Merge commit '6e5cdf26281945ddea3aaf5eca4d127791f23ca8'
authorMichael Niedermayer <michaelni@gmx.at>
Tue, 27 Nov 2012 13:21:13 +0000 (14:21 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 27 Nov 2012 13:31:04 +0000 (14:31 +0100)
* commit '6e5cdf26281945ddea3aaf5eca4d127791f23ca8':
  h264: check ref_count validity for num_ref_idx_active_override_flag
  h264: add missing new line to log message
  dcadec: skip QMF on unused channels
  wavenc: write fact chunk sample count at the correct file position
  riff: do not add empty metadata tags in INFO chunk

Conflicts:
libavcodec/dcadec.c
libavcodec/h264.c
libavformat/riff.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
1  2 
libavcodec/dcadec.c
libavcodec/h264.c
libavformat/riff.c

Simple merge
@@@ -2931,17 -2841,13 +2931,17 @@@ static int decode_slice_header(H264Cont
  
          if (num_ref_idx_active_override_flag) {
              h->ref_count[0] = get_ue_golomb(&s->gb) + 1;
-             if (h->slice_type_nos == AV_PICTURE_TYPE_B)
 -            if (h->ref_count[0] < 1)
 -                return AVERROR_INVALIDDATA;
+             if (h->slice_type_nos == AV_PICTURE_TYPE_B) {
                  h->ref_count[1] = get_ue_golomb(&s->gb) + 1;
-             else
 -                if (h->ref_count[1] < 1)
 -                    return AVERROR_INVALIDDATA;
 -            }
++            } else
 +                // full range is spec-ok in this case, even for frames
 +                h->ref_count[1] = 1;
 +        }
 +
 +        if (h->ref_count[0]-1 > max[0] || h->ref_count[1]-1 > max[1]){
 +            av_log(h->s.avctx, AV_LOG_ERROR, "reference overflow %u > %u or %u > %u\n", h->ref_count[0]-1, max[0], h->ref_count[1]-1, max[1]);
 +            h->ref_count[0] = h->ref_count[1] = 1;
 +            return AVERROR_INVALIDDATA;
          }
  
          if (h->slice_type_nos == AV_PICTURE_TYPE_B)
@@@ -837,7 -734,13 +837,13 @@@ int ff_read_riff_info(AVFormatContext *
  
          chunk_size += (chunk_size & 1);
  
 -        value = av_malloc(chunk_size + 1);
+         if (!chunk_code) {
+             if (chunk_size)
+                 avio_skip(pb, chunk_size);
+             continue;
+         }
 +        value = av_mallocz(chunk_size + 1);
          if (!value) {
              av_log(s, AV_LOG_ERROR, "out of memory, unable to read INFO tag\n");
              return AVERROR(ENOMEM);