count > 0) {
             /* Zero run coding only, no range coding. */
-            for (i = 0; i < height; i++)
-                src += lag_decode_zero_run_line(l, dst + (i * stride), src, srcend,
-                                                width, esc_count);
+            for (i = 0; i < height; i++) {
+                int res = lag_decode_zero_run_line(l, dst + (i * stride), src,
+                                                   src_end, width, esc_count);
+                if (res < 0)
+                    return res;
+                src += res;
+            }
         } else {
-            if (src_size < height * width)
-                return -1;
+            if (src_size < width * height)
+                return AVERROR_INVALIDDATA; // buffer not big enough
             /* Plane is stored uncompressed */
             for (i = 0; i < height; i++) {
                 memcpy(dst + (i * stride), src, width);
@@ -518,15 +524,18 @@ static int lag_decode_frame(AVCodecContext *avctx,
         }
         for (i = 0; i < planes; i++)
             srcs[i] = l->rgb_planes + (i + 1) * l->rgb_stride * avctx->height - l->rgb_stride;
-        for (i = 0; i < planes; i++) {
+        for (i = 0; i < planes; i++)
             if (buf_size <= offs[i]) {
+                av_log(avctx, AV_LOG_ERROR,
+                        "Invalid frame offsets\n");
                 return AVERROR_INVALIDDATA;
             }
+
+        for (i = 0; i < planes; i++)
             lag_decode_arith_plane(l, srcs[i],
                                    avctx->width, avctx->height,
                                    -l->rgb_stride, buf + offs[i],
                                    buf_size - offs[i]);
-        }
         dst = p->data[0];
         for (i = 0; i < planes; i++)
             srcs[i] = l->rgb_planes + i * l->rgb_stride * avctx->height;
@@ -563,6 +572,14 @@ static int lag_decode_frame(AVCodecContext *avctx,
             return AVERROR_INVALIDDATA;
         }
 
+        if (offset_ry >= buf_size ||
+            offset_gu >= buf_size ||
+            offset_bv >= buf_size) {
+            av_log(avctx, AV_LOG_ERROR,
+                   "Invalid frame offsets\n");
+            return AVERROR_INVALIDDATA;
+        }
+
         lag_decode_arith_plane(l, p->data[0], avctx->width, avctx->height,
                                p->linesize[0], buf + offset_ry,
                                buf_size - offset_ry);