4 files changed, 18 insertions, 12 deletions

diff --git a/src/combined/ffmpeg/ff_audio_decoder.c b/src/combined/ffmpeg/ff_audio_decoder.c
index a3c61b097..38b393506 100644
--- a/src/combined/ffmpeg/ff_audio_decoder.c
+++ b/src/combined/ffmpeg/ff_audio_decoder.c
@@ -248,6 +248,8 @@ static void ff_audio_decode_data (audio_decoder_t *this_gen, buf_element_t *buf)
 
               if (extradata + data_len > this->size)
                 break; /* abort early - extradata length is bad */
+              if (extradata > INT_MAX - data_len)
+                break;/*integer overflow*/
 
 	      this->context->extradata_size = data_len;
 	      this->context->extradata      = malloc(this->context->extradata_size +
diff --git a/src/combined/ffmpeg/ff_video_decoder.c b/src/combined/ffmpeg/ff_video_decoder.c
index eca73d982..885e0ec18 100644
--- a/src/combined/ffmpeg/ff_video_decoder.c
+++ b/src/combined/ffmpeg/ff_video_decoder.c
@@ -608,6 +608,10 @@ static void ff_convert_frame(ff_video_decoder_t *this, vo_frame_t *img) {
   su = this->av_frame->data[1];
   sv = this->av_frame->data[2];
 
+  /* Some segfaults & heap corruption have been observed with img->height,
+   * so we use this->bih.biHeight instead (which is the displayed height)
+   */
+
   if (this->context->pix_fmt == PIX_FMT_YUV410P) {
 
     yuv9_to_yv12(
@@ -628,7 +632,7 @@ static void ff_convert_frame(ff_video_decoder_t *this, vo_frame_t *img) {
       img->pitches[2],
      /* width x height */
       img->width,
-      img->height);
+      this->bih.biHeight);
 
   } else if (this->context->pix_fmt == PIX_FMT_YUV411P) {
 
@@ -650,7 +654,7 @@ static void ff_convert_frame(ff_video_decoder_t *this, vo_frame_t *img) {
       img->pitches[2],
      /* width x height */
       img->width,
-      img->height);
+      this->bih.biHeight);
 
   } else if (this->context->pix_fmt == PIX_FMT_RGBA32) {
           
@@ -658,7 +662,7 @@ static void ff_convert_frame(ff_video_decoder_t *this, vo_frame_t *img) {
     uint32_t *argb_pixels;
     uint32_t argb;
 
-    for(y = 0; y < img->height; y++) {
+    for(y = 0; y < this->bih.biHeight; y++) {
       argb_pixels = (uint32_t *)sy;
       for(x = 0; x < img->width; x++) {
         uint8_t r, g, b;
@@ -686,7 +690,7 @@ static void ff_convert_frame(ff_video_decoder_t *this, vo_frame_t *img) {
     uint8_t *src;
     uint16_t pixel16;
 
-    for(y = 0; y < img->height; y++) {
+    for(y = 0; y < this->bih.biHeight; y++) {
       src = sy;
       for(x = 0; x < img->width; x++) {
         uint8_t r, g, b;
@@ -715,7 +719,7 @@ static void ff_convert_frame(ff_video_decoder_t *this, vo_frame_t *img) {
     uint8_t *src;
     uint16_t pixel16;
             
-    for(y = 0; y < img->height; y++) {
+    for(y = 0; y < this->bih.biHeight; y++) {
       src = sy;
       for(x = 0; x < img->width; x++) {
         uint8_t r, g, b;
@@ -743,7 +747,7 @@ static void ff_convert_frame(ff_video_decoder_t *this, vo_frame_t *img) {
     int x, plane_ptr = 0;
     uint8_t *src;
 
-    for(y = 0; y < img->height; y++) {
+    for(y = 0; y < this->bih.biHeight; y++) {
       src = sy;
       for(x = 0; x < img->width; x++) {
         uint8_t r, g, b;
@@ -767,7 +771,7 @@ static void ff_convert_frame(ff_video_decoder_t *this, vo_frame_t *img) {
     int x, plane_ptr = 0;
     uint8_t *src;
 
-    for(y = 0; y < img->height; y++) {
+    for(y = 0; y < this->bih.biHeight; y++) {
       src = sy;
       for(x = 0; x < img->width; x++) {
         uint8_t r, g, b;
@@ -810,7 +814,7 @@ static void ff_convert_frame(ff_video_decoder_t *this, vo_frame_t *img) {
       v_palette[x] = COMPUTE_V(r, g, b);
     }
 
-    for(y = 0; y < img->height; y++) {
+    for(y = 0; y < this->bih.biHeight; y++) {
       src = sy;
       for(x = 0; x < img->width; x++) {
         pixel = *src++;
@@ -827,7 +831,7 @@ static void ff_convert_frame(ff_video_decoder_t *this, vo_frame_t *img) {
           
   } else {
           
-    for (y=0; y<img->height; y++) {
+    for (y = 0; y < this->bih.biHeight; y++) {
       xine_fast_memcpy (dy, sy, img->width);
   
       dy += img->pitches[0];
@@ -835,7 +839,7 @@ static void ff_convert_frame(ff_video_decoder_t *this, vo_frame_t *img) {
       sy += this->av_frame->linesize[0];
     }
 
-    for (y=0; y<(img->height/2); y++) {
+    for (y = 0; y < this->bih.biHeight / 2; y++) {
       
       if (this->context->pix_fmt != PIX_FMT_YUV444P) {
         
diff --git a/src/combined/nsf_demuxer.c b/src/combined/nsf_demuxer.c
index 8ee816c99..059a91ff4 100644
--- a/src/combined/nsf_demuxer.c
+++ b/src/combined/nsf_demuxer.c
@@ -125,7 +125,7 @@ static int demux_nsf_send_chunk(demux_plugin_t *this_gen) {
     buf->type = BUF_AUDIO_NSF;
     bytes_read = this->input->read(this->input, buf->content, buf->max_size);
 
-    if (bytes_read == 0) {
+    if (bytes_read <= 0) {
       /* the file has been completely loaded, free the buffer and start
        * sending control buffers */
       buf->free_buffer(buf);
diff --git a/src/combined/xine_ogg_demuxer.c b/src/combined/xine_ogg_demuxer.c
index 036d2f0fc..5ec30c00d 100644
--- a/src/combined/xine_ogg_demuxer.c
+++ b/src/combined/xine_ogg_demuxer.c
@@ -240,7 +240,7 @@ static int read_ogg_packet (demux_ogg_t *this) {
   while (ogg_sync_pageout(&this->oy,&this->og)!=1) {
     buffer = ogg_sync_buffer(&this->oy, CHUNKSIZE);
     bytes  = this->input->read(this->input, buffer, CHUNKSIZE);
-    if (bytes == 0) {
+    if (bytes <= 0) {
       if (total == 0) {
         lprintf("read_ogg_packet read nothing\n");
         return 0;