Merge remote-tracking branch 'qatar/master'

* qatar/master: (29 commits)
  doc: update libavfilter documentation
  tls: Use the URLContext as logging context
  aes: Avoid illegal read and don't generate more key than we use.
  mpc7: Fix memset call in mpc7_decode_frame function
  atrac1: use correct context for av_log()
  apedec: consume the whole packet when copying to the decoder buffer.
  apedec: do not needlessly copy s->samples to nblocks.
  apedec: check output buffer size after calculating actual output size
  apedec: remove unneeded entropy decoder normalization.
  truespeech: use memmove() in truespeech_update_filters()
  vorbisdec: remove AVCODEC_MAX_AUDIO_FRAME_SIZE check
  vorbisdec: remove unneeded buf_size==0 check
  vorbisdec: return proper error codes instead of made-up ones
  http: Don't add a Range: bytes=0- header for POST
  sunrast: Check for invalid/corrupted bitstream
  http: Change the chunksize AVOption into chunked_post
  http: Add encoding/decoding flags to the AVOptions
  avconv: remove some codec-specific hacks
  crypto: add decoding flag to options.
  tls: use AVIO_FLAG_NONBLOCK instead of deprecated URL_FLAG_NONBLOCK
  ...

Conflicts:
	doc/libavfilter.texi
	libavcodec/atrac1.c
	libavcodec/sunrast.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 18 insertions, 11 deletions

diff --git a/libavformat/avc.c b/libavformat/avc.c
index ed2125b527..eff1ddb121 100644
--- a/libavformat/avc.c
+++ b/libavformat/avc.c
@@ -75,8 +75,11 @@ int ff_avc_parse_nal_units(AVIOContext *pb, const uint8_t *buf_in, int size)
 
     size = 0;
     nal_start = ff_avc_find_startcode(p, end);
-    while (nal_start < end) {
-        while(!*(nal_start++));
+    for (;;) {
+        while (nal_start < end && !*(nal_start++));
+        if (nal_start == end)
+            break;
+
         nal_end = ff_avc_find_startcode(nal_start, end);
         avio_wb32(pb, nal_end - nal_start);
         avio_write(pb, nal_start, nal_end - nal_start);
@@ -117,22 +120,26 @@ int ff_isom_write_avcc(AVIOContext *pb, const uint8_t *data, int len)
             end = buf + len;
 
             /* look for sps and pps */
-            while (buf < end) {
-                unsigned int size;
+            while (end - buf > 4) {
+                uint32_t size;
                 uint8_t nal_type;
-                size = AV_RB32(buf);
-                nal_type = buf[4] & 0x1f;
+                size = FFMIN(AV_RB32(buf), end - buf - 4);
+                buf += 4;
+                nal_type = buf[0] & 0x1f;
+
                 if (nal_type == 7) { /* SPS */
-                    sps = buf + 4;
+                    sps = buf;
                     sps_size = size;
                 } else if (nal_type == 8) { /* PPS */
-                    pps = buf + 4;
+                    pps = buf;
                     pps_size = size;
                 }
-                buf += size + 4;
+
+                buf += size;
             }
-            assert(sps);
-            assert(pps);
+
+            if (!sps || !pps || sps_size < 4 || sps_size > UINT16_MAX || pps_size > UINT16_MAX)
+                return AVERROR_INVALIDDATA;
 
             avio_w8(pb, 1); /* version */
             avio_w8(pb, sps[1]); /* profile */