Merge commit 'bd7b4da0f4627bb6c4a7c2575da83fe6b261a21c'

* commit 'bd7b4da0f4627bb6c4a7c2575da83fe6b261a21c':
  8bps: Bound-check the input buffer

Conflicts:
	libavcodec/8bps.c

See: 66ff90f4a3d81c25feaa672dc8cc9cc88017753d
Merged-by: Michael Niedermayer <michaelni@gmx.at>

diff --cc libavcodec/8bps.c
index a910551,dbe1f22..2c03e8b
--- 1/libavcodec/8bps.c
--- 2/libavcodec/8bps.c
+++ b/libavcodec/8bps.c
@@@ -64,15 -64,20 +64,17 @@@ static int decode_frame(AVCodecContext 
      unsigned char *pixptr, *pixptr_end;
      unsigned int height = avctx->height; // Real image height
      unsigned int dlen, p, row;
-     const unsigned char *lp, *dp;
+     const unsigned char *lp, *dp, *ep;
      unsigned char count;
 -    unsigned int px_inc;
      unsigned int planes     = c->planes;
      unsigned char *planemap = c->planemap;
      int ret;
  
 -    if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) {
 -        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
 +    if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
          return ret;
 -    }
  
+     ep = encoded + buf_size;
+ 
      /* Set data pointer after line lengths */
      dp = encoded + planes * (height << 1);
  
@@@ -94,9 -105,9 +96,9 @@@
                  if ((count = *dp++) <= 127) {
                      count++;
                      dlen -= count + 1;
 -                    if (pixptr + count * px_inc > pixptr_end)
 +                    if (pixptr + count * planes > pixptr_end)
                          break;
-                     if (dp + count > buf + buf_size)
+                     if (ep - dp < count)
                          return AVERROR_INVALIDDATA;
                      while (count--) {
                          *pixptr = *dp++;