Merge remote-tracking branch 'qatar/master'

* qatar/master: (35 commits)
  libopencore-amr: check output buffer size before decoding
  libopencore-amr: remove unneeded buf_size==0 check.
  libopencore-amr: remove unneeded frame_count field.
  aac_latm: remove unneeded check for zero-size packet.
  pcmdec: fix output buffer size check by calculating the actual output size prior to decoding.
  pcmdec: move codec-specific variable declarations to the corresponding codec blocks.
  pcmdec: return buf_size instead of src-buf.
  avcodec: remove the Zork PCM encoder.
  pcm_zork: use AV_SAMPLE_FMT_U8 instead of shifting all samples by 8.
  pcmenc: remove unneeded sample_fmt check.
  pcmdec: move number of channels check to pcm_decode_init()
  pcmdec: remove unnecessary check for sample_fmt change
  pcmdec: move DVD PCM bits_per_coded_sample check near to the code that sets the sample size.
  pcmdec: do not needlessly set *data_size to 0
  alacdec: remove unneeded NULL or zero-size packet checks.
  alacdec: simplify buffer allocation by using FF_ALLOC_OR_GOTO()
  alacdec: ask for a sample for unsupported sample depths.
  alacdec: cosmetics: use 'ch' instead of 'chan' to iterate channels
  alacdec: move some declarations to the top of the function
  alacdec: always use get_sbits_long() for uncompressed samples
  ...

Conflicts:
	libavcodec/pcm.c
	tests/ref/acodec/pcm

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 16 insertions, 13 deletions

diff --git a/libavcodec/libopencore-amr.c b/libavcodec/libopencore-amr.c
index 7af773f581..e456c407a4 100644
--- a/libavcodec/libopencore-amr.c
+++ b/libavcodec/libopencore-amr.c
@@ -79,7 +79,6 @@ static int get_bitrate_mode(int bitrate, void *log_ctx)
 
 typedef struct AMRContext {
     AVClass *av_class;
-    int   frame_count;
     void *dec_state;
     void *enc_state;
     int   enc_bitrate;
@@ -100,7 +99,6 @@ static av_cold int amr_nb_decode_init(AVCodecContext *avctx)
 {
     AMRContext *s  = avctx->priv_data;
 
-    s->frame_count = 0;
     s->dec_state   = Decoder_Interface_init();
     if (!s->dec_state) {
         av_log(avctx, AV_LOG_ERROR, "Decoder_Interface_init error\n");
@@ -133,10 +131,16 @@ static int amr_nb_decode_frame(AVCodecContext *avctx, void *data,
     AMRContext *s      = avctx->priv_data;
     static const uint8_t block_size[16] = { 12, 13, 15, 17, 19, 20, 26, 31, 5, 0, 0, 0, 0, 0, 0, 0 };
     enum Mode dec_mode;
-    int packet_size;
+    int packet_size, out_size;
 
     av_dlog(avctx, "amr_decode_frame buf=%p buf_size=%d frame_count=%d!!\n",
-            buf, buf_size, s->frame_count);
+            buf, buf_size, avctx->frame_number);
+
+    out_size = 160 * av_get_bytes_per_sample(avctx->sample_fmt);
+    if (*data_size < out_size) {
+        av_log(avctx, AV_LOG_ERROR, "output buffer is too small\n");
+        return AVERROR(EINVAL);
+    }
 
     dec_mode    = (buf[0] >> 3) & 0x000F;
     packet_size = block_size[dec_mode] + 1;
@@ -147,12 +151,11 @@ static int amr_nb_decode_frame(AVCodecContext *avctx, void *data,
         return AVERROR_INVALIDDATA;
     }
 
-    s->frame_count++;
     av_dlog(avctx, "packet_size=%d buf= 0x%X %X %X %X\n",
               packet_size, buf[0], buf[1], buf[2], buf[3]);
     /* call decoder */
     Decoder_Interface_Decode(s->dec_state, buf, data, 0);
-    *data_size = 160 * 2;
+    *data_size = out_size;
 
     return packet_size;
 }
@@ -172,8 +175,6 @@ static av_cold int amr_nb_encode_init(AVCodecContext *avctx)
 {
     AMRContext *s = avctx->priv_data;
 
-    s->frame_count = 0;
-
     if (avctx->sample_rate != 8000) {
         av_log(avctx, AV_LOG_ERROR, "Only 8000Hz sample rate supported\n");
         return AVERROR(ENOSYS);
@@ -276,12 +277,14 @@ static int amr_wb_decode_frame(AVCodecContext *avctx, void *data,
     int buf_size       = avpkt->size;
     AMRWBContext *s    = avctx->priv_data;
     int mode;
-    int packet_size;
+    int packet_size, out_size;
     static const uint8_t block_size[16] = {18, 24, 33, 37, 41, 47, 51, 59, 61, 6, 6, 0, 0, 0, 1, 1};
 
-    if (!buf_size)
-        /* nothing to do */
-        return 0;
+    out_size = 320 * av_get_bytes_per_sample(avctx->sample_fmt);
+    if (*data_size < out_size) {
+        av_log(avctx, AV_LOG_ERROR, "output buffer is too small\n");
+        return AVERROR(EINVAL);
+    }
 
     mode        = (buf[0] >> 3) & 0x000F;
     packet_size = block_size[mode];
@@ -293,7 +296,7 @@ static int amr_wb_decode_frame(AVCodecContext *avctx, void *data,
     }
 
     D_IF_decode(s->state, buf, data, _good_frame);
-    *data_size = 320 * 2;
+    *data_size = out_size;
     return packet_size;
 }