Merge remote-tracking branch 'qatar/master'

* qatar/master:
  adtsenc: Check frame size.
  txd: Fix order of operations.
  APIchanges: fill in some blanks
  timer: fix misspelling of "decicycles"
  Eliminate pointless 0/NULL initializers in AVCodec and similar declarations.
  indeo3: cosmetics
  md5proto: Fix order of operations.
  dca: Replace oversized unused get_bits() with skip_bits_long().

Conflicts:
	doc/APIchanges
	libavformat/mmsh.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

11 files changed, 22 insertions, 17 deletions

diff --git a/libavformat/a64.c b/libavformat/a64.c
index edab918129..4c8a942471 100644
--- a/libavformat/a64.c
+++ b/libavformat/a64.c
@@ -166,7 +166,6 @@ static int a64_write_trailer(struct AVFormatContext *s)
 AVOutputFormat ff_a64_muxer = {
     .name = "a64",
     .long_name = NULL_IF_CONFIG_SMALL("a64 - video for Commodore 64"),
-    .mime_type = NULL,
     .extensions = "a64, A64",
     .priv_data_size = sizeof (A64Context),
     .video_codec = CODEC_ID_A64_MULTI,
diff --git a/libavformat/adtsenc.c b/libavformat/adtsenc.c
index 4b14b95ef4..ed1d913347 100644
--- a/libavformat/adtsenc.c
+++ b/libavformat/adtsenc.c
@@ -27,6 +27,8 @@
 #include "avformat.h"
 #include "adts.h"
 
+#define ADTS_MAX_FRAME_BYTES ((1 << 13) - 1)
+
 int ff_adts_decode_extradata(AVFormatContext *s, ADTSContext *adts, uint8_t *buf, int size)
 {
     GetBitContext gb;
@@ -93,6 +95,13 @@ int ff_adts_write_frame_header(ADTSContext *ctx,
 {
     PutBitContext pb;
 
+    unsigned full_frame_size = (unsigned)ADTS_HEADER_SIZE + size + pce_size;
+    if (full_frame_size > ADTS_MAX_FRAME_BYTES) {
+        av_log(NULL, AV_LOG_ERROR, "ADTS frame size too large: %u (max %d)\n",
+               full_frame_size, ADTS_MAX_FRAME_BYTES);
+        return AVERROR_INVALIDDATA;
+    }
+
     init_put_bits(&pb, buf, ADTS_HEADER_SIZE);
 
     /* adts_fixed_header */
@@ -110,7 +119,7 @@ int ff_adts_write_frame_header(ADTSContext *ctx,
     /* adts_variable_header */
     put_bits(&pb, 1, 0);        /* copyright_identification_bit */
     put_bits(&pb, 1, 0);        /* copyright_identification_start */
-    put_bits(&pb, 13, ADTS_HEADER_SIZE + size + pce_size); /* aac_frame_length */
+    put_bits(&pb, 13, full_frame_size); /* aac_frame_length */
     put_bits(&pb, 11, 0x7ff);   /* adts_buffer_fullness */
     put_bits(&pb, 2, 0);        /* number_of_raw_data_blocks_in_frame */
 
@@ -128,7 +137,10 @@ static int adts_write_packet(AVFormatContext *s, AVPacket *pkt)
     if (!pkt->size)
         return 0;
     if (adts->write_adts) {
-        ff_adts_write_frame_header(adts, buf, pkt->size, adts->pce_size);
+        int err = ff_adts_write_frame_header(adts, buf, pkt->size,
+                                             adts->pce_size);
+        if (err < 0)
+            return err;
         avio_write(pb, buf, ADTS_HEADER_SIZE);
         if (adts->pce_size) {
             avio_write(pb, adts->pce_data, adts->pce_size);
diff --git a/libavformat/amr.c b/libavformat/amr.c
index 8c3b1416c8..c2c56cc8c2 100644
--- a/libavformat/amr.c
+++ b/libavformat/amr.c
@@ -176,7 +176,6 @@ static int amr_read_packet(AVFormatContext *s,
 AVInputFormat ff_amr_demuxer = {
     .name           = "amr",
     .long_name      = NULL_IF_CONFIG_SMALL("3GPP AMR file format"),
-    .priv_data_size = 0, /*priv_data_size*/
     .read_probe     = amr_probe,
     .read_header    = amr_read_header,
     .read_packet    = amr_read_packet,
diff --git a/libavformat/md5proto.c b/libavformat/md5proto.c
index 4e041b020f..05ee9d366a 100644
--- a/libavformat/md5proto.c
+++ b/libavformat/md5proto.c
@@ -36,7 +36,7 @@ static int md5_open(URLContext *h, const char *filename, int flags)
         return -1;
     }
 
-    if (!flags & AVIO_FLAG_WRITE)
+    if (!(flags & AVIO_FLAG_WRITE))
         return AVERROR(EINVAL);
 
     av_md5_init(h->priv_data);
diff --git a/libavformat/mmsh.c b/libavformat/mmsh.c
index 47cfea020b..bc93722f1a 100644
--- a/libavformat/mmsh.c
+++ b/libavformat/mmsh.c
@@ -406,7 +406,6 @@ URLProtocol ff_mmsh_protocol = {
     .name      = "mmsh",
     .url_open  = mmsh_open,
     .url_read  = mmsh_read,
-    .url_write = NULL,
     .url_seek  = mmsh_seek,
     .url_close = mmsh_close,
     .url_read_seek  = mmsh_read_seek,
diff --git a/libavformat/mpeg.c b/libavformat/mpeg.c
index 5b72c93c2c..de2dd9dfbe 100644
--- a/libavformat/mpeg.c
+++ b/libavformat/mpeg.c
@@ -620,7 +620,6 @@ AVInputFormat ff_mpegps_demuxer = {
     .read_probe     = mpegps_probe,
     .read_header    = mpegps_read_header,
     .read_packet    = mpegps_read_packet,
-    .read_seek      = NULL, //mpegps_read_seek,
     .read_timestamp = mpegps_read_dts,
     .flags = AVFMT_SHOW_IDS|AVFMT_TS_DISCONT,
 };
diff --git a/libavformat/mpegtsenc.c b/libavformat/mpegtsenc.c
index f072f80d80..abdbb5d1d1 100644
--- a/libavformat/mpegtsenc.c
+++ b/libavformat/mpegtsenc.c
@@ -1006,7 +1006,7 @@ static int mpegts_write_packet(AVFormatContext *s, AVPacket *pkt)
             return -1;
         if ((AV_RB16(pkt->data) & 0xfff0) != 0xfff0) {
             ADTSContext *adts = ts_st->adts;
-            int new_size;
+            int new_size, err;
             if (!adts) {
                 av_log(s, AV_LOG_ERROR, "aac bitstream not in adts format "
                        "and extradata missing\n");
@@ -1018,7 +1018,12 @@ static int mpegts_write_packet(AVFormatContext *s, AVPacket *pkt)
             data = av_malloc(new_size);
             if (!data)
                 return AVERROR(ENOMEM);
-            ff_adts_write_frame_header(adts, data, pkt->size, adts->pce_size);
+            err = ff_adts_write_frame_header(adts, data, pkt->size,
+                                             adts->pce_size);
+            if (err < 0) {
+                av_free(data);
+                return err;
+            }
             if (adts->pce_size) {
                 memcpy(data+ADTS_HEADER_SIZE, adts->pce_data, adts->pce_size);
                 adts->pce_size = 0;
diff --git a/libavformat/rsodec.c b/libavformat/rsodec.c
index 14adc04b4b..0888eca217 100644
--- a/libavformat/rsodec.c
+++ b/libavformat/rsodec.c
@@ -92,11 +92,8 @@ AVInputFormat ff_rso_demuxer = {
     .name           =   "rso",
     .long_name      =   NULL_IF_CONFIG_SMALL("Lego Mindstorms RSO format"),
     .extensions     =   "rso",
-    .priv_data_size =   0,
-    .read_probe     =   NULL, /* no magic value in this format */
     .read_header    =   rso_read_header,
     .read_packet    =   rso_read_packet,
-    .read_close     =   NULL,
     .read_seek      =   pcm_read_seek,
     .codec_tag      =   (const AVCodecTag* const []){ff_codec_rso_tags, 0},
 };
diff --git a/libavformat/rsoenc.c b/libavformat/rsoenc.c
index ca9985b070..ef4350b970 100644
--- a/libavformat/rsoenc.c
+++ b/libavformat/rsoenc.c
@@ -104,7 +104,6 @@ AVOutputFormat ff_rso_muxer = {
     .name           =   "rso",
     .long_name      =   NULL_IF_CONFIG_SMALL("Lego Mindstorms RSO format"),
     .extensions     =   "rso",
-    .priv_data_size =   0,
     .audio_codec    =   CODEC_ID_PCM_U8,
     .video_codec    =   CODEC_ID_NONE,
     .write_header   =   rso_write_header,
diff --git a/libavformat/rtpdec_mpeg4.c b/libavformat/rtpdec_mpeg4.c
index 4548bc7981..f6547bc70e 100644
--- a/libavformat/rtpdec_mpeg4.c
+++ b/libavformat/rtpdec_mpeg4.c
@@ -234,9 +234,6 @@ RTPDynamicProtocolHandler ff_mp4v_es_dynamic_handler = {
     .codec_type         = AVMEDIA_TYPE_VIDEO,
     .codec_id           = CODEC_ID_MPEG4,
     .parse_sdp_a_line   = parse_sdp_line,
-    .alloc              = NULL,
-    .free               = NULL,
-    .parse_packet       = NULL
 };
 
 RTPDynamicProtocolHandler ff_mpeg4_generic_dynamic_handler = {
diff --git a/libavformat/tls.c b/libavformat/tls.c
index 339b799322..26f5ee5106 100644
--- a/libavformat/tls.c
+++ b/libavformat/tls.c
@@ -246,7 +246,6 @@ URLProtocol ff_tls_protocol = {
     .url_open       = tls_open,
     .url_read       = tls_read,
     .url_write      = tls_write,
-    .url_seek       = NULL,
     .url_close      = tls_close,
     .priv_data_size = sizeof(TLSContext),
 };