Merge commit '5e8243e843be8f71da7dde199a71d095726533eb' into release/0.10

* commit '5e8243e843be8f71da7dde199a71d095726533eb':
  bfi: Avoid divisions by zero
  electronicarts: Add more sanity checking for the number of channels
  riffdec: Add sanity checks for the sample rate
  mvi: Add sanity checking for the audio frame size
  xwma: Avoid division by zero
  avidec: Make sure a packet is large enough before reading its data
  vqf: Make sure the bitrate is in the valid range
  vqf: Make sure sample_rate is set to a valid value
  vc1dec: Undo mpegvideo initialization if unable to allocate tables

Conflicts:
	libavformat/riff.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

8 files changed, 46 insertions, 8 deletions

diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c
index dc97774f2b..4137b704d4 100644
--- a/libavcodec/vc1dec.c
+++ b/libavcodec/vc1dec.c
@@ -5486,8 +5486,12 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data,
     }
 
     if (!s->context_initialized) {
-        if (ff_msmpeg4_decode_init(avctx) < 0 || vc1_decode_init_alloc_tables(v) < 0)
+        if (ff_msmpeg4_decode_init(avctx) < 0)
             return -1;
+        if (vc1_decode_init_alloc_tables(v) < 0) {
+            MPV_common_end(s);
+            return -1;
+        }
 
         s->low_delay = !avctx->has_b_frames || v->res_sprite;
 
diff --git a/libavformat/avidec.c b/libavformat/avidec.c
index 6fd69236ce..1d4bcf7cbb 100644
--- a/libavformat/avidec.c
+++ b/libavformat/avidec.c
@@ -807,8 +807,10 @@ static int avi_read_header(AVFormatContext *s, AVFormatParameters *ap)
     return 0;
 }
 
-static int read_gab2_sub(AVStream *st, AVPacket *pkt) {
-    if (!strcmp(pkt->data, "GAB2") && AV_RL16(pkt->data+5) == 2) {
+static int read_gab2_sub(AVStream *st, AVPacket *pkt)
+{
+    if (pkt->size >= 7 &&
+        !strcmp(pkt->data, "GAB2") && AV_RL16(pkt->data + 5) == 2) {
         uint8_t desc[256];
         int score = AVPROBE_SCORE_MAX / 2, ret;
         AVIStream *ast = st->priv_data;
diff --git a/libavformat/bfi.c b/libavformat/bfi.c
index 3886d4bedd..35a6a51f04 100644
--- a/libavformat/bfi.c
+++ b/libavformat/bfi.c
@@ -138,9 +138,7 @@ static int bfi_read_packet(AVFormatContext * s, AVPacket * pkt)
 
         pkt->pts          = bfi->audio_frame;
         bfi->audio_frame += ret;
-    }
-
-    else {
+    } else if (bfi->video_size > 0) {
 
         //Tossing a video packet at the video decoder.
         ret = av_get_packet(pb, pkt, bfi->video_size);
@@ -152,6 +150,9 @@ static int bfi_read_packet(AVFormatContext * s, AVPacket * pkt)
 
         /* One less frame to read. A cursory decrement. */
         bfi->nframes--;
+    } else {
+        /* Empty video packet */
+        ret = AVERROR(EAGAIN);
     }
 
     bfi->avflag       = !bfi->avflag;
diff --git a/libavformat/electronicarts.c b/libavformat/electronicarts.c
index 19b72edc8e..859ad7c174 100644
--- a/libavformat/electronicarts.c
+++ b/libavformat/electronicarts.c
@@ -426,8 +426,9 @@ static int ea_read_header(AVFormatContext *s,
     }
 
     if (ea->audio_codec) {
-        if (ea->num_channels <= 0) {
-            av_log(s, AV_LOG_WARNING, "Unsupported number of channels: %d\n", ea->num_channels);
+        if (ea->num_channels <= 0 || ea->num_channels > 2) {
+            av_log(s, AV_LOG_WARNING,
+                   "Unsupported number of channels: %d\n", ea->num_channels);
             ea->audio_codec = 0;
             return 1;
         }
diff --git a/libavformat/mvi.c b/libavformat/mvi.c
index 70a9b66919..6dfb28ffdb 100644
--- a/libavformat/mvi.c
+++ b/libavformat/mvi.c
@@ -91,6 +91,12 @@ static int read_header(AVFormatContext *s, AVFormatParameters *ap)
     mvi->get_int = (vst->codec->width * vst->codec->height < (1 << 16)) ? avio_rl16 : avio_rl24;
 
     mvi->audio_frame_size   = ((uint64_t)mvi->audio_data_size << MVI_FRAC_BITS) / frames_count;
+    if (mvi->audio_frame_size <= 1 << MVI_FRAC_BITS - 1) {
+        av_log(s, AV_LOG_ERROR, "Invalid audio_data_size (%d) or frames_count (%d)\n",
+               mvi->audio_data_size, frames_count);
+        return AVERROR_INVALIDDATA;
+    }
+
     mvi->audio_size_counter = (ast->codec->sample_rate * 830 / mvi->audio_frame_size - 1) * mvi->audio_frame_size;
     mvi->audio_size_left    = mvi->audio_data_size;
 
diff --git a/libavformat/riff.c b/libavformat/riff.c
index 522c57b869..703e820333 100644
--- a/libavformat/riff.c
+++ b/libavformat/riff.c
@@ -600,6 +600,11 @@ int ff_get_wav_header(AVIOContext *pb, AVCodecContext *codec, int size)
         if (size > 0)
             avio_skip(pb, size);
     }
+    if (codec->sample_rate <= 0) {
+        av_log(NULL, AV_LOG_ERROR,
+               "Invalid sample rate: %d\n", codec->sample_rate);
+        return AVERROR_INVALIDDATA;
+    }
     if (codec->codec_id == CODEC_ID_AAC_LATM) {
         /* channels and sample_rate values are those prior to applying SBR and/or PS */
         codec->channels    = 0;
diff --git a/libavformat/vqf.c b/libavformat/vqf.c
index 1014b41e68..88caccacea 100644
--- a/libavformat/vqf.c
+++ b/libavformat/vqf.c
@@ -174,10 +174,21 @@ static int vqf_read_header(AVFormatContext *s, AVFormatParameters *ap)
         st->codec->sample_rate = 11025;
         break;
     default:
+        if (rate_flag < 8 || rate_flag > 44) {
+            av_log(s, AV_LOG_ERROR, "Invalid rate flag %d\n", rate_flag);
+            return AVERROR_INVALIDDATA;
+        }
         st->codec->sample_rate = rate_flag*1000;
         break;
     }
 
+    if (read_bitrate / st->codec->channels <  8 ||
+        read_bitrate / st->codec->channels > 48) {
+        av_log(s, AV_LOG_ERROR, "Invalid bitrate per channel %d\n",
+               read_bitrate / st->codec->channels);
+        return AVERROR_INVALIDDATA;
+    }
+
     switch (((st->codec->sample_rate/1000) << 8) +
             read_bitrate/st->codec->channels) {
     case (11<<8) + 8 :
diff --git a/libavformat/xwma.c b/libavformat/xwma.c
index 44de49a159..551099e8b3 100644
--- a/libavformat/xwma.c
+++ b/libavformat/xwma.c
@@ -200,6 +200,14 @@ static int xwma_read_header(AVFormatContext *s, AVFormatParameters *ap)
 
         /* Estimate the duration from the total number of output bytes. */
         const uint64_t total_decoded_bytes = dpds_table[dpds_table_size - 1];
+
+        if (!bytes_per_sample) {
+            av_log(s, AV_LOG_ERROR,
+                   "Invalid bits_per_coded_sample %d for %d channels\n",
+                   st->codec->bits_per_coded_sample, st->codec->channels);
+            return AVERROR_INVALIDDATA;
+        }
+
         st->duration = total_decoded_bytes / bytes_per_sample;
 
         /* Use the dpds data to build a seek table.  We can only do this after