Merge commit '067432c1c95882c7221e694f33d9f3bdbe46de7f'

* commit '067432c1c95882c7221e694f33d9f3bdbe46de7f':
  loco: check that there is data left after decoding a plane.
  lagarith: avoid infinite loop in lag_rac_refill()

Conflicts:
	libavcodec/loco.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

libavcodec/lagarithrac.h

@@ -107,6 +107,9 @@ static inline uint8_t lag_get_rac(lag_rac *l)
         l->range -= range_scaled * l->prob[255];
     }
 
+    if (!l->range)
+        l->range = 0x80;
+
     l->low -= range_scaled * l->prob[val];
 
     return val;

libavcodec/loco.c

@@ -190,7 +190,7 @@ static int decode_frame(AVCodecContext *avctx,
     p->key_frame = 1;
 
 #define ADVANCE_BY_DECODED do { \
-    if (decoded < 0) goto stop; \
+    if (decoded < 0 || decoded >= buf_size) goto buf_too_small; \
     buf += decoded; buf_size -= decoded; \
 } while(0)
     switch(l->mode) {
@@ -224,7 +224,8 @@ static int decode_frame(AVCodecContext *avctx,
         decoded = loco_decode_plane(l, p->data[0] + p->linesize[0]*(avctx->height-1) + 2, avctx->width, avctx->height,
                                     -p->linesize[0], buf, buf_size, 3);
         break;
-    case LOCO_CRGBA: case LOCO_RGBA:
+    case LOCO_CRGBA:
+    case LOCO_RGBA:
         decoded = loco_decode_plane(l, p->data[0] + p->linesize[0]*(avctx->height-1), avctx->width, avctx->height,
                                     -p->linesize[0], buf, buf_size, 4);
         ADVANCE_BY_DECODED;
@@ -238,12 +239,14 @@ static int decode_frame(AVCodecContext *avctx,
                                     -p->linesize[0], buf, buf_size, 4);
         break;
     }
-stop:
 
     *got_frame      = 1;
     *(AVFrame*)data = l->pic;
 
     return buf_size < 0 ? -1 : avpkt->size - buf_size;
+buf_too_small:
+    av_log(avctx, AV_LOG_ERROR, "Input data too small.\n");
+    return AVERROR(EINVAL);
 }
 
 static av_cold int decode_init(AVCodecContext *avctx)