Merge svn changes up to r27332

7 files changed, 33 insertions, 44 deletions

diff --git a/libmpdemux/demux_asf.c b/libmpdemux/demux_asf.c
index 65741d3ab7..518d08d220 100644
--- a/libmpdemux/demux_asf.c
+++ b/libmpdemux/demux_asf.c
@@ -3,6 +3,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
+#include <limits.h>
 
 #include "config.h"
 #include "mp_msg.h"
@@ -50,9 +51,12 @@ static inline int check_varlen(uint8_t *ptr, uint8_t *endptr, int len) {
 }
 
 static void asf_descrambling(unsigned char **src,unsigned len, struct asf_priv* asf){
-  unsigned char *dst=malloc(len);
+  unsigned char *dst;
   unsigned char *s2=*src;
   unsigned i=0,x,y;
+  if (len > UINT_MAX - MP_INPUT_BUFFER_PADDING_SIZE)
+	return;
+  dst = malloc(len + MP_INPUT_BUFFER_PADDING_SIZE);
   while(len>=asf->scrambling_h*asf->scrambling_w*asf->scrambling_b+i){
 //    mp_msg(MSGT_DEMUX,MSGL_DBG4,"descrambling! (w=%d  b=%d)\n",w,asf_scrambling_b);
 	//i+=asf_scrambling_h*asf_scrambling_w;
@@ -79,19 +83,12 @@ static void init_priv (struct asf_priv* asf){
   asf->vid_ext_frame_index=-1;
 }
 
-#ifdef USE_LIBAVCODEC
-#include "libavcodec/avcodec.h"
-#else
-#define FF_INPUT_BUFFER_PADDING_SIZE 8
-#endif
-
-
 static void demux_asf_append_to_packet(demux_packet_t* dp,unsigned char *data,int len,int offs)
 {
   if(dp->len!=offs && offs!=-1) mp_msg(MSGT_DEMUX,MSGL_V,"warning! fragment.len=%d BUT next fragment offset=%d  \n",dp->len,offs);
-  dp->buffer=realloc(dp->buffer,dp->len+len+FF_INPUT_BUFFER_PADDING_SIZE);
+  dp->buffer=realloc(dp->buffer,dp->len+len+MP_INPUT_BUFFER_PADDING_SIZE);
   fast_memcpy(dp->buffer+dp->len,data,len);
-  memset(dp->buffer+dp->len+len, 0, FF_INPUT_BUFFER_PADDING_SIZE);
+  memset(dp->buffer+dp->len+len, 0, MP_INPUT_BUFFER_PADDING_SIZE);
   mp_dbg(MSGT_DEMUX,MSGL_DBG4,"data appended! %d+%d\n",dp->len,len);
   dp->len+=len;
 }
@@ -488,6 +485,7 @@ static int demux_asf_fill_buffer(demuxer_t *demux, demux_stream_t *ds){
               }
               if(len<0 || (p+len)>p_end){
                 mp_msg(MSGT_DEMUX,MSGL_V,"ASF_parser: warning! segment len=%d\n",len);
+                len = p_end - p;
               }
               mp_dbg(MSGT_DEMUX,MSGL_DBG4,"  seg #%d: streamno=%d  seq=%d  type=%02X  len=%d\n",seg,streamno,seq,rlen,len);
 
diff --git a/libmpdemux/demux_mov.c b/libmpdemux/demux_mov.c
index 1f0358a799..c15b205774 100644
--- a/libmpdemux/demux_mov.c
+++ b/libmpdemux/demux_mov.c
@@ -1751,7 +1751,7 @@ static int lschunks_intrak(demuxer_t* demuxer, int level, unsigned int id,
              "MOV: %*sSample duration table! (%d blocks)\n", level, "",
              len);
       trak->durmap = calloc(len, sizeof(mov_durmap_t));
-      trak->durmap_size = trak->durmap ? 0 : len;
+      trak->durmap_size = trak->durmap ? len : 0;
       for (i = 0; i < trak->durmap_size; i++) {
         trak->durmap[i].num = stream_read_dword(demuxer->stream);
         trak->durmap[i].dur = stream_read_dword(demuxer->stream);
@@ -1887,7 +1887,7 @@ static int lschunks_intrak(demuxer_t* demuxer, int level, unsigned int id,
              "MOV: %*sEdit list table (%d entries) (ver:%d,flags:%d)\n", level, "",
              entries, ver, flags);
 #if 1
-      trak->editlist = calloc(trak->editlist_size, sizeof(mov_editlist_t));
+      trak->editlist = calloc(entries, sizeof(mov_editlist_t));
       trak->editlist_size = trak->editlist ? entries : 0;
       for (i = 0; i < trak->editlist_size; i++) {
         int dur = stream_read_dword(demuxer->stream);
diff --git a/libmpdemux/demux_real.c b/libmpdemux/demux_real.c
index d48af16413..7de8611ec0 100644
--- a/libmpdemux/demux_real.c
+++ b/libmpdemux/demux_real.c
@@ -33,12 +33,6 @@ Video codecs: (supported by RealPlayer8 for Linux)
 #include "demuxer.h"
 #include "stheader.h"
 
-#ifdef USE_LIBAVCODEC
-#include "libavcodec/avcodec.h"
-#else
-#define FF_INPUT_BUFFER_PADDING_SIZE 8
-#endif
-
 //#define mp_dbg(mod,lev, args... ) mp_msg_c((mod<<8)|lev, ## args )
 
 #define MKTAG(a, b, c, d) (a | (b << 8) | (c << 16) | (d << 24))
@@ -940,8 +934,8 @@ got_video:
 			    // increase buffer size, this should not happen!
 			    mp_msg(MSGT_DEMUX,MSGL_WARN, "chunktab buffer too small!!!!!\n");
 			    dp->len=dp_hdr->chunktab+8*(4+dp_hdr->chunks);
-			    dp->buffer=realloc(dp->buffer,dp->len+FF_INPUT_BUFFER_PADDING_SIZE);
-			    memset(dp->buffer + dp->len, 0, FF_INPUT_BUFFER_PADDING_SIZE);
+			    dp->buffer=realloc(dp->buffer,dp->len+MP_INPUT_BUFFER_PADDING_SIZE);
+			    memset(dp->buffer + dp->len, 0, MP_INPUT_BUFFER_PADDING_SIZE);
 			    // re-calc pointers:
 			    dp_hdr=(dp_hdr_t*)dp->buffer;
 			    dp_data=dp->buffer+sizeof(dp_hdr_t);
diff --git a/libmpdemux/demux_viv.c b/libmpdemux/demux_viv.c
index 46ff28841d..489ccaaf19 100644
--- a/libmpdemux/demux_viv.c
+++ b/libmpdemux/demux_viv.c
@@ -14,12 +14,6 @@
 #include "demuxer.h"
 #include "stheader.h"
 
-#ifdef USE_LIBAVCODEC
-#include "libavcodec/avcodec.h"
-#else
-#define FF_INPUT_BUFFER_PADDING_SIZE 8
-#endif
-
 /* parameters ! */
 int vivo_param_version = -1;
 char *vivo_param_acodec = NULL;
@@ -384,10 +378,10 @@ static int demux_vivo_fill_buffer(demuxer_t *demux, demux_stream_t *dsds){
       } else {
         // append data to it!
         demux_packet_t* dp=ds->asf_packet;
-        if(dp->len + len + FF_INPUT_BUFFER_PADDING_SIZE < 0)
+        if(dp->len + len + MP_INPUT_BUFFER_PADDING_SIZE < 0)
 	    return 0;
-        dp->buffer=realloc(dp->buffer,dp->len+len+FF_INPUT_BUFFER_PADDING_SIZE);
-        memset(dp->buffer+dp->len+len, 0, FF_INPUT_BUFFER_PADDING_SIZE);
+        dp->buffer=realloc(dp->buffer,dp->len+len+MP_INPUT_BUFFER_PADDING_SIZE);
+        memset(dp->buffer+dp->len+len, 0, MP_INPUT_BUFFER_PADDING_SIZE);
         //memcpy(dp->buffer+dp->len,data,len);
 	stream_read(demux->stream,dp->buffer+dp->len,len);
         mp_dbg(MSGT_DEMUX,MSGL_DBG4,"data appended! %d+%d\n",dp->len,len);
diff --git a/libmpdemux/demuxer.c b/libmpdemux/demuxer.c
index 5d51a30b50..e7234b14af 100644
--- a/libmpdemux/demuxer.c
+++ b/libmpdemux/demuxer.c
@@ -28,6 +28,13 @@
 #include "libass/ass_mp.h"
 #endif
 
+#ifdef USE_LIBAVCODEC
+#include "libavcodec/avcodec.h"
+#if MP_INPUT_BUFFER_PADDING_SIZE < FF_INPUT_BUFFER_PADDING_SIZE
+#error MP_INPUT_BUFFER_PADDING_SIZE is too small!
+#endif
+#endif
+
 extern void resync_video_stream(sh_video_t *sh_video);
 extern void resync_audio_stream(sh_audio_t *sh_audio);
 
diff --git a/libmpdemux/demuxer.h b/libmpdemux/demuxer.h
index 58744f8a0f..be4339b62e 100644
--- a/libmpdemux/demuxer.h
+++ b/libmpdemux/demuxer.h
@@ -92,6 +92,8 @@ struct MPOpts;
 #define SEEK_ABSOLUTE (1 << 0)
 #define SEEK_FACTOR   (1 << 1)
 
+#define MP_INPUT_BUFFER_PADDING_SIZE 8
+
 // Holds one packet/frame/whatever
 typedef struct demux_packet {
   int len;
@@ -240,7 +242,7 @@ static inline demux_packet_t* new_demux_packet(int len){
   dp->refcount=1;
   dp->master=NULL;
   dp->buffer=NULL;
-  if (len > 0 && (dp->buffer = (unsigned char *)malloc(len + 8)))
+  if (len > 0 && (dp->buffer = (unsigned char *)malloc(len + MP_INPUT_BUFFER_PADDING_SIZE)))
     memset(dp->buffer + len, 0, 8);
   else
     dp->len = 0;
diff --git a/libmpdemux/video.c b/libmpdemux/video.c
index b0f72c515f..95348a8efa 100644
--- a/libmpdemux/video.c
+++ b/libmpdemux/video.c
@@ -22,12 +22,6 @@
 /* sub_cc (closed captions)*/
 #include "sub_cc.h"
 
-#ifdef USE_LIBAVCODEC
-#include "libavcodec/avcodec.h"
-#else
-#define FF_INPUT_BUFFER_PADDING_SIZE 8
-#endif
-
 /* biCompression constant */
 #define BI_RGB        0L
 
@@ -117,8 +111,8 @@ switch(video_codec){
    }
    mp_msg(MSGT_DECVIDEO,MSGL_V,"OK!\n");
    if(!videobuffer) {
-     videobuffer=(char*)memalign(8,VIDEOBUFFER_SIZE + FF_INPUT_BUFFER_PADDING_SIZE);
-     if (videobuffer) memset(videobuffer+VIDEOBUFFER_SIZE, 0, FF_INPUT_BUFFER_PADDING_SIZE);
+     videobuffer=(char*)memalign(8,VIDEOBUFFER_SIZE + MP_INPUT_BUFFER_PADDING_SIZE);
+     if (videobuffer) memset(videobuffer+VIDEOBUFFER_SIZE, 0, MP_INPUT_BUFFER_PADDING_SIZE);
      else {
        mp_msg(MSGT_DECVIDEO,MSGL_ERR,MSGTR_ShMemAllocFail);
        return 0;
@@ -210,8 +204,8 @@ switch(video_codec){
    }
    mp_msg(MSGT_DECVIDEO,MSGL_V,"OK!\n");
    if(!videobuffer) {
-     videobuffer=(char*)memalign(8,VIDEOBUFFER_SIZE + FF_INPUT_BUFFER_PADDING_SIZE);
-     if (videobuffer) memset(videobuffer+VIDEOBUFFER_SIZE, 0, FF_INPUT_BUFFER_PADDING_SIZE);
+     videobuffer=(char*)memalign(8,VIDEOBUFFER_SIZE + MP_INPUT_BUFFER_PADDING_SIZE);
+     if (videobuffer) memset(videobuffer+VIDEOBUFFER_SIZE, 0, MP_INPUT_BUFFER_PADDING_SIZE);
      else {
        mp_msg(MSGT_DECVIDEO,MSGL_ERR,MSGTR_ShMemAllocFail);
        return 0;
@@ -273,8 +267,8 @@ mpeg_header_parser:
    mp_msg(MSGT_DECVIDEO,MSGL_V,"OK!\n");
    // ========= Read & process sequence header & extension ============
    if(!videobuffer) {
-     videobuffer=(char*)memalign(8,VIDEOBUFFER_SIZE + FF_INPUT_BUFFER_PADDING_SIZE);
-     if (videobuffer) memset(videobuffer+VIDEOBUFFER_SIZE, 0, FF_INPUT_BUFFER_PADDING_SIZE);
+     videobuffer=(char*)memalign(8,VIDEOBUFFER_SIZE + MP_INPUT_BUFFER_PADDING_SIZE);
+     if (videobuffer) memset(videobuffer+VIDEOBUFFER_SIZE, 0, MP_INPUT_BUFFER_PADDING_SIZE);
      else {
        mp_msg(MSGT_DECVIDEO,MSGL_ERR,MSGTR_ShMemAllocFail);
        return 0;
@@ -341,8 +335,8 @@ mpeg_header_parser:
    }
    mp_msg(MSGT_DECVIDEO,MSGL_INFO,"found\n");
    if(!videobuffer) {
-     videobuffer=(char*)memalign(8,VIDEOBUFFER_SIZE + FF_INPUT_BUFFER_PADDING_SIZE);
-     if (videobuffer) memset(videobuffer+VIDEOBUFFER_SIZE, 0, FF_INPUT_BUFFER_PADDING_SIZE);
+     videobuffer=(char*)memalign(8,VIDEOBUFFER_SIZE + MP_INPUT_BUFFER_PADDING_SIZE);
+     if (videobuffer) memset(videobuffer+VIDEOBUFFER_SIZE, 0, MP_INPUT_BUFFER_PADDING_SIZE);
      else {
        mp_msg(MSGT_DECVIDEO,MSGL_ERR,MSGTR_ShMemAllocFail);
        return 0;