From c3c08baefbf8c9b19c9c1f1bd7a899b697422eea Mon Sep 17 00:00:00 2001
From: Kostya Shishkov <kostya.shishkov@gmail.com>
Date: Mon, 27 May 2013 06:26:28 +0200
Subject: [PATCH 1/2] smacker: fix off-by-one error in palette expanding code

---
 libavformat/smacker.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/smacker.c b/libavformat/smacker.c
index 17c7c529e7..e14424323e 100644
--- a/libavformat/smacker.c
+++ b/libavformat/smacker.c
@@ -274,7 +274,7 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
                 } else if(t & 0x40){ /* copy with offset */
                     off = avio_r8(s->pb);
                     j = (t & 0x3F) + 1;
-                    if (off + j > 0xff) {
+                    if (off + j > 0x100) {
                         av_log(s, AV_LOG_ERROR,
                                "Invalid palette update, offset=%d length=%d extends beyond palette size\n",
                                off, j);

From 564b7e0c0095768cd20001b28154d69462be54e7 Mon Sep 17 00:00:00 2001
From: Anton Khirnov <anton@khirnov.net>
Date: Wed, 15 May 2013 15:48:15 +0200
Subject: [PATCH 2/2] matroskadec: silently skip CodecState element.

mkvmerge apparrently uses it for mpeg1/2 video, but it contains the same
information as CodecPrivate, so it can be ignored.
---
 libavformat/matroska.h    | 1 +
 libavformat/matroskadec.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/libavformat/matroska.h b/libavformat/matroska.h
index b1f7ae4ed5..0dbc724d56 100644
--- a/libavformat/matroska.h
+++ b/libavformat/matroska.h
@@ -176,6 +176,7 @@
 #define MATROSKA_ID_BLOCK      0xA1
 #define MATROSKA_ID_BLOCKDURATION 0x9B
 #define MATROSKA_ID_BLOCKREFERENCE 0xFB
+#define MATROSKA_ID_CODECSTATE 0xA4
 
 /* IDs in the attachments master */
 #define MATROSKA_ID_ATTACHEDFILE        0x61A7
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 744f7c0f6c..3b801e0845 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -500,6 +500,7 @@ static EbmlSyntax matroska_blockgroup[] = {
     { MATROSKA_ID_SIMPLEBLOCK,    EBML_BIN,  0, offsetof(MatroskaBlock,bin) },
     { MATROSKA_ID_BLOCKDURATION,  EBML_UINT, 0, offsetof(MatroskaBlock,duration), {.u=AV_NOPTS_VALUE} },
     { MATROSKA_ID_BLOCKREFERENCE, EBML_UINT, 0, offsetof(MatroskaBlock,reference) },
+    { MATROSKA_ID_CODECSTATE,     EBML_NONE },
     { 1,                          EBML_UINT, 0, offsetof(MatroskaBlock,non_simple), {.u=1} },
     { 0 }
 };