Merge branch 'release/0.7' into oldabi

* release/0.7: (290 commits)
  nuv: Fix combination of size changes and LZO compression.
  av_lzo1x_decode: properly handle negative buffer length.
  Do not call parse_keyframes_index with NULL stream.
  update versions for 0.7 branch
  Version numbers for 0.8.6
  snow: emu edge support Fixes Ticket592
  imc: validate channel count
  imc: check for ff_fft_init() failure (cherry picked from commit 95fee70d6773fde1c34ff6422f48e5e66f37f263)
  libgsmdec: check output buffer size before decoding (cherry picked from commit b03761b1309293bbf30edef767503875277b01cf)
  configure: fix arch x86_32
  mp3enc: avoid truncating id3v1 tags by one byte
  asfdec: Check packet_replic_size earlier
  cin audio: validate the channel count
  binkaudio: add some buffer overread checks.
  atrac1: validate number of channels (cherry picked from commit bff5b2c1ca1290ea30587ff2f76171f9e3854872)
  atrac1: check output buffer size before decoding (cherry picked from commit 33684b9c12b74c0140fb91e8150263db4a48d55e)
  vp3: fix oob read for negative tokens and memleaks on error. (cherry picked from commit 8370e426e42f2e4b9d14a1fb8107ecfe5163ce7f)
  apedec: set s->currentframeblocks after validating nblocks
  apedec: use unsigned int for 'nblocks' and make sure that it's within int range
  apedec: check for data buffer realloc failure (cherry picked from commit 11ca8b2d7486e879926488404b3b79af774f0f2d)
  ...

Conflicts:
	Changelog
	Makefile
	RELEASE
	configure
	libavcodec/error_resilience.c
	libavcodec/mpegvideo.c
	libavformat/matroskaenc.c
	tests/ref/lavf/mxf

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 44 insertions, 10 deletions

diff --git a/libavformat/psxstr.c b/libavformat/psxstr.c
index 4376e743c4..398e44e128 100644
--- a/libavformat/psxstr.c
+++ b/libavformat/psxstr.c
@@ -68,6 +68,8 @@ static const char sync_header[12] = {0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xf
 static int str_probe(AVProbeData *p)
 {
     uint8_t *sector= p->buf;
+    uint8_t *end= sector + p->buf_size;
+    int aud=0, vid=0;
 
     if (p->buf_size < RAW_CD_SECTOR_SIZE)
         return 0;
@@ -79,20 +81,52 @@ static int str_probe(AVProbeData *p)
         sector += RIFF_HEADER_SIZE;
     }
 
-    /* look for CD sync header (00, 0xFF x 10, 00) */
-    if (memcmp(sector,sync_header,sizeof(sync_header)))
-        return 0;
+    while (end - sector >= RAW_CD_SECTOR_SIZE) {
+        /* look for CD sync header (00, 0xFF x 10, 00) */
+        if (memcmp(sector,sync_header,sizeof(sync_header)))
+            return 0;
 
-    if(sector[0x11] >= 32)
-        return 0;
-    if(   (sector[0x12] & CDXA_TYPE_MASK) != CDXA_TYPE_VIDEO
-       && (sector[0x12] & CDXA_TYPE_MASK) != CDXA_TYPE_AUDIO
-       && (sector[0x12] & CDXA_TYPE_MASK) != CDXA_TYPE_DATA)
-        return 0;
+        if (sector[0x11] >= 32)
+            return 0;
+
+        switch (sector[0x12] & CDXA_TYPE_MASK) {
+        case CDXA_TYPE_DATA:
+        case CDXA_TYPE_VIDEO: {
+                int current_sector = AV_RL16(&sector[0x1C]);
+                int sector_count   = AV_RL16(&sector[0x1E]);
+                int frame_size = AV_RL32(&sector[0x24]);
+
+                if(!(   frame_size>=0
+                     && current_sector < sector_count
+                     && sector_count*VIDEO_DATA_CHUNK_SIZE >=frame_size)){
+                    return 0;
+                }
 
+                /*st->codec->width      = AV_RL16(&sector[0x28]);
+                st->codec->height     = AV_RL16(&sector[0x2A]);*/
+
+//                 if (current_sector == sector_count-1) {
+                    vid++;
+//                 }
+
+            }
+            break;
+        case CDXA_TYPE_AUDIO:
+            if(sector[0x13]&0x2A)
+                return 0;
+            aud++;
+            break;
+        default:
+            if(sector[0x12] & CDXA_TYPE_MASK)
+                return 0;
+        }
+        sector += RAW_CD_SECTOR_SIZE;
+    }
     /* MPEG files (like those ripped from VCDs) can also look like this;
      * only return half certainty */
-    return 50;
+    if(vid+aud > 3)  return 50;
+    else if(vid+aud) return 1;
+    else             return 0;
 }
 
 static int str_read_header(AVFormatContext *s,