Merge remote-tracking branch 'qatar/master'

* qatar/master: (38 commits)
  v210enc: remove redundant check for pix_fmt
  wavpack: allow user to disable CRC checking
  v210enc: Use Bytestream2 functions
  cafdec: Check return value of avio_seek and avoid modifying state if it fails
  yop: Check return value of avio_seek and avoid modifying state if it fails
  tta: Check return value of avio_seek and avoid modifying state if it fails
  tmv: Check return value of avio_seek and avoid modifying state if it fails
  r3d: Check return value of avio_seek and avoid modifying state if it fails
  nsvdec: Check return value of avio_seek and avoid modifying state if it fails
  mpc8: Check return value of avio_seek and avoid modifying state if it fails
  jvdec: Check return value of avio_seek and avoid modifying state if it fails
  filmstripdec: Check return value of avio_seek and avoid modifying state if it fails
  ffmdec: Check return value of avio_seek and avoid modifying state if it fails
  dv: Check return value of avio_seek and avoid modifying state if it fails
  bink: Check return value of avio_seek and avoid modifying state if it fails
  Check AVCodec.pix_fmts in avcodec_open2()
  svq3: Prevent illegal reads while parsing extradata.
  remove ParseContext1
  vc1: use ff_parse_close
  mpegvideo parser: move specific fields into private context
  ...

Conflicts:
	libavcodec/4xm.c
	libavcodec/aacdec.c
	libavcodec/h264.c
	libavcodec/h264.h
	libavcodec/h264_cabac.c
	libavcodec/h264_cavlc.c
	libavcodec/mpeg4video_parser.c
	libavcodec/svq3.c
	libavcodec/v210enc.c
	libavformat/cafdec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 16 insertions, 7 deletions

diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c
index d96ce8ee8d..aec56fd161 100644
--- a/libavcodec/svq3.c
+++ b/libavcodec/svq3.c
@@ -614,7 +614,7 @@ static int svq3_decode_mb(SVQ3Context *svq3, unsigned int mb_type)
         dir = i_mb_type_info[mb_type - 8].pred_mode;
         dir = (dir >> 1) ^ 3*(dir & 1) ^ 1;
 
-        if ((h->intra16x16_pred_mode = ff_h264_check_intra16x16_pred_mode(h, dir)) == -1){
+        if ((h->intra16x16_pred_mode = ff_h264_check_intra_pred_mode(h, dir, 0)) == -1){
             av_log(h->s.avctx, AV_LOG_ERROR, "check_intra_pred_mode = -1\n");
             return -1;
         }
@@ -713,7 +713,7 @@ static int svq3_decode_mb(SVQ3Context *svq3, unsigned int mb_type)
     s->current_picture.f.mb_type[mb_xy] = mb_type;
 
     if (IS_INTRA(mb_type)) {
-        h->chroma_pred_mode = ff_h264_check_intra_chroma_pred_mode(h, DC_PRED8x8);
+        h->chroma_pred_mode = ff_h264_check_intra_pred_mode(h, DC_PRED8x8, 1);
     }
 
     return 0;
@@ -813,7 +813,9 @@ static av_cold int svq3_decode_init(AVCodecContext *avctx)
     MpegEncContext *s = &h->s;
     int m;
     unsigned char *extradata;
+    unsigned char *extradata_end;
     unsigned int size;
+    int marker_found = 0;
 
     if (ff_h264_decode_init(avctx) < 0)
         return -1;
@@ -834,19 +836,26 @@ static av_cold int svq3_decode_init(AVCodecContext *avctx)
 
         /* prowl for the "SEQH" marker in the extradata */
         extradata = (unsigned char *)avctx->extradata;
-        for (m = 0; m < avctx->extradata_size; m++) {
-            if (!memcmp(extradata, "SEQH", 4))
-                break;
-            extradata++;
+        extradata_end = avctx->extradata + avctx->extradata_size;
+        if (extradata) {
+            for (m = 0; m + 8 < avctx->extradata_size; m++) {
+                if (!memcmp(extradata, "SEQH", 4)) {
+                    marker_found = 1;
+                    break;
+                }
+                extradata++;
+            }
         }
 
         /* if a match was found, parse the extra data */
-        if (extradata && !memcmp(extradata, "SEQH", 4)) {
+        if (marker_found) {
 
             GetBitContext gb;
             int frame_size_code;
 
             size = AV_RB32(&extradata[4]);
+            if (size > extradata_end - extradata - 8)
+                return AVERROR_INVALIDDATA;
             init_get_bits(&gb, extradata + 8, size*8);
 
             /* 'frame size code' and optional 'width, height' */