Merge remote-tracking branch 'qatar/master'

* qatar/master:
  mov: Use defines for sample flags in fragments
  mov: Use defines for trun flags
  mov: Use defines for tfhd flags
  proresenc: force bitrate not to exceed given limit
  vc1parse: call vc1_init_common().
  wma: don't return 0 on invalid packets.
  asf: prevent packet_size_left from going negative if hdrlen > pktlen.
  mjpegb: don't return 0 at the end of frame decoding.
  rtpdec: Identify incorrectly signalled H263
  vp8dsp: split long line.
  aiff: don't skip block_align==0 check on COMM-after-SSND files.
  dpcm: ignore extra unpaired bytes in stereo streams.
  mp3on4: require a minimum framesize.
  mpc7: assign an error level + context to av_log() msg.
  huffyuv: error out on bit overrun.
  dct-test: Add the missing ff_ prefix to the altivec functions
  dct-test: Remove a stray declaration of a nonexistent function
  movenc: Write the unknown duration as 64 bit fields in ismv
  movenc: Write track durations with all bits set if duration is unknown

Conflicts:
	libavcodec/dct-test.c
	libavcodec/wmadec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 7 insertions, 0 deletions

diff --git a/libavformat/asfdec.c b/libavformat/asfdec.c
index e2f46dc005..b37cbb04d3 100644
--- a/libavformat/asfdec.c
+++ b/libavformat/asfdec.c
@@ -797,6 +797,13 @@ static int ff_asf_get_packet(AVFormatContext *s, AVIOContext *pb)
         asf->packet_segments = 1;
         asf->packet_segsizetype = 0x80;
     }
+    if (rsize > packet_length - padsize) {
+        asf->packet_size_left = 0;
+        av_log(s, AV_LOG_ERROR,
+               "invalid packet header length %d for pktlen %d-%d at %"PRId64"\n",
+               rsize, packet_length, padsize, avio_tell(pb));
+        return -1;
+    }
     asf->packet_size_left = packet_length - padsize - rsize;
     if (packet_length < asf->hdr.min_pktsize)
         padsize += asf->hdr.min_pktsize - packet_length;