Merge remote-tracking branch 'qatar/master'

* qatar/master:
  docs: use -bsf:[vas] instead of -[vas]bsf.
  mpegaudiodec: Prevent premature clipping of mp3 input buffer.
  lavf: move the packet keyframe setting code.
  oggenc: free comment header for all codecs
  lcl: error out if uncompressed input buffer is smaller than framesize.
  mjpeg: abort decoding if packet is too large.
  golomb: use HAVE_BITS_REMAINING() macro to prevent infloop on EOF.
  get_bits: add HAVE_BITS_REMAINING macro.
  lavf/output-example: use new audio encoding API correctly.
  lavf/output-example: more proper usage of the new API.
  tiff: Prevent overreads in the type_sizes array.
  tiff: Make the TIFF_LONG and TIFF_SHORT types unsigned.
  apetag: do not leak memory if avio_read() fails
  apetag: propagate errors.
  SBR DSP x86: implement SSE sbr_hf_g_filt
  SBR DSP x86: implement SSE sbr_sum_square_sse
  SBR DSP: use intptr_t for the ixh parameter.

Conflicts:
	doc/bitstream_filters.texi
	doc/examples/muxing.c
	doc/ffmpeg.texi
	libavcodec/golomb.h
	libavcodec/x86/Makefile
	libavformat/oggenc.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 22 insertions, 1 deletions

diff --git a/libavcodec/lcldec.c b/libavcodec/lcldec.c
index 901d9421f4..88567f6a98 100644
--- a/libavcodec/lcldec.c
+++ b/libavcodec/lcldec.c
@@ -229,8 +229,29 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac
                 len = mszh_dlen;
             }
             break;
-        case COMP_MSZH_NOCOMP:
+        case COMP_MSZH_NOCOMP: {
+            int bppx2;
+            switch (c->imgtype) {
+            case IMGTYPE_YUV111:
+            case IMGTYPE_RGB24:
+                bppx2 = 6;
+                break;
+            case IMGTYPE_YUV422:
+            case IMGTYPE_YUV211:
+                bppx2 = 4;
+                break;
+            case IMGTYPE_YUV411:
+            case IMGTYPE_YUV420:
+                bppx2 = 3;
+                break;
+            default:
+                bppx2 = 0; // will error out below
+                break;
+            }
+            if (len < ((width * height * bppx2) >> 1))
+                return AVERROR_INVALIDDATA;
             break;
+        }
         default:
             av_log(avctx, AV_LOG_ERROR, "BUG! Unknown MSZH compression in frame decoder.\n");
             return -1;