Merge remote-tracking branch 'qatar/master'

* qatar/master:
  id3v2: fix doxy comment - 'machine byte order' makes no sense on char arrays
  VC1: restore mistakenly removed code
  twinvq: check output buffer size before decoding
  twinvq: return an error when the packet size is too small
  lavf: export some forgotten symbols with non-av prefixes.
  swscale: update altivec yuv2planeX asm to new per-plane API.
  swscale: make yuv2yuvX_10_sse2/avx 8/9/16-bits aware.
  yuv2planeX10 SIMD
  swscale: decide whether to use yuv2plane1/X on a per-plane basis.
  swscale: reintroduce full precision in 16-bit output.
  Split up yuv2yuvX functions
  Split out yuv2yuv1 luma and chroma in order to make them generic DSP functions
  lavc: replace references to deprecated AVCodecContext.error_recognition to use AVCodecContext.err_recognition
  lavc: translate non-flag-based er options into flag-based ef options at codec open
  add -err_filter AVOptions to access flag-based error recognition
  h264_weight: initialize "height" function argument properly.
  presets: spelling error in libvpx 1080p50_60
  avplay: fix fullscreen behaviour with SDL 1.2.14 on Mac OS X

Conflicts:
	ffplay.c
	libavformat/libavformat.v
	libswscale/swscale.c
	libswscale/x86/swscale_template.c
	tests/ref/lavfi/pixfmts_scale

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 10 insertions, 4 deletions

diff --git a/libavcodec/twinvq.c b/libavcodec/twinvq.c
index 17c268dad1..2ce7b306fc 100644
--- a/libavcodec/twinvq.c
+++ b/libavcodec/twinvq.c
@@ -822,7 +822,7 @@ static int twin_decode_frame(AVCodecContext * avctx, void *data,
     const ModeTab *mtab = tctx->mtab;
     float *out = data;
     enum FrameType ftype;
-    int window_type;
+    int window_type, out_size;
     static const enum FrameType wtype_to_ftype_table[] = {
         FT_LONG,   FT_LONG, FT_SHORT, FT_LONG,
         FT_MEDIUM, FT_LONG, FT_LONG,  FT_MEDIUM, FT_MEDIUM
@@ -831,8 +831,14 @@ static int twin_decode_frame(AVCodecContext * avctx, void *data,
     if (buf_size*8 < avctx->bit_rate*mtab->size/avctx->sample_rate + 8) {
         av_log(avctx, AV_LOG_ERROR,
                "Frame too small (%d bytes). Truncated file?\n", buf_size);
-        *data_size = 0;
-        return buf_size;
+        return AVERROR(EINVAL);
+    }
+
+    out_size = mtab->size * avctx->channels *
+               av_get_bytes_per_sample(avctx->sample_fmt);
+    if (*data_size < out_size) {
+        av_log(avctx, AV_LOG_ERROR, "output buffer is too small\n");
+        return AVERROR(EINVAL);
     }
 
     init_get_bits(&gb, buf, buf_size * 8);
@@ -857,7 +863,7 @@ static int twin_decode_frame(AVCodecContext * avctx, void *data,
         return buf_size;
     }
 
-    *data_size = mtab->size*avctx->channels*4;
+    *data_size = out_size;
 
     return buf_size;
 }