Merge commit 'aade60ab165716523788cd11caf03ae61b40144a' into release/1.1

* commit 'aade60ab165716523788cd11caf03ae61b40144a':
  matroskadec: Check that .lang was allocated and set before reading it
  alac: Limit max_samples_per_frame
  ape demuxer: check for EOF in potentially long loops
  4xm: check that bits per sample is strictly positive
  lavf: avoid integer overflow when estimating bitrate
  pictordec: pass correct context to avpriv_request_sample

Conflicts:
	libavcodec/pictordec.c
	libavformat/matroskadec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

5 files changed, 15 insertions, 6 deletions

diff --git a/libavcodec/alac.c b/libavcodec/alac.c
index 180ef53105..68e4b75c91 100644
--- a/libavcodec/alac.c
+++ b/libavcodec/alac.c
@@ -546,7 +546,8 @@ static int alac_set_info(ALACContext *alac)
     bytestream2_skipu(&gb, 12); // size:4, alac:4, version:4
 
     alac->max_samples_per_frame = bytestream2_get_be32u(&gb);
-    if (!alac->max_samples_per_frame || alac->max_samples_per_frame > INT_MAX) {
+    if (!alac->max_samples_per_frame ||
+        alac->max_samples_per_frame > INT_MAX / sizeof(int32_t)) {
         av_log(alac->avctx, AV_LOG_ERROR, "max samples per frame invalid: %u\n",
                alac->max_samples_per_frame);
         return AVERROR_INVALIDDATA;
diff --git a/libavformat/4xm.c b/libavformat/4xm.c
index 9eb46e7d64..7f85bcadbd 100644
--- a/libavformat/4xm.c
+++ b/libavformat/4xm.c
@@ -151,7 +151,7 @@ static int parse_strk(AVFormatContext *s,
 
     if (fourxm->tracks[track].channels    <= 0 ||
         fourxm->tracks[track].sample_rate <= 0 ||
-        fourxm->tracks[track].bits        < 0) {
+        fourxm->tracks[track].bits        <= 0) {
         av_log(s, AV_LOG_ERROR, "audio header invalid\n");
         return AVERROR_INVALIDDATA;
     }
diff --git a/libavformat/ape.c b/libavformat/ape.c
index 551513d3d1..58f2418ce7 100644
--- a/libavformat/ape.c
+++ b/libavformat/ape.c
@@ -274,7 +274,9 @@ static int ape_read_header(AVFormatContext * s)
         ape->seektable = av_malloc(ape->seektablelength);
         if (!ape->seektable)
             return AVERROR(ENOMEM);
-        for (i = 0; i < ape->seektablelength / sizeof(uint32_t); i++)
+        for (i = 0;
+             i < ape->seektablelength / sizeof(uint32_t) && !pb->eof_reached;
+             i++)
             ape->seektable[i] = avio_rl32(pb);
     }else{
         av_log(s, AV_LOG_ERROR, "Missing seektable\n");
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 668011ce20..9b7038a926 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -1231,7 +1231,8 @@ static void matroska_convert_tag(AVFormatContext *s, EbmlList *list,
     int i;
 
     for (i=0; i < list->nb_elem; i++) {
-        const char *lang= (tags[i].lang && strcmp(tags[i].lang, "und")) ? tags[i].lang : NULL;
+        const char *lang = tags[i].lang && strcmp(tags[i].lang, "und") ?
+                           tags[i].lang : NULL;
 
         if (!tags[i].name) {
             av_log(s, AV_LOG_WARNING, "Skipping invalid tag with no TagName.\n");
diff --git a/libavformat/utils.c b/libavformat/utils.c
index 05b8feb277..5fff3e26fa 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -2261,8 +2261,13 @@ static void estimate_timings_from_bit_rate(AVFormatContext *ic)
         bit_rate = 0;
         for(i=0;i<ic->nb_streams;i++) {
             st = ic->streams[i];
-            if (st->codec->bit_rate > 0)
-            bit_rate += st->codec->bit_rate;
+            if (st->codec->bit_rate > 0) {
+                if (INT_MAX - st->codec->bit_rate > bit_rate) {
+                    bit_rate = 0;
+                    break;
+                }
+                bit_rate += st->codec->bit_rate;
+            }
         }
         ic->bit_rate = bit_rate;
     }