Merge commit '7e350b7ddd19af856b55634233d609e29baab646' into release/1.1

* commit '7e350b7ddd19af856b55634233d609e29baab646':
  pcx: Check the packet size before assuming it fits a palette
  rpza: Fix a buffer size check
  xxan: Disallow odd width
  xan: Only read within the data that actually was initialized
  xan: Use bytestream2 to limit reading to within the buffer
  pcx: Consume the whole packet if giving up due to missing palette
  pngdec: Stop trying to decode once inflate returns Z_STREAM_END
  mov: Make sure the read sample count is nonnegative
  bfi: Add some very basic sanity checks for input packet sizes
  bfi: Avoid divisions by zero
  electronicarts: Add more sanity checking for the number of channels
  riffdec: Add sanity checks for the sample rate

Conflicts:
	libavcodec/pcx.c
	libavcodec/xan.c
	libavformat/mov.c
	libavformat/riff.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 4 insertions, 0 deletions

diff --git a/libavcodec/xxan.c b/libavcodec/xxan.c
index 1deafe8bcc..c8ccb9716c 100644
--- a/libavcodec/xxan.c
+++ b/libavcodec/xxan.c
@@ -49,6 +49,10 @@ static av_cold int xan_decode_init(AVCodecContext *avctx)
         av_log(avctx, AV_LOG_ERROR, "Invalid frame height: %d.\n", avctx->height);
         return AVERROR(EINVAL);
     }
+    if (avctx->width & 1) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid frame width: %d.\n", avctx->width);
+        return AVERROR(EINVAL);
+    }
 
     s->buffer_size = avctx->width * avctx->height;
     s->y_buffer = av_malloc(s->buffer_size);