Merge commit '0b6adcf76bda8994902f5b6d8e694b0b916ea210' into release/1.1

* commit '0b6adcf76bda8994902f5b6d8e694b0b916ea210':
  oma: refactor seek function
  xl: Make sure the width is valid
  8bps: Bound-check the input buffer
  4xm: Reject not a multiple of 16 dimension
  alsdec: Clean up error paths
  alsdec: Fix the clipping range
  dsicinav: Clip the source size to the expected maximum
  dsicinav: Bound-check the source buffer when needed
  dsicinav: K&R formatting cosmetics
  lavf: Make sure avg_frame_rate can be calculated without integer overflow
  mov: Do not allow updating the time scale after it has been set
  mov: Seek back if overreading an individual atom
  ac3dec: Don't consume more data than the actual input packet size
  indeo: Reject impossible FRAMETYPE_NULL
  indeo: Do not reference mismatched tiles

Conflicts:
	libavcodec/4xm.c
	libavcodec/8bps.c
	libavcodec/alsdec.c
	libavcodec/dsicinav.c
	libavcodec/ivi_common.c
	libavcodec/xl.c
	libavformat/mov.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 10 insertions, 0 deletions

diff --git a/libavcodec/ivi_common.c b/libavcodec/ivi_common.c
index ab35c59185..60bb9a2533 100644
--- a/libavcodec/ivi_common.c
+++ b/libavcodec/ivi_common.c
@@ -345,6 +345,8 @@ static int ivi_init_tiles(IVIBandDesc *band, IVITile *ref_tile,
 
             tile->ref_mbs = 0;
             if (p || b) {
+                if (tile->num_MBs != ref_tile->num_MBs)
+                    return AVERROR_INVALIDDATA;
                 tile->ref_mbs = ref_tile->mbs;
                 ref_tile++;
             }
@@ -984,6 +986,14 @@ int ff_ivi_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
             }
         }
         ctx->buf_invalid[ctx->dst_buf] = 0;
+    } else {
+        if (ctx->is_scalable)
+            return AVERROR_INVALIDDATA;
+
+        for (p = 0; p < 3; p++) {
+            if (!ctx->planes[p].bands[0].buf)
+                return AVERROR_INVALIDDATA;
+        }
     }
     if (ctx->buf_invalid[ctx->dst_buf])
         return -1;