Merge remote-tracking branch 'qatar/master'

* qatar/master: (21 commits)
  fate: allow testing with libavfilter disabled
  x86: XOP/FMA4 CPU detection support
  ws_snd: misc cosmetic clean-ups
  ws_snd: remove the 2-bit ADPCM table and just subtract 2 instead.
  ws_snd: use memcpy() and memset() instead of loops
  ws_snd: use samples pointer for loop termination instead of a separate iterator variable.
  ws_snd: make sure number of channels is 1
  ws_snd: add some checks to prevent buffer overread or overwrite.
  ws_snd: decode to AV_SAMPLE_FMT_U8 instead of S16.
  flacdec: fix buffer size checking in get_metadata_size()
  rtp: Simplify ff_rtp_get_payload_type
  rtpenc: Add a payload type private option
  rtp: Correct ff_rtp_get_payload_type documentation
  avconv: replace all fprintf() by av_log().
  avconv: change av_log verbosity from ERROR to FATAL for fatal errors.
  cmdutils: replace fprintf() by av_log()
  avtools: parse loglevel before all the other options.
  oggdec: add support for Xiph's CELT codec
  sol: return error if av_get_packet() fails.
  cosmetics: reindent and pretty-print
  ...

Conflicts:
	avconv.c
	cmdutils.c
	libavcodec/avcodec.h
	libavcodec/version.h
	libavformat/oggparsecelt.c
	libavformat/utils.c
	libavutil/avutil.h

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 72 insertions, 54 deletions

diff --git a/libavcodec/ws-snd1.c b/libavcodec/ws-snd1.c
index 8e2e8ced99..17b8cbfa3a 100644
--- a/libavcodec/ws-snd1.c
+++ b/libavcodec/ws-snd1.c
@@ -25,47 +25,50 @@
 
 /**
  * @file
- * Westwood SNDx codecs.
+ * Westwood SNDx codecs
  *
  * Reference documents about VQA format and its audio codecs
  * can be found here:
  * http://www.multimedia.cx
  */
 
-static const int8_t ws_adpcm_2bit[] = { -2, -1, 0, 1};
 static const int8_t ws_adpcm_4bit[] = {
     -9, -8, -6, -5, -4, -3, -2, -1,
-     0,  1,  2,  3,  4,  5,  6,  8 };
-
-#define CLIP8(a) if(a>127)a=127;if(a<-128)a=-128;
+     0,  1,  2,  3,  4,  5,  6,  8
+};
 
-static av_cold int ws_snd_decode_init(AVCodecContext * avctx)
+static av_cold int ws_snd_decode_init(AVCodecContext *avctx)
 {
-//    WSSNDContext *c = avctx->priv_data;
+    if (avctx->channels != 1) {
+        av_log_ask_for_sample(avctx, "unsupported number of channels\n");
+        return AVERROR(EINVAL);
+    }
 
-    avctx->sample_fmt = AV_SAMPLE_FMT_S16;
+    avctx->sample_fmt = AV_SAMPLE_FMT_U8;
     return 0;
 }
 
-static int ws_snd_decode_frame(AVCodecContext *avctx,
-                void *data, int *data_size,
-                AVPacket *avpkt)
+static int ws_snd_decode_frame(AVCodecContext *avctx, void *data,
+                               int *data_size, AVPacket *avpkt)
 {
     const uint8_t *buf = avpkt->data;
-    int buf_size = avpkt->size;
-//    WSSNDContext *c = avctx->priv_data;
+    int buf_size       = avpkt->size;
 
     int in_size, out_size;
-    int sample = 0;
-    int i;
-    short *samples = data;
+    int sample = 128;
+    uint8_t *samples = data;
+    uint8_t *samples_end;
 
     if (!buf_size)
         return 0;
 
+    if (buf_size < 4) {
+        av_log(avctx, AV_LOG_ERROR, "packet is too small\n");
+        return AVERROR(EINVAL);
+    }
+
     out_size = AV_RL16(&buf[0]);
-    *data_size = out_size * 2;
-    in_size = AV_RL16(&buf[2]);
+    in_size  = AV_RL16(&buf[2]);
     buf += 4;
 
     if (out_size > *data_size) {
@@ -76,47 +79,63 @@ static int ws_snd_decode_frame(AVCodecContext *avctx,
         av_log(avctx, AV_LOG_ERROR, "Frame data is larger than input buffer\n");
         return -1;
     }
+    samples_end = samples + out_size;
+
     if (in_size == out_size) {
-        for (i = 0; i < out_size; i++)
-            *samples++ = (*buf++ - 0x80) << 8;
+        memcpy(samples, buf, out_size);
+        *data_size = out_size;
         return buf_size;
     }
 
-    while (out_size > 0) {
-        int code;
+    while (samples < samples_end && buf - avpkt->data < buf_size) {
+        int code, smp, size;
         uint8_t count;
-        code = (*buf) >> 6;
-        count = (*buf) & 0x3F;
+        code  = *buf >> 6;
+        count = *buf & 0x3F;
         buf++;
-        switch(code) {
+
+        /* make sure we don't write past the output buffer */
+        switch (code) {
+        case 0:  smp = 4;                              break;
+        case 1:  smp = 2;                              break;
+        case 2:  smp = (count & 0x20) ? 1 : count + 1; break;
+        default: smp = count + 1;                      break;
+        }
+        if (samples_end - samples < smp)
+            break;
+
+        /* make sure we don't read past the input buffer */
+        size = ((code == 2 && (count & 0x20)) || code == 3) ? 0 : count + 1;
+        if ((buf - avpkt->data) + size > buf_size)
+            break;
+
+        switch (code) {
         case 0: /* ADPCM 2-bit */
             for (count++; count > 0; count--) {
                 code = *buf++;
-                sample += ws_adpcm_2bit[code & 0x3];
-                CLIP8(sample);
-                *samples++ = sample << 8;
-                sample += ws_adpcm_2bit[(code >> 2) & 0x3];
-                CLIP8(sample);
-                *samples++ = sample << 8;
-                sample += ws_adpcm_2bit[(code >> 4) & 0x3];
-                CLIP8(sample);
-                *samples++ = sample << 8;
-                sample += ws_adpcm_2bit[(code >> 6) & 0x3];
-                CLIP8(sample);
-                *samples++ = sample << 8;
-                out_size -= 4;
+                sample += ( code       & 0x3) - 2;
+                sample = av_clip_uint8(sample);
+                *samples++ = sample;
+                sample += ((code >> 2) & 0x3) - 2;
+                sample = av_clip_uint8(sample);
+                *samples++ = sample;
+                sample += ((code >> 4) & 0x3) - 2;
+                sample = av_clip_uint8(sample);
+                *samples++ = sample;
+                sample +=  (code >> 6)        - 2;
+                sample = av_clip_uint8(sample);
+                *samples++ = sample;
             }
             break;
         case 1: /* ADPCM 4-bit */
             for (count++; count > 0; count--) {
                 code = *buf++;
                 sample += ws_adpcm_4bit[code & 0xF];
-                CLIP8(sample);
-                *samples++ = sample << 8;
+                sample = av_clip_uint8(sample);
+                *samples++ = sample;
                 sample += ws_adpcm_4bit[code >> 4];
-                CLIP8(sample);
-                *samples++ = sample << 8;
-                out_size -= 2;
+                sample = av_clip_uint8(sample);
+                *samples++ = sample;
             }
             break;
         case 2: /* no compression */
@@ -125,24 +144,23 @@ static int ws_snd_decode_frame(AVCodecContext *avctx,
                 t = count;
                 t <<= 3;
                 sample += t >> 3;
-                *samples++ = sample << 8;
-                out_size--;
+                sample = av_clip_uint8(sample);
+                *samples++ = sample;
             } else { /* copy */
-                for (count++; count > 0; count--) {
-                    *samples++ = (*buf++ - 0x80) << 8;
-                    out_size--;
-                }
-                sample = buf[-1] - 0x80;
+                memcpy(samples, buf, smp);
+                samples += smp;
+                buf     += smp;
+                sample = buf[-1];
             }
             break;
         default: /* run */
-            for(count++; count > 0; count--) {
-                *samples++ = sample << 8;
-                out_size--;
-            }
+            memset(samples, sample, smp);
+            samples += smp;
         }
     }
 
+    *data_size = samples - (uint8_t *)data;
+
     return buf_size;
 }