Merge commit '65830277d2d2ee3658e1f070a61044fff261ed3e' into release/1.1

* commit '65830277d2d2ee3658e1f070a61044fff261ed3e':
  prores: Add a codepath for decoding errors
  nut: Fix unchecked allocations
  avi: directly resync on DV in AVI read failure
  mov: Don't allocate arrays with av_malloc that will be realloced
  shorten: Extend fixed_coeffs to properly support pred_order 0
  Prepare for 9.11 RELEASE
  avi: properly fail if the dv demuxer is missing
  prores: Reject negative run and level values
  audio_mix: fix channel order in mix_1_to_2_fltp_flt_c
  indeo4: Check the inherited quant_mat

Conflicts:
	RELEASE
	libavcodec/indeo4.c
	libavcodec/shorten.c
	libavformat/nut.c
	libavformat/nutdec.c
	libavformat/nutenc.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

6 files changed, 21 insertions, 6 deletions

diff --git a/libavformat/avidec.c b/libavformat/avidec.c
index f33d3a7108..d48829ed99 100644
--- a/libavformat/avidec.c
+++ b/libavformat/avidec.c
@@ -490,7 +490,8 @@ static int avi_read_header(AVFormatContext *s)
                     avi->dv_demux = avpriv_dv_init_demux(s);
                     if (!avi->dv_demux)
                         goto fail;
-                }
+                } else
+                    goto fail;
                 s->streams[0]->priv_data = ast;
                 avio_skip(pb, 3 * 4);
                 ast->scale = avio_rl32(pb);
@@ -1067,6 +1068,8 @@ static int avi_read_packet(AVFormatContext *s, AVPacket *pkt)
         int size = avpriv_dv_get_packet(avi->dv_demux, pkt);
         if (size >= 0)
             return size;
+        else
+            goto resync;
     }
 
     if(avi->non_interleaved){
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 905647edcc..2e069ead13 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2524,7 +2524,7 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     if (!sc->ctts_count && sc->sample_count)
     {
         /* Complement ctts table if moov atom doesn't have ctts atom. */
-        ctts_data = av_malloc(sizeof(*sc->ctts_data));
+        ctts_data = av_realloc(NULL, sizeof(*sc->ctts_data));
         if (!ctts_data)
             return AVERROR(ENOMEM);
         sc->ctts_data = ctts_data;
diff --git a/libavformat/nut.c b/libavformat/nut.c
index 62a650dbed..699e90a2b8 100644
--- a/libavformat/nut.c
+++ b/libavformat/nut.c
@@ -210,10 +210,16 @@ int ff_nut_sp_pts_cmp(const Syncpoint *a, const Syncpoint *b){
     return ((a->ts - b->ts) >> 32) - ((b->ts - a->ts) >> 32);
 }
 
-void ff_nut_add_sp(NUTContext *nut, int64_t pos, int64_t back_ptr, int64_t ts){
+int ff_nut_add_sp(NUTContext *nut, int64_t pos, int64_t back_ptr, int64_t ts){
     Syncpoint *sp= av_mallocz(sizeof(Syncpoint));
     struct AVTreeNode *node = av_tree_node_alloc();
 
+    if (!sp || !node) {
+        av_freep(&sp);
+        av_freep(&node);
+        return AVERROR(ENOMEM);
+    }
+
     nut->sp_count++;
 
     sp->pos= pos;
@@ -224,6 +230,8 @@ void ff_nut_add_sp(NUTContext *nut, int64_t pos, int64_t back_ptr, int64_t ts){
         av_free(sp);
         av_free(node);
     }
+
+    return 0;
 }
 
 static int enu_free(void *opaque, void *elem)
diff --git a/libavformat/nut.h b/libavformat/nut.h
index ab31c27429..f38406eff8 100644
--- a/libavformat/nut.h
+++ b/libavformat/nut.h
@@ -123,7 +123,7 @@ void ff_nut_reset_ts(NUTContext *nut, AVRational time_base, int64_t val);
 int64_t ff_lsb2full(StreamContext *stream, int64_t lsb);
 int ff_nut_sp_pos_cmp(const Syncpoint *a, const Syncpoint *b);
 int ff_nut_sp_pts_cmp(const Syncpoint *a, const Syncpoint *b);
-void ff_nut_add_sp(NUTContext *nut, int64_t pos, int64_t back_ptr, int64_t ts);
+int ff_nut_add_sp(NUTContext *nut, int64_t pos, int64_t back_ptr, int64_t ts);
 void ff_nut_free_sp(NUTContext *nut);
 
 extern const Dispositions ff_nut_dispositions[];
diff --git a/libavformat/nutdec.c b/libavformat/nutdec.c
index f260a3e4fd..c44e7b1e16 100644
--- a/libavformat/nutdec.c
+++ b/libavformat/nutdec.c
@@ -546,6 +546,7 @@ static int decode_syncpoint(NUTContext *nut, int64_t *ts, int64_t *back_ptr)
     AVIOContext *bc    = s->pb;
     int64_t end;
     uint64_t tmp;
+    int ret;
 
     nut->last_syncpoint_pos = avio_tell(bc) - 8;
 
@@ -567,7 +568,9 @@ static int decode_syncpoint(NUTContext *nut, int64_t *ts, int64_t *back_ptr)
 
     *ts = tmp / nut->time_base_count *
           av_q2d(nut->time_base[tmp % nut->time_base_count]) * AV_TIME_BASE;
-    ff_nut_add_sp(nut, nut->last_syncpoint_pos, *back_ptr, *ts);
+
+    if ((ret = ff_nut_add_sp(nut, nut->last_syncpoint_pos, *back_ptr, *ts)) < 0)
+        return ret;
 
     return 0;
 }
diff --git a/libavformat/nutenc.c b/libavformat/nutenc.c
index 9b1ffaf935..7924530386 100644
--- a/libavformat/nutenc.c
+++ b/libavformat/nutenc.c
@@ -865,7 +865,8 @@ static int nut_write_packet(AVFormatContext *s, AVPacket *pkt)
         ff_put_v(dyn_bc, sp ? (nut->last_syncpoint_pos - sp->pos) >> 4 : 0);
         put_packet(nut, bc, dyn_bc, 1, SYNCPOINT_STARTCODE);
 
-        ff_nut_add_sp(nut, nut->last_syncpoint_pos, 0 /*unused*/, pkt->dts);
+        if ((ret = ff_nut_add_sp(nut, nut->last_syncpoint_pos, 0 /*unused*/, pkt->dts)) < 0)
+            return ret;
 
         if ((1ll<<60) % nut->sp_count == 0)
             for (i=0; i<s->nb_streams; i++) {