Merge branch 'release/0.8' into release/0.7

* release/0.8: (31 commits)
  svq1dec: call avcodec_set_dimensions() after dimensions changed. Fixes NGS00148
  vp3dec: Check coefficient index in vp3_dequant() Fixes NGS00145
  qdm2dec: fix buffer overflow. Fixes NGS00144
  h264: Fix invalid interlaced progressive MB combinations for direct mode prediction. Fixes Ticket312
  mpegvideo: dont use ff_mspel_motion() for vc1 Fixes Ticket655
  imgutils: Fix illegal read.
  ac3probe: Detect Sonic Foundry Soft Encode AC3 as raw AC3. Our ac3 code chain can handle it fine. More ideal would be to write a demuxer that actually extracts what can be from the additional headers and uses it for whatever it can be used for.
  mjpeg: support mpo Fixes stereoscopic_photo.mpo
  Add a version bump and APIchanges entry for avcodec_open2 and avformat_find_stream_info.
  lavf: fix multiplication overflow in avformat_find_stream_info()
  lavf: fix invalid reads in avformat_find_stream_info()
  lavf: add avformat_find_stream_info()
  lavc: fix parentheses placement in avcodec_open2().
  lavc: introduce avcodec_open2() as a replacement for avcodec_open().
  rawdec: use a default sample rate if none is specified. Fixes "ffmpeg -f s16le -i /dev/zero"
  rawdec: add check on sample_rate
  qdm2dec: check remaining input bits in the mainloop of qdm2_fft_decode_tones() This is neccessary but likely not sufficient to prevent out of array reads.
  cinepak: check strip_size
  wma: Check channel number before init. Fixes Ticket240
  Do not try to read 16bit gray png files with alpha channel.
  ...

Conflicts:
	libavcodec/version.h
	libavformat/version.h

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 6 insertions, 3 deletions

diff --git a/libavcodec/vp6.c b/libavcodec/vp6.c
index c66d2e74ff..bcb437db57 100644
--- a/libavcodec/vp6.c
+++ b/libavcodec/vp6.c
@@ -440,7 +440,8 @@ static void vp6_parse_coeff(VP56Context *s)
         model1 = model->coeff_dccv[pt];
         model2 = model->coeff_dcct[pt][ctx];
 
-        for (coeff_idx=0; coeff_idx<64; ) {
+        coeff_idx = 0;
+        for (;;) {
             if ((coeff_idx>1 && ct==0) || vp56_rac_get_prob(c, model2[0])) {
                 /* parse a coeff */
                 if (vp56_rac_get_prob(c, model2[2])) {
@@ -481,8 +482,10 @@ static void vp6_parse_coeff(VP56Context *s)
                             run += vp56_rac_get_prob(c, model3[i+8]) << i;
                 }
             }
-
-            cg = vp6_coeff_groups[coeff_idx+=run];
+            coeff_idx += run;
+            if (coeff_idx >= 64)
+                break;
+            cg = vp6_coeff_groups[coeff_idx];
             model1 = model2 = model->coeff_ract[pt][ct][cg];
         }