Merge commit '1b0082eabcc98e079d33c61da4d30ded89de68a9' into release/1.1

* commit '1b0082eabcc98e079d33c61da4d30ded89de68a9':
  flvdec: Don't read the VP6 header byte when setting codec type based on metadata
  vorbisdec: Accept 0 amplitude_bits
  vorbisdec: Error on bark_map_size equal to 0.
  vorbisdec: Add missing checks
  ac3dec: validate channel output mode against channel count

Conflicts:
	libavcodec/ac3dec.c
	libavformat/flvdec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

3 files changed, 32 insertions, 21 deletions

diff --git a/libavcodec/ac3dec.c b/libavcodec/ac3dec.c
index 567c797659..b98ffa9889 100644
--- a/libavcodec/ac3dec.c
+++ b/libavcodec/ac3dec.c
@@ -1336,8 +1336,10 @@ static int ac3_decode_frame(AVCodecContext * avctx, void *data,
     if (!err) {
         avctx->sample_rate = s->sample_rate;
         avctx->bit_rate    = s->bit_rate;
+    }
 
-        /* channel config */
+    /* channel config */
+    if (!err || (s->channels && s->out_channels != s->channels)) {
         s->out_channels = s->channels;
         s->output_mode  = s->channel_mode;
         if (s->lfe_on)
@@ -1360,22 +1362,18 @@ static int ac3_decode_frame(AVCodecContext * avctx, void *data,
                 s->fbw_channels == s->out_channels)) {
             set_downmix_coeffs(s);
         }
-    } else if (!s->out_channels) {
-        s->out_channels = avctx->channels;
-        if (s->out_channels < s->channels)
-            s->output_mode  = s->out_channels == 1 ? AC3_CHMODE_MONO : AC3_CHMODE_STEREO;
-    }
-    if (avctx->channels != s->out_channels) {
-        av_log(avctx, AV_LOG_ERROR, "channel number mismatching on damaged frame\n");
+    } else if (!s->channels) {
+        av_log(avctx, AV_LOG_ERROR, "unable to determine channel mode\n");
         return AVERROR_INVALIDDATA;
     }
+    avctx->channels = s->out_channels;
+
     /* set audio service type based on bitstream mode for AC-3 */
     avctx->audio_service_type = s->bitstream_mode;
     if (s->bitstream_mode == 0x7 && s->channels > 1)
         avctx->audio_service_type = AV_AUDIO_SERVICE_TYPE_KARAOKE;
 
     /* get output buffer */
-    avctx->channels = s->out_channels;
     s->frame.nb_samples = s->num_blocks * 256;
     if ((ret = ff_get_buffer(avctx, &s->frame)) < 0) {
         av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c
index 63a855b241..dd4a8bc810 100644
--- a/libavcodec/vorbisdec.c
+++ b/libavcodec/vorbisdec.c
@@ -591,16 +591,24 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context *vc)
             floor_setup->decode = vorbis_floor0_decode;
 
             floor_setup->data.t0.order          = get_bits(gb,  8);
+            if (!floor_setup->data.t0.order) {
+                av_log(vc->avccontext, AV_LOG_ERROR,
+                       "Floor 0 order is 0.\n");
+                return AVERROR_INVALIDDATA;
+            }
             floor_setup->data.t0.rate           = get_bits(gb, 16);
+            if (!floor_setup->data.t0.rate) {
+                av_log(vc->avccontext, AV_LOG_ERROR,
+                       "Floor 0 rate is 0.\n");
+                return AVERROR_INVALIDDATA;
+            }
             floor_setup->data.t0.bark_map_size  = get_bits(gb, 16);
-            floor_setup->data.t0.amplitude_bits = get_bits(gb,  6);
-            /* zero would result in a div by zero later *
-             * 2^0 - 1 == 0                             */
-            if (floor_setup->data.t0.amplitude_bits == 0) {
+            if (floor_setup->data.t0.bark_map_size == 0) {
                 av_log(vc->avccontext, AV_LOG_ERROR,
-                       "Floor 0 amplitude bits is 0.\n");
+                       "Floor 0 bark map size is 0.\n");
                 return AVERROR_INVALIDDATA;
             }
+            floor_setup->data.t0.amplitude_bits = get_bits(gb,  6);
             floor_setup->data.t0.amplitude_offset = get_bits(gb, 8);
             floor_setup->data.t0.num_books        = get_bits(gb, 4) + 1;
 
@@ -1054,6 +1062,9 @@ static int vorbis_floor0_decode(vorbis_context *vc,
     unsigned amplitude, book_idx;
     unsigned blockflag = vc->modes[vc->mode_number].blockflag;
 
+    if (!vf->amplitude_bits)
+        return 1;
+
     amplitude = get_bits(&vc->gb, vf->amplitude_bits);
     if (amplitude > 0) {
         float last = 0;
diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c
index b57929eda1..482e876d6e 100644
--- a/libavformat/flvdec.c
+++ b/libavformat/flvdec.c
@@ -199,7 +199,7 @@ static int flv_same_video_codec(AVCodecContext *vcodec, int flags)
     }
 }
 
-static int flv_set_video_codec(AVFormatContext *s, AVStream *vstream, int flv_codecid) {
+static int flv_set_video_codec(AVFormatContext *s, AVStream *vstream, int flv_codecid, int read) {
     AVCodecContext *vcodec = vstream->codec;
     switch(flv_codecid) {
         case FLV_CODECID_H263  : vcodec->codec_id = AV_CODEC_ID_FLV1   ; break;
@@ -210,11 +210,13 @@ static int flv_set_video_codec(AVFormatContext *s, AVStream *vstream, int flv_co
         case FLV_CODECID_VP6A  :
             if(flv_codecid == FLV_CODECID_VP6A)
                 vcodec->codec_id = AV_CODEC_ID_VP6A;
-            if(vcodec->extradata_size != 1) {
-                vcodec->extradata_size = 1;
-                vcodec->extradata = av_malloc(1 + FF_INPUT_BUFFER_PADDING_SIZE);
+            if (read) {
+                if (vcodec->extradata_size != 1) {
+                    vcodec->extradata_size = 1;
+                    vcodec->extradata = av_malloc(1 + FF_INPUT_BUFFER_PADDING_SIZE);
+                }
+                vcodec->extradata[0] = avio_r8(s->pb);
             }
-            vcodec->extradata[0] = avio_r8(s->pb);
             return 1; // 1 byte body size adjustment for flv_read_packet()
         case FLV_CODECID_H264:
             vcodec->codec_id = AV_CODEC_ID_H264;
@@ -406,7 +408,7 @@ static int amf_parse_object(AVFormatContext *s, AVStream *astream, AVStream *vst
                 st->codec->codec_id = AV_CODEC_ID_TEXT;
             } else if (flv->trust_metadata) {
                 if (!strcmp(key, "videocodecid") && vcodec) {
-                    flv_set_video_codec(s, vstream, num_val);
+                    flv_set_video_codec(s, vstream, num_val, 0);
                 } else
                 if (!strcmp(key, "audiocodecid") && acodec) {
                     flv_set_audio_codec(s, astream, acodec, num_val);
@@ -795,7 +797,7 @@ retry_duration:
             sample_rate = ctx.sample_rate;
         }
     } else if(stream_type == FLV_STREAM_TYPE_VIDEO) {
-        size -= flv_set_video_codec(s, st, flags & FLV_VIDEO_CODECID_MASK);
+        size -= flv_set_video_codec(s, st, flags & FLV_VIDEO_CODECID_MASK, 1);
     }
 
     if (st->codec->codec_id == AV_CODEC_ID_AAC ||