Merge remote-tracking branch 'qatar/master'

* qatar/master: (34 commits)
  h264: reset h->ref_count in case of errors in ff_h264_decode_ref_pic_list_reordering()
  error_resilience: fix the check for missing references in ff_er_frame_end() for H264
  4xm: prevent NULL dereference with invalid huffman table
  4xmdemux: prevent use of uninitialized memory
  4xm: clear FF_INPUT_BUFFER_PADDING_SIZE bytes in temporary buffers
  ptx: check for out of bound reads
  tiffdec: fix out of bound reads/writes
  eacmv: check for out of bound reads
  eacmv: fix potential pointer arithmetic overflows
  adpcm: fix out of bound reads due to integer overflow
  anm: prevent infinite loop
  avsdemux: check for out of bound writes
  avs: check for out of bound reads
  avsdemux: check for corrupted data
  AVOptions: refactor set_number/write_number
  AVOptions: cosmetics, rename static av_set_number2() to write_number().
  AVOptions: cosmetics, move and rename static av_set_number().
  AVOptions: split av_set_string3 into opt type-specific functions
  avidec: fix signed overflow in avi_sync()
  mxfdec: Fix some buffer overreads caused by the misuse of AVPacket related functions.
  ...

Conflicts:
	Changelog
	configure
	libavcodec/ptx.c
	libavcodec/ra144.c
	libavcodec/vaapi_vc1.c
	libavcodec/vc1.c
	libavcodec/version.h
	libavformat/4xm.c
	libavformat/avidec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 4 insertions, 3 deletions

diff --git a/libavformat/avidec.c b/libavformat/avidec.c
index 8dce8f8c45..acb73aff19 100644
--- a/libavformat/avidec.c
+++ b/libavformat/avidec.c
@@ -874,12 +874,13 @@ static int avi_sync(AVFormatContext *s, int exit_early)
 {
     AVIContext *avi = s->priv_data;
     AVIOContext *pb = s->pb;
-    int n, d[8];
+    int n;
+    unsigned int d[8];
     unsigned int size;
     int64_t i, sync;
 
 start_sync:
-    memset(d, -1, sizeof(int)*8);
+    memset(d, -1, sizeof(d));
     for(i=sync=avio_tell(pb); !url_feof(pb); i++) {
         int j;
 
@@ -891,7 +892,7 @@ start_sync:
 
         n= get_stream_idx(d+2);
 //av_log(s, AV_LOG_DEBUG, "%X %X %X %X %X %X %X %X %"PRId64" %d %d\n", d[0], d[1], d[2], d[3], d[4], d[5], d[6], d[7], i, size, n);
-        if(i + (uint64_t)size > avi->fsize || d[0]<0)
+        if(i + (uint64_t)size > avi->fsize || d[0] > 127)
             continue;
 
         //parse ix##