Merge commit 'd785f6940144eb6ce4c24309ed034056b81395bc' into release/0.8

* commit 'd785f6940144eb6ce4c24309ed034056b81395bc':
  shorten: validate that the channel count in the header is not <= 0
  matroskadec: request a read buffer for the wav header
  h264: check for luma and chroma bit depth being equal
  xxan: fix invalid memory access in xan_decode_frame_type0()
  wmadec: require block_align to be set.

Merged-by: Michael Niedermayer <michaelni@gmx.at>

5 files changed, 14 insertions, 3 deletions

diff --git a/libavcodec/h264.c b/libavcodec/h264.c
index 97b46fdcd7..3cbde55c4b 100644
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -3880,6 +3880,12 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){
             if(avctx->has_b_frames < 2)
                 avctx->has_b_frames= !s->low_delay;
 
+            if (h->sps.bit_depth_luma != h->sps.bit_depth_chroma) {
+                av_log_missing_feature(s->avctx,
+                    "Different bit depth between chroma and luma", 1);
+                return AVERROR_PATCHWELCOME;
+            }
+
             if (avctx->bits_per_raw_sample != h->sps.bit_depth_luma) {
                 if (h->sps.bit_depth_luma >= 8 && h->sps.bit_depth_luma <= 10) {
                     avctx->bits_per_raw_sample = h->sps.bit_depth_luma;
diff --git a/libavcodec/shorten.c b/libavcodec/shorten.c
index 50332aaf68..e8b4cb9d95 100644
--- a/libavcodec/shorten.c
+++ b/libavcodec/shorten.c
@@ -342,7 +342,7 @@ static int shorten_decode_frame(AVCodecContext *avctx,
         s->internal_ftype = get_uint(s, TYPESIZE);
 
         s->channels = get_uint(s, CHANSIZE);
-        if (s->channels > MAX_CHANNELS) {
+        if (s->channels <= 0 || s->channels > MAX_CHANNELS) {
             av_log(s->avctx, AV_LOG_ERROR, "too many channels: %d\n", s->channels);
             return -1;
         }
diff --git a/libavcodec/wmadec.c b/libavcodec/wmadec.c
index 11740203fb..16ef54e378 100644
--- a/libavcodec/wmadec.c
+++ b/libavcodec/wmadec.c
@@ -85,6 +85,11 @@ static int wma_decode_init(AVCodecContext * avctx)
     int i, flags2;
     uint8_t *extradata;
 
+    if (!avctx->block_align) {
+        av_log(avctx, AV_LOG_ERROR, "block_align is not set\n");
+        return AVERROR(EINVAL);
+    }
+
     s->avctx = avctx;
 
     /* extract flag infos */
diff --git a/libavcodec/xxan.c b/libavcodec/xxan.c
index c93ff43663..bc35c9542e 100644
--- a/libavcodec/xxan.c
+++ b/libavcodec/xxan.c
@@ -301,7 +301,7 @@ static int xan_decode_frame_type0(AVCodecContext *avctx, AVPacket *avpkt)
         corr_end = avpkt->size;
         if (chroma_off > corr_off)
             corr_end = chroma_off;
-        dec_size = xan_unpack(s->scratch_buffer, s->buffer_size,
+        dec_size = xan_unpack(s->scratch_buffer, s->buffer_size / 2,
                               avpkt->data + 8 + corr_off,
                               corr_end - corr_off);
         if (dec_size < 0)
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index ad505f28b4..4b95abe1e4 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -1402,7 +1402,7 @@ static int matroska_read_header(AVFormatContext *s, AVFormatParameters *ap)
                    && track->codec_priv.data != NULL) {
             int ret;
             ffio_init_context(&b, track->codec_priv.data, track->codec_priv.size,
-                          AVIO_FLAG_READ, NULL, NULL, NULL, NULL);
+                              0, NULL, NULL, NULL, NULL);
             ret = ff_get_wav_header(&b, st->codec, track->codec_priv.size);
             if (ret < 0)
                 return ret;