Merge remote-tracking branch 'qatar/master'

* qatar/master:
  indeo: Bound-check before applying transform

Conflicts:
	libavcodec/indeo4.c
	libavcodec/indeo5.c
	libavcodec/ivi_common.c

See: af388237093ed6df6f5118b34ef938a2ca2ffbda, 0846719dd11ab3f7a7caee13e7af71f71d913389
Merged-by: Michael Niedermayer <michaelni@gmx.at>

diff --cc libavcodec/indeo4.c
index c35ca33,1d68ded..474140e
--- 1/libavcodec/indeo4.c
--- 2/libavcodec/indeo4.c
+++ b/libavcodec/indeo4.c
@@@ -352,7 -346,13 +352,14 @@@ static int decode_band_hdr(IVI45DecCont
              band->inv_transform = transforms[transform_id].inv_trans;
              band->dc_transform  = transforms[transform_id].dc_trans;
              band->is_2d_trans   = transforms[transform_id].is_2d_trans;
-             band->transform_size= (transform_id < 10) ? 8 : 4;
++
+             if (transform_id < 10)
+                 band->transform_size = 8;
+             else
+                 band->transform_size = 4;
+ 
+             if (band->blk_size != band->transform_size)
+                 return AVERROR_INVALIDDATA;
  
              scan_indx = get_bits(&ctx->gb, 4);
              if (scan_indx == 15) {

diff --cc libavcodec/indeo5.c
Simple merge

diff --cc libavcodec/ivi_common.c
index 417e3ea,0dbed97..62c3017
--- 1/libavcodec/ivi_common.c
--- 2/libavcodec/ivi_common.c
+++ b/libavcodec/ivi_common.c
@@@ -415,6 -407,24 +415,20 @@@ static int ivi_dec_tile_data_size(GetBi
      return len;
  }
  
 -    if (!band->dc_transform)
 -        return 0;
 -
 -
+ static int ivi_dc_transform(IVIBandDesc *band, int *prev_dc, int buf_offs,
+                             int blk_size)
+ {
+     int buf_size = band->pitch * band->aheight - buf_offs;
+     int min_size = (blk_size - 1) * band->pitch + blk_size;
+ 
+     if (min_size > buf_size)
+         return AVERROR_INVALIDDATA;
+ 
+     band->dc_transform(prev_dc, band->buf + buf_offs,
+                        band->pitch, blk_size);
+ 
+     return 0;
+ }
  
  static int ivi_decode_coded_blocks(GetBitContext *gb, IVIBandDesc *band,
                                     ivi_mc_func mc, int mv_x, int mv_y,

diff --cc libavcodec/ivi_common.h
Simple merge