@@ -694,10 +694,13 @@ static int decode_i_frame(FourXContext *f, const uint8_t *buf, int length){

     unsigned int prestream_size;

     const uint8_t *prestream;

-    if (bitstream_size > (1<<26) || length < bitstream_size + 12)

-        return -1;

-    prestream_size = 4*AV_RL32(buf + bitstream_size + 4);

-    prestream = buf + bitstream_size + 12;

+    if (length < bitstream_size + 12) {

+        av_log(f->avctx, AV_LOG_ERROR, "packet size too small\n");

+        return AVERROR_INVALIDDATA;

+    }

+

+    prestream_size = 4 * AV_RL32(buf + bitstream_size + 4);

+    prestream      = buf + bitstream_size + 12;

     if (prestream_size > (1<<26) ||

         prestream_size != length - (bitstream_size + 12)){

@@ -1514,7 +1514,10 @@ static void render_slice(Vp3DecodeContext *s, int slice)

                     /* invert DCT and place (or add) in final output */

                     if (s->all_fragments[i].coding_method == MODE_INTRA) {

-                        vp3_dequant(s, s->all_fragments + i, plane, 0, block);

+                        int index;

+                        index = vp3_dequant(s, s->all_fragments + i, plane, 0, block);

+                        if (index > 63)

+                            continue;

                         if(s->avctx->idct_algo!=FF_IDCT_VP3)

                             block[0] += 128<<3;

                         s->dsp.idct_put(

@@ -1522,7 +1525,10 @@ static void render_slice(Vp3DecodeContext *s, int slice)

                             stride,

                             block);

                     } else {

-                        if (vp3_dequant(s, s->all_fragments + i, plane, 1, block)) {

+                        int index = vp3_dequant(s, s->all_fragments + i, plane, 1, block);

+                        if (index > 63)

+                            continue;

+                        if (index > 0) {

                         s->dsp.idct_add(

                             output_plane + first_pixel,

                             stride,

@@ -137,6 +137,9 @@ int ff_wma_init(AVCodecContext *avctx, int flags2)

     /* compute MDCT block size */

     s->frame_len_bits = ff_wma_get_frame_len_bits(s->sample_rate, s->version, 0);

+    s->next_block_len_bits = s->frame_len_bits;

+    s->prev_block_len_bits = s->frame_len_bits;

+    s->block_len_bits      = s->frame_len_bits;

     s->frame_len = 1 << s->frame_len_bits;

     if (s->use_variable_block_len) {

@@ -44,6 +44,7 @@

 #include "libavutil/cpu.h"

 #include "libavutil/avutil.h"

 #include "libavutil/bswap.h"

+#include "libavutil/mathematics.h"

 #include "libavutil/opt.h"

 #include "libavutil/pixdesc.h"