Merge remote-tracking branch 'qatar/release/0.7' into release/0.8

* qatar/release/0.7: (96 commits)
  intfloat_readwrite: fix signed addition overflows
  smacker: validate channels and sample format.
  smacker: check buffer size before reading output size
  smacker: validate number of channels
  sipr: fix get_bits(0) calls
  motion_est: make MotionExtContext.map_generation unsigned
  4xm: prevent NULL dereference with invalid huffman table
  4xmdemux: prevent use of uninitialized memory
  4xm: clear FF_INPUT_BUFFER_PADDING_SIZE bytes in temporary buffers
  ptx: check for out of bound reads
  tiffdec: fix out of bound reads/writes
  eacmv: check for out of bound reads
  eacmv: fix potential pointer arithmetic overflows
  adpcm: fix out of bound reads due to integer overflow
  anm: prevent infinite loop
  avsdemux: check for out of bound writes
  avs: check for out of bound reads
  avsdemux: check for corrupted data
  mxfdec: Fix some buffer overreads caused by the misuse of AVPacket related functions.
  vaapi: Fix VC-1 decoding (reconstruct bitstream TTFRM correctly).
  ...

Conflicts:
	libavcodec/adpcm.c
	libavcodec/bink.c
	libavcodec/h264.c
	libavcodec/h264.h
	libavcodec/h264_cabac.c
	libavcodec/h264_cavlc.c
	libavcodec/motion_est_template.c
	libavcodec/mpegvideo.c
	libavcodec/nellymoserdec.c
	libavcodec/ptx.c
	libavcodec/svq3.c
	libavcodec/vaapi_vc1.c
	libavcodec/xan.c
	libavfilter/vf_scale.c
	libavformat/4xm.c
	libavformat/flvdec.c
	libavformat/mpeg.c
	tests/ref/fate/motionpixels

Merged-by: Michael Niedermayer <michaelni@gmx.at>

5 files changed, 9 insertions, 8 deletions

diff --git a/libavformat/4xm.c b/libavformat/4xm.c
index e3b696d57b..b4dd3d4416 100644
--- a/libavformat/4xm.c
+++ b/libavformat/4xm.c
@@ -176,7 +176,7 @@ static int fourxm_read_header(AVFormatContext *s,
                                               sizeof(AudioTrack),
                                               current_track + 1);
                 if (!fourxm->tracks) {
-                    ret=  AVERROR(ENOMEM);
+                    ret = AVERROR(ENOMEM);
                     goto fail;
                 }
                 memset(&fourxm->tracks[fourxm->track_count], 0,
diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c
index c48224b445..c9c6d7e898 100644
--- a/libavformat/flvdec.c
+++ b/libavformat/flvdec.c
@@ -173,8 +173,8 @@ static int parse_keyframes_index(AVFormatContext *s, AVIOContext *ioc, AVStream
         }
     }
 
-    if (timeslen == fileposlen) {
-         for(i = 0; i < timeslen; i++)
+    if (!ret && timeslen == fileposlen) {
+         for (i = 0; i < fileposlen; i++)
              av_add_index_entry(vstream, filepositions[i], times[i]*1000, 0, 0, AVINDEX_KEYFRAME);
     } else
         av_log(s, AV_LOG_WARNING, "Invalid keyframes object, skipping.\n");
diff --git a/libavformat/isom.c b/libavformat/isom.c
index 1f75a4a956..e471ac580f 100644
--- a/libavformat/isom.c
+++ b/libavformat/isom.c
@@ -397,7 +397,7 @@ int ff_mp4_read_dec_config_descr(AVFormatContext *fc, AVStream *st, AVIOContext
     len = ff_mp4_read_descr(fc, pb, &tag);
     if (tag == MP4DecSpecificDescrTag) {
         av_dlog(fc, "Specific MPEG4 header len=%d\n", len);
-        if((uint64_t)len > (1<<30))
+        if (!len || (uint64_t)len > (1<<30))
             return -1;
         av_free(st->codec->extradata);
         st->codec->extradata = av_mallocz(len + FF_INPUT_BUFFER_PADDING_SIZE);
diff --git a/libavformat/mpeg.c b/libavformat/mpeg.c
index 3166b42172..b4bd1e50c6 100644
--- a/libavformat/mpeg.c
+++ b/libavformat/mpeg.c
@@ -423,7 +423,7 @@ static int mpegps_read_packet(AVFormatContext *s,
 {
     MpegDemuxContext *m = s->priv_data;
     AVStream *st;
-    int len, startcode, i, es_type;
+    int len, startcode, i, es_type, ret;
     int request_probe= 0;
     enum CodecID codec_id = CODEC_ID_NONE;
     enum AVMediaType type;
@@ -568,8 +568,7 @@ static int mpegps_read_packet(AVFormatContext *s,
         else if (st->codec->bits_per_coded_sample == 28)
             return AVERROR(EINVAL);
     }
-    av_new_packet(pkt, len);
-    avio_read(s->pb, pkt->data, pkt->size);
+    ret = av_get_packet(s->pb, pkt, len);
     pkt->pts = pts;
     pkt->dts = dts;
     pkt->pos = dummy_pos;
@@ -578,7 +577,7 @@ static int mpegps_read_packet(AVFormatContext *s,
             pkt->stream_index, pkt->pts / 90000.0, pkt->dts / 90000.0,
             pkt->size);
 
-    return 0;
+    return (ret < 0) ? ret : 0;
 }
 
 static int64_t mpegps_read_dts(AVFormatContext *s, int stream_index,
diff --git a/libavformat/sol.c b/libavformat/sol.c
index c0d2c5d5a2..e22207515b 100644
--- a/libavformat/sol.c
+++ b/libavformat/sol.c
@@ -132,6 +132,8 @@ static int sol_read_packet(AVFormatContext *s,
     if (url_feof(s->pb))
         return AVERROR(EIO);
     ret= av_get_packet(s->pb, pkt, MAX_SIZE);
+    if (ret < 0)
+        return ret;
     pkt->stream_index = 0;
 
     /* note: we need to modify the packet size here to handle the last