Merge remote-tracking branch 'qatar/master'

* qatar/master:
  dxva2: don't check for DXVA_PictureParameters->wDecodedPictureIndex
  img2: split muxer and demuxer into separate files
  rm: prevent infinite loops for index parsing.
  aac: fix infinite loop on end-of-frame with sequence of 1-bits.
  mov: Add more HDV and XDCAM FourCCs.
  lavf: don't set AVCodecContext.has_b_frames in compute_pkt_fields().
  rmdec: when using INT4 deinterleaving, error out if sub_packet_h <= 1.
  cdxl: correctly synchronize video timestamps to audio
  mlpdec_parser: fix a few channel layouts.
  Add channel names to channel_names[] array for channels added in b2890f5
  movenc: Buffer the mdat for the initial moov fragment, too
  flvdec: Ignore the index if the ignidx flag is set
  flvdec: Fix indentation
  movdec: Don't parse all fragments if ignidx is set
  movdec: Restart parsing root-level atoms at the right spot
  prores: use natural integer type for the codebook index
  mov: Add support for MPEG2 HDV 720p24 (hdv4)
  swscale: K&R formatting cosmetics (part I)
  swscale: variable declaration and placement cosmetics

Conflicts:
	configure
	libavcodec/aacdec.c
	libavcodec/mlp_parser.c
	libavformat/flvdec.c
	libavformat/img2.c
	libavformat/isom.h
	libavformat/mov.c
	libavformat/movenc.c
	libswscale/rgb2rgb.c
	libswscale/rgb2rgb_template.c
	libswscale/yuv2rgb.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 18 insertions, 3 deletions

diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index 68383b2d21..b66de30f2e 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -266,6 +266,7 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb,
         switch (ast->deint_id) {
         case DEINT_ID_INT4:
             if (ast->coded_framesize > ast->audio_framesize ||
+                sub_packet_h <= 1 ||
                 ast->coded_framesize * sub_packet_h > (2 + (sub_packet_h & 1)) * ast->audio_framesize)
                 return AVERROR_INVALIDDATA;
             break;
@@ -370,8 +371,19 @@ static int rm_read_index(AVFormatContext *s)
                 st = s->streams[n];
                 break;
             }
-        if (n == s->nb_streams)
+        if (n == s->nb_streams) {
+            av_log(s, AV_LOG_ERROR,
+                   "Invalid stream index %d for index at pos %"PRId64"\n",
+                   str_id, avio_tell(pb));
             goto skip;
+        } else if ((avio_size(pb) - avio_tell(pb)) / 14 < n_pkts) {
+            av_log(s, AV_LOG_ERROR,
+                   "Nr. of packets in packet index for stream index %d "
+                   "exceeds filesize (%"PRId64" at %"PRId64" = %d)\n",
+                   str_id, avio_size(pb), avio_tell(pb),
+                   (avio_size(pb) - avio_tell(pb)) / 14);
+            goto skip;
+        }
 
         for (n = 0; n < n_pkts; n++) {
             avio_skip(pb, 2);
@@ -383,9 +395,12 @@ static int rm_read_index(AVFormatContext *s)
         }
 
 skip:
-        if (next_off && avio_tell(pb) != next_off &&
-            avio_seek(pb, next_off, SEEK_SET) < 0)
+        if (next_off && avio_tell(pb) < next_off &&
+            avio_seek(pb, next_off, SEEK_SET) < 0) {
+            av_log(s, AV_LOG_ERROR,
+                   "Non-linear index detected, not supported\n");
             return -1;
+        }
     } while (next_off);
 
     return 0;