Merge remote-tracking branch 'qatar/master'

* qatar/master: (29 commits)
  amrwb: remove duplicate arguments from extrapolate_isf().
  amrwb: error out early if mode is invalid.
  h264: change underread for 10bit QPEL to overread.
  matroska: check buffer size for RM-style byte reordering.
  vp8: disable mmx functions with sse/sse2 counterparts on x86-64.
  vp8: change int stride to ptrdiff_t stride.
  wma: fix invalid buffer size assumptions causing random overreads.
  Windows Media Audio Lossless decoder
  rv10/20: Fix slice overflow with checked bitstream reader.
  h263dec: Disallow width/height changing with frame threads.
  rv10/20: Fix a buffer overread caused by losing track of the remaining buffer size.
  rmdec: Honor .RMF tag size rather than assuming 18.
  g722: Fix the QMF scaling
  r3d: don't set codec timebase.
  electronicarts: set timebase for tgv video.
  electronicarts: parse the framerate for cmv video.
  ogg: don't set codec timebase
  electronicarts: don't set codec timebase
  avs: don't set codec timebase
  wavpack: Fix an integer overflow
  ...

Conflicts:
	libavcodec/arm/vp8dsp_init_arm.c
	libavcodec/fraps.c
	libavcodec/h264.c
	libavcodec/mpeg4videodec.c
	libavcodec/mpegvideo.c
	libavcodec/msmpeg4.c
	libavcodec/pnmdec.c
	libavcodec/qpeg.c
	libavcodec/rawenc.c
	libavcodec/ulti.c
	libavcodec/vcr1.c
	libavcodec/version.h
	libavcodec/wmalosslessdec.c
	libavformat/electronicarts.c
	libswscale/ppc/yuv2rgb_altivec.c
	tests/ref/acodec/g722
	tests/ref/fate/ea-cmv

Merged-by: Michael Niedermayer <michaelni@gmx.at>

7 files changed, 67 insertions, 34 deletions

diff --git a/libavformat/avs.c b/libavformat/avs.c
index 75efe15306..8f3dd27dae 100644
--- a/libavformat/avs.c
+++ b/libavformat/avs.c
@@ -188,8 +188,8 @@ static int avs_read_packet(AVFormatContext * s, AVPacket * pkt)
                     avs->st_video->codec->height = avs->height;
                     avs->st_video->codec->bits_per_coded_sample=avs->bits_per_sample;
                     avs->st_video->nb_frames = avs->nb_frames;
-                    avs->st_video->codec->time_base = (AVRational) {
-                    1, avs->fps};
+                    avs->st_video->r_frame_rate = avs->st_video->avg_frame_rate =
+                                                  (AVRational){avs->fps, 1};
                 }
                 return avs_read_video_packet(s, pkt, type, sub_type, size,
                                              palette, palette_size);
diff --git a/libavformat/electronicarts.c b/libavformat/electronicarts.c
index 55cab7c70f..9719c6711a 100644
--- a/libavformat/electronicarts.c
+++ b/libavformat/electronicarts.c
@@ -283,6 +283,20 @@ static int process_video_header_vp6(AVFormatContext *s)
     return 1;
 }
 
+static int process_video_header_cmv(AVFormatContext *s)
+{
+    EaDemuxContext *ea = s->priv_data;
+    int fps;
+
+    avio_skip(s->pb, 10);
+    fps = avio_rl16(s->pb);
+    if (fps)
+        ea->time_base = (AVRational){1, fps};
+    ea->video_codec = CODEC_ID_CMV;
+
+    return 0;
+}
+
 /*
  * Process EA file header
  * Returns 1 if the EA file is valid and successfully opened, 0 otherwise
@@ -330,7 +344,7 @@ static int process_ea_header(AVFormatContext *s) {
                 break;
 
             case MVIh_TAG :
-                ea->video_codec = CODEC_ID_CMV;
+                err = process_video_header_cmv(s);
                 break;
 
             case kVGT_TAG:
@@ -418,10 +432,12 @@ static int ea_read_header(AVFormatContext *s)
         if (st->codec->codec_id == CODEC_ID_MPEG2VIDEO)
             st->need_parsing = AVSTREAM_PARSE_HEADERS;
         st->codec->codec_tag = 0;  /* no fourcc */
-        if (ea->time_base.num)
-            avpriv_set_pts_info(st, 64, ea->time_base.num, ea->time_base.den);
         st->codec->width = ea->width;
         st->codec->height = ea->height;
+        if (ea->time_base.num)
+            avpriv_set_pts_info(st, 64, ea->time_base.num, ea->time_base.den);
+        st->r_frame_rate = st->avg_frame_rate = (AVRational){ea->time_base.den,
+                                                             ea->time_base.num};
     }
 
     if (ea->audio_codec) {
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 690eac6499..882660e668 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -1921,15 +1921,31 @@ static int matroska_parse_block(MatroskaDemuxContext *matroska, uint8_t *data,
                 if (!track->audio.pkt_cnt) {
                     if (track->audio.sub_packet_cnt == 0)
                         track->audio.buf_timecode = timecode;
-                    if (st->codec->codec_id == CODEC_ID_RA_288)
+                    if (st->codec->codec_id == CODEC_ID_RA_288) {
+                        if (size < cfs * h / 2) {
+                            av_log(matroska->ctx, AV_LOG_ERROR,
+                                   "Corrupt int4 RM-style audio packet size\n");
+                            return AVERROR_INVALIDDATA;
+                        }
                         for (x=0; x<h/2; x++)
                             memcpy(track->audio.buf+x*2*w+y*cfs,
                                    data+x*cfs, cfs);
-                    else if (st->codec->codec_id == CODEC_ID_SIPR)
+                    } else if (st->codec->codec_id == CODEC_ID_SIPR) {
+                        if (size < w) {
+                            av_log(matroska->ctx, AV_LOG_ERROR,
+                                   "Corrupt sipr RM-style audio packet size\n");
+                            return AVERROR_INVALIDDATA;
+                        }
                         memcpy(track->audio.buf + y*w, data, w);
-                    else
+                    } else {
+                        if (size < sps * w / sps) {
+                            av_log(matroska->ctx, AV_LOG_ERROR,
+                                   "Corrupt generic RM-style audio packet size\n");
+                            return AVERROR_INVALIDDATA;
+                        }
                         for (x=0; x<w/sps; x++)
                             memcpy(track->audio.buf+sps*(h*x+((h+1)/2)*(y&1)+(y>>1)), data+x*sps, sps);
+                    }
 
                     if (++track->audio.sub_packet_cnt >= h) {
                         if (st->codec->codec_id == CODEC_ID_SIPR)
diff --git a/libavformat/oggparseogm.c b/libavformat/oggparseogm.c
index 36f61c7680..a69e3baff1 100644
--- a/libavformat/oggparseogm.c
+++ b/libavformat/oggparseogm.c
@@ -84,9 +84,7 @@ ogm_header(AVFormatContext *s, int idx)
         if(st->codec->codec_type == AVMEDIA_TYPE_VIDEO){
             st->codec->width = bytestream_get_le32(&p);
             st->codec->height = bytestream_get_le32(&p);
-            st->codec->time_base.den = spu * 10000000;
-            st->codec->time_base.num = time_unit;
-            avpriv_set_pts_info(st, 64, st->codec->time_base.num, st->codec->time_base.den);
+            avpriv_set_pts_info(st, 64, spu * 10000000, time_unit);
         } else {
             st->codec->channels = bytestream_get_le16(&p);
             p += 2;                 /* block_align */
@@ -132,8 +130,7 @@ ogm_dshow_header(AVFormatContext *s, int idx)
     if(t == 0x05589f80){
         st->codec->codec_type = AVMEDIA_TYPE_VIDEO;
         st->codec->codec_id = ff_codec_get_id(ff_codec_bmp_tags, AV_RL32(p + 68));
-        st->codec->time_base.den = 10000000;
-        st->codec->time_base.num = AV_RL64(p + 164);
+        avpriv_set_pts_info(st, 64, AV_RL64(p + 164), 10000000);
         st->codec->width = AV_RL32(p + 176);
         st->codec->height = AV_RL32(p + 180);
     } else if(t == 0x05589f81){
diff --git a/libavformat/oggparsetheora.c b/libavformat/oggparsetheora.c
index 993db3ee55..d1559f4632 100644
--- a/libavformat/oggparsetheora.c
+++ b/libavformat/oggparsetheora.c
@@ -56,6 +56,7 @@ theora_header (AVFormatContext * s, int idx)
     if (os->buf[os->pstart] == 0x80) {
         GetBitContext gb;
         int width, height;
+        AVRational timebase;
 
         init_get_bits(&gb, os->buf + os->pstart, os->psize*8);
 
@@ -85,14 +86,14 @@ theora_header (AVFormatContext * s, int idx)
 
             skip_bits(&gb, 16);
         }
-        st->codec->time_base.den = get_bits_long(&gb, 32);
-        st->codec->time_base.num = get_bits_long(&gb, 32);
-        if (!(st->codec->time_base.num > 0 && st->codec->time_base.den > 0)) {
+        timebase.den = get_bits_long(&gb, 32);
+        timebase.num = get_bits_long(&gb, 32);
+        if (!(timebase.num > 0 && timebase.den > 0)) {
             av_log(s, AV_LOG_WARNING, "Invalid time base in theora stream, assuming 25 FPS\n");
-            st->codec->time_base.num = 1;
-            st->codec->time_base.den = 25;
+            timebase.num = 1;
+            timebase.den = 25;
         }
-        avpriv_set_pts_info(st, 64, st->codec->time_base.num, st->codec->time_base.den);
+        avpriv_set_pts_info(st, 64, timebase.num, timebase.den);
 
         st->sample_aspect_ratio.num = get_bits_long(&gb, 24);
         st->sample_aspect_ratio.den = get_bits_long(&gb, 24);
diff --git a/libavformat/r3d.c b/libavformat/r3d.c
index 1e0e73ea6b..b37f065693 100644
--- a/libavformat/r3d.c
+++ b/libavformat/r3d.c
@@ -57,6 +57,7 @@ static int r3d_read_red1(AVFormatContext *s)
     char filename[258];
     int tmp;
     int av_unused tmp2;
+    AVRational framerate;
 
     if (!st)
         return AVERROR(ENOMEM);
@@ -84,8 +85,10 @@ static int r3d_read_red1(AVFormatContext *s)
     tmp = avio_rb16(s->pb); // unknown
     av_dlog(s, "unknown2 %d\n", tmp);
 
-    st->codec->time_base.den = avio_rb16(s->pb);
-    st->codec->time_base.num = avio_rb16(s->pb);
+    framerate.num = avio_rb16(s->pb);
+    framerate.den = avio_rb16(s->pb);
+    if (framerate.num && framerate.den)
+        st->r_frame_rate = st->avg_frame_rate = framerate;
 
     tmp = avio_r8(s->pb); // audio channels
     av_dlog(s, "audio channels %d\n", tmp);
@@ -107,7 +110,7 @@ static int r3d_read_red1(AVFormatContext *s)
     av_dlog(s, "resolution %dx%d\n", st->codec->width, st->codec->height);
     av_dlog(s, "timescale %d\n", st->time_base.den);
     av_dlog(s, "frame rate %d/%d\n",
-            st->codec->time_base.num, st->codec->time_base.den);
+            framerate.num, framerate.den);
 
     return 0;
 }
@@ -132,9 +135,11 @@ static int r3d_read_rdvo(AVFormatContext *s, Atom *atom)
         av_dlog(s, "video offset %d: %#x\n", i, r3d->video_offsets[i]);
     }
 
-    if (st->codec->time_base.den)
-        st->duration = (uint64_t)r3d->video_offsets_count*
-            st->time_base.den*st->codec->time_base.num/st->codec->time_base.den;
+    if (st->r_frame_rate.num)
+        st->duration = av_rescale_q(r3d->video_offsets_count,
+                                    (AVRational){st->r_frame_rate.den,
+                                                 st->r_frame_rate.num},
+                                    st->time_base);
     av_dlog(s, "duration %"PRId64"\n", st->duration);
 
     return 0;
@@ -257,9 +262,9 @@ static int r3d_read_redv(AVFormatContext *s, AVPacket *pkt, Atom *atom)
 
     pkt->stream_index = 0;
     pkt->dts = dts;
-    if (st->codec->time_base.den)
+    if (st->r_frame_rate.num)
         pkt->duration = (uint64_t)st->time_base.den*
-            st->codec->time_base.num/st->codec->time_base.den;
+            st->r_frame_rate.den/st->r_frame_rate.num;
     av_dlog(s, "pkt dts %"PRId64" duration %d\n", pkt->dts, pkt->duration);
 
     return 0;
@@ -357,11 +362,11 @@ static int r3d_seek(AVFormatContext *s, int stream_index, int64_t sample_time, i
     R3DContext *r3d = s->priv_data;
     int frame_num;
 
-    if (!st->codec->time_base.num || !st->time_base.den)
+    if (!st->r_frame_rate.num)
         return -1;
 
-    frame_num = sample_time*st->codec->time_base.den/
-        ((int64_t)st->codec->time_base.num*st->time_base.den);
+    frame_num = av_rescale_q(sample_time, st->time_base,
+                             (AVRational){st->r_frame_rate.den, st->r_frame_rate.num});
     av_dlog(s, "seek frame num %d timestamp %"PRId64"\n",
             frame_num, sample_time);
 
diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index 0245411baf..5fb43106c8 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -439,10 +439,8 @@ static int rm_read_header(AVFormatContext *s)
         return AVERROR(EIO);
     }
 
-    avio_rb32(pb); /* header size */
-    avio_rb16(pb);
-    avio_rb32(pb);
-    avio_rb32(pb); /* number of headers */
+    tag_size = avio_rb32(pb);
+    avio_skip(pb, tag_size - 8);
 
     for(;;) {
         if (url_feof(pb))