Merge commit 'c5c7e3e6f7cf17943c04bd078f260eaf789afbc9' into release/1.1

* commit 'c5c7e3e6f7cf17943c04bd078f260eaf789afbc9':
  gifdec: check that the image dimensions are non-zero
  gifdec: return meaningful error codes.
  eacmv: check the framerate before setting it.
  rv30: fix extradata size check.
  sdp: Check that fmt->oformat is non-null before accessing it
  matroskadec: use correct compression parameters for current track CodecPrivate
  vc1: Reset numref if fieldmode is not set

Conflicts:
	libavcodec/gifdec.c
	libavcodec/rv30.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

4 files changed, 20 insertions, 9 deletions

diff --git a/libavcodec/eacmv.c b/libavcodec/eacmv.c
index fe32cf6ce6..facbd69cb4 100644
--- a/libavcodec/eacmv.c
+++ b/libavcodec/eacmv.c
@@ -123,7 +123,7 @@ static void cmv_decode_inter(CmvContext * s, const uint8_t *buf, const uint8_t *
 
 static void cmv_process_header(CmvContext *s, const uint8_t *buf, const uint8_t *buf_end)
 {
-    int pal_start, pal_count, i;
+    int pal_start, pal_count, i, fps;
 
     if(buf_end - buf < 16) {
         av_log(s->avctx, AV_LOG_WARNING, "truncated header\n");
@@ -135,8 +135,9 @@ static void cmv_process_header(CmvContext *s, const uint8_t *buf, const uint8_t
     if (s->avctx->width!=s->width || s->avctx->height!=s->height)
         avcodec_set_dimensions(s->avctx, s->width, s->height);
 
-    s->avctx->time_base.num = 1;
-    s->avctx->time_base.den = AV_RL16(&buf[10]);
+    fps = AV_RL16(&buf[10]);
+    if (fps > 0)
+        s->avctx->time_base = (AVRational){ 1, fps };
 
     pal_start = AV_RL16(&buf[12]);
     pal_count = AV_RL16(&buf[14]);
diff --git a/libavcodec/gifdec.c b/libavcodec/gifdec.c
index 41d3d5b9dd..6c9c751054 100644
--- a/libavcodec/gifdec.c
+++ b/libavcodec/gifdec.c
@@ -185,8 +185,11 @@ static int gif_read_image(GifState *s)
 
     /* verify that all the image is inside the screen dimensions */
     if (left + width > s->screen_width ||
-        top + height > s->screen_height)
+        top + height > s->screen_height ||
+        !width || !height) {
+        av_log(s->avctx, AV_LOG_ERROR, "Invalid image dimensions.\n");
         return AVERROR_INVALIDDATA;
+    }
 
     /* process disposal method */
     if (s->gce_prev_disposal == GCE_DISPOSAL_BACKGROUND) {
@@ -411,10 +414,10 @@ static int gif_read_header1(GifState *s)
 
 static int gif_parse_next_image(GifState *s, int *got_picture)
 {
-    int ret;
     *got_picture = 1;
     while (bytestream2_get_bytes_left(&s->gb)) {
         int code = bytestream2_get_byte(&s->gb);
+        int ret;
 
         av_dlog(s->avctx, "code=%02x '%c'\n", code, code);
 
diff --git a/libavcodec/rv30.c b/libavcodec/rv30.c
index c40010e3b2..dca42b71e8 100644
--- a/libavcodec/rv30.c
+++ b/libavcodec/rv30.c
@@ -35,6 +35,7 @@
 
 static int rv30_parse_slice_header(RV34DecContext *r, GetBitContext *gb, SliceInfo *si)
 {
+    AVCodecContext *avctx = r->s.avctx;
     int mb_bits;
     int w = r->s.width, h = r->s.height;
     int mb_size;
@@ -57,6 +58,13 @@ static int rv30_parse_slice_header(RV34DecContext *r, GetBitContext *gb, SliceIn
         rpr = 0;
     }
     if(rpr){
+        if (avctx->extradata_size < rpr * 2 + 8) {
+            av_log(avctx, AV_LOG_ERROR,
+                   "Insufficient extradata - need at least %d bytes, got %d\n",
+                   8 + rpr * 2, avctx->extradata_size);
+            return AVERROR(EINVAL);
+        }
+
         w = r->s.avctx->extradata[6 + rpr*2] << 2;
         h = r->s.avctx->extradata[7 + rpr*2] << 2;
     }
@@ -260,10 +268,7 @@ static av_cold int rv30_decode_init(AVCodecContext *avctx)
     }
     r->rpr = (avctx->extradata[1] & 7) >> 1;
     r->rpr = FFMIN(r->rpr + 1, 3);
-    if(avctx->extradata_size - 8 < (r->rpr - 1) * 2){
-        av_log(avctx, AV_LOG_ERROR, "Insufficient extradata - need at least %d bytes, got %d\n",
-               6 + r->rpr * 2, avctx->extradata_size);
-    }
+
     r->parse_slice_header = rv30_parse_slice_header;
     r->decode_intra_types = rv30_decode_intra_types;
     r->decode_mb_info     = rv30_decode_mb_info;
diff --git a/libavcodec/vc1.c b/libavcodec/vc1.c
index fa0b916898..d988668029 100644
--- a/libavcodec/vc1.c
+++ b/libavcodec/vc1.c
@@ -1011,6 +1011,8 @@ int ff_vc1_parse_frame_header_adv(VC1Context *v, GetBitContext* gb)
                 v->reffield          = get_bits1(gb);
                 v->ref_field_type[0] = v->reffield ^ !v->cur_field_type;
             }
+        } else {
+            v->numref = 0;
         }
         if (v->extended_mv)
             v->mvrange = get_unary(gb, 0, 3);