Merge remote-tracking branch 'qatar/master'

* qatar/master: (34 commits)
  h264: reset h->ref_count in case of errors in ff_h264_decode_ref_pic_list_reordering()
  error_resilience: fix the check for missing references in ff_er_frame_end() for H264
  4xm: prevent NULL dereference with invalid huffman table
  4xmdemux: prevent use of uninitialized memory
  4xm: clear FF_INPUT_BUFFER_PADDING_SIZE bytes in temporary buffers
  ptx: check for out of bound reads
  tiffdec: fix out of bound reads/writes
  eacmv: check for out of bound reads
  eacmv: fix potential pointer arithmetic overflows
  adpcm: fix out of bound reads due to integer overflow
  anm: prevent infinite loop
  avsdemux: check for out of bound writes
  avs: check for out of bound reads
  avsdemux: check for corrupted data
  AVOptions: refactor set_number/write_number
  AVOptions: cosmetics, rename static av_set_number2() to write_number().
  AVOptions: cosmetics, move and rename static av_set_number().
  AVOptions: split av_set_string3 into opt type-specific functions
  avidec: fix signed overflow in avi_sync()
  mxfdec: Fix some buffer overreads caused by the misuse of AVPacket related functions.
  ...

Conflicts:
	Changelog
	configure
	libavcodec/ptx.c
	libavcodec/ra144.c
	libavcodec/vaapi_vc1.c
	libavcodec/vc1.c
	libavcodec/version.h
	libavformat/4xm.c
	libavformat/avidec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 16 insertions, 12 deletions

diff --git a/libavcodec/ra144dec.c b/libavcodec/ra144dec.c
index fffcf02de0..2e57e5054c 100644
--- a/libavcodec/ra144dec.c
+++ b/libavcodec/ra144dec.c
@@ -59,29 +59,33 @@ static int ra144_decode_frame(AVCodecContext * avctx, void *vdata,
 {
     const uint8_t *buf = avpkt->data;
     int buf_size = avpkt->size;
-    static const uint8_t sizes[10] = {6, 5, 5, 4, 4, 3, 3, 3, 3, 2};
-    unsigned int refl_rms[4];    // RMS of the reflection coefficients
-    uint16_t block_coefs[4][10]; // LPC coefficients of each sub-block
-    unsigned int lpc_refl[10];   // LPC reflection coefficients of the frame
+    static const uint8_t sizes[LPC_ORDER] = {6, 5, 5, 4, 4, 3, 3, 3, 3, 2};
+    unsigned int refl_rms[NBLOCKS];           // RMS of the reflection coefficients
+    uint16_t block_coefs[NBLOCKS][LPC_ORDER]; // LPC coefficients of each sub-block
+    unsigned int lpc_refl[LPC_ORDER];         // LPC reflection coefficients of the frame
     int i, j;
+    int out_size;
     int16_t *data = vdata;
     unsigned int energy;
 
     RA144Context *ractx = avctx->priv_data;
     GetBitContext gb;
 
-    if (*data_size < 2*160)
-        return -1;
+    out_size = NBLOCKS * BLOCKSIZE * av_get_bytes_per_sample(avctx->sample_fmt);
+    if (*data_size < out_size) {
+        av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\n");
+        return AVERROR(EINVAL);
+    }
 
-    if(buf_size < 20) {
+    if(buf_size < FRAMESIZE) {
         av_log(avctx, AV_LOG_ERROR,
                "Frame too small (%d bytes). Truncated file?\n", buf_size);
         *data_size = 0;
         return buf_size;
     }
-    init_get_bits(&gb, buf, 20 * 8);
+    init_get_bits(&gb, buf, FRAMESIZE * 8);
 
-    for (i=0; i<10; i++)
+    for (i = 0; i < LPC_ORDER; i++)
         lpc_refl[i] = ff_lpc_refl_cb[i][get_bits(&gb, sizes[i])];
 
     ff_eval_coefs(ractx->lpc_coef[0], lpc_refl);
@@ -98,7 +102,7 @@ static int ra144_decode_frame(AVCodecContext * avctx, void *vdata,
 
     ff_int_to_int16(block_coefs[3], ractx->lpc_coef[0]);
 
-    for (i=0; i < 4; i++) {
+    for (i=0; i < NBLOCKS; i++) {
         do_output_subblock(ractx, block_coefs[i], refl_rms[i], &gb);
 
         for (j=0; j < BLOCKSIZE; j++)
@@ -110,8 +114,8 @@ static int ra144_decode_frame(AVCodecContext * avctx, void *vdata,
 
     FFSWAP(unsigned int *, ractx->lpc_coef[0], ractx->lpc_coef[1]);
 
-    *data_size = 2*160;
-    return 20;
+    *data_size = out_size;
+    return FRAMESIZE;
 }
 
 AVCodec ff_ra_144_decoder = {