Merge commit 'b19eafa2b930ee40abfde6d1f026b7fa5591c4dc' into release/0.10

* commit 'b19eafa2b930ee40abfde6d1f026b7fa5591c4dc':
  eacmv: Make sure a reference frame exists before referencing it
  mpeg4videodec: Check the width/height in mpeg4_decode_sprite_trajectory
  ivi_common: Make sure color planes have been initialized
  oggparseogm: Convert to use bytestream2
  rv34: Check the return value from ff_rv34_decode_init
  matroskadec: Verify realaudio codec parameters
  mace: Make sure that the channel count is set to a valid value
  svq3: Check for any negative return value from ff_h264_check_intra_pred_mode
  vp3: Check the framerate for validity
  cavsdec: Make sure a sequence header has been decoded before decoding pictures
  sierravmd: Do sanity checking of frame sizes
  omadec: Properly check lengths before incrementing the position
  mpc8: Make sure the first stream exists before parsing the seek table

Conflicts:
	libavcodec/eacmv.c
	libavcodec/mpeg4videodec.c
	libavformat/omadec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 5 insertions, 1 deletions

diff --git a/libavformat/omadec.c b/libavformat/omadec.c
index 1df2244607..93c661e615 100644
--- a/libavformat/omadec.c
+++ b/libavformat/omadec.c
@@ -173,7 +173,11 @@ static int nprobe(AVFormatContext *s, uint8_t *enc_header, unsigned size,
     if(taglen + (((uint64_t)datalen)<<4) + 44 > size)
         return -1;
 
-    pos += 44 + taglen;
+    pos += 44;
+    if (size - pos < taglen)
+        return -1;
+
+    pos += taglen;
 
     if (datalen << 4 > size - pos)
         return -1;