Merge remote-tracking branch 'qatar/release/0.7' into release/0.8

* qatar/release/0.7:
  matroskadec: Fix a bug where a pointer was cached to an array that might later move due to a realloc()
  vorbis: Avoid some out-of-bounds reads
  vp3: fix oob read for negative tokens and memleaks on error. (cherry picked from commit 8370e426e42f2e4b9d14a1fb8107ecfe5163ce7f)
  avserver: Fix a bug where the socket is IPv4, but IPv6 is autoselected for the loopback address.
  vp3: fix streams with non-zero last coefficient

Merged-by: Michael Niedermayer <[email protected]>

1 files changed, 2 insertions, 0 deletions

diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
index 2f07af8c4b..648c464aed 100644
--- a/libavcodec/vp3.c
+++ b/libavcodec/vp3.c
@@ -1323,6 +1323,8 @@ static inline int vp3_dequant(Vp3DecodeContext *s, Vp3Fragment *frag,
             return i;
         }
     } while (i < 64);
+    // return value is expected to be a valid level
+    i--;
 end:
     // the actual DC+prediction is in the fragment structure
     block[0] = frag->dc * s->qmat[0][inter][plane][0];