Merge lp:~noskcaj/ubuntu/saucy/libav/merge0.8.7-1 into lp:ubuntu/saucy/libav

[Jackson Doak]

Merged to latest debian unstable version

[Martin Pitt (pitti)]

Thanks! Uploaded with a proper changelog.

review: Approve

=== added file '.pc/01-Tweak-doxygen-config.patch/.timestamp'
=== added file '.pc/03-disable-configuration-warnings.patch/.timestamp'
=== added file '.pc/04-ffmpeg-warning-change.patch/.timestamp'
=== modified file 'Changelog'
--- Changelog	2013-03-27 07:57:15 +0000
+++ Changelog	2013-07-10 23:28:31 +0000
@@ -1,6 +1,26 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.
 
+version 0.8.7:
+
+- avfiltergraph: check for sws opts being non-NULL before using them
+- bmv: check for len being valid in bmv_decode_frame()
+- dfa: check for invalid access in decode_wdlt()
+- indeo3: check motion vectors
+- indeo3: fix data size check
+- indeo3: switch parsing the header to bytestream2
+- lavf: make sure stream probe data gets freed.
+- oggdec: fix faulty cleanup prototype
+- oma: Validate sample rates
+- qdm2: check that the FFT size is a power of 2
+- rv10: check that extradata is large enough
+- xmv: check audio track parameters validity
+- xmv: do not leak memory in the error paths in xmv_read_header()
+- aac: check the maximum number of channels
+- indeo3: fix off by one in MV validity check, Bug #503
+- id3v2: check for end of file while unescaping tags
+- wav: Always seek to an even offset, Bug #500, LP: #1174737
+- proresdec: support mixed interlaced/non-interlaced content
 
 version 0.8.6:
 

=== modified file 'RELEASE'
--- RELEASE	2013-03-27 07:57:15 +0000
+++ RELEASE	2013-07-10 23:28:31 +0000
@@ -1,1 +1,1 @@
-0.8.6
+0.8.7

=== modified file 'VERSION'
--- VERSION	2013-03-24 07:35:51 +0000
+++ VERSION	2013-07-10 23:28:31 +0000
@@ -1,1 +1,1 @@
-0.8.6
+0.8.7

=== modified file 'debian/changelog'
--- debian/changelog	2013-03-30 22:41:36 +0000
+++ debian/changelog	2013-07-10 23:28:31 +0000
@@ -1,3 +1,17 @@
+libav (6:0.8.7-1ubuntu1) UNRELEASED; urgency=low
+
+  *merged from debian unstable 
+
+ -- Jackson Doak <[e-mail]>  Thu, 11 Jul 2013 09:21:04 +1000
+
+libav (6:0.8.7-1) unstable; urgency=medium
+
+  * Imported Upstream version 0.8.7, new releases fixes:
+    - wav: Always seek to an even offset, Bug #500, LP: #1174737
+    - A number of further security relevant patches.
+
+ -- Reinhard Tartler <[e-mail]>  Mon, 20 May 2013 11:04:00 +0200
+
 libav (6:0.8.6-1ubuntu2) raring; urgency=low
 
   * Put back the dh_strip invocations. Otherwise, no .ddebs will be

=== modified file 'debian/gbp.conf'
--- debian/gbp.conf	2011-09-28 09:18:34 +0000
+++ debian/gbp.conf	2013-07-10 23:28:31 +0000
@@ -4,3 +4,5 @@
 upstream-tag = upstream/%(version)s
 debian-tag = debian/%(version)s
 pristine-tar = True
+compression = xz
+

=== modified file 'debian/patches/01-Tweak-doxygen-config.patch'
--- debian/patches/01-Tweak-doxygen-config.patch	2012-01-21 09:34:37 +0000
+++ debian/patches/01-Tweak-doxygen-config.patch	2013-07-10 23:28:31 +0000
@@ -7,9 +7,11 @@
  Doxyfile |    2 +-
  1 files changed, 1 insertions(+), 1 deletions(-)
 
---- a/Doxyfile
-+++ b/Doxyfile
-@@ -616,7 +616,7 @@ RECURSIVE              = YES
+Index: libav/Doxyfile
+===================================================================
+--- libav.orig/Doxyfile	2013-07-11 09:20:18.889079924 +1000
++++ libav/Doxyfile	2013-07-11 09:20:18.885079906 +1000
+@@ -616,7 +616,7 @@
  # excluded from the INPUT source files. This way you can easily exclude a
  # subdirectory from a directory tree whose root is specified with the INPUT tag.
  

=== modified file 'debian/patches/03-disable-configuration-warnings.patch'
--- debian/patches/03-disable-configuration-warnings.patch	2012-01-21 09:34:37 +0000
+++ debian/patches/03-disable-configuration-warnings.patch	2013-07-10 23:28:31 +0000
@@ -4,9 +4,11 @@
 Bug-Ubuntu: https://launchpad.net/bugs/765357
 Forwarded: not-needed
 
---- a/cmdutils.c
-+++ b/cmdutils.c
-@@ -457,7 +457,9 @@ void print_error(const char *filename, i
+Index: libav/cmdutils.c
+===================================================================
+--- libav.orig/cmdutils.c	2013-07-11 09:20:36.705168281 +1000
++++ libav/cmdutils.c	2013-07-11 09:20:36.701168254 +1000
+@@ -457,7 +457,9 @@
      av_log(NULL, AV_LOG_ERROR, "%s: %s\n", filename, errbuf_ptr);
  }
  

=== modified file 'debian/patches/04-ffmpeg-warning-change.patch'
--- debian/patches/04-ffmpeg-warning-change.patch	2012-08-07 22:23:55 +0000
+++ debian/patches/04-ffmpeg-warning-change.patch	2013-07-10 23:28:31 +0000
@@ -3,8 +3,10 @@
 Origin: Debian
 Forwarded: not-needed
 
---- a/ffmpeg.c
-+++ b/ffmpeg.c
+Index: libav/ffmpeg.c
+===================================================================
+--- libav.orig/ffmpeg.c	2013-07-11 09:20:44.457206714 +1000
++++ libav/ffmpeg.c	2013-07-11 09:20:44.453206699 +1000
 @@ -4376,9 +4376,10 @@
  
      show_banner();

=== modified file 'debian/watch'
--- debian/watch	2012-01-24 07:41:33 +0000
+++ debian/watch	2013-07-10 23:28:31 +0000
@@ -1,3 +1,3 @@
 version=3
 opts="uversionmangle=s/_/~/i" \
-http://libav.org/releases/libav-(.*)\.tar\.gz
+http://libav.org/releases/libav-(.*)\.tar\.xz

=== modified file 'libavcodec/aacdec.c'
--- libavcodec/aacdec.c	2013-03-27 07:57:15 +0000
+++ libavcodec/aacdec.c	2013-07-10 23:28:31 +0000
@@ -192,6 +192,8 @@
                                  enum ChannelPosition che_pos[4][MAX_ELEM_ID],
                                  int type, int id, int *channels)
 {
+    if (*channels >= MAX_CHANNELS)
+        return AVERROR_INVALIDDATA;
     if (che_pos[type][id]) {
         if (!ac->che[type][id]) {
             if (!(ac->che[type][id] = av_mallocz(sizeof(ChannelElement))))

=== modified file 'libavcodec/bmv.c'
--- libavcodec/bmv.c	2012-01-12 22:30:00 +0000
+++ libavcodec/bmv.c	2013-07-10 23:28:31 +0000
@@ -134,7 +134,7 @@
         mode += 1 + advance_mode;
         if (mode >= 4)
             mode -= 3;
-        if (FFABS(dst_end - dst) < len)
+        if (len <= 0 || FFABS(dst_end - dst) < len)
             return -1;
         switch (mode) {
         case 1:

=== modified file 'libavcodec/dfa.c'
--- libavcodec/dfa.c	2012-11-06 11:03:10 +0000
+++ libavcodec/dfa.c	2013-07-10 23:28:31 +0000
@@ -258,6 +258,8 @@
             segments = bytestream2_get_le16(gb);
         }
         line_ptr = frame;
+        if (frame_end - frame < width)
+            return AVERROR_INVALIDDATA;
         frame += width;
         y++;
         while (segments--) {

=== modified file 'libavcodec/indeo3.c'
--- libavcodec/indeo3.c	2013-03-27 07:57:15 +0000
+++ libavcodec/indeo3.c	2013-07-10 23:28:31 +0000
@@ -222,7 +222,7 @@
  *  @param plane    pointer to the plane descriptor
  *  @param cell     pointer to the cell  descriptor
  */
-static void copy_cell(Indeo3DecodeContext *ctx, Plane *plane, Cell *cell)
+static int copy_cell(Indeo3DecodeContext *ctx, Plane *plane, Cell *cell)
 {
     int     h, w, mv_x, mv_y, offset, offset_dst;
     uint8_t *src, *dst;
@@ -232,6 +232,16 @@
     dst         = plane->pixels[ctx->buf_sel] + offset_dst;
     mv_y        = cell->mv_ptr[0];
     mv_x        = cell->mv_ptr[1];
+
+    /* -1 because there is an extra line on top for prediction */
+    if ((cell->ypos << 2) + mv_y < -1 || (cell->xpos << 2) + mv_x < 0 ||
+        ((cell->ypos + cell->height) << 2) + mv_y > plane->height     ||
+        ((cell->xpos + cell->width)  << 2) + mv_x > plane->width) {
+        av_log(ctx->avctx, AV_LOG_ERROR,
+               "Motion vectors point out of the frame.\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     offset      = offset_dst + mv_y * plane->pitch + mv_x;
     src         = plane->pixels[ctx->buf_sel ^ 1] + offset;
 
@@ -259,6 +269,8 @@
             dst += 4;
         }
     }
+
+    return 0;
 }
 
 
@@ -584,11 +596,23 @@
     } else if (mode >= 10) {
         /* for mode 10 and 11 INTER first copy the predicted cell into the current one */
         /* so we don't need to do data copying for each RLE code later */
-        copy_cell(ctx, plane, cell);
+        int ret = copy_cell(ctx, plane, cell);
+        if (ret < 0)
+            return ret;
     } else {
         /* set the pointer to the reference pixels for modes 0-4 INTER */
         mv_y      = cell->mv_ptr[0];
         mv_x      = cell->mv_ptr[1];
+
+        /* -1 because there is an extra line on top for prediction */
+        if ((cell->ypos << 2) + mv_y < -1 || (cell->xpos << 2) + mv_x < 0 ||
+            ((cell->ypos + cell->height) << 2) + mv_y > plane->height     ||
+            ((cell->xpos + cell->width)  << 2) + mv_x > plane->width) {
+            av_log(ctx->avctx, AV_LOG_ERROR,
+                   "Motion vectors point out of the frame.\n");
+            return AVERROR_INVALIDDATA;
+        }
+
         offset   += mv_y * plane->pitch + mv_x;
         ref_block = plane->pixels[ctx->buf_sel ^ 1] + offset;
     }
@@ -720,7 +744,7 @@
                          const int depth, const int strip_width)
 {
     Cell    curr_cell;
-    int     bytes_used;
+    int     bytes_used, ret;
 
     if (depth <= 0) {
         av_log(avctx, AV_LOG_ERROR, "Stack overflow (corrupted binary tree)!\n");
@@ -771,8 +795,8 @@
                 CHECK_CELL
                 if (!curr_cell.mv_ptr)
                     return AVERROR_INVALIDDATA;
-                copy_cell(ctx, plane, &curr_cell);
-                return 0;
+                ret = copy_cell(ctx, plane, &curr_cell);
+                return ret;
             }
             break;
         case INTER_DATA:
@@ -855,17 +879,20 @@
 static int decode_frame_headers(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
                                 const uint8_t *buf, int buf_size)
 {
-    const uint8_t   *buf_ptr = buf, *bs_hdr;
+    GetByteContext gb;
+    const uint8_t   *bs_hdr;
     uint32_t        frame_num, word2, check_sum, data_size;
     uint32_t        y_offset, u_offset, v_offset, starts[3], ends[3];
     uint16_t        height, width;
     int             i, j;
 
+    bytestream2_init(&gb, buf, buf_size);
+
     /* parse and check the OS header */
-    frame_num = bytestream_get_le32(&buf_ptr);
-    word2     = bytestream_get_le32(&buf_ptr);
-    check_sum = bytestream_get_le32(&buf_ptr);
-    data_size = bytestream_get_le32(&buf_ptr);
+    frame_num = bytestream2_get_le32(&gb);
+    word2     = bytestream2_get_le32(&gb);
+    check_sum = bytestream2_get_le32(&gb);
+    data_size = bytestream2_get_le32(&gb);
 
     if ((frame_num ^ word2 ^ data_size ^ OS_HDR_ID) != check_sum) {
         av_log(avctx, AV_LOG_ERROR, "OS header checksum mismatch!\n");
@@ -873,28 +900,27 @@
     }
 
     /* parse the bitstream header */
-    bs_hdr = buf_ptr;
+    bs_hdr = gb.buffer;
 
-    if (bytestream_get_le16(&buf_ptr) != 32) {
+    if (bytestream2_get_le16(&gb) != 32) {
         av_log(avctx, AV_LOG_ERROR, "Unsupported codec version!\n");
         return AVERROR_INVALIDDATA;
     }
 
     ctx->frame_num   =  frame_num;
-    ctx->frame_flags =  bytestream_get_le16(&buf_ptr);
-    ctx->data_size   = (bytestream_get_le32(&buf_ptr) + 7) >> 3;
-    ctx->cb_offset   = *buf_ptr++;
+    ctx->frame_flags =  bytestream2_get_le16(&gb);
+    ctx->data_size   = (bytestream2_get_le32(&gb) + 7) >> 3;
+    ctx->cb_offset   =  bytestream2_get_byte(&gb);
 
     if (ctx->data_size == 16)
         return 4;
-    if (ctx->data_size > buf_size)
-        ctx->data_size = buf_size;
+    ctx->data_size = FFMIN(ctx->data_size, buf_size - 16);
 
-    buf_ptr += 3; // skip reserved byte and checksum
+    bytestream2_skip(&gb, 3); // skip reserved byte and checksum
 
     /* check frame dimensions */
-    height = bytestream_get_le16(&buf_ptr);
-    width  = bytestream_get_le16(&buf_ptr);
+    height = bytestream2_get_le16(&gb);
+    width  = bytestream2_get_le16(&gb);
     if (av_image_check_size(width, height, 0, avctx))
         return AVERROR_INVALIDDATA;
 
@@ -920,9 +946,10 @@
         avcodec_set_dimensions(avctx, width, height);
     }
 
-    y_offset = bytestream_get_le32(&buf_ptr);
-    v_offset = bytestream_get_le32(&buf_ptr);
-    u_offset = bytestream_get_le32(&buf_ptr);
+    y_offset = bytestream2_get_le32(&gb);
+    v_offset = bytestream2_get_le32(&gb);
+    u_offset = bytestream2_get_le32(&gb);
+    bytestream2_skip(&gb, 4);
 
     /* unfortunately there is no common order of planes in the buffer */
     /* so we use that sorting algo for determining planes data sizes  */
@@ -941,6 +968,7 @@
     ctx->v_data_size = ends[1] - starts[1];
     ctx->u_data_size = ends[2] - starts[2];
     if (FFMAX3(y_offset, v_offset, u_offset) >= ctx->data_size - 16 ||
+        FFMIN3(y_offset, v_offset, u_offset) < gb.buffer - bs_hdr + 16 ||
         FFMIN3(ctx->y_data_size, ctx->v_data_size, ctx->u_data_size) <= 0) {
         av_log(avctx, AV_LOG_ERROR, "One of the y/u/v offsets is invalid\n");
         return AVERROR_INVALIDDATA;
@@ -949,7 +977,7 @@
     ctx->y_data_ptr = bs_hdr + y_offset;
     ctx->v_data_ptr = bs_hdr + v_offset;
     ctx->u_data_ptr = bs_hdr + u_offset;
-    ctx->alt_quant  = buf_ptr + sizeof(uint32_t);
+    ctx->alt_quant  = gb.buffer;
 
     if (ctx->data_size == 16) {
         av_log(avctx, AV_LOG_DEBUG, "Sync frame encountered!\n");

=== modified file 'libavcodec/proresdec.c'
--- libavcodec/proresdec.c	2011-12-30 23:45:34 +0000
+++ libavcodec/proresdec.c	2013-07-10 23:28:31 +0000
@@ -186,6 +186,8 @@
     if (ctx->frame_type) {      /* if interlaced */
         ctx->picture.interlaced_frame = 1;
         ctx->picture.top_field_first  = ctx->frame_type & 1;
+    } else {
+        ctx->picture.interlaced_frame = 0;
     }
 
     ctx->alpha_info = buf[17] & 0xf;

=== modified file 'libavcodec/qdm2.c'
--- libavcodec/qdm2.c	2012-06-09 13:25:31 +0000
+++ libavcodec/qdm2.c	2013-07-10 23:28:31 +0000
@@ -1881,6 +1881,10 @@
         av_log(avctx, AV_LOG_ERROR, "Unknown FFT order (%d), contact the developers!\n", s->fft_order);
         return -1;
     }
+    if (s->fft_size != (1 << (s->fft_order - 1))) {
+        av_log(avctx, AV_LOG_ERROR, "FFT size %d not power of 2.\n", s->fft_size);
+        return AVERROR_INVALIDDATA;
+    }
 
     ff_rdft_init(&s->rdft_ctx, s->fft_order, IDFT_C2R);
     ff_mpadsp_init(&s->mpadsp);

=== modified file 'libavcodec/rv10.c'
--- libavcodec/rv10.c	2013-03-27 07:57:15 +0000
+++ libavcodec/rv10.c	2013-07-10 23:28:31 +0000
@@ -341,6 +341,11 @@
         f = get_bits(&s->gb, rpr_bits);
 
         if(f){
+            if (s->avctx->extradata_size < 8 + 2 * f) {
+                av_log(s->avctx, AV_LOG_ERROR, "Extradata too small.\n");
+                return AVERROR_INVALIDDATA;
+            }
+
             new_w= 4*((uint8_t*)s->avctx->extradata)[6+2*f];
             new_h= 4*((uint8_t*)s->avctx->extradata)[7+2*f];
         }else{

=== modified file 'libavfilter/avfiltergraph.c'
--- libavfilter/avfiltergraph.c	2011-12-30 23:45:34 +0000
+++ libavfilter/avfiltergraph.c	2013-07-10 23:28:31 +0000
@@ -23,6 +23,7 @@
 #include <ctype.h>
 #include <string.h>
 
+#include "libavutil/avstring.h"
 #include "avfilter.h"
 #include "avfiltergraph.h"
 #include "internal.h"
@@ -163,7 +164,11 @@
                     /* couldn't merge format lists. auto-insert scale filter */
                     snprintf(inst_name, sizeof(inst_name), "auto-inserted scaler %d",
                              scaler_count++);
-                    snprintf(scale_args, sizeof(scale_args), "0:0:%s", graph->scale_sws_opts);
+                    av_strlcpy(scale_args, "0:0", sizeof(scale_args));
+                    if (graph->scale_sws_opts) {
+                        av_strlcat(scale_args, ":", sizeof(scale_args));
+                        av_strlcat(scale_args, graph->scale_sws_opts, sizeof(scale_args));
+                    }
                     if ((ret = avfilter_graph_create_filter(&scale, avfilter_get_by_name("scale"),
                                                             inst_name, scale_args, NULL, graph)) < 0)
                         return ret;

=== modified file 'libavfilter/graphparser.c'
--- libavfilter/graphparser.c	2011-12-30 23:45:34 +0000
+++ libavfilter/graphparser.c	2013-07-10 23:28:31 +0000
@@ -121,7 +121,8 @@
         return ret;
     }
 
-    if (!strcmp(filt_name, "scale") && args && !strstr(args, "flags")) {
+    if (!strcmp(filt_name, "scale") && args && !strstr(args, "flags") &&
+        ctx->scale_sws_opts) {
         snprintf(tmp_args, sizeof(tmp_args), "%s:%s",
                  args, ctx->scale_sws_opts);
         args = tmp_args;

=== modified file 'libavformat/id3v2.c'
--- libavformat/id3v2.c	2013-01-13 11:56:59 +0000
+++ libavformat/id3v2.c	2013-07-10 23:28:31 +0000
@@ -510,9 +510,10 @@
                     goto seek;
                 }
                 b = buffer;
-                while (avio_tell(s->pb) < end) {
+                while (avio_tell(s->pb) < end && !s->pb->eof_reached) {
                     *b++ = avio_r8(s->pb);
-                    if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1) {
+                    if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1 &&
+                        !s->pb->eof_reached ) {
                         uint8_t val = avio_r8(s->pb);
                         *b++ = val ? val : avio_r8(s->pb);
                     }

=== modified file 'libavformat/oggparsevorbis.c'
--- libavformat/oggparsevorbis.c	2013-03-24 07:35:51 +0000
+++ libavformat/oggparsevorbis.c	2013-07-10 23:28:31 +0000
@@ -188,7 +188,7 @@
     return offset;
 }
 
-static int vorbis_cleanup(AVFormatContext *s, int idx)
+static void vorbis_cleanup(AVFormatContext *s, int idx)
 {
     struct ogg *ogg = s->priv_data;
     struct ogg_stream *os = ogg->streams + idx;

=== modified file 'libavformat/oma.c'
--- libavformat/oma.c	2011-12-30 23:45:34 +0000
+++ libavformat/oma.c	2013-07-10 23:28:31 +0000
@@ -22,7 +22,7 @@
 #include "oma.h"
 #include "libavcodec/avcodec.h"
 
-const uint16_t ff_oma_srate_tab[6] = { 320, 441, 480, 882, 960, 0 };
+const uint16_t ff_oma_srate_tab[8] = { 320, 441, 480, 882, 960, 0 };
 
 const AVCodecTag ff_oma_codec_tags[] = {
     { CODEC_ID_ATRAC3,      OMA_CODECID_ATRAC3  },

=== modified file 'libavformat/oma.h'
--- libavformat/oma.h	2011-12-30 23:45:34 +0000
+++ libavformat/oma.h	2013-07-10 23:28:31 +0000
@@ -37,7 +37,7 @@
     OMA_CODECID_WMA     = 5,
 };
 
-extern const uint16_t ff_oma_srate_tab[6];
+extern const uint16_t ff_oma_srate_tab[8];
 
 extern const AVCodecTag ff_oma_codec_tags[];
 

=== modified file 'libavformat/omadec.c'
--- libavformat/omadec.c	2012-03-19 08:39:18 +0000
+++ libavformat/omadec.c	2013-07-10 23:28:31 +0000
@@ -302,7 +302,11 @@
 
     switch (buf[32]) {
         case OMA_CODECID_ATRAC3:
-            samplerate = ff_oma_srate_tab[(codec_params >> 13) & 7]*100;
+            samplerate = ff_oma_srate_tab[(codec_params >> 13) & 7] * 100;
+            if (!samplerate) {
+                av_log(s, AV_LOG_ERROR, "Unsupported sample rate\n");
+                return AVERROR_INVALIDDATA;
+            }
             if (samplerate != 44100)
                 av_log_ask_for_sample(s, "Unsupported sample rate: %d\n",
                                       samplerate);
@@ -332,9 +336,14 @@
         case OMA_CODECID_ATRAC3P:
             st->codec->channels = (codec_params >> 10) & 7;
             framesize = ((codec_params & 0x3FF) * 8) + 8;
-            st->codec->sample_rate = ff_oma_srate_tab[(codec_params >> 13) & 7]*100;
-            st->codec->bit_rate    = st->codec->sample_rate * framesize * 8 / 1024;
-            avpriv_set_pts_info(st, 64, 1, st->codec->sample_rate);
+            samplerate = ff_oma_srate_tab[(codec_params >> 13) & 7] * 100;
+            if (!samplerate) {
+                av_log(s, AV_LOG_ERROR, "Unsupported sample rate\n");
+                return AVERROR_INVALIDDATA;
+            }
+            st->codec->sample_rate = samplerate;
+            st->codec->bit_rate    = samplerate * framesize * 8 / 1024;
+            avpriv_set_pts_info(st, 64, 1, samplerate);
             av_log(s, AV_LOG_ERROR, "Unsupported codec ATRAC3+!\n");
             break;
         case OMA_CODECID_MP3:

=== modified file 'libavformat/utils.c'
--- libavformat/utils.c	2013-03-27 07:57:15 +0000
+++ libavformat/utils.c	2013-07-10 23:28:31 +0000
@@ -2712,6 +2712,7 @@
             av_free_packet(&st->cur_pkt);
         }
         av_dict_free(&st->metadata);
+        av_freep(&st->probe_data.buf);
         av_free(st->index_entries);
         av_free(st->codec->extradata);
         av_free(st->codec->subtitle_header);

=== modified file 'libavformat/wav.c'
--- libavformat/wav.c	2012-11-06 11:03:10 +0000
+++ libavformat/wav.c	2013-07-10 23:28:31 +0000
@@ -230,6 +230,12 @@
     return avio_rl32(pb);
 }
 
+/* RIFF chunks are always on a even offset. */
+static int64_t wav_seek_tag(AVIOContext *s, int64_t offset, int whence)
+{
+    return avio_seek(s, offset + (offset & 1), whence);
+}
+
 /* return the size of the found tag */
 static int64_t find_tag(AVIOContext *pb, uint32_t tag1)
 {
@@ -242,7 +248,7 @@
         size = next_tag(pb, &tag);
         if (tag == tag1)
             break;
-        avio_skip(pb, size);
+        wav_seek_tag(pb, size, SEEK_CUR);
     }
     return size;
 }
@@ -483,7 +489,7 @@
 
         /* seek to next tag unless we know that we'll run into EOF */
         if ((avio_size(pb) > 0 && next_tag_ofs >= avio_size(pb)) ||
-            avio_seek(pb, next_tag_ofs, SEEK_SET) < 0) {
+            wav_seek_tag(pb, next_tag_ofs, SEEK_SET) < 0) {
             break;
         }
     }

=== modified file 'libavformat/xmv.c'
--- libavformat/xmv.c	2011-12-30 23:45:34 +0000
+++ libavformat/xmv.c	2013-07-10 23:28:31 +0000
@@ -126,6 +126,16 @@
     return 0;
 }
 
+static int xmv_read_close(AVFormatContext *s)
+{
+    XMVDemuxContext *xmv = s->priv_data;
+
+    av_free(xmv->audio);
+    av_free(xmv->audio_tracks);
+
+    return 0;
+}
+
 static int xmv_read_header(AVFormatContext *s,
                            AVFormatParameters *ap)
 {
@@ -136,6 +146,7 @@
     uint32_t file_version;
     uint32_t this_packet_size;
     uint16_t audio_track;
+    int ret;
 
     avio_skip(pb, 4); /* Next packet size */
 
@@ -178,8 +189,10 @@
         return AVERROR(ENOMEM);
 
     xmv->audio = av_malloc(xmv->audio_track_count * sizeof(XMVAudioPacket));
-    if (!xmv->audio)
-        return AVERROR(ENOMEM);
+    if (!xmv->audio) {
+        ret = AVERROR(ENOMEM);
+        goto fail;
+    }
 
     for (audio_track = 0; audio_track < xmv->audio_track_count; audio_track++) {
         XMVAudioTrack  *track  = &xmv->audio_tracks[audio_track];
@@ -212,9 +225,18 @@
             av_log(s, AV_LOG_WARNING, "Unsupported 5.1 ADPCM audio stream "
                                       "(0x%04X)\n", track->flags);
 
+        if (!track->channels || !track->sample_rate) {
+            av_log(s, AV_LOG_ERROR, "Invalid parameters for audio track %d.\n",
+                   audio_track);
+            ret = AVERROR_INVALIDDATA;
+            goto fail;
+        }
+
         ast = avformat_new_stream(s, NULL);
-        if (!ast)
-            return AVERROR(ENOMEM);
+        if (!ast) {
+            ret = AVERROR(ENOMEM);
+            goto fail;
+        }
 
         ast->codec->codec_type            = AVMEDIA_TYPE_AUDIO;
         ast->codec->codec_id              = track->codec_id;
@@ -240,6 +262,10 @@
     xmv->stream_count       = xmv->audio_track_count + 1;
 
     return 0;
+
+fail:
+    xmv_read_close(s);
+    return ret;
 }
 
 static void xmv_read_extradata(uint8_t *extradata, AVIOContext *pb)
@@ -547,16 +573,6 @@
     return 0;
 }
 
-static int xmv_read_close(AVFormatContext *s)
-{
-    XMVDemuxContext *xmv = s->priv_data;
-
-    av_free(xmv->audio);
-    av_free(xmv->audio_tracks);
-
-    return 0;
-}
-
 AVInputFormat ff_xmv_demuxer = {
     .name           = "xmv",
     .long_name      = NULL_IF_CONFIG_SMALL("Microsoft XMV"),