Merge commit 'c8462bd17f35f435192281a2ea4ce8008a7398d3' into release/1.1

* commit 'c8462bd17f35f435192281a2ea4ce8008a7398d3':
  mp3dec: fallback to generic seeking when a TOC is not present
  svq1dec: clip motion vectors to the frame size.
  svq1dec: check that the reference frame has the same dimensions as the current one
  qdm2: check that the FFT size is a power of 2

Conflicts:
	libavcodec/svq1dec.c
	libavformat/mp3dec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

3 files changed, 27 insertions, 23 deletions

diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c
index f5ed707402..9a75ec5a46 100644
--- a/libavcodec/qdm2.c
+++ b/libavcodec/qdm2.c
@@ -1870,6 +1870,10 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx)
         av_log(avctx, AV_LOG_ERROR, "Unknown FFT order (%d), contact the developers!\n", s->fft_order);
         return -1;
     }
+    if (s->fft_size != (1 << (s->fft_order - 1))) {
+        av_log(avctx, AV_LOG_ERROR, "FFT size %d not power of 2.\n", s->fft_size);
+        return AVERROR_INVALIDDATA;
+    }
 
     ff_rdft_init(&s->rdft_ctx, s->fft_order, IDFT_C2R);
     ff_mpadsp_init(&s->mpadsp);
diff --git a/libavcodec/svq1dec.c b/libavcodec/svq1dec.c
index 187522c3bf..05da1b0aa9 100644
--- a/libavcodec/svq1dec.c
+++ b/libavcodec/svq1dec.c
@@ -321,7 +321,8 @@ static void svq1_skip_block(uint8_t *current, uint8_t *previous,
 
 static int svq1_motion_inter_block(DSPContext *dsp, GetBitContext *bitbuf,
                                    uint8_t *current, uint8_t *previous,
-                                   int pitch, svq1_pmv *motion, int x, int y)
+                                   int pitch, svq1_pmv *motion, int x, int y,
+                                   int width, int height)
 {
     uint8_t *src;
     uint8_t *dst;
@@ -350,10 +351,8 @@ static int svq1_motion_inter_block(DSPContext *dsp, GetBitContext *bitbuf,
     motion[x / 8 + 2].y =
     motion[x / 8 + 3].y = mv.y;
 
-    if (y + (mv.y >> 1) < 0)
-        mv.y = 0;
-    if (x + (mv.x >> 1) < 0)
-        mv.x = 0;
+    mv.x = av_clip(mv.x, -2 * x, 2 * (width  - x - 16));
+    mv.y = av_clip(mv.y, -2 * y, 2 * (height - y - 16));
 
     src = &previous[(x + (mv.x >> 1)) + (y + (mv.y >> 1)) * pitch];
     dst = current;
@@ -365,7 +364,8 @@ static int svq1_motion_inter_block(DSPContext *dsp, GetBitContext *bitbuf,
 
 static int svq1_motion_inter_4v_block(DSPContext *dsp, GetBitContext *bitbuf,
                                       uint8_t *current, uint8_t *previous,
-                                      int pitch, svq1_pmv *motion, int x, int y)
+                                      int pitch, svq1_pmv *motion, int x, int y,
+                                      int width, int height)
 {
     uint8_t *src;
     uint8_t *dst;
@@ -421,10 +421,8 @@ static int svq1_motion_inter_4v_block(DSPContext *dsp, GetBitContext *bitbuf,
         int mvy = pmv[i]->y + (i >> 1) * 16;
 
         // FIXME: clipping or padding?
-        if (y + (mvy >> 1) < 0)
-            mvy = 0;
-        if (x + (mvx >> 1) < 0)
-            mvx = 0;
+        mvx = av_clip(mvx, -2 * x, 2 * (width  - x - 8));
+        mvy = av_clip(mvy, -2 * y, 2 * (height - y - 8));
 
         src = &previous[(x + (mvx >> 1)) + (y + (mvy >> 1)) * pitch];
         dst = current;
@@ -444,7 +442,8 @@ static int svq1_motion_inter_4v_block(DSPContext *dsp, GetBitContext *bitbuf,
 static int svq1_decode_delta_block(AVCodecContext *avctx, DSPContext *dsp,
                                    GetBitContext *bitbuf,
                                    uint8_t *current, uint8_t *previous,
-                                   int pitch, svq1_pmv *motion, int x, int y)
+                                   int pitch, svq1_pmv *motion, int x, int y,
+                                   int width, int height)
 {
     uint32_t block_type;
     int result = 0;
@@ -469,7 +468,7 @@ static int svq1_decode_delta_block(AVCodecContext *avctx, DSPContext *dsp,
 
     case SVQ1_BLOCK_INTER:
         result = svq1_motion_inter_block(dsp, bitbuf, current, previous,
-                                         pitch, motion, x, y);
+                                         pitch, motion, x, y, width, height);
 
         if (result != 0) {
             av_dlog(avctx, "Error in svq1_motion_inter_block %i\n", result);
@@ -480,7 +479,7 @@ static int svq1_decode_delta_block(AVCodecContext *avctx, DSPContext *dsp,
 
     case SVQ1_BLOCK_INTER_4V:
         result = svq1_motion_inter_4v_block(dsp, bitbuf, current, previous,
-                                            pitch, motion, x, y);
+                                            pitch, motion, x, y, width, height);
 
         if (result != 0) {
             av_dlog(avctx, "Error in svq1_motion_inter_4v_block %i\n", result);
@@ -692,7 +691,8 @@ static int svq1_decode_frame(AVCodecContext *avctx, void *data,
         } else {
             /* delta frame */
             uint8_t *previous = s->prev->data[i];
-            if (!previous) {
+            if (!previous ||
+                s->prev->width != s->width || s->prev->height != s->height) {
                 av_log(avctx, AV_LOG_ERROR, "Missing reference frame.\n");
                 result = AVERROR_INVALIDDATA;
                 goto err;
@@ -705,8 +705,8 @@ static int svq1_decode_frame(AVCodecContext *avctx, void *data,
                     result = svq1_decode_delta_block(avctx, &s->dsp,
                                                      &s->gb, &current[x],
                                                      previous, linesize,
-                                                     pmv, x, y);
-                    if (result) {
+                                                     pmv, x, y, width, height);
+                    if (result != 0) {
                         av_dlog(avctx,
                                 "Error in svq1_decode_delta_block %i\n",
                                 result);
diff --git a/libavformat/mp3dec.c b/libavformat/mp3dec.c
index 57e4ba33b1..d599c9c489 100644
--- a/libavformat/mp3dec.c
+++ b/libavformat/mp3dec.c
@@ -40,7 +40,7 @@ typedef struct {
     int xing_toc;
     int start_pad;
     int end_pad;
-} MP3Context;
+} MP3DecContext;
 
 /* mp3 read */
 
@@ -89,7 +89,7 @@ static int mp3_read_probe(AVProbeData *p)
 static void read_xing_toc(AVFormatContext *s, int64_t filesize, int64_t duration)
 {
     int i;
-    MP3Context *mp3 = s->priv_data;
+    MP3DecContext *mp3 = s->priv_data;
 
     if (!filesize &&
         !(filesize = avio_size(s->pb))) {
@@ -113,7 +113,7 @@ static void read_xing_toc(AVFormatContext *s, int64_t filesize, int64_t duration
  */
 static int mp3_parse_vbr_tags(AVFormatContext *s, AVStream *st, int64_t base)
 {
-    MP3Context *mp3 = s->priv_data;
+    MP3DecContext *mp3 = s->priv_data;
     uint32_t v, spf;
     unsigned frames = 0; /* Total number of frames in file */
     unsigned size = 0; /* Total number of bytes in the stream */
@@ -190,7 +190,7 @@ static int mp3_parse_vbr_tags(AVFormatContext *s, AVStream *st, int64_t base)
 
 static int mp3_read_header(AVFormatContext *s)
 {
-    MP3Context *mp3 = s->priv_data;
+    MP3DecContext *mp3 = s->priv_data;
     AVStream *st;
     int64_t off;
 
@@ -226,7 +226,7 @@ static int mp3_read_header(AVFormatContext *s)
 
 static int mp3_read_packet(AVFormatContext *s, AVPacket *pkt)
 {
-    MP3Context *mp3 = s->priv_data;
+    MP3DecContext *mp3 = s->priv_data;
     int ret, size;
     int64_t pos;
 
@@ -273,7 +273,7 @@ static int check(AVFormatContext *s, int64_t pos)
 static int mp3_seek(AVFormatContext *s, int stream_index, int64_t timestamp,
                     int flags)
 {
-    MP3Context *mp3 = s->priv_data;
+    MP3DecContext *mp3 = s->priv_data;
     AVIndexEntry *ie;
     AVStream *st = s->streams[0];
     int64_t ret  = av_index_search_timestamp(st, timestamp, flags);
@@ -319,11 +319,11 @@ static int mp3_seek(AVFormatContext *s, int stream_index, int64_t timestamp,
 AVInputFormat ff_mp3_demuxer = {
     .name           = "mp3",
     .long_name      = NULL_IF_CONFIG_SMALL("MP2/3 (MPEG audio layer 2/3)"),
-    .priv_data_size = sizeof(MP3Context),
     .read_probe     = mp3_read_probe,
     .read_header    = mp3_read_header,
     .read_packet    = mp3_read_packet,
     .read_seek      = mp3_seek,
+    .priv_data_size = sizeof(MP3DecContext),
     .flags          = AVFMT_GENERIC_INDEX,
     .extensions     = "mp2,mp3,m2a", /* XXX: use probe */
 };