Merge remote-tracking branch 'qatar/master'

* qatar/master: (28 commits)
  dfa: use more meaningful return codes
  eatgv: check vector_bits
  eatgv: check motion vectors
  Mark a number of variables only used in av_dlog() calls as av_unused.
  dvdec: drop const qualifier from variable to eliminate a warning
  avcodec: Improve comment for thread_safe_callbacks to avoid misinterpretation.
  tests/utils: don't ignore the return value of fwrite()
  lavfi/formats: use sizeof(var) instead of sizeof(type).
  lavfi: remove avfilter_default_config_input_link() declaration
  lavfi: always enable the scale filter and depend on sws.
  vf_split: support user-specifiable number of outputs.
  avconv: remove stray useless comment.
  mpegmux: add stuffing to avoid incomplete PCM frames
  rtsp: avoid const warnings from strtol() call
  avserver: check return value of ftruncate()
  lagarith: make offset array type unsigned
  dfa: add some checks to ensure that decoder won't write past frame end
  aacps: NEON optimisations
  aacps: align some arrays
  aacps: move some loops to function pointers
  ...

Conflicts:
	configure
	doc/filters.texi
	libavcodec/dfa.c
	libavcodec/eatgv.c
	libavfilter/Makefile
	libavfilter/allfilters.c
	libavfilter/avfilter.h
	libavfilter/formats.c
	libavfilter/vf_split.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 11 insertions, 8 deletions

diff --git a/libavcodec/eatgv.c b/libavcodec/eatgv.c
index 01d0489c4c..3b19d703f9 100644
--- a/libavcodec/eatgv.c
+++ b/libavcodec/eatgv.c
@@ -138,7 +138,6 @@ static int unpack(const uint8_t *src, const uint8_t *src_end, unsigned char *dst
  * @return 0 on success, -1 on critical buffer underflow
  */
 static int tgv_decode_inter(TgvContext * s, const uint8_t *buf, const uint8_t *buf_end){
-    unsigned last_frame_size = s->avctx->height*s->last_frame.linesize[0];
     int num_mvs;
     int num_blocks_raw;
     int num_blocks_packed;
@@ -158,7 +157,8 @@ static int tgv_decode_inter(TgvContext * s, const uint8_t *buf, const uint8_t *b
     buf += 12;
 
     if (vector_bits > MIN_CACHE_BITS || !vector_bits) {
-        av_log(s->avctx, AV_LOG_ERROR, "vector_bits %d invalid\n", vector_bits);
+        av_log(s->avctx, AV_LOG_ERROR,
+               "Invalid value for motion vector bits: %d\n", vector_bits);
         return AVERROR_INVALIDDATA;
     }
 
@@ -212,14 +212,17 @@ static int tgv_decode_inter(TgvContext * s, const uint8_t *buf, const uint8_t *b
         int src_stride;
 
         if (vector < num_mvs) {
-            unsigned offset =
-                (y*4 + s->mv_codebook[vector][1])*s->last_frame.linesize[0] +
-                 x*4 + s->mv_codebook[vector][0];
+            int mx = x * 4 + s->mv_codebook[vector][0];
+            int my = y * 4 + s->mv_codebook[vector][1];
 
-            src_stride = s->last_frame.linesize[0];
-            if (offset >= last_frame_size - (3*src_stride+3))
+            if (   mx < 0 || mx + 4 > s->avctx->width
+                || my < 0 || my + 4 > s->avctx->height) {
+                av_log(s->avctx, AV_LOG_ERROR, "MV %d %d out of picture\n", mx, my);
                 continue;
-            src = s->last_frame.data[0] + offset;
+            }
+
+            src = s->last_frame.data[0] + mx + my * s->last_frame.linesize[0];
+            src_stride = s->last_frame.linesize[0];
         }else{
             int offset = vector - num_mvs;
             if (offset<num_blocks_raw)