Merge commit '36017d49e2f797f7371dc24848a2285ca63e39ab' into release/0.10

* commit '36017d49e2f797f7371dc24848a2285ca63e39ab':
  Prepare for 0.8.11 Release
  lavf: make av_probe_input_buffer more robust
  Updated Changelog for 0.8.10
  oggparseogm: check timing variables
  mathematics: remove asserts from av_rescale_rnd()
  vc1: Always reset numref when parsing a new frame header.
  h264: reset num_reorder_frames if it is invalid

Conflicts:
	RELEASE
	libavcodec/vc1.c
	libavformat/utils.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

5 files changed, 13 insertions, 8 deletions

diff --git a/libavcodec/h264_ps.c b/libavcodec/h264_ps.c
index 8c9b5167be..c703b2836e 100644
--- a/libavcodec/h264_ps.c
+++ b/libavcodec/h264_ps.c
@@ -250,7 +250,9 @@ static inline int decode_vui_parameters(H264Context *h, SPS *sps){
         }
 
         if(sps->num_reorder_frames > 16U /*max_dec_frame_buffering || max_dec_frame_buffering > 16*/){
-            av_log(h->s.avctx, AV_LOG_ERROR, "illegal num_reorder_frames %d\n", sps->num_reorder_frames);
+            av_log(h->s.avctx, AV_LOG_ERROR, "Clipping illegal num_reorder_frames %d\n",
+                   sps->num_reorder_frames);
+            sps->num_reorder_frames = 16;
             return -1;
         }
     }
diff --git a/libavcodec/vc1.c b/libavcodec/vc1.c
index 81b0218b26..daf6325c0c 100644
--- a/libavcodec/vc1.c
+++ b/libavcodec/vc1.c
@@ -824,7 +824,7 @@ int vc1_parse_frame_header_adv(VC1Context *v, GetBitContext* gb)
     int mbmodetab, imvtab, icbptab, twomvbptab, fourmvbptab; /* useful only for debugging */
     int scale, shift, i; /* for initializing LUT for intensity compensation */
 
-    v->numref=0;
+    v->numref          = 0;
     v->p_frame_skipped = 0;
     if (v->second_field) {
         if(v->fcm!=2 || v->field_mode!=1)
diff --git a/libavformat/oggparseogm.c b/libavformat/oggparseogm.c
index c761bbd7db..b74537c689 100644
--- a/libavformat/oggparseogm.c
+++ b/libavformat/oggparseogm.c
@@ -75,6 +75,11 @@ ogm_header(AVFormatContext *s, int idx)
 
         time_unit   = bytestream2_get_le64(&p);
         spu         = bytestream2_get_le64(&p);
+        if (!time_unit || !spu) {
+            av_log(s, AV_LOG_ERROR, "Invalid timing values.\n");
+            return AVERROR_INVALIDDATA;
+        }
+
         bytestream2_skip(&p, 4);    /* default_len */
         bytestream2_skip(&p, 8);    /* buffersize + bits_per_sample */
 
diff --git a/libavformat/utils.c b/libavformat/utils.c
index 7e0476ca5f..48fe249b14 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -558,7 +558,6 @@ int av_probe_input_buffer(AVIOContext *pb, AVInputFormat **fmt,
     for(probe_size= PROBE_BUF_MIN; probe_size<=max_probe_size && !*fmt;
         probe_size = FFMIN(probe_size<<1, FFMAX(max_probe_size, probe_size+1))) {
         int score = probe_size < max_probe_size ? AVPROBE_SCORE_MAX/4 : 0;
-        int buf_offset = (probe_size == PROBE_BUF_MIN) ? 0 : probe_size>>1;
         void *buftmp;
 
         if (probe_size < offset) {
@@ -572,7 +571,7 @@ int av_probe_input_buffer(AVIOContext *pb, AVInputFormat **fmt,
             return AVERROR(ENOMEM);
         }
         buf=buftmp;
-        if ((ret = avio_read(pb, buf + buf_offset, probe_size - buf_offset)) < 0) {
+        if ((ret = avio_read(pb, buf + pd.buf_size, probe_size - pd.buf_size)) < 0) {
             /* fail if error was not end of file, otherwise, lower score */
             if (ret != AVERROR_EOF) {
                 av_free(buf);
diff --git a/libavutil/mathematics.c b/libavutil/mathematics.c
index 180f72e3f0..2fe4a7c36b 100644
--- a/libavutil/mathematics.c
+++ b/libavutil/mathematics.c
@@ -23,7 +23,6 @@
  * miscellaneous math routines and tables
  */
 
-#include <assert.h>
 #include <stdint.h>
 #include <limits.h>
 #include "mathematics.h"
@@ -77,9 +76,9 @@ int64_t av_gcd(int64_t a, int64_t b){
 
 int64_t av_rescale_rnd(int64_t a, int64_t b, int64_t c, enum AVRounding rnd){
     int64_t r=0;
-    assert(c > 0);
-    assert(b >=0);
-    assert((unsigned)rnd<=5 && rnd!=4);
+
+    if (c <= 0 || b < 0 || rnd == 4 || rnd > 5)
+        return INT64_MIN;
 
     if(a<0 && a != INT64_MIN) return -av_rescale_rnd(-a, b, c, rnd ^ ((rnd>>1)&1));