Merge branch 'release/0.8' into release/0.7

* release/0.8: (96 commits)
  Version numbers for 0.8.6
  snow: emu edge support Fixes Ticket592
  imc: validate channel count
  imc: check for ff_fft_init() failure (cherry picked from commit 95fee70d6773fde1c34ff6422f48e5e66f37f263)
  libgsmdec: check output buffer size before decoding (cherry picked from commit b03761b1309293bbf30edef767503875277b01cf)
  configure: fix arch x86_32
  mp3enc: avoid truncating id3v1 tags by one byte
  asfdec: Check packet_replic_size earlier
  cin audio: validate the channel count
  binkaudio: add some buffer overread checks.
  atrac1: validate number of channels (cherry picked from commit bff5b2c1ca1290ea30587ff2f76171f9e3854872)
  atrac1: check output buffer size before decoding (cherry picked from commit 33684b9c12b74c0140fb91e8150263db4a48d55e)
  vp3: fix oob read for negative tokens and memleaks on error. (cherry picked from commit 8370e426e42f2e4b9d14a1fb8107ecfe5163ce7f)
  apedec: set s->currentframeblocks after validating nblocks
  apedec: use unsigned int for 'nblocks' and make sure that it's within int range
  apedec: check for data buffer realloc failure (cherry picked from commit 11ca8b2d7486e879926488404b3b79af774f0f2d)
  apedec: check for filter buffer allocation failure (cherry picked from commit 7500781313d11b37772c05a28da20fbc112db478)
  mpegaudiodec: check output data size based on avctx->frame_size
  resample: Fix array size
  resample2: fix potential overflow
  ...

Conflicts:
	Doxyfile
	RELEASE
	VERSION

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 8 insertions, 2 deletions

diff --git a/libavcodec/qcelpdec.c b/libavcodec/qcelpdec.c
index e83704d801..61c812c85d 100644
--- a/libavcodec/qcelpdec.c
+++ b/libavcodec/qcelpdec.c
@@ -738,11 +738,17 @@ static int qcelp_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
     int buf_size = avpkt->size;
     QCELPContext *q = avctx->priv_data;
     float *outbuffer = data;
-    int   i;
+    int   i, out_size;
     float quantized_lspf[10], lpc[10];
     float gain[16];
     float *formant_mem;
 
+    out_size = 160 * av_get_bytes_per_sample(avctx->sample_fmt);
+    if (*data_size < out_size) {
+        av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\n");
+        return AVERROR(EINVAL);
+    }
+
     if((q->bitrate = determine_bitrate(avctx, buf_size, &buf)) == I_F_Q)
     {
         warn_insufficient_frame_quality(avctx, "bitrate cannot be determined.");
@@ -837,7 +843,7 @@ erasure:
     memcpy(q->prev_lspf, quantized_lspf, sizeof(q->prev_lspf));
     q->prev_bitrate = q->bitrate;
 
-    *data_size = 160 * sizeof(*outbuffer);
+    *data_size = out_size;
 
     return buf_size;
 }