Merge remote-tracking branch 'qatar/master'

* qatar/master:
  vp3dec: Check coefficient index in vp3_dequant()
  svq1dec: call avcodec_set_dimensions() after dimensions changed.
  Prepare for 0.8_beta1 snapshot release
  threads: check defines before using them in automatic thread detection
  pthread: include sys/types.h before sys/sysctl.h
  4xm: remove unused variables.
  h264: Fix a possible overread in decode_nal_units()
  allfilters: fix type of avfilter_vsrc_buffer.
  w32thread: call ResetEvent() in pthread_cond_broadcast().

Conflicts:
	Changelog
	RELEASE
	doc/RELEASE_NOTES
	libavcodec/pthread.c
	libavcodec/vp3.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

4 files changed, 13 insertions, 9 deletions

diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c
index 5dcb6d8276..e57ce90df6 100644
--- a/libavcodec/4xm.c
+++ b/libavcodec/4xm.c
@@ -682,8 +682,6 @@ static int decode_i_frame(FourXContext *f, const uint8_t *buf, int length){
     int x, y;
     const int width= f->avctx->width;
     const int height= f->avctx->height;
-    uint16_t *dst= (uint16_t*)f->current_picture.data[0];
-    const int stride= f->current_picture.linesize[0]>>1;
     const unsigned int bitstream_size= AV_RL32(buf);
     unsigned int prestream_size;
     const uint8_t *prestream;
@@ -726,7 +724,6 @@ static int decode_i_frame(FourXContext *f, const uint8_t *buf, int length){
 
             idct_put(f, x, y);
         }
-        dst += 16*stride;
     }
 
     if(get_vlc2(&f->pre_gb, f->pre_vlc.table, ACDC_VLC_BITS, 3) != 256)
diff --git a/libavcodec/h264.c b/libavcodec/h264.c
index 9978188620..f6fcc84eaa 100644
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -3803,7 +3803,7 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){
         int err;
 
         if(buf_index >= next_avc) {
-            if(buf_index >= buf_size) break;
+            if (buf_index >= buf_size - h->nal_length_size) break;
             nalsize = 0;
             for(i = 0; i < h->nal_length_size; i++)
                 nalsize = (nalsize << 8) | buf[buf_index++];
diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
index 9e59dd8127..0137253e64 100644
--- a/libavcodec/vp3.c
+++ b/libavcodec/vp3.c
@@ -1363,9 +1363,9 @@ static inline int vp3_dequant(Vp3DecodeContext *s, Vp3Fragment *frag,
         case 1: // zero run
             s->dct_tokens[plane][i]++;
             i += (token >> 2) & 0x7f;
-            if(i>63){
+            if (i > 63) {
                 av_log(s->avctx, AV_LOG_ERROR, "Coefficient index overflow\n");
-                return -1;
+                return i;
             }
             block[perm[i]] = (token >> 9) * dequantizer[perm[i]];
             i++;
@@ -1570,7 +1570,10 @@ static void render_slice(Vp3DecodeContext *s, int slice)
                     /* invert DCT and place (or add) in final output */
 
                     if (s->all_fragments[i].coding_method == MODE_INTRA) {
-                        vp3_dequant(s, s->all_fragments + i, plane, 0, block);
+                        int index;
+                        index = vp3_dequant(s, s->all_fragments + i, plane, 0, block);
+                        if (index > 63)
+                            continue;
                         if(s->avctx->idct_algo!=FF_IDCT_VP3)
                             block[0] += 128<<3;
                         s->dsp.idct_put(
@@ -1578,7 +1581,10 @@ static void render_slice(Vp3DecodeContext *s, int slice)
                             stride,
                             block);
                     } else {
-                        if (vp3_dequant(s, s->all_fragments + i, plane, 1, block)) {
+                        int index = vp3_dequant(s, s->all_fragments + i, plane, 1, block);
+                        if (index > 63)
+                            continue;
+                        if (index > 0) {
                         s->dsp.idct_add(
                             output_plane + first_pixel,
                             stride,
diff --git a/libavcodec/w32pthreads.h b/libavcodec/w32pthreads.h
index 3cdbc2c343..70b84cf2e1 100644
--- a/libavcodec/w32pthreads.h
+++ b/libavcodec/w32pthreads.h
@@ -120,7 +120,7 @@ typedef struct {
     volatile int waiter_count;
     HANDLE semaphore;
     HANDLE waiters_done;
-    int is_broadcast;
+    volatile int is_broadcast;
 } win32_cond_t;
 
 static void pthread_cond_init(pthread_cond_t *cond, const void *unused_attr)
@@ -187,6 +187,7 @@ static void pthread_cond_broadcast(pthread_cond_t *cond)
         ReleaseSemaphore(win32_cond->semaphore, win32_cond->waiter_count, NULL);
         pthread_mutex_unlock(&win32_cond->mtx_waiter_count);
         WaitForSingleObject(win32_cond->waiters_done, INFINITE);
+        ResetEvent(win32_cond->waiters_done);
         win32_cond->is_broadcast = 0;
     } else
         pthread_mutex_unlock(&win32_cond->mtx_waiter_count);