Merge remote-tracking branch 'qatar/master'

* qatar/master:
  h264: clear trailing bits in partially parsed NAL units
  vc1: Handle WVC1 interlaced stream
  xl: Fix overreads
  mpegts: rename payload_index to payload_size
  segment: introduce segmented chain muxer
  lavu: add AVERROR_BUG error value
  avplay: clear pkt_temp when pkt is freed.
  qcelpdec: K&R formatting cosmetics
  qcelpdec: cosmetics: drop some pointless parentheses
  x86: conditionally compile dnxhd encoder optimizations
  Revert "h264: skip start code search if the size of the nal unit is known"
  swscale: fix formatting and indentation of unscaled conversion routines.
  h264: skip start code search if the size of the nal unit is known
  cljr: fix buf_size sanity check
  cljr: Check if width and height are positive integers

Conflicts:
	libavcodec/cljr.c
	libavcodec/vc1dec.c
	libavformat/Makefile
	libavformat/mpegtsenc.c
	libavformat/segment.c
	libswscale/swscale_unscaled.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 6 insertions, 0 deletions

diff --git a/libavcodec/xl.c b/libavcodec/xl.c
index c29e8b3190..78f34afa4e 100644
--- a/libavcodec/xl.c
+++ b/libavcodec/xl.c
@@ -68,6 +68,12 @@ static int decode_frame(AVCodecContext *avctx,
     V = a->pic.data[2];
 
     stride = avctx->width - 4;
+
+    if (buf_size < avctx->width * avctx->height) {
+        av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     for (i = 0; i < avctx->height; i++) {
         /* lines are stored in reversed order */
         buf += stride;