Merge remote-tracking branch 'qatar/master'

* qatar/master:
  indeo: Bound-check before applying transform

Conflicts:
	libavcodec/indeo4.c
	libavcodec/indeo5.c
	libavcodec/ivi_common.c

See: af388237093ed6df6f5118b34ef938a2ca2ffbda, 0846719dd11ab3f7a7caee13e7af71f71d913389
Merged-by: Michael Niedermayer <michaelni@gmx.at>

diff --cc libavcodec/indeo4.c
index c35ca33fc3b5dfe91c2a954eebfc0700352934b2,1d68ded3ff30ac6f6a37f83eeb7666cbc72cadc2..474140e641bfe04a087c24cbca4e73c60b32ea8b
--- 1/libavcodec/indeo4.c
--- 2/libavcodec/indeo4.c
+++ b/libavcodec/indeo4.c
@@@ -352,7 -346,13 +352,14 @@@ static int decode_band_hdr(IVI45DecCont
              band->inv_transform = transforms[transform_id].inv_trans;
              band->dc_transform  = transforms[transform_id].dc_trans;
              band->is_2d_trans   = transforms[transform_id].is_2d_trans;
-             band->transform_size= (transform_id < 10) ? 8 : 4;
++
+             if (transform_id < 10)
+                 band->transform_size = 8;
+             else
+                 band->transform_size = 4;
+ 
+             if (band->blk_size != band->transform_size)
+                 return AVERROR_INVALIDDATA;
  
              scan_indx = get_bits(&ctx->gb, 4);
              if (scan_indx == 15) {

diff --cc libavcodec/indeo5.c
Simple merge

diff --cc libavcodec/ivi_common.c
index 417e3ea9638bc0d424e269868459cdc0a71fdbff,0dbed97bf3c3b62425b4b15fe687f70e71d824ac..62c30175bed079c29c666001895ce28b992859db
--- 1/libavcodec/ivi_common.c
--- 2/libavcodec/ivi_common.c
+++ b/libavcodec/ivi_common.c
@@@ -415,6 -407,24 +415,20 @@@ static int ivi_dec_tile_data_size(GetBi
      return len;
  }
  
 -    if (!band->dc_transform)
 -        return 0;
 -
 -
+ static int ivi_dc_transform(IVIBandDesc *band, int *prev_dc, int buf_offs,
+                             int blk_size)
+ {
+     int buf_size = band->pitch * band->aheight - buf_offs;
+     int min_size = (blk_size - 1) * band->pitch + blk_size;
+ 
+     if (min_size > buf_size)
+         return AVERROR_INVALIDDATA;
+ 
+     band->dc_transform(prev_dc, band->buf + buf_offs,
+                        band->pitch, blk_size);
+ 
+     return 0;
+ }
  
  static int ivi_decode_coded_blocks(GetBitContext *gb, IVIBandDesc *band,
                                     ivi_mc_func mc, int mv_x, int mv_y,

diff --cc libavcodec/ivi_common.h
Simple merge