Merge commit '50c449ac24fbb4c03c15d2e2026cef2204b80385'

* commit '50c449ac24fbb4c03c15d2e2026cef2204b80385':
  iff: validate CMAP palette size
  asfenc: return error on negative timestamp

Conflicts:
	libavformat/iff.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

diff --cc libavformat/asfenc.c
index f3aec9c,6112d3f..9a8a739
--- 1/libavformat/asfenc.c
--- 2/libavformat/asfenc.c
+++ b/libavformat/asfenc.c
@@@ -804,11 -774,19 +804,19 @@@ static int asf_write_packet(AVFormatCon
          flags &= ~AV_PKT_FLAG_KEY;
  
      pts = (pkt->pts != AV_NOPTS_VALUE) ? pkt->pts : pkt->dts;
+ 
+     if (pts < 0) {
+         av_log(s, AV_LOG_ERROR,
+                "Negative dts not supported stream %d, dts %"PRId64"\n",
+                pkt->stream_index, pts);
+         return AVERROR(ENOSYS);
+     }
+ 
      assert(pts != AV_NOPTS_VALUE);
 -    duration      = pts * 10000;
 -    asf->duration = FFMAX(asf->duration, duration + pkt->duration * 10000);
 +    pts *= 10000;
 +    asf->duration = FFMAX(asf->duration, pts + pkt->duration * 10000);
  
 -    packet_st = asf->nb_packets;
 +    packet_number = asf->nb_packets;
      put_frame(s, stream, s->streams[pkt->stream_index],
                pkt->dts, pkt->data, pkt->size, flags);
  

diff --cc libavformat/iff.c
index 5b0d3ff,79f5f16..1efc147
--- 1/libavformat/iff.c
--- 2/libavformat/iff.c
+++ b/libavformat/iff.c
@@@ -243,20 -165,17 +243,23 @@@ static int iff_read_header(AVFormatCont
              }
              break;
  
 +        case ID_CAMG:
 +            if (data_size < 4)
 +                return AVERROR_INVALIDDATA;
 +            screenmode                = avio_rb32(pb);
 +            break;
 +
          case ID_CMAP:
-             if (data_size > INT_MAX - IFF_EXTRA_VIDEO_SIZE - FF_INPUT_BUFFER_PADDING_SIZE)
-                 return AVERROR_INVALIDDATA;
+             if (data_size < 3 || data_size > 768 || data_size % 3) {
+                  av_log(s, AV_LOG_ERROR, "Invalid CMAP chunk size %d\n",
+                         data_size);
+                  return AVERROR_INVALIDDATA;
+             }
 -            st->codec->extradata_size = data_size;
 -            st->codec->extradata      = av_malloc(data_size);
 +            st->codec->extradata_size = data_size + IFF_EXTRA_VIDEO_SIZE;
 +            st->codec->extradata      = av_malloc(data_size + IFF_EXTRA_VIDEO_SIZE + FF_INPUT_BUFFER_PADDING_SIZE);
              if (!st->codec->extradata)
                  return AVERROR(ENOMEM);
 -            if (avio_read(pb, st->codec->extradata, data_size) < 0)
 +            if (avio_read(pb, st->codec->extradata + IFF_EXTRA_VIDEO_SIZE, data_size) < 0)
                  return AVERROR(EIO);
              break;