Merge commit 'b0ca5fef09d1b1268ea0c8f89bf53cd38aaa85e7' into release/0.10

* commit 'b0ca5fef09d1b1268ea0c8f89bf53cd38aaa85e7':
  dv: Add a guard to not overread the ppcm array
  mpegvideo: Avoid 32-bit wrapping of linesize multiplications
  mjpegb: Detect changing number of planes in interlaced video
  matroskadec: Check that .lang was allocated and set before reading it
  ape demuxer: check for EOF in potentially long loops
  lavf: avoid integer overflow when estimating bitrate
  pictordec: break out of both decoding loops when y drops below 0
  ac3: Return proper error codes

Conflicts:
	libavcodec/pictordec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

4 files changed, 14 insertions, 6 deletions

diff --git a/libavformat/ape.c b/libavformat/ape.c
index 016638b54e..d712331fb1 100644
--- a/libavformat/ape.c
+++ b/libavformat/ape.c
@@ -276,7 +276,9 @@ static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap)
         ape->seektable = av_malloc(ape->seektablelength);
         if (!ape->seektable)
             return AVERROR(ENOMEM);
-        for (i = 0; i < ape->seektablelength / sizeof(uint32_t); i++)
+        for (i = 0;
+             i < ape->seektablelength / sizeof(uint32_t) && !pb->eof_reached;
+             i++)
             ape->seektable[i] = avio_rl32(pb);
     }else{
         av_log(s, AV_LOG_ERROR, "Missing seektable\n");
diff --git a/libavformat/dv.c b/libavformat/dv.c
index 1275b1971f..9e016391c5 100644
--- a/libavformat/dv.c
+++ b/libavformat/dv.c
@@ -106,7 +106,7 @@ static const uint8_t* dv_extract_pack(uint8_t* frame, enum dv_pack_type t)
  * 3. Audio is always returned as 16bit linear samples: 12bit nonlinear samples
  *    are converted into 16bit linear ones.
  */
-static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4],
+static int dv_extract_audio(uint8_t *frame, uint8_t **ppcm,
                             const DVprofile *sys)
 {
     int size, chan, i, j, d, of, smpls, freq, quant, half_ch;
@@ -374,7 +374,7 @@ int avpriv_dv_produce_packet(DVDemuxContext *c, AVPacket *pkt,
                       uint8_t* buf, int buf_size, int64_t pos)
 {
     int size, i;
-    uint8_t *ppcm[4] = {0};
+    uint8_t *ppcm[5] = { 0 };
 
     if (buf_size < DV_PROFILE_BYTES ||
         !(c->sys = avpriv_dv_frame_profile(c->sys, buf, buf_size)) ||
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 3cba90fd6d..32c6af1d81 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -1114,7 +1114,8 @@ static void matroska_convert_tag(AVFormatContext *s, EbmlList *list,
     int i;
 
     for (i=0; i < list->nb_elem; i++) {
-        const char *lang = strcmp(tags[i].lang, "und") ? tags[i].lang : NULL;
+        const char *lang = tags[i].lang && strcmp(tags[i].lang, "und") ?
+                           tags[i].lang : NULL;
 
         if (!tags[i].name) {
             av_log(s, AV_LOG_WARNING, "Skipping invalid tag with no TagName.\n");
diff --git a/libavformat/utils.c b/libavformat/utils.c
index aee3179dee..3141b9d5e8 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -2057,8 +2057,13 @@ static void estimate_timings_from_bit_rate(AVFormatContext *ic)
         bit_rate = 0;
         for(i=0;i<ic->nb_streams;i++) {
             st = ic->streams[i];
-            if (st->codec->bit_rate > 0)
-            bit_rate += st->codec->bit_rate;
+            if (st->codec->bit_rate > 0) {
+                if (INT_MAX - st->codec->bit_rate > bit_rate) {
+                    bit_rate = 0;
+                    break;
+                }
+                bit_rate += st->codec->bit_rate;
+            }
         }
         ic->bit_rate = bit_rate;
     }