fixes by Gildas Bazin <gbazin at altern dot org>

Originally committed as revision 2745 to svn://svn.ffmpeg.org/ffmpeg/trunk

ffmpeg.c

@@ -1261,18 +1261,11 @@ static int av_encode(AVFormatContext **output_files,
                     ost->topBand = frame_topBand;
                     ost->leftBand = frame_leftBand;
                 } else {
-                    uint8_t *buf;
                     ost->video_resample = 1;
                     ost->video_crop = 0; // cropping is handled as part of resample
-                    buf = av_malloc((codec->width * codec->height * 3) / 2);
+                    if( avpicture_alloc( &ost->pict_tmp, codec->pix_fmt,
-                    if (!buf)
+                                         codec->width, codec->height ) )
                         goto fail;
-                    ost->pict_tmp.data[0] = buf;
-                    ost->pict_tmp.data[1] = ost->pict_tmp.data[0] + (codec->width * codec->height);
-                    ost->pict_tmp.data[2] = ost->pict_tmp.data[1] + (codec->width * codec->height) / 4;
-                    ost->pict_tmp.linesize[0] = codec->width;
-                    ost->pict_tmp.linesize[1] = codec->width / 2;
-                    ost->pict_tmp.linesize[2] = codec->width / 2;
 
                     ost->img_resample_ctx = img_resample_full_init( 
                                       ost->st->codec.width, ost->st->codec.height,

libavcodec/mpegaudiodec.c

@@ -1231,6 +1231,7 @@ static int decode_header(MPADecodeContext *s, uint32_t header)
 int mpa_decode_header(AVCodecContext *avctx, uint32_t head)
 {
     MPADecodeContext s1, *s = &s1;
+    memset( s, 0, sizeof(MPADecodeContext) );
 
     if (check_header(head) != 0)
         return -1;
@@ -1373,6 +1374,10 @@ static int mp_decode_layer2(MPADecodeContext *s)
         bound = sblimit;
 
     dprintf("bound=%d sblimit=%d\n", bound, sblimit);
+
+    /* sanity check */
+    if( bound > sblimit ) bound = sblimit;
+
     /* parse bit allocation */
     j = 0;
     for(i=0;i<bound;i++) {