Merge remote-tracking branch 'qatar/master'

* qatar/master:
  mov_chan: Pass a separate AVIOContext for reading
  af_asyncts: check return value from lavr when flushing.
  mss2: simplify loop in decode_rle()
  mss12: avoid unnecessary division in arith*_get_bit()
  mss2: do not try to read too many palette entries
  mpegvideo: set AVFrame fields to NULL after freeing the base memory
  configure: Set the right cc_e flags for msvc

Merged-by: Michael Niedermayer <michaelni@gmx.at>

11 files changed, 24 insertions, 14 deletions

diff --git a/configure b/configure
index a92b367665..36746854a5 100755
--- a/configure
+++ b/configure
@@ -2590,6 +2590,7 @@ probe_cc(){
             _ld_o='-Fe$@'
         fi
         _cc_o='-Fo $@'
+        _cc_e='-P -Fi $@'
         _flags_filter=msvc_flags
         _ld_lib='lib%.a'
         _ld_path='-libpath:'
diff --git a/libavcodec/mpegvideo.c b/libavcodec/mpegvideo.c
index 6fe2303c03..6b3d4e7b16 100644
--- a/libavcodec/mpegvideo.c
+++ b/libavcodec/mpegvideo.c
@@ -393,13 +393,16 @@ static void free_picture(MpegEncContext *s, Picture *pic)
     av_freep(&pic->mb_mean);
     av_freep(&pic->f.mbskip_table);
     av_freep(&pic->qscale_table_base);
+    pic->f.qscale_table = NULL;
     av_freep(&pic->mb_type_base);
+    pic->f.mb_type = NULL;
     av_freep(&pic->f.dct_coeff);
     av_freep(&pic->f.pan_scan);
     pic->f.mb_type = NULL;
     for (i = 0; i < 2; i++) {
         av_freep(&pic->motion_val_base[i]);
         av_freep(&pic->f.ref_index[i]);
+        pic->f.motion_val[i] = NULL;
     }
 
     if (pic->f.type == FF_BUFFER_TYPE_SHARED) {
diff --git a/libavcodec/mss12.h b/libavcodec/mss12.h
index ba80030ee3..42ceab568f 100644
--- a/libavcodec/mss12.h
+++ b/libavcodec/mss12.h
@@ -103,7 +103,7 @@ av_cold int ff_mss12_decode_end(MSS12Context *ctx);
 static int arith ## VERSION ## _get_bit(ArithCoder *c)                  \
 {                                                                       \
     int range = c->high - c->low + 1;                                   \
-    int bit   = (((c->value - c->low) << 1) + 1) / range;               \
+    int bit   = 2 * c->value - c->low >= c->high;                       \
                                                                         \
     if (bit)                                                            \
         c->low += range >> 1;                                           \
diff --git a/libavcodec/mss2.c b/libavcodec/mss2.c
index fc9ebff4d7..ceb0a45fe5 100644
--- a/libavcodec/mss2.c
+++ b/libavcodec/mss2.c
@@ -161,7 +161,7 @@ static int decode_pal_v2(MSS12Context *ctx, const uint8_t *buf, int buf_size)
         return 0;
 
     ncol = *buf++;
-    if (buf_size < 2 + ncol * 3)
+    if (ncol > ctx->free_colours || buf_size < 2 + ncol * 3)
         return -1;
     for (i = 0; i < ncol; i++)
         *pal++ = AV_RB24(buf + 3 * i);
@@ -335,8 +335,7 @@ static int decode_rle(GetBitContext *gb, uint8_t *pal_dst, int pal_stride,
                     else
                         repeat = get_bits(gb, b);
 
-                    while (b--)
-                        repeat += 1 << b;
+                    repeat += (1 << b) - 1;
 
                     if (last_symbol == -2) {
                         int skip = FFMIN(repeat, pal_dst + w - pp);
diff --git a/libavfilter/af_asyncts.c b/libavfilter/af_asyncts.c
index 0ecaf52ee8..18892d4826 100644
--- a/libavfilter/af_asyncts.c
+++ b/libavfilter/af_asyncts.c
@@ -127,8 +127,13 @@ static int request_frame(AVFilterLink *link)
                                                      nb_samples);
         if (!buf)
             return AVERROR(ENOMEM);
-        avresample_convert(s->avr, (void**)buf->extended_data, buf->linesize[0],
-                           nb_samples, NULL, 0, 0);
+        ret = avresample_convert(s->avr, (void**)buf->extended_data,
+                                 buf->linesize[0], nb_samples, NULL, 0, 0);
+        if (ret <= 0) {
+            avfilter_unref_bufferp(&buf);
+            return (ret < 0) ? ret : AVERROR_EOF;
+        }
+
         buf->pts = s->pts;
         return ff_filter_samples(link, buf);
     }
diff --git a/libavformat/aiffdec.c b/libavformat/aiffdec.c
index a4606a6336..41fe0d2994 100644
--- a/libavformat/aiffdec.c
+++ b/libavformat/aiffdec.c
@@ -278,7 +278,7 @@ static int aiff_read_header(AVFormatContext *s)
                 st->codec->block_align = AV_RB32(st->codec->extradata+11*4);
             break;
         case MKTAG('C','H','A','N'):
-            if(ff_mov_read_chan(s, st, size) < 0)
+            if(ff_mov_read_chan(s, pb, st, size) < 0)
                 return AVERROR_INVALIDDATA;
             break;
         default: /* Jump */
diff --git a/libavformat/cafdec.c b/libavformat/cafdec.c
index f1682b0d34..a576dac07e 100644
--- a/libavformat/cafdec.c
+++ b/libavformat/cafdec.c
@@ -268,7 +268,7 @@ static int read_header(AVFormatContext *s)
             break;
 
         case MKBETAG('c','h','a','n'):
-            if ((ret = ff_mov_read_chan(s, st, size)) < 0)
+            if ((ret = ff_mov_read_chan(s, s->pb, st, size)) < 0)
                 return ret;
             break;
 
diff --git a/libavformat/isom.h b/libavformat/isom.h
index f7d25375a1..6565bdcc17 100644
--- a/libavformat/isom.h
+++ b/libavformat/isom.h
@@ -197,7 +197,7 @@ int ff_mov_read_esds(AVFormatContext *fc, AVIOContext *pb, MOVAtom atom);
 enum AVCodecID ff_mov_get_lpcm_codec_id(int bps, int flags);
 
 int ff_mov_read_stsd_entries(MOVContext *c, AVIOContext *pb, int entries);
-int ff_mov_read_chan(AVFormatContext *s, AVStream *st, int64_t size);
+int ff_mov_read_chan(AVFormatContext *s, AVIOContext *pb, AVStream *st, int64_t size);
 void ff_mov_write_chan(AVIOContext *pb, int64_t channel_layout);
 
 #endif /* AVFORMAT_ISOM_H */
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 4108b870f6..078bd3f8ea 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -676,7 +676,7 @@ static int mov_read_chan(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     if (atom.size < 16)
         return 0;
 
-    ff_mov_read_chan(c->fc, st, atom.size - 4);
+    ff_mov_read_chan(c->fc, pb, st, atom.size - 4);
 
     return 0;
 }
@@ -2575,7 +2575,7 @@ static int mov_read_chan2(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     if (atom.size < 16)
         return 0;
     avio_skip(pb, 4);
-    ff_mov_read_chan(c->fc,c->fc->streams[0],  atom.size - 4);
+    ff_mov_read_chan(c->fc, pb, c->fc->streams[0],  atom.size - 4);
     return 0;
 }
 
diff --git a/libavformat/mov_chan.c b/libavformat/mov_chan.c
index 475a66ba82..074a32019a 100644
--- a/libavformat/mov_chan.c
+++ b/libavformat/mov_chan.c
@@ -543,9 +543,9 @@ uint32_t ff_mov_get_channel_layout_tag(enum AVCodecID codec_id,
     return tag;
 }
 
-int ff_mov_read_chan(AVFormatContext *s, AVStream *st, int64_t size)
+int ff_mov_read_chan(AVFormatContext *s, AVIOContext *pb, AVStream *st,
+                     int64_t size)
 {
-    AVIOContext *pb = s->pb;
     uint32_t layout_tag, bitmap, num_descr, label_mask;
     int i;
 
diff --git a/libavformat/mov_chan.h b/libavformat/mov_chan.h
index 3972aa6178..3fae93961e 100644
--- a/libavformat/mov_chan.h
+++ b/libavformat/mov_chan.h
@@ -57,10 +57,12 @@ uint32_t ff_mov_get_channel_layout_tag(enum AVCodecID codec_id,
  * Read 'chan' tag from the input stream.
  *
  * @param s     AVFormatContext
+ * @param pb    AVIOContext
  * @param st    The stream to set codec values for
  * @param size  Remaining size in the 'chan' tag
  * @return      0 if ok, or negative AVERROR code on failure
  */
-int ff_mov_read_chan(AVFormatContext *s, AVStream *st, int64_t size);
+int ff_mov_read_chan(AVFormatContext *s, AVIOContext *pb, AVStream *st,
+                     int64_t size);
 
 #endif /* AVFORMAT_MOV_CHAN_H */