Merge remote-tracking branch 'qatar/master'

* qatar/master: (53 commits)
  probe: Restore identification of files with very large id3 tags and no extension.
  probe: Remove id3 tag presence as a criteria to do file extension checking.
  mpegts: MP4 SL support
  mpegts: MP4 OD support
  mpegts: Add support for Sections in PMT
  mpegts: Replace the MP4 descriptor parser with a recursive parser.
  mpegts: Add support for multiple mp4 descriptors
  mpegts: Parse mpeg2 SL descriptors.
  isom: Add MPEG4SYSTEMS dummy object type indication.
  aacdec: allow output reconfiguration on channel changes
  nellymoserenc: take float input samples instead of int16
  nellymoserdec: use dsp functions for overlap and windowing
  nellymoserdec: do not fail if there is extra data in the packet
  nellymoserdec: fail if output buffer is too small
  nellymoserdec: remove pointless buffer size check.
  lavf: add init_put_byte() to the list of visible symbols.
  seek-test: free options dictionary after use
  snow: do not draw_edge if emu_edge is set
  tools/pktdumper: update to recent avformat api
  seek-test: update to recent avformat api
  ...

Conflicts:
	doc/APIchanges
	libavcodec/mpegaudiodec.c
	libavcodec/nellymoserdec.c
	libavcodec/snow.c
	libavcodec/version.h
	libavcodec/wmadec.c
	libavformat/avformat.h
	libavformat/mpegts.c
	libavformat/mxfdec.c
	libavformat/utils.c
	libavformat/wtv.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 14 insertions, 11 deletions

diff --git a/libavcodec/wmadec.c b/libavcodec/wmadec.c
index b4a4c800af..bf6e7ee71e 100644
--- a/libavcodec/wmadec.c
+++ b/libavcodec/wmadec.c
@@ -816,7 +816,7 @@ static int wma_decode_superframe(AVCodecContext *avctx,
     const uint8_t *buf = avpkt->data;
     int buf_size = avpkt->size;
     WMACodecContext *s = avctx->priv_data;
-    int nb_frames, bit_offset, i, pos, len;
+    int nb_frames, bit_offset, i, pos, len, out_size;
     uint8_t *q;
     int16_t *samples;
 
@@ -838,13 +838,19 @@ static int wma_decode_superframe(AVCodecContext *avctx,
     if (s->use_bit_reservoir) {
         /* read super frame header */
         skip_bits(&s->gb, 4); /* super frame index */
-        nb_frames = get_bits(&s->gb, 4) - 1;
+        nb_frames = get_bits(&s->gb, 4) - (s->last_superframe_len <= 0);
+    } else {
+        nb_frames = 1;
+    }
 
-        if((nb_frames+1) * s->nb_channels * s->frame_len * sizeof(int16_t) > *data_size){
-            av_log(s->avctx, AV_LOG_ERROR, "Insufficient output space\n");
-            goto fail;
-        }
+    out_size = nb_frames * s->frame_len * s->nb_channels *
+               av_get_bytes_per_sample(avctx->sample_fmt);
+    if (*data_size < out_size) {
+        av_log(s->avctx, AV_LOG_ERROR, "Insufficient output space\n");
+        goto fail;
+    }
 
+    if (s->use_bit_reservoir) {
         bit_offset = get_bits(&s->gb, s->byte_offset_bits + 3);
 
         if (s->last_superframe_len > 0) {
@@ -873,6 +879,7 @@ static int wma_decode_superframe(AVCodecContext *avctx,
             if (wma_decode_frame(s, samples) < 0)
                 goto fail;
             samples += s->nb_channels * s->frame_len;
+            nb_frames--;
         }
 
         /* read each frame starting from bit_offset */
@@ -901,10 +908,6 @@ static int wma_decode_superframe(AVCodecContext *avctx,
         s->last_superframe_len = len;
         memcpy(s->last_superframe, buf + pos, len);
     } else {
-        if(s->nb_channels * s->frame_len * sizeof(int16_t) > *data_size){
-            av_log(s->avctx, AV_LOG_ERROR, "Insufficient output space\n");
-            goto fail;
-        }
         /* single frame decode */
         if (wma_decode_frame(s, samples) < 0)
             goto fail;
@@ -912,7 +915,7 @@ static int wma_decode_superframe(AVCodecContext *avctx,
     }
 
 //av_log(NULL, AV_LOG_ERROR, "%d %d %d %d outbytes:%d eaten:%d\n", s->frame_len_bits, s->block_len_bits, s->frame_len, s->block_len,        (int8_t *)samples - (int8_t *)data, s->block_align);
-    *data_size = (int8_t *)samples - (int8_t *)data;
+    *data_size = out_size;
     return buf_size;
  fail:
     /* when error, we reset the bit reservoir */