Merge remote-tracking branch 'qatar/master'

* qatar/master:
  swscale: K&R formatting cosmetics (part II)
  tiffdec: Add a malloc check and refactor another.
  faxcompr: Check malloc results and unify return path
  configure: escape colons in values written to config.fate
  ac3dsp: call femms/emms at the end of float_to_fixed24() for 3DNow and SSE
  matroska: Fix leaking memory allocated for laces.
  pthread: Fix crash due to fctx->delaying not being cleared.
  vp3: Assert on invalid filter_limit values.
  h264: fix 10bit biweight functions after recent x86inc.asm fixes.
  ffv1: Fix size mismatch in encode_line.
  movenc: Remove a dead initialization
  git-howto: Explain how to avoid Windows line endings in git checkouts.
  build: Move all arch OBJS declarations into arch subdirectory Makefiles.

Conflicts:
	configure
	libavcodec/vp3.c
	libavformat/matroskadec.c
	libavutil/Makefile
	libswscale/Makefile
	libswscale/swscale.c
	libswscale/swscale_internal.h
	libswscale/utils.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 10 insertions, 5 deletions

diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index 84edca049a..0d79f6192b 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -145,13 +145,18 @@ static int tiff_unpack_strip(TiffContext *s, uint8_t* dst, int stride, const uin
     int c, line, pixels, code;
     const uint8_t *ssrc = src;
     int width = ((s->width * s->bpp) + 7) >> 3;
-#if CONFIG_ZLIB
-    uint8_t *zbuf; unsigned long outlen;
 
+    if (size <= 0)
+        return AVERROR_INVALIDDATA;
+
+#if CONFIG_ZLIB
     if(s->compr == TIFF_DEFLATE || s->compr == TIFF_ADOBE_DEFLATE){
+        uint8_t *zbuf; unsigned long outlen;
         int ret;
         outlen = width * lines;
         zbuf = av_malloc(outlen);
+        if (!zbuf)
+            return AVERROR(ENOMEM);
         ret = tiff_uncompress(zbuf, &outlen, src, size);
         if(ret != Z_OK){
             av_log(s->avctx, AV_LOG_ERROR, "Uncompressing failed (%lu of %lu) with error %d\n", outlen, (unsigned long)width * lines, ret);
@@ -180,11 +185,11 @@ static int tiff_unpack_strip(TiffContext *s, uint8_t* dst, int stride, const uin
     }
     if(s->compr == TIFF_CCITT_RLE || s->compr == TIFF_G3 || s->compr == TIFF_G4){
         int i, ret = 0;
-        uint8_t *src2 = av_malloc(size + FF_INPUT_BUFFER_PADDING_SIZE);
+        uint8_t *src2 = av_malloc((unsigned)size + FF_INPUT_BUFFER_PADDING_SIZE);
 
-        if(!src2 || (unsigned)size + FF_INPUT_BUFFER_PADDING_SIZE < (unsigned)size){
+        if (!src2) {
             av_log(s->avctx, AV_LOG_ERROR, "Error allocating temporary buffer\n");
-            return -1;
+            return AVERROR(ENOMEM);
         }
         if(s->fax_opts & 2){
             av_log(s->avctx, AV_LOG_ERROR, "Uncompressed fax mode is not supported (yet)\n");