Merge remote-tracking branch 'qatar/release/9' into release/1.1

* qatar/release/9:
  eamad: allocate a dummy reference frame when the real one is missing
  libmp3lame: use the correct remaining buffer size when flushing
  png: use av_mallocz_array() for the zlib zalloc function
  wmaprodec: require block_align to be set.
  ffv1: fix calculating slice dimensions for version 2
  xxan: fix invalid memory access in xan_decode_frame_type0()
  wmadec: require block_align to be set.
  ivi_common: do not call MC for intra frames when dc_transform is unset

Conflicts:
	libavcodec/ffv1dec.c
	libavcodec/ivi_common.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

libavcodec/eamad.c

@@ -276,6 +276,21 @@ static int decode_frame(AVCodecContext *avctx,
         }
     }
 
+    if (inter && !s->last_frame.data[0]) {
+        int ret;
+        av_log(avctx, AV_LOG_WARNING, "Missing reference frame.\n");
+        s->last_frame.reference = 1;
+        ret = ff_get_buffer(avctx, &s->last_frame);
+        if (ret < 0)
+            return ret;
+        memset(s->last_frame.data[0], 0, s->last_frame.height *
+               s->last_frame.linesize[0]);
+        memset(s->last_frame.data[1], 0x80, s->last_frame.height / 2 *
+               s->last_frame.linesize[1]);
+        memset(s->last_frame.data[2], 0x80, s->last_frame.height / 2 *
+               s->last_frame.linesize[2]);
+    }
+
     av_fast_padded_malloc(&s->bitstream_buf, &s->bitstream_buf_size,
                           buf_end - buf);
     if (!s->bitstream_buf)

libavcodec/libmp3lame.c

@@ -218,7 +218,7 @@ static int mp3lame_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
         }
     } else {
         lame_result = lame_encode_flush(s->gfp, s->buffer + s->buffer_index,
-                                        BUFFER_SIZE - s->buffer_index);
+                                        s->buffer_size - s->buffer_index);
     }
     if (lame_result < 0) {
         if (lame_result == -1) {

libavcodec/png.c

@@ -38,9 +38,7 @@ static const uint8_t ff_png_pass_xshift[NB_PASSES] = {
 
 void *ff_png_zalloc(void *opaque, unsigned int items, unsigned int size)
 {
-    if(items >= UINT_MAX / size)
-        return NULL;
-    return av_malloc(items * size);
+    return av_mallocz_array(items, size);
 }
 
 void ff_png_zfree(void *opaque, void *ptr)

libavcodec/wmadec.c

@@ -72,6 +72,11 @@ static int wma_decode_init(AVCodecContext * avctx)
     int i, flags2;
     uint8_t *extradata;
 
+    if (!avctx->block_align) {
+        av_log(avctx, AV_LOG_ERROR, "block_align is not set\n");
+        return AVERROR(EINVAL);
+    }
+
     s->avctx = avctx;
 
     /* extract flag infos */

libavcodec/wmaprodec.c

@@ -280,6 +280,11 @@ static av_cold int decode_init(AVCodecContext *avctx)
     int log2_max_num_subframes;
     int num_possible_block_sizes;
 
+    if (!avctx->block_align) {
+        av_log(avctx, AV_LOG_ERROR, "block_align is not set\n");
+        return AVERROR(EINVAL);
+    }
+
     s->avctx = avctx;
     ff_dsputil_init(&s->dsp, avctx);
     avpriv_float_dsp_init(&s->fdsp, avctx->flags & CODEC_FLAG_BITEXACT);

libavcodec/xxan.c

@@ -315,7 +315,7 @@ static int xan_decode_frame_type0(AVCodecContext *avctx)
         int dec_size;
 
         bytestream2_seek(&s->gb, 8 + corr_off, SEEK_SET);
-        dec_size = xan_unpack(s, s->scratch_buffer, s->buffer_size);
+        dec_size = xan_unpack(s, s->scratch_buffer, s->buffer_size / 2);
         if (dec_size < 0)
             dec_size = 0;
         else