Merge remote-tracking branch 'qatar/master'

* qatar/master:
  xwma: Validate channels and bits_per_coded_sample.
  mov: Do not read past the end of the ctts_data table.
  mov: Add missing terminator to mov_ch_layout_map_1ch.
  asf: reset side data elements on packet copy.
  wmavoice: fix stack overread.
  wmalossless: error out if a subframe is not used by any channel.
  vqa: check palette chunk size before reading data.
  wmalossless: reset sample pointer for each subframe.
  wmalossless: error out on invalid values for order.

Conflicts:
	libavcodec/vqavideo.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

4 files changed, 15 insertions, 1 deletions

diff --git a/libavformat/asfdec.c b/libavformat/asfdec.c
index cdec63b481..2adb1780c4 100644
--- a/libavformat/asfdec.c
+++ b/libavformat/asfdec.c
@@ -1080,6 +1080,8 @@ static int ff_asf_parse_packet(AVFormatContext *s, AVIOContext *pb, AVPacket *pk
             //printf("packet %d %d\n", asf_st->pkt.size, asf->packet_frag_size);
             asf_st->pkt.size = 0;
             asf_st->pkt.data = 0;
+            asf_st->pkt.side_data_elems = 0;
+            asf_st->pkt.side_data = NULL;
             break; // packet completed
         }
     }
diff --git a/libavformat/mov.c b/libavformat/mov.c
index de290aa70c..2687a88816 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2874,7 +2874,7 @@ static int mov_read_packet(AVFormatContext *s, AVPacket *pkt)
 
     pkt->stream_index = sc->ffindex;
     pkt->dts = sample->timestamp;
-    if (sc->ctts_data) {
+    if (sc->ctts_data && sc->ctts_index < sc->ctts_count) {
         pkt->pts = pkt->dts + sc->dts_shift + sc->ctts_data[sc->ctts_index].duration;
         /* update ctts context */
         sc->ctts_sample++;
diff --git a/libavformat/mov_chan.c b/libavformat/mov_chan.c
index 5728ebd898..a0fbecc991 100644
--- a/libavformat/mov_chan.c
+++ b/libavformat/mov_chan.c
@@ -155,6 +155,7 @@ static const struct MovChannelLayoutMap mov_ch_layout_map_misc[] = {
 
 static const struct MovChannelLayoutMap mov_ch_layout_map_1ch[] = {
     { MOV_CH_LAYOUT_MONO,               AV_CH_LAYOUT_MONO }, // C
+    { 0, 0 },
 };
 
 static const struct MovChannelLayoutMap mov_ch_layout_map_2ch[] = {
diff --git a/libavformat/xwma.c b/libavformat/xwma.c
index ea7cc4f36e..bd3af35b72 100644
--- a/libavformat/xwma.c
+++ b/libavformat/xwma.c
@@ -115,6 +115,17 @@ static int xwma_read_header(AVFormatContext *s)
         }
     }
 
+    if (!st->codec->channels) {
+        av_log(s, AV_LOG_WARNING, "Invalid channel count: %d\n",
+               st->codec->channels);
+        return AVERROR_INVALIDDATA;
+    }
+    if (!st->codec->bits_per_coded_sample) {
+        av_log(s, AV_LOG_WARNING, "Invalid bits_per_coded_sample: %d\n",
+               st->codec->bits_per_coded_sample);
+        return AVERROR_INVALIDDATA;
+    }
+
     /* set the sample rate */
     avpriv_set_pts_info(st, 64, 1, st->codec->sample_rate);