Merge commit '75647dea6f7db79b409bad66a119f5c73da730f3'

* commit '75647dea6f7db79b409bad66a119f5c73da730f3':
  oggparseogm: check timing variables

See: 9ed388f5985992a0a6a43fdc0b1732962b6b5619
Merged-by: Michael Niedermayer <michaelni@gmx.at>

diff --cc libavformat/oggparseogm.c
index fe4c1f2,2313625..95369df
--- 1/libavformat/oggparseogm.c
--- 2/libavformat/oggparseogm.c
+++ b/libavformat/oggparseogm.c
@@@ -70,15 -68,18 +70,20 @@@ ogm_header(AVFormatContext *s, int idx
              acid[4] = 0;
              cid = strtol(acid, NULL, 16);
              st->codec->codec_id = ff_codec_get_id(ff_codec_wav_tags, cid);
 -            st->need_parsing = AVSTREAM_PARSE_FULL;
 +            // our parser completely breaks AAC in Ogg
 +            if (st->codec->codec_id != AV_CODEC_ID_AAC)
 +                st->need_parsing = AVSTREAM_PARSE_FULL;
          }
  
 -        bytestream2_skip(&p, 4);    /* useless size field */
 -
 +        size        = bytestream2_get_le32(&p);
 +        size        = FFMIN(size, os->psize);
          time_unit   = bytestream2_get_le64(&p);
          spu         = bytestream2_get_le64(&p);
+         if (!time_unit || !spu) {
+             av_log(s, AV_LOG_ERROR, "Invalid timing values.\n");
+             return AVERROR_INVALIDDATA;
+         }
+ 
          bytestream2_skip(&p, 4);    /* default_len */
          bytestream2_skip(&p, 8);    /* buffersize + bits_per_sample */
  
@@@ -90,18 -91,8 +95,18 @@@
              st->codec->channels = bytestream2_get_le16(&p);
              bytestream2_skip(&p, 2); /* block_align */
              st->codec->bit_rate = bytestream2_get_le32(&p) * 8;
-             st->codec->sample_rate = time_unit ? spu * 10000000 / time_unit : 0;
+             st->codec->sample_rate = spu * 10000000 / time_unit;
              avpriv_set_pts_info(st, 64, 1, st->codec->sample_rate);
 +            if (size >= 56 && st->codec->codec_id == AV_CODEC_ID_AAC) {
 +                bytestream2_skip(&p, 4);
 +                size -= 4;
 +            }
 +            if (size > 52) {
 +                av_assert0(FF_INPUT_BUFFER_PADDING_SIZE <= 52);
 +                size -= 52;
 +                ff_alloc_extradata(st->codec, size);
 +                bytestream2_get_buffer(&p, st->codec->extradata, st->codec->extradata_size);
 +            }
          }
      } else if (bytestream2_peek_byte(&p) == 3) {
          bytestream2_skip(&p, 7);