Merge commit '50c449ac24fbb4c03c15d2e2026cef2204b80385'

* commit '50c449ac24fbb4c03c15d2e2026cef2204b80385':
  iff: validate CMAP palette size
  asfenc: return error on negative timestamp

Conflicts:
	libavformat/iff.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

libavformat/asfenc.c

@@ -804,6 +804,14 @@ static int asf_write_packet(AVFormatContext *s, AVPacket *pkt)
         flags &= ~AV_PKT_FLAG_KEY;
 
     pts = (pkt->pts != AV_NOPTS_VALUE) ? pkt->pts : pkt->dts;
+
+    if (pts < 0) {
+        av_log(s, AV_LOG_ERROR,
+               "Negative dts not supported stream %d, dts %"PRId64"\n",
+               pkt->stream_index, pts);
+        return AVERROR(ENOSYS);
+    }
+
     assert(pts != AV_NOPTS_VALUE);
     pts *= 10000;
     asf->duration = FFMAX(asf->duration, pts + pkt->duration * 10000);

libavformat/iff.c

@@ -250,8 +250,11 @@ static int iff_read_header(AVFormatContext *s)
             break;
 
         case ID_CMAP:
-            if (data_size > INT_MAX - IFF_EXTRA_VIDEO_SIZE - FF_INPUT_BUFFER_PADDING_SIZE)
-                return AVERROR_INVALIDDATA;
+            if (data_size < 3 || data_size > 768 || data_size % 3) {
+                 av_log(s, AV_LOG_ERROR, "Invalid CMAP chunk size %d\n",
+                        data_size);
+                 return AVERROR_INVALIDDATA;
+            }
             st->codec->extradata_size = data_size + IFF_EXTRA_VIDEO_SIZE;
             st->codec->extradata      = av_malloc(data_size + IFF_EXTRA_VIDEO_SIZE + FF_INPUT_BUFFER_PADDING_SIZE);
             if (!st->codec->extradata)