Merge remote-tracking branch 'qatar/release/9' into release/1.1

* qatar/release/9:
  update Changelog
  af_asyncts: fix offset calculation
  oma: properly forward errors in oma_read_packet
  indeo3: use unaligned reads on reference blocks.

Conflicts:
	Changelog

Merged-by: Michael Niedermayer <michaelni@gmx.at>

4 files changed, 44 insertions, 26 deletions

diff --git a/Changelog b/Changelog
index ecb2560ef8..6442a89148 100644
--- a/Changelog
+++ b/Changelog
@@ -2,6 +2,17 @@ Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.
 
 version <next>:
+- aac: check the maximum number of channels to avoid invalid writes
+- indeo3: fix off by one in MV validity check
+- id3v2: check for end of file while unescaping tags to avoid invalid
+  writes, reported by Google Security Team
+- afifo: fix request_samples on the last frame in certain cases
+- hls, segment: fix splitting for audio-only streams
+- wav: Always seek to an even offset, Bug #500, LP: #1174737
+- swscale: Use alpha from the right row in yuva2rgba_c, Bug #504
+- indeo3: use unaligned reads on reference blocks, Bug #503
+- oma: properly forward errors in oma_read_packet
+- af_asyncts: fix offset calculation
 
 Most of the following fixes resulted from test samples that the Google
 Security Team has kindly made available to us:
diff --git a/libavcodec/indeo3.c b/libavcodec/indeo3.c
index 88cf9fec2f..9a93f5726f 100644
--- a/libavcodec/indeo3.c
+++ b/libavcodec/indeo3.c
@@ -283,10 +283,10 @@ static int copy_cell(Indeo3DecodeContext *ctx, Plane *plane, Cell *cell)
 
 /* Average 4/8 pixels at once without rounding using SWAR */
 #define AVG_32(dst, src, ref) \
-    AV_WN32A(dst, ((AV_RN32A(src) + AV_RN32A(ref)) >> 1) & 0x7F7F7F7FUL)
+    AV_WN32A(dst, ((AV_RN32(src) + AV_RN32(ref)) >> 1) & 0x7F7F7F7FUL)
 
 #define AVG_64(dst, src, ref) \
-    AV_WN64A(dst, ((AV_RN64A(src) + AV_RN64A(ref)) >> 1) & 0x7F7F7F7F7F7F7F7FULL)
+    AV_WN64A(dst, ((AV_RN64(src) + AV_RN64(ref)) >> 1) & 0x7F7F7F7F7F7F7F7FULL)
 
 
 /*
@@ -345,7 +345,7 @@ if (*data_ptr >= last_ptr) \
         copy_block4(dst, ref, row_offset, row_offset, 4 << v_zoom)
 
 #define RLE_BLOCK_COPY_8 \
-    pix64 = AV_RN64A(ref);\
+    pix64 = AV_RN64(ref);\
     if (is_first_row) {/* special prediction case: top line of a cell */\
         pix64 = replicate64(pix64);\
         fill_64(dst + row_offset, pix64, 7, row_offset);\
@@ -357,7 +357,7 @@ if (*data_ptr >= last_ptr) \
     copy_block4(dst, ref, row_offset, row_offset, num_lines << v_zoom)
 
 #define RLE_LINES_COPY_M10 \
-    pix64 = AV_RN64A(ref);\
+    pix64 = AV_RN64(ref);\
     if (is_top_of_cell) {\
         pix64 = replicate64(pix64);\
         fill_64(dst + row_offset, pix64, (num_lines << 1) - 1, row_offset);\
@@ -367,12 +367,12 @@ if (*data_ptr >= last_ptr) \
 
 #define APPLY_DELTA_4 \
     AV_WN16A(dst + line_offset    ,\
-             (AV_RN16A(ref    ) + delta_tab->deltas[dyad1]) & 0x7F7F);\
+             (AV_RN16(ref    ) + delta_tab->deltas[dyad1]) & 0x7F7F);\
     AV_WN16A(dst + line_offset + 2,\
-             (AV_RN16A(ref + 2) + delta_tab->deltas[dyad2]) & 0x7F7F);\
+             (AV_RN16(ref + 2) + delta_tab->deltas[dyad2]) & 0x7F7F);\
     if (mode >= 3) {\
         if (is_top_of_cell && !cell->ypos) {\
-            AV_COPY32(dst, dst + row_offset);\
+            AV_COPY32U(dst, dst + row_offset);\
         } else {\
             AVG_32(dst, ref, dst + row_offset);\
         }\
@@ -382,20 +382,20 @@ if (*data_ptr >= last_ptr) \
     /* apply two 32-bit VQ deltas to next even line */\
     if (is_top_of_cell) { \
         AV_WN32A(dst + row_offset    , \
-                 (replicate32(AV_RN32A(ref    )) + delta_tab->deltas_m10[dyad1]) & 0x7F7F7F7F);\
+                 (replicate32(AV_RN32(ref    )) + delta_tab->deltas_m10[dyad1]) & 0x7F7F7F7F);\
         AV_WN32A(dst + row_offset + 4, \
-                 (replicate32(AV_RN32A(ref + 4)) + delta_tab->deltas_m10[dyad2]) & 0x7F7F7F7F);\
+                 (replicate32(AV_RN32(ref + 4)) + delta_tab->deltas_m10[dyad2]) & 0x7F7F7F7F);\
     } else { \
         AV_WN32A(dst + row_offset    , \
-                 (AV_RN32A(ref    ) + delta_tab->deltas_m10[dyad1]) & 0x7F7F7F7F);\
+                 (AV_RN32(ref    ) + delta_tab->deltas_m10[dyad1]) & 0x7F7F7F7F);\
         AV_WN32A(dst + row_offset + 4, \
-                 (AV_RN32A(ref + 4) + delta_tab->deltas_m10[dyad2]) & 0x7F7F7F7F);\
+                 (AV_RN32(ref + 4) + delta_tab->deltas_m10[dyad2]) & 0x7F7F7F7F);\
     } \
     /* odd lines are not coded but rather interpolated/replicated */\
     /* first line of the cell on the top of image? - replicate */\
     /* otherwise - interpolate */\
     if (is_top_of_cell && !cell->ypos) {\
-        AV_COPY64(dst, dst + row_offset);\
+        AV_COPY64U(dst, dst + row_offset);\
     } else \
         AVG_64(dst, ref, dst + row_offset);
 
@@ -403,22 +403,22 @@ if (*data_ptr >= last_ptr) \
 #define APPLY_DELTA_1011_INTER \
     if (mode == 10) { \
         AV_WN32A(dst                 , \
-                 (AV_RN32A(dst                 ) + delta_tab->deltas_m10[dyad1]) & 0x7F7F7F7F);\
+                 (AV_RN32(dst                 ) + delta_tab->deltas_m10[dyad1]) & 0x7F7F7F7F);\
         AV_WN32A(dst + 4             , \
-                 (AV_RN32A(dst + 4             ) + delta_tab->deltas_m10[dyad2]) & 0x7F7F7F7F);\
+                 (AV_RN32(dst + 4             ) + delta_tab->deltas_m10[dyad2]) & 0x7F7F7F7F);\
         AV_WN32A(dst + row_offset    , \
-                 (AV_RN32A(dst + row_offset    ) + delta_tab->deltas_m10[dyad1]) & 0x7F7F7F7F);\
+                 (AV_RN32(dst + row_offset    ) + delta_tab->deltas_m10[dyad1]) & 0x7F7F7F7F);\
         AV_WN32A(dst + row_offset + 4, \
-                 (AV_RN32A(dst + row_offset + 4) + delta_tab->deltas_m10[dyad2]) & 0x7F7F7F7F);\
+                 (AV_RN32(dst + row_offset + 4) + delta_tab->deltas_m10[dyad2]) & 0x7F7F7F7F);\
     } else { \
         AV_WN16A(dst                 , \
-                 (AV_RN16A(dst                 ) + delta_tab->deltas[dyad1]) & 0x7F7F);\
+                 (AV_RN16(dst                 ) + delta_tab->deltas[dyad1]) & 0x7F7F);\
         AV_WN16A(dst + 2             , \
-                 (AV_RN16A(dst + 2             ) + delta_tab->deltas[dyad2]) & 0x7F7F);\
+                 (AV_RN16(dst + 2             ) + delta_tab->deltas[dyad2]) & 0x7F7F);\
         AV_WN16A(dst + row_offset    , \
-                 (AV_RN16A(dst + row_offset    ) + delta_tab->deltas[dyad1]) & 0x7F7F);\
+                 (AV_RN16(dst + row_offset    ) + delta_tab->deltas[dyad1]) & 0x7F7F);\
         AV_WN16A(dst + row_offset + 2, \
-                 (AV_RN16A(dst + row_offset + 2) + delta_tab->deltas[dyad2]) & 0x7F7F);\
+                 (AV_RN16(dst + row_offset + 2) + delta_tab->deltas[dyad2]) & 0x7F7F);\
     }
 
 
diff --git a/libavfilter/af_asyncts.c b/libavfilter/af_asyncts.c
index 500be0f73a..415beaa487 100644
--- a/libavfilter/af_asyncts.c
+++ b/libavfilter/af_asyncts.c
@@ -231,18 +231,23 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *buf)
         }
 
         if (s->first_frame && delta > 0) {
+            int planar = av_sample_fmt_is_planar(buf_out->format);
+            int planes = planar ?  nb_channels : 1;
+            int block_size = av_get_bytes_per_sample(buf_out->format) *
+                             (planar ? 1 : nb_channels);
+
             int ch;
 
             av_samples_set_silence(buf_out->extended_data, 0, delta,
                                    nb_channels, buf->format);
 
-            for (ch = 0; ch < nb_channels; ch++)
-                buf_out->extended_data[ch] += delta;
+            for (ch = 0; ch < planes; ch++)
+                buf_out->extended_data[ch] += delta * block_size;
 
             avresample_read(s->avr, buf_out->extended_data, out_size);
 
-            for (ch = 0; ch < nb_channels; ch++)
-                buf_out->extended_data[ch] -= delta;
+            for (ch = 0; ch < planes; ch++)
+                buf_out->extended_data[ch] -= delta * block_size;
         } else {
             avresample_read(s->avr, buf_out->extended_data, out_size);
 
diff --git a/libavformat/omadec.c b/libavformat/omadec.c
index 46d13ffbf1..39ac652811 100644
--- a/libavformat/omadec.c
+++ b/libavformat/omadec.c
@@ -386,8 +386,10 @@ static int oma_read_packet(AVFormatContext *s, AVPacket *pkt)
     int packet_size = s->streams[0]->codec->block_align;
     int ret = av_get_packet(s->pb, pkt, packet_size);
 
-    if (ret <= 0)
-        return AVERROR(EIO);
+    if (ret < 0)
+        return ret;
+    if (!ret)
+        return AVERROR_EOF;
 
     pkt->stream_index = 0;