Merge from 1.1, discarding new "#if"s in ff_video_decoder.c.

3 files changed, 20 insertions, 14 deletions

diff --git a/src/demuxers/demux_4xm.c b/src/demuxers/demux_4xm.c
index 0870179fe..7f4407733 100644
--- a/src/demuxers/demux_4xm.c
+++ b/src/demuxers/demux_4xm.c
@@ -190,9 +190,9 @@ static int open_fourxm_file(demux_fourxm_t *fourxm) {
         return 0;
       }
       const uint32_t current_track = _X_LE_32(&header[i + 8]);
-      if (current_track + 1 > fourxm->track_count) {
+      if (current_track >= fourxm->track_count) {
         fourxm->track_count = current_track + 1;
-        if (fourxm->track_count >= UINT_MAX / sizeof(audio_track_t)) {
+        if (!fourxm->track_count || fourxm->track_count >= UINT_MAX / sizeof(audio_track_t)) {
           free(header);
           return 0;
         }
diff --git a/src/demuxers/demux_qt.c b/src/demuxers/demux_qt.c
index 972395533..0f3c42276 100644
--- a/src/demuxers/demux_qt.c
+++ b/src/demuxers/demux_qt.c
@@ -1581,7 +1581,8 @@ static qt_error parse_trak_atom (qt_trak *trak,
 
     case STTS_ATOM:
       /* there should only be one of these atoms */
-      if (trak->time_to_sample_table) {
+      if (trak->time_to_sample_table
+          || current_atom_size < 12 || current_atom_size >= UINT_MAX) {
         last_error = QT_HEADER_TROUBLE;
         goto free_trak;
       }
@@ -1591,6 +1592,11 @@ static qt_error parse_trak_atom (qt_trak *trak,
       debug_atom_load("    qt stts atom (time-to-sample atom): %d entries\n",
         trak->time_to_sample_count);
 
+      if (trak->time_to_sample_count > (current_atom_size - 12) / 8) {
+        last_error = QT_HEADER_TROUBLE;
+        goto free_trak;
+      }
+
       trak->time_to_sample_table = calloc(trak->time_to_sample_count+1, sizeof(time_to_sample_table_t));
       if (!trak->time_to_sample_table) {
         last_error = QT_NO_MEMORY;
diff --git a/src/demuxers/id3.c b/src/demuxers/id3.c
index db04b89c4..ab15184af 100644
--- a/src/demuxers/id3.c
+++ b/src/demuxers/id3.c
@@ -241,7 +241,7 @@ static int id3v2_parse_header(input_plugin_t *input, uint32_t id3_signature,
 
     lprintf("tag: ID3 v2.%d.%d\n", tag_header->id & 0xFF, tag_header->revision);
     lprintf("flags: %d\n", tag_header->flags);
-    lprintf("size: %d\n", tag_header->size);
+    lprintf("size: %zu\n", tag_header->size);
     return 1;
   } else {
     return 0;
@@ -261,7 +261,7 @@ static int id3v22_parse_frame_header(input_plugin_t *input,
 
     frame_header->size = _X_BE_24_synchsafe(&buf[3]);
 
-    lprintf("frame: %c%c%c: size: %d\n", buf[0], buf[1], buf[2],
+    lprintf("frame: %c%c%c: size: %zu\n", buf[0], buf[1], buf[2],
             frame_header->size);
 
     return 1;
@@ -363,7 +363,7 @@ static int id3v22_parse_tag(input_plugin_t *input,
     while ((pos + ID3V22_FRAME_HEADER_SIZE) <= tag_header.size) {
       if (id3v22_parse_frame_header(input, &tag_frame_header)) {
         pos += ID3V22_FRAME_HEADER_SIZE;
-        if (tag_frame_header.id && tag_frame_header.size) {
+        if (tag_frame_header.id) {
           if ((pos + tag_frame_header.size) <= tag_header.size) {
             if (!id3v22_interp_frame(input, stream, &tag_frame_header)) {
               xprintf(stream->xine, XINE_VERBOSITY_DEBUG, 
@@ -407,7 +407,7 @@ static int id3v23_parse_frame_header(input_plugin_t *input,
     frame_header->size  = _X_BE_32(&buf[4]);
     frame_header->flags = _X_BE_16(buf + 8);
 
-    lprintf("frame: %c%c%c%c, size: %d, flags: %X\n", buf[0], buf[1], buf[2], buf[3],
+    lprintf("frame: %c%c%c%c, size: %zu, flags: %X\n", buf[0], buf[1], buf[2], buf[3],
             frame_header->size, frame_header->flags);
 
     return 1;
@@ -443,11 +443,11 @@ static int id3v23_parse_frame_ext_header(input_plugin_t *input,
       }
 
     } else {
-      lprintf("invalid ext header size: %d\n", frame_ext_header->size);
+      lprintf("invalid ext header size: %zu\n", frame_ext_header->size);
       return 0;
     }
 
-    lprintf("ext header: size: %d, flags: %X, padding_size: %d, crc: %d\n",
+    lprintf("ext header: size: %zu, flags: %X, padding_size: %d, crc: %d\n",
             frame_ext_header->size, frame_ext_header->flags,
             frame_ext_header->padding_size, frame_ext_header->crc);
     return 1;
@@ -549,7 +549,7 @@ static int id3v23_parse_tag(input_plugin_t *input,
     while ((pos + ID3V23_FRAME_HEADER_SIZE) <= tag_header.size) {
       if (id3v23_parse_frame_header(input, &tag_frame_header)) {
         pos += ID3V23_FRAME_HEADER_SIZE;
-        if (tag_frame_header.id && tag_frame_header.size) {
+        if (tag_frame_header.id) {
           if ((pos + tag_frame_header.size) <= tag_header.size) {
             if (!id3v23_interp_frame(input, stream, &tag_frame_header)) {
               xprintf(stream->xine, XINE_VERBOSITY_DEBUG, 
@@ -564,7 +564,7 @@ static int id3v23_parse_tag(input_plugin_t *input,
           pos += tag_frame_header.size;
         } else {
           /* end of frames, the rest is padding */
-	  lprintf("skipping padding %d bytes\n", tag_header.size - pos);
+	  lprintf("skipping padding %zu bytes\n", tag_header.size - pos);
 	  input->seek (input, tag_header.size - pos, SEEK_CUR);
           return 1;
         }
@@ -610,7 +610,7 @@ static int id3v24_parse_frame_header(input_plugin_t *input,
     frame_header->size  = _X_BE_32_synchsafe(&buf[4]);
     frame_header->flags = _X_BE_16(&buf[8]);
 
-    lprintf("frame: %c%c%c%c, size: %d, flags: %X\n", buf[0], buf[1], buf[2], buf[3],
+    lprintf("frame: %c%c%c%c, size: %zu, flags: %X\n", buf[0], buf[1], buf[2], buf[3],
             frame_header->size, frame_header->flags);
 
     return 1;
@@ -690,7 +690,7 @@ static int id3v24_parse_ext_header(input_plugin_t *input,
     } else {
       return 0;
     }
-    lprintf("ext header: size: %d, flags: %X, crc: %d, restrictions: %8X\n",
+    lprintf("ext header: size: %zu, flags: %X, crc: %d, restrictions: %8X\n",
             frame_ext_header->size, frame_ext_header->flags,
             frame_ext_header->crc, frame_ext_header->restrictions);
     return 1;
@@ -794,7 +794,7 @@ static int id3v24_parse_tag(input_plugin_t *input,
     while ((pos + ID3V24_FRAME_HEADER_SIZE) <= tag_header.size) {
       if (id3v24_parse_frame_header(input, &tag_frame_header)) {
         pos += ID3V24_FRAME_HEADER_SIZE;
-        if (tag_frame_header.id && tag_frame_header.size) {
+        if (tag_frame_header.id) {
           if ((pos + tag_frame_header.size) <= tag_header.size) {
             if (!id3v24_interp_frame(input, stream, &tag_frame_header)) {
               xprintf(stream->xine, XINE_VERBOSITY_DEBUG,