Merge commit '43c0a87279e717c1384314c6da7155c306ee7c60' into release/0.10

* commit '43c0a87279e717c1384314c6da7155c306ee7c60':
  qdm2: check that the FFT size is a power of 2
  indeo3: switch parsing the header to bytestream2
  indeo3: check motion vectors.
  rv10: check that extradata is large enough
  indeo3: fix data size check
  lavf: make sure stream probe data gets freed.
  dfa: check for invalid access in decode_wdlt().
  xmv: check audio track parameters validity.
  bmv: check for len being valid in bmv_decode_frame().
  xmv: do not leak memory in the error paths in xmv_read_header()
  avfiltergraph: check for sws opts being non-NULL before using them.
  oma: Validate sample rates
  Prepare for 0.8.7 Release

Conflicts:
	RELEASE
	libavcodec/indeo3.c
	libavfilter/avfiltergraph.c
	libavformat/utils.c
	libavformat/xmv.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 29 insertions, 13 deletions

diff --git a/libavformat/xmv.c b/libavformat/xmv.c
index e7402f7a4a..9c365c8df1 100644
--- a/libavformat/xmv.c
+++ b/libavformat/xmv.c
@@ -123,6 +123,15 @@ static int xmv_probe(AVProbeData *p)
     return 0;
 }
 
+static int xmv_read_close(AVFormatContext *s)
+{
+    XMVDemuxContext *xmv = s->priv_data;
+
+    av_free(xmv->audio);
+
+    return 0;
+}
+
 static int xmv_read_header(AVFormatContext *s,
                            AVFormatParameters *ap)
 {
@@ -133,6 +142,7 @@ static int xmv_read_header(AVFormatContext *s,
     uint32_t file_version;
     uint32_t this_packet_size;
     uint16_t audio_track;
+    int ret;
 
     avio_skip(pb, 4); /* Next packet size */
 
@@ -171,8 +181,10 @@ static int xmv_read_header(AVFormatContext *s,
     avio_skip(pb, 2); /* Unknown (padding?) */
 
     xmv->audio = av_malloc(xmv->audio_track_count * sizeof(XMVAudioPacket));
-    if (!xmv->audio)
-        return AVERROR(ENOMEM);
+    if (!xmv->audio) {
+        ret = AVERROR(ENOMEM);
+        goto fail;
+    }
 
     for (audio_track = 0; audio_track < xmv->audio_track_count; audio_track++) {
         XMVAudioPacket *packet = &xmv->audio[audio_track];
@@ -203,9 +215,18 @@ static int xmv_read_header(AVFormatContext *s,
             av_log(s, AV_LOG_WARNING, "Unsupported 5.1 ADPCM audio stream "
                                       "(0x%04X)\n", packet->flags);
 
+        if (!packet->channels || !packet->sample_rate) {
+            av_log(s, AV_LOG_ERROR, "Invalid parameters for audio track %d.\n",
+                   audio_track);
+            ret = AVERROR_INVALIDDATA;
+            goto fail;
+        }
+
         ast = avformat_new_stream(s, NULL);
-        if (!ast)
-            return AVERROR(ENOMEM);
+        if (!ast) {
+            ret = AVERROR(ENOMEM);
+            goto fail;
+        }
 
         ast->codec->codec_type            = AVMEDIA_TYPE_AUDIO;
         ast->codec->codec_id              = packet->codec_id;
@@ -231,6 +252,10 @@ static int xmv_read_header(AVFormatContext *s,
     xmv->stream_count       = xmv->audio_track_count + 1;
 
     return 0;
+
+fail:
+    xmv_read_close(s);
+    return ret;
 }
 
 static void xmv_read_extradata(uint8_t *extradata, AVIOContext *pb)
@@ -538,15 +563,6 @@ static int xmv_read_packet(AVFormatContext *s,
     return 0;
 }
 
-static int xmv_read_close(AVFormatContext *s)
-{
-    XMVDemuxContext *xmv = s->priv_data;
-
-    av_free(xmv->audio);
-
-    return 0;
-}
-
 AVInputFormat ff_xmv_demuxer = {
     .name           = "xmv",
     .long_name      = NULL_IF_CONFIG_SMALL("Microsoft XMV"),