Merge remote-tracking branch 'qatar/master'

* qatar/master: (23 commits)
  fix AC3ENC_OPT_MODE_ON/OFF
  h264: fix HRD parameters parsing
  prores: implement multithreading.
  prores: idct sse2/sse4 optimizations.
  swscale: use aligned move for storage into temporary buffer.
  prores: extract idct into its own dspcontext and merge with put_pixels.
  h264: fix invalid shifts in init_cavlc_level_tab()
  intfloat_readwrite: fix signed addition overflows
  mov: do not misreport empty stts
  mov: cosmetics, fix for and if spacing
  id3v2: fix NULL pointer dereference
  mov: read album_artist atom
  mov: fix disc/track numbers and totals
  doc: fix references to obsolete presets directories for avconv/ffmpeg
  flashsv: return more meaningful error value
  flashsv: fix typo in av_log() message
  smacker: validate channels and sample format.
  smacker: check buffer size before reading output size
  smacker: validate number of channels
  smacker: Separate audio flags from sample rates in smacker demuxer.
  ...

Conflicts:
	cmdutils.h
	doc/ffmpeg.texi
	libavcodec/Makefile
	libavcodec/motion_est_template.c
	libavformat/id3v2.c
	libavformat/mov.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 17 insertions, 0 deletions

diff --git a/libavcodec/smacker.c b/libavcodec/smacker.c
index 3a4ba1a114..c7eafbc261 100644
--- a/libavcodec/smacker.c
+++ b/libavcodec/smacker.c
@@ -560,6 +560,10 @@ static av_cold int decode_end(AVCodecContext *avctx)
 
 static av_cold int smka_decode_init(AVCodecContext *avctx)
 {
+    if (avctx->channels < 1 || avctx->channels > 2) {
+        av_log(avctx, AV_LOG_ERROR, "invalid number of channels\n");
+        return AVERROR(EINVAL);
+    }
     avctx->channel_layout = (avctx->channels==2) ? AV_CH_LAYOUT_STEREO : AV_CH_LAYOUT_MONO;
     avctx->sample_fmt = avctx->bits_per_coded_sample == 8 ? AV_SAMPLE_FMT_U8 : AV_SAMPLE_FMT_S16;
     return 0;
@@ -583,6 +587,11 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
     int bits, stereo;
     int pred[2] = {0, 0};
 
+    if (buf_size <= 4) {
+        av_log(avctx, AV_LOG_ERROR, "packet is too small\n");
+        return AVERROR(EINVAL);
+    }
+
     unp_size = AV_RL32(buf);
 
     init_get_bits(&gb, buf + 4, (buf_size - 4) * 8);
@@ -598,6 +607,14 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
         av_log(avctx, AV_LOG_ERROR, "Frame is too large to fit in buffer\n");
         return -1;
     }
+    if (stereo ^ (avctx->channels != 1)) {
+        av_log(avctx, AV_LOG_ERROR, "channels mismatch\n");
+        return AVERROR(EINVAL);
+    }
+    if (bits && avctx->sample_fmt == AV_SAMPLE_FMT_U8) {
+        av_log(avctx, AV_LOG_ERROR, "sample format mismatch\n");
+        return AVERROR(EINVAL);
+    }
 
     memset(vlc, 0, sizeof(VLC) * 4);
     memset(h, 0, sizeof(HuffContext) * 4);