Merge branch 'release/0.7' into oldabi

* release/0.7: (290 commits)
  nuv: Fix combination of size changes and LZO compression.
  av_lzo1x_decode: properly handle negative buffer length.
  Do not call parse_keyframes_index with NULL stream.
  update versions for 0.7 branch
  Version numbers for 0.8.6
  snow: emu edge support Fixes Ticket592
  imc: validate channel count
  imc: check for ff_fft_init() failure (cherry picked from commit 95fee70d6773fde1c34ff6422f48e5e66f37f263)
  libgsmdec: check output buffer size before decoding (cherry picked from commit b03761b1309293bbf30edef767503875277b01cf)
  configure: fix arch x86_32
  mp3enc: avoid truncating id3v1 tags by one byte
  asfdec: Check packet_replic_size earlier
  cin audio: validate the channel count
  binkaudio: add some buffer overread checks.
  atrac1: validate number of channels (cherry picked from commit bff5b2c1ca1290ea30587ff2f76171f9e3854872)
  atrac1: check output buffer size before decoding (cherry picked from commit 33684b9c12b74c0140fb91e8150263db4a48d55e)
  vp3: fix oob read for negative tokens and memleaks on error. (cherry picked from commit 8370e426e42f2e4b9d14a1fb8107ecfe5163ce7f)
  apedec: set s->currentframeblocks after validating nblocks
  apedec: use unsigned int for 'nblocks' and make sure that it's within int range
  apedec: check for data buffer realloc failure (cherry picked from commit 11ca8b2d7486e879926488404b3b79af774f0f2d)
  ...

Conflicts:
	Changelog
	Makefile
	RELEASE
	configure
	libavcodec/error_resilience.c
	libavcodec/mpegvideo.c
	libavformat/matroskaenc.c
	tests/ref/lavf/mxf

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 25 insertions, 1 deletions

diff --git a/libavutil/mem.c b/libavutil/mem.c
index fa2c388ff4..9916234c3d 100644
--- a/libavutil/mem.c
+++ b/libavutil/mem.c
@@ -137,12 +137,29 @@ void *av_realloc(void *ptr, FF_INTERNAL_MEM_TYPE size)
     //FIXME this isn't aligned correctly, though it probably isn't needed
     if(!ptr) return av_malloc(size);
     diff= ((char*)ptr)[-1];
-    return (char*)realloc((char*)ptr - diff, size + diff) + diff;
+    ptr= realloc((char*)ptr - diff, size + diff);
+    if(ptr) ptr = (char*)ptr + diff;
+    return ptr;
 #else
     return realloc(ptr, size + !size);
 #endif
 }
 
+void *av_realloc_f(void *ptr, size_t nelem, size_t elsize)
+{
+    size_t size;
+    void *r;
+
+    if (av_size_mult(elsize, nelem, &size)) {
+        av_free(ptr);
+        return NULL;
+    }
+    r = av_realloc(ptr, size);
+    if (!r && size)
+        av_free(ptr);
+    return r;
+}
+
 void av_free(void *ptr)
 {
 #if CONFIG_MEMALIGN_HACK
@@ -168,6 +185,13 @@ void *av_mallocz(FF_INTERNAL_MEM_TYPE size)
     return ptr;
 }
 
+void *av_calloc(size_t nmemb, size_t size)
+{
+    if (size <= 0 || nmemb >= INT_MAX / size)
+        return NULL;
+    return av_mallocz(nmemb * size);
+}
+
 char *av_strdup(const char *s)
 {
     char *ptr= NULL;