Merge commit '42fed7f433e6d2167ffd4aae31905b583a53b988' into release/0.10

* commit '42fed7f433e6d2167ffd4aae31905b583a53b988':
  wavpack: check packet size early
  mjpegdec: validate parameters in mjpeg_decode_scan_progressive_ac
  mjpeg: Validate sampling factors
  ljpeg: use the correct number of components in yuv
  wavpack: validate samples size parsed in wavpack_decode_block
  jpegls: check the scan offset
  jpegls: factorize return paths
  jpegls: return meaningful errors
  mjpegdec: properly report unsupported disabled features
  update Changelog
  proresdec: support mixed interlaced/non-interlaced content
  update Changelog
  wav: Always seek to an even offset
  id3v2: check for end of file while unescaping tags
  indeo3: fix off by one in MV validity check
  aac: check the maximum number of channels
  update Changelog
  oggdec: fix faulty cleanup prototype

Conflicts:
	Changelog
	libavcodec/jpeglsdec.c
	libavcodec/mjpegdec.c
	libavformat/id3v2.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 22 insertions, 3 deletions

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index e4c9574118..dd437ebefd 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -276,6 +276,13 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
         s->quant_index[i] = get_bits(&s->gb, 8);
         if (s->quant_index[i] >= 4)
             return -1;
+        if (!s->h_count[i] || !s->v_count[i]) {
+            av_log(s->avctx, AV_LOG_ERROR,
+                   "Invalid sampling factor in component %d %d:%d\n",
+                   i, s->h_count[i], s->v_count[i]);
+            return AVERROR_INVALIDDATA;
+        }
+
         av_log(s->avctx, AV_LOG_DEBUG, "component %d %d:%d id: %d quant:%d\n",
                i, s->h_count[i], s->v_count[i],
                s->component_id[i], s->quant_index[i]);
@@ -783,10 +790,9 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int nb_components, int p
 }
 
 static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor,
-                                 int point_transform)
+                                 int point_transform, int nb_components)
 {
     int i, mb_x, mb_y;
-    const int nb_components=s->nb_components;
     int bits= (s->bits+7)&~7;
     int resync_mb_y = 0;
     int resync_mb_x = 0;
@@ -1085,6 +1091,12 @@ static int mjpeg_decode_scan_progressive_ac(MJpegDecodeContext *s, int ss,
     int last_scan = 0;
     int16_t *quant_matrix = s->quant_matrixes[s->quant_index[c]];
 
+
+    if (ss < 0  || ss >= 64 ||
+        se < ss || se >= 64 ||
+        Ah < 0  || Al < 0)
+        return AVERROR_INVALIDDATA;
+
     if (!Al) {
         s->coefs_finished[c] |= (1LL << (se + 1)) - (1LL << ss);
         last_scan = !~s->coefs_finished[c];
@@ -1226,7 +1238,8 @@ int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
                 if (ljpeg_decode_rgb_scan(s, nb_components, predictor, point_transform) < 0)
                     return -1;
             } else {
-                if (ljpeg_decode_yuv_scan(s, predictor, point_transform) < 0)
+                if (ljpeg_decode_yuv_scan(s, predictor, point_transform,
+                                          nb_components))
                     return -1;
             }
         }
@@ -1597,6 +1610,12 @@ int ff_mjpeg_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
             else if (start_code == COM)
                 mjpeg_decode_com(s);
 
+            if (!CONFIG_JPEGLS_DECODER &&
+                (start_code == SOF48 || start_code == LSE)) {
+                av_log(avctx, AV_LOG_ERROR, "JPEG-LS support not enabled.\n");
+                return AVERROR(ENOSYS);
+            }
+
             switch (start_code) {
             case SOI:
                 s->restart_interval = 0;