Merge commit '9925f7df0a50387ade8d83cb85b40c53e41e7041' into release/0.10

* commit '9925f7df0a50387ade8d83cb85b40c53e41e7041':
  vc1dec: Make sure last_picture is initialized in vc1_decode_skip_blocks
  r3d: Add more input value validation
  fraps: Make the input buffer size checks more strict
  svq3: Avoid a division by zero
  rmdec: Validate the fps value
  twinvqdec: Check the ibps parameter separately
  asfdec: Check the return value of asf_read_stream_properties
  mxfdec: set audio timebase to 1/samplerate
  pcx: Check the packet size before assuming it fits a palette
  rpza: Fix a buffer size check
  xxan: Disallow odd width
  xan: Only read within the data that actually was initialized

Conflicts:
	libavcodec/fraps.c
	libavformat/mxfdec.c
	tests/ref/seek/lavf_mxf
	tests/ref/seek/lavf_mxf_d10

Merged-by: Michael Niedermayer <michaelni@gmx.at>

4 files changed, 25 insertions, 5 deletions

diff --git a/libavformat/asfdec.c b/libavformat/asfdec.c
index 27685ee218..9ae0d43c87 100644
--- a/libavformat/asfdec.c
+++ b/libavformat/asfdec.c
@@ -618,7 +618,9 @@ static int asf_read_header(AVFormatContext *s, AVFormatParameters *ap)
             if (ret < 0)
                 return ret;
         } else if (!ff_guidcmp(&g, &ff_asf_stream_header)) {
-            asf_read_stream_properties(s, gsize);
+            int ret = asf_read_stream_properties(s, gsize);
+            if (ret < 0)
+                return ret;
         } else if (!ff_guidcmp(&g, &ff_asf_comment_header)) {
             asf_read_content_desc(s, gsize);
         } else if (!ff_guidcmp(&g, &ff_asf_language_guid)) {
diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index f63cff9be8..b7bb4dff19 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -1397,8 +1397,17 @@ static int mxf_parse_structural_metadata(MXFContext *mxf)
                 st->codec->codec_id = container_ul->id;
             st->codec->channels = descriptor->channels;
             st->codec->bits_per_coded_sample = descriptor->bits_per_sample;
-            if (descriptor->sample_rate.den > 0)
-            st->codec->sample_rate = descriptor->sample_rate.num / descriptor->sample_rate.den;
+            if (descriptor->sample_rate.den > 0) {
+                st->codec->sample_rate = descriptor->sample_rate.num / descriptor->sample_rate.den;
+                avpriv_set_pts_info(st, 64, descriptor->sample_rate.den, descriptor->sample_rate.num);
+            } else {
+                av_log(mxf->fc, AV_LOG_WARNING, "invalid sample rate (%d/%d) "
+                       "found for stream #%d, time base forced to 1/48000\n",
+                       descriptor->sample_rate.num, descriptor->sample_rate.den,
+                       st->index);
+                avpriv_set_pts_info(st, 64, 1, 48000);
+            }
+
             /* TODO: implement CODEC_ID_RAWAUDIO */
             if (st->codec->codec_id == CODEC_ID_PCM_S16LE) {
                 if (descriptor->bits_per_sample > 16 && descriptor->bits_per_sample <= 24)
diff --git a/libavformat/r3d.c b/libavformat/r3d.c
index 874c361406..ada239f550 100644
--- a/libavformat/r3d.c
+++ b/libavformat/r3d.c
@@ -277,6 +277,10 @@ static int r3d_read_reda(AVFormatContext *s, AVPacket *pkt, Atom *atom)
     dts = avio_rb32(s->pb);
 
     st->codec->sample_rate = avio_rb32(s->pb);
+    if (st->codec->sample_rate <= 0) {
+        av_log(s, AV_LOG_ERROR, "Bad sample rate\n");
+        return AVERROR_INVALIDDATA;
+    }
 
     samples = avio_rb32(s->pb);
 
diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index 5d1791f79f..dfd229e93e 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -336,8 +336,13 @@ ff_rm_read_mdpr_codecdata (AVFormatContext *s, AVIOContext *pb,
         if ((ret = rm_read_extradata(pb, st->codec, codec_data_size - (avio_tell(pb) - codec_pos))) < 0)
             return ret;
 
-        av_reduce(&st->r_frame_rate.den, &st->r_frame_rate.num,
-                  0x10000, fps, (1 << 30) - 1);
+        if (fps > 0) {
+            av_reduce(&st->r_frame_rate.den, &st->r_frame_rate.num,
+                      0x10000, fps, (1 << 30) - 1);
+        } else if (s->error_recognition & AV_EF_EXPLODE) {
+            av_log(s, AV_LOG_ERROR, "Invalid framerate\n");
+            return AVERROR_INVALIDDATA;
+        }
         st->avg_frame_rate = st->r_frame_rate;
     }