Merge remote-tracking branch 'qatar/master'

* qatar/master:
  Revert "v210enc: use FFALIGN()"
  doxygen: Do not include license boilerplates in Doxygen comment blocks.
  avplay: reset decoder flush state when seeking
  ape: skip packets with invalid size
  ape: calculate final packet size instead of guessing
  ape: stop reading after the last frame has been read
  ape: return AVERROR_EOF instead of AVERROR(EIO) when demuxing is finished
  ape: return error if seeking to the current packet fails in ape_read_packet()
  avcodec: Clarify AVFrame member documentation.
  v210dec: check for coded_frame allocation failure
  v210enc: use stride as it is already calculated
  v210enc: use FFALIGN()
  v210enc: return proper AVERROR codes instead of -1
  v210enc: do not set coded_frame->key_frame
  v210enc: check for coded_frame allocation failure
  drawtext: add 'fix_bounds' option on coords fixing
  drawtext: fix text_{w, h} expression vars
  drawtext: add missing braces around an if() block.

Conflicts:
	libavcodec/arm/vp8.h
	libavcodec/arm/vp8dsp_init_arm.c
	libavcodec/v210dec.c
	libavfilter/vf_drawtext.c
	libavformat/ape.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

4 files changed, 28 insertions, 10 deletions

diff --git a/libavformat/ape.c b/libavformat/ape.c
index d4d0ac9d57..549330d4aa 100644
--- a/libavformat/ape.c
+++ b/libavformat/ape.c
@@ -159,8 +159,8 @@ static int ape_read_header(AVFormatContext * s)
     AVStream *st;
     uint32_t tag;
     int i;
-    int total_blocks;
-    int64_t pts;
+    int total_blocks, final_size = 0;
+    int64_t pts, file_size;
 
     /* Skip any leading junk such as id3v2 tags */
     ape->junklength = avio_tell(pb);
@@ -289,8 +289,17 @@ static int ape_read_header(AVFormatContext * s)
         ape->frames[i - 1].size = ape->frames[i].pos - ape->frames[i - 1].pos;
         ape->frames[i].skip     = (ape->frames[i].pos - ape->frames[0].pos) & 3;
     }
-    ape->frames[ape->totalframes - 1].size    = ape->finalframeblocks * 4;
     ape->frames[ape->totalframes - 1].nblocks = ape->finalframeblocks;
+    /* calculate final packet size from total file size, if available */
+    file_size = avio_size(pb);
+    if (file_size > 0) {
+        final_size = file_size - ape->frames[ape->totalframes - 1].pos -
+                     ape->wavtaillength;
+        final_size -= final_size & 3;
+    }
+    if (file_size <= 0 || final_size <= 0)
+        final_size = ape->finalframeblocks * 8;
+    ape->frames[ape->totalframes - 1].size = final_size;
 
     for (i = 0; i < ape->totalframes; i++) {
         if(ape->frames[i].skip){
@@ -357,11 +366,12 @@ static int ape_read_packet(AVFormatContext * s, AVPacket * pkt)
     uint32_t extra_size = 8;
 
     if (url_feof(s->pb))
-        return AVERROR(EIO);
-    if (ape->currentframe > ape->totalframes)
-        return AVERROR(EIO);
+        return AVERROR_EOF;
+    if (ape->currentframe >= ape->totalframes)
+        return AVERROR_EOF;
 
-    avio_seek (s->pb, ape->frames[ape->currentframe].pos, SEEK_SET);
+    if (avio_seek(s->pb, ape->frames[ape->currentframe].pos, SEEK_SET) < 0)
+        return AVERROR(EIO);
 
     /* Calculate how many blocks there are in this frame */
     if (ape->currentframe == (ape->totalframes - 1))
@@ -369,6 +379,14 @@ static int ape_read_packet(AVFormatContext * s, AVPacket * pkt)
     else
         nblocks = ape->blocksperframe;
 
+    if (ape->frames[ape->currentframe].size <= 0 ||
+        ape->frames[ape->currentframe].size > INT_MAX - extra_size) {
+        av_log(s, AV_LOG_ERROR, "invalid packet size: %d\n",
+               ape->frames[ape->currentframe].size);
+        ape->currentframe++;
+        return AVERROR(EIO);
+    }
+
     if (av_new_packet(pkt,  ape->frames[ape->currentframe].size + extra_size) < 0)
         return AVERROR(ENOMEM);
 
diff --git a/libavformat/rtpdec_latm.c b/libavformat/rtpdec_latm.c
index f08415dde7..a642b5a079 100644
--- a/libavformat/rtpdec_latm.c
+++ b/libavformat/rtpdec_latm.c
@@ -1,4 +1,4 @@
-/**
+/*
  * RTP Depacketization of MP4A-LATM, RFC 3016
  * Copyright (c) 2010 Martin Storsjo
  *
diff --git a/libavformat/rtpdec_mpeg4.c b/libavformat/rtpdec_mpeg4.c
index f6547bc70e..9b388782b3 100644
--- a/libavformat/rtpdec_mpeg4.c
+++ b/libavformat/rtpdec_mpeg4.c
@@ -1,4 +1,4 @@
-/**
+/*
  * Common code for the RTP depacketization of MPEG-4 formats.
  * Copyright (c) 2010 Fabrice Bellard
  *                    Romain Degez
diff --git a/libavformat/rtpdec_qcelp.c b/libavformat/rtpdec_qcelp.c
index 5eb6770297..d6ef4fce02 100644
--- a/libavformat/rtpdec_qcelp.c
+++ b/libavformat/rtpdec_qcelp.c
@@ -1,4 +1,4 @@
-/**
+/*
  * RTP Depacketization of QCELP/PureVoice, RFC 2658
  * Copyright (c) 2010 Martin Storsjo
  *