Merge commit '159993acc7f4e3155510d42c543e09fe972b933c' into release/0.10

* commit '159993acc7f4e3155510d42c543e09fe972b933c':
  vc1dec: Fix leaks in ff_vc1_decode_init_alloc_tables on errors
  wnv1: Make sure the input packet is large enough
  dca: Validate the lfe parameter
  rl2: Avoid a division by zero
  wtv: Add more sanity checks for a length read from the file
  segafilm: Validate the number of audio channels
  qpeg: Add checks for running out of rows in qpeg_decode_inter
  mpegaudiodec: Validate that the number of channels fits at the given offset
  asv1: Verify the amount of extradata
  idroqdec: Make sure a video stream has been allocated before returning packets
  rv10: Validate the dimensions set from the container
  xmv: Add more sanity checks for parameters read from the bitstream
  ffv1: Make sure at least one slice context is initialized
  truemotion2: Use av_freep properly in an error path

Conflicts:
	libavcodec/qpeg.c
	libavcodec/wnv1.c
	libavformat/wtv.c
	libavformat/xmv.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 4 insertions, 1 deletions

diff --git a/libavcodec/rv10.c b/libavcodec/rv10.c
index 62266dc2d7..84962f65d0 100644
--- a/libavcodec/rv10.c
+++ b/libavcodec/rv10.c
@@ -442,12 +442,15 @@ static av_cold int rv10_decode_init(AVCodecContext *avctx)
 {
     MpegEncContext *s = avctx->priv_data;
     static int done=0;
-    int major_ver, minor_ver, micro_ver;
+    int major_ver, minor_ver, micro_ver, ret;
 
     if (avctx->extradata_size < 8) {
         av_log(avctx, AV_LOG_ERROR, "Extradata is too small.\n");
         return -1;
     }
+    if ((ret = av_image_check_size(avctx->coded_width,
+                                   avctx->coded_height, 0, avctx)) < 0)
+        return ret;
 
     MPV_decode_defaults(s);