Merge branch 'master' into 0.11

Conflicts:
	ext/pulse/pulseaudiosink.c
	ext/pulse/pulsesink.c

ext/libpng/Makefile.am

@@ -2,7 +2,8 @@ plugin_LTLIBRARIES = libgstpng.la
 
 libgstpng_la_SOURCES = gstpng.c gstpngenc.c gstpngdec.c
 libgstpng_la_CFLAGS = $(GST_PLUGINS_BASE_CFLAGS) $(GST_CFLAGS) $(LIBPNG_CFLAGS)
-libgstpng_la_LIBADD = $(GST_LIBS) $(LIBPNG_LIBS)
+libgstpng_la_LIBADD = $(GST_PLUGINS_BASE_LIBS) -lgstvideo-@GST_MAJORMINOR@ \
+	$(GST_LIBS) $(LIBPNG_LIBS)
 libgstpng_la_LDFLAGS = $(GST_PLUGIN_LDFLAGS)
 libgstpng_la_LIBTOOLFLAGS = --tag=disable-static
 

ext/libpng/gstpngenc.c

@@ -30,8 +30,6 @@
 #include <gst/video/video.h>
 #include <zlib.h>
 
-#define MAX_HEIGHT              4096
-
 GST_DEBUG_CATEGORY_STATIC (pngenc_debug);
 #define GST_CAT_DEFAULT pngenc_debug
 
@@ -59,8 +57,8 @@ GST_STATIC_PAD_TEMPLATE ("src",
     GST_PAD_SRC,
     GST_PAD_ALWAYS,
     GST_STATIC_CAPS ("image/png, "
-        "width = (int) [ 16, 4096 ], "
+        "width = (int) [ 16, 1000000 ], "
-        "height = (int) [ 16, 4096 ], " "framerate = " GST_VIDEO_FPS_RANGE)
+        "height = (int) [ 16, 1000000 ], " "framerate = " GST_VIDEO_FPS_RANGE)
     );
 
 static GstStaticPadTemplate pngenc_sink_template =
@@ -146,35 +144,60 @@ static gboolean
 gst_pngenc_setcaps (GstPad * pad, GstCaps * caps)
 {
   GstPngEnc *pngenc;
-  const GValue *fps;
+  GstVideoFormat format;
-  GstStructure *structure;
+  int fps_n, fps_d;
   GstCaps *pcaps;
-  gboolean ret = TRUE;
+  gboolean ret;
 
   pngenc = GST_PNGENC (gst_pad_get_parent (pad));
 
-  structure = gst_caps_get_structure (caps, 0);
+  ret = gst_video_format_parse_caps (caps, &format,
-  gst_structure_get_int (structure, "width", &pngenc->width);
+      &pngenc->width, &pngenc->height);
-  gst_structure_get_int (structure, "height", &pngenc->height);
+  if (G_LIKELY (ret))
-  fps = gst_structure_get_value (structure, "framerate");
+    ret = gst_video_parse_caps_framerate (caps, &fps_n, &fps_d);
-  gst_structure_get_int (structure, "bpp", &pngenc->bpp);
 
-  if (pngenc->bpp == 32)
+  if (G_UNLIKELY (!ret))
-    pngenc->stride = pngenc->width * 4;
+    goto done;
-  else if (pngenc->bpp == 8)
+
-    pngenc->stride = GST_ROUND_UP_4 (pngenc->width);
+  switch (format) {
-  else
+    case GST_VIDEO_FORMAT_RGBA:
-    pngenc->stride = GST_ROUND_UP_4 (pngenc->width * 3);
+      pngenc->png_color_type = PNG_COLOR_TYPE_RGBA;
+      break;
+    case GST_VIDEO_FORMAT_RGB:
+      pngenc->png_color_type = PNG_COLOR_TYPE_RGB;
+      break;
+    case GST_VIDEO_FORMAT_GRAY8:
+      pngenc->png_color_type = PNG_COLOR_TYPE_GRAY;
+      break;
+    default:
+      ret = FALSE;
+      goto done;
+  }
+
+  if (G_UNLIKELY (pngenc->width < 16 || pngenc->width > 1000000 ||
+          pngenc->height < 16 || pngenc->height > 1000000)) {
+    ret = FALSE;
+    goto done;
+  }
+
+  pngenc->stride = gst_video_format_get_row_stride (format, 0, pngenc->width);
 
   pcaps = gst_caps_new_simple ("image/png",
       "width", G_TYPE_INT, pngenc->width,
-      "height", G_TYPE_INT, pngenc->height, NULL);
+      "height", G_TYPE_INT, pngenc->height,
-  structure = gst_caps_get_structure (pcaps, 0);
+      "framerate", GST_TYPE_FRACTION, fps_n, fps_d, NULL);
-  gst_structure_set_value (structure, "framerate", fps);
 
   ret = gst_pad_set_caps (pngenc->srcpad, pcaps);
 
   gst_caps_unref (pcaps);
+
+  /* Fall-through. */
+done:
+  if (G_UNLIKELY (!ret)) {
+    pngenc->width = 0;
+    pngenc->height = 0;
+  }
+
   gst_object_unref (pngenc);
 
   return ret;
@@ -238,8 +261,7 @@ gst_pngenc_chain (GstPad * pad, GstBuffer * buf)
 {
   GstPngEnc *pngenc;
   gint row_index;
-  gint color_type;
+  png_byte **row_pointers;
-  png_byte *row_pointers[MAX_HEIGHT];
   GstFlowReturn ret = GST_FLOW_OK;
   GstBuffer *encoded_buf = NULL;
 
@@ -247,6 +269,19 @@ gst_pngenc_chain (GstPad * pad, GstBuffer * buf)
 
   GST_DEBUG_OBJECT (pngenc, "BEGINNING");
 
+  if (G_UNLIKELY (pngenc->width <= 0 || pngenc->height <= 0)) {
+    ret = GST_FLOW_NOT_NEGOTIATED;
+    goto done;
+  }
+
+  if (G_UNLIKELY (GST_BUFFER_SIZE (buf) < pngenc->height * pngenc->stride)) {
+    gst_buffer_unref (buf);
+    GST_ELEMENT_ERROR (pngenc, STREAM, FORMAT, (NULL),
+        ("Provided input buffer is too small, caps problem?"));
+    ret = GST_FLOW_ERROR;
+    goto done;
+  }
+
   /* initialize png struct stuff */
   pngenc->png_struct_ptr = png_create_write_struct (PNG_LIBPNG_VER_STRING,
       (png_voidp) NULL, user_error_fn, user_warning_fn);
@@ -282,25 +317,20 @@ gst_pngenc_chain (GstPad * pad, GstBuffer * buf)
       PNG_FILTER_NONE | PNG_FILTER_VALUE_NONE);
   png_set_compression_level (pngenc->png_struct_ptr, pngenc->compression_level);
 
-  if (pngenc->bpp == 32)
-    color_type = PNG_COLOR_TYPE_RGBA;
-  else if (pngenc->bpp == 8)
-    color_type = PNG_COLOR_TYPE_GRAY;
-  else
-    color_type = PNG_COLOR_TYPE_RGB;
-
   png_set_IHDR (pngenc->png_struct_ptr,
       pngenc->png_info_ptr,
       pngenc->width,
       pngenc->height,
       8,
-      color_type,
+      pngenc->png_color_type,
       PNG_INTERLACE_NONE,
       PNG_COMPRESSION_TYPE_DEFAULT, PNG_FILTER_TYPE_DEFAULT);
 
   png_set_write_fn (pngenc->png_struct_ptr, pngenc,
       (png_rw_ptr) user_write_data, user_flush_data);
 
+  row_pointers = g_new (png_byte *, pngenc->height);
+
   for (row_index = 0; row_index < pngenc->height; row_index++) {
     row_pointers[row_index] = GST_BUFFER_DATA (buf) +
         (row_index * pngenc->stride);
@@ -315,6 +345,8 @@ gst_pngenc_chain (GstPad * pad, GstBuffer * buf)
   png_write_image (pngenc->png_struct_ptr, row_pointers);
   png_write_end (pngenc->png_struct_ptr, NULL);
 
+  g_free (row_pointers);
+
   encoded_buf = gst_buffer_create_sub (pngenc->buffer_out, 0, pngenc->written);
 
   png_destroy_info_struct (pngenc->png_struct_ptr, &pngenc->png_info_ptr);

ext/libpng/gstpngenc.h

@@ -49,9 +49,9 @@ struct _GstPngEnc
   png_structp png_struct_ptr;
   png_infop png_info_ptr;
 
+  gint png_color_type;
   gint width;
   gint height;
-  gint bpp;
   gint stride;
   guint compression_level;
 

ext/pulse/pulseaudiosink.c

@@ -642,7 +642,14 @@ proxypad_blocked_cb (GstPad * pad, GstProbeType ptype, gpointer type_data,
 
   if (!pbin->format_lost) {
     sinkpad = gst_element_get_static_pad (GST_ELEMENT (pbin->psink), "sink");
-    caps = gst_pad_get_caps (pad, NULL);
+
+    if (gst_pad_has_current_caps (pbin->sinkpad)) {
+      /* See if we already got caps on our sinkpad */
+      caps = gst_pad_get_current_caps (pbin->sinkpad);
+    } else {
+      /* We haven't, so get caps from upstream */
+      caps = gst_pad_get_caps (pad, NULL);
+    }
 
     if (gst_pad_accept_caps (sinkpad, caps)) {
       if (pbin->dbin2) {

ext/pulse/pulsesink.c

@@ -142,6 +142,7 @@ struct _GstPulseRingBuffer
 #ifdef HAVE_PULSE_1_0
   pa_format_info *format;
   guint channels;
+  gboolean is_pcm;
 #else
   pa_sample_spec sample_spec;
 #endif
@@ -231,6 +232,7 @@ gst_pulseringbuffer_init (GstPulseRingBuffer * pbuf)
 #ifdef HAVE_PULSE_1_0
   pbuf->format = NULL;
   pbuf->channels = 0;
+  pbuf->is_pcm = FALSE;
 #else
   pa_sample_spec_init (&pbuf->sample_spec);
 #endif
@@ -267,6 +269,7 @@ gst_pulsering_destroy_stream (GstPulseRingBuffer * pbuf)
       pa_format_info_free (pbuf->format);
       pbuf->format = NULL;
       pbuf->channels = 0;
+      pbuf->is_pcm = FALSE;
     }
 #endif
 
@@ -421,7 +424,7 @@ gst_pulsering_context_subscribe_cb (pa_context * c,
       continue;
 
 #ifdef HAVE_PULSE_1_0
-    if (psink->device && pa_format_info_is_pcm (pbuf->format) &&
+    if (psink->device && pbuf->is_pcm &&
         !g_str_equal (psink->device,
             pa_stream_get_device_name (pbuf->stream))) {
       /* Underlying sink changed. And this is not a passthrough stream. Let's
@@ -821,6 +824,7 @@ gst_pulseringbuffer_acquire (GstRingBuffer * buf, GstRingBufferSpec * spec)
 #ifdef HAVE_PULSE_1_0
   if (!gst_pulse_fill_format_info (spec, &pbuf->format, &pbuf->channels))
     goto invalid_spec;
+  pbuf->is_pcm = pa_format_info_is_pcm (pbuf->format);
 #else
   if (!gst_pulse_fill_sample_spec (spec, &pbuf->sample_spec))
     goto invalid_spec;
@@ -842,8 +846,7 @@ gst_pulseringbuffer_acquire (GstRingBuffer * buf, GstRingBufferSpec * spec)
 
   /* initialize the channel map */
 #ifdef HAVE_PULSE_1_0
-  if (pa_format_info_is_pcm (pbuf->format) &&
+  if (pbuf->is_pcm && gst_pulse_gst_to_channel_map (&channel_map, spec))
-      gst_pulse_gst_to_channel_map (&channel_map, spec))
     pa_format_info_set_channel_map (pbuf->format, &channel_map);
 #else
   gst_pulse_gst_to_channel_map (&channel_map, spec);
@@ -905,7 +908,7 @@ gst_pulseringbuffer_acquire (GstRingBuffer * buf, GstRingBufferSpec * spec)
     GST_LOG_OBJECT (psink, "have volume of %f", psink->volume);
     pv = &v;
 #ifdef HAVE_PULSE_1_0
-    if (pa_format_info_is_pcm (pbuf->format))
+    if (pbuf->is_pcm)
       gst_pulse_cvolume_from_linear (pv, pbuf->channels, psink->volume);
     else {
       GST_DEBUG_OBJECT (psink, "passthrough stream, not setting volume");
@@ -1535,7 +1538,7 @@ gst_pulseringbuffer_commit (GstRingBuffer * buf, guint64 * sample,
 
 #ifdef HAVE_PULSE_1_0
     /* No trick modes for passthrough streams */
-    if (G_UNLIKELY (inr != outr || reverse)) {
+    if (G_UNLIKELY (!pbuf->is_pcm && (inr != outr || reverse))) {
       GST_WARNING_OBJECT (psink, "Passthrough stream can't run in trick mode");
       goto unlock_and_fail;
     }
@@ -2237,7 +2240,7 @@ gst_pulsesink_set_volume (GstPulseSink * psink, gdouble volume)
     goto no_index;
 
 #ifdef HAVE_PULSE_1_0
-  if (pa_format_info_is_pcm (pbuf->format))
+  if (pbuf->is_pcm)
     gst_pulse_cvolume_from_linear (&v, pbuf->channels, volume);
   else
     /* FIXME: this will eventually be superceded by checks to see if the volume

ext/wavpack/gstwavpackenc.c

@@ -858,7 +858,7 @@ gst_wavpack_enc_sink_event (GstPad * pad, GstEvent * event)
       /* Drop all remaining data, this is no complete block otherwise
        * it would've been pushed already */
       if (enc->pending_buffer) {
-        gst_object_unref (enc->pending_buffer);
+        gst_buffer_unref (enc->pending_buffer);
         enc->pending_buffer = NULL;
         enc->pending_offset = 0;
       }

gst/deinterlace/gstdeinterlace.c

@@ -392,10 +392,9 @@ gst_deinterlace_set_method (GstDeinterlace * self, GstDeinterlaceMethods method)
     g_assert (method_type != G_TYPE_INVALID);
   }
 
-  self->method = g_object_new (method_type, NULL);
+  self->method = g_object_new (method_type, "name", "method", NULL);
   self->method_id = method;
 
-  gst_object_set_name (GST_OBJECT (self->method), "method");
   gst_object_set_parent (GST_OBJECT (self->method), GST_OBJECT (self));
   gst_child_proxy_child_added (GST_OBJECT (self), GST_OBJECT (self->method));
 

gst/equalizer/gstiirequalizer.c

@@ -642,10 +642,10 @@ gst_iir_equalizer_compute_frequencies (GstIirEqualizer * equ, guint new_count)
     /* add new bands */
     equ->bands = g_realloc (equ->bands, sizeof (GstObject *) * new_count);
     for (i = old_count; i < new_count; i++) {
-      equ->bands[i] = g_object_new (GST_TYPE_IIR_EQUALIZER_BAND, NULL);
       /* otherwise they get names like 'iirequalizerband5' */
       sprintf (name, "band%u", i);
-      gst_object_set_name (GST_OBJECT (equ->bands[i]), name);
+      equ->bands[i] = g_object_new (GST_TYPE_IIR_EQUALIZER_BAND,
+          "name", name, NULL);
       GST_DEBUG ("adding band[%d]=%p", i, equ->bands[i]);
 
       gst_object_set_parent (GST_OBJECT (equ->bands[i]), GST_OBJECT (equ));

gst/matroska/ebml-write.c

@@ -25,7 +25,6 @@
 #endif
 
 #include <string.h>
-#include <gst/floatcast/floatcast.h>
 
 #include "ebml-write.h"
 #include "ebml-ids.h"
@@ -280,7 +279,7 @@ gst_ebml_write_flush_cache (GstEbmlWrite * ebml, gboolean is_keyframe,
  * Returns: A new #GstBuffer.
  */
 static GstBuffer *
-gst_ebml_write_element_new (GstEbmlWrite * ebml, guint size)
+gst_ebml_write_element_new (GstEbmlWrite * ebml, guint8 ** data_out, guint size)
 {
   /* Create new buffer of size + ID + length */
   GstBuffer *buf;
@@ -289,24 +288,25 @@ gst_ebml_write_element_new (GstEbmlWrite * ebml, guint size)
   size += 12;
 
   buf = gst_buffer_new_and_alloc (size);
-  GST_BUFFER_SIZE (buf) = 0;
   GST_BUFFER_TIMESTAMP (buf) = ebml->timestamp;
 
+  *data_out = GST_BUFFER_DATA (buf);
+
   return buf;
 }
 
 
 /**
  * gst_ebml_write_element_id:
- * @buf: Buffer to which id should be written.
+ * @data_inout: Pointer to data pointer
  * @id: Element ID that should be written.
  * 
  * Write element ID into a buffer.
  */
 static void
-gst_ebml_write_element_id (GstBuffer * buf, guint32 id)
+gst_ebml_write_element_id (guint8 ** data_inout, guint32 id)
 {
-  guint8 *data = GST_BUFFER_DATA (buf) + GST_BUFFER_SIZE (buf);
+  guint8 *data = *data_inout;
   guint bytes = 4, mask = 0x10;
 
   /* get ID length */
@@ -323,7 +323,7 @@ gst_ebml_write_element_id (GstBuffer * buf, guint32 id)
   }
 
   /* write out, BE */
-  GST_BUFFER_SIZE (buf) += bytes;
+  *data_inout += bytes;
   while (bytes--) {
     data[bytes] = id & 0xff;
     id >>= 8;
@@ -333,15 +333,15 @@ gst_ebml_write_element_id (GstBuffer * buf, guint32 id)
 
 /**
  * gst_ebml_write_element_size:
- * @buf: #GstBuffer to which size should be written.
+ * @data_inout: Pointer to data pointer
  * @size: Element length.
- * 
+ *
  * Write element length into a buffer.
  */
 static void
-gst_ebml_write_element_size (GstBuffer * buf, guint64 size)
+gst_ebml_write_element_size (guint8 ** data_inout, guint64 size)
 {
-  guint8 *data = GST_BUFFER_DATA (buf) + GST_BUFFER_SIZE (buf);
+  guint8 *data = *data_inout;
   guint bytes = 1, mask = 0x80;
 
   if (size != GST_EBML_SIZE_UNKNOWN) {
@@ -365,7 +365,7 @@ gst_ebml_write_element_size (GstBuffer * buf, guint64 size)
   }
 
   /* write out, BE, with length size marker */
-  GST_BUFFER_SIZE (buf) += bytes;
+  *data_inout += bytes;
   while (bytes-- > 0) {
     data[bytes] = size & 0xff;
     size >>= 8;
@@ -377,19 +377,18 @@ gst_ebml_write_element_size (GstBuffer * buf, guint64 size)
 
 /**
  * gst_ebml_write_element_data:
- * @buf: #GstBuffer to which data should be written.
+ * @data_inout: Pointer to data pointer
  * @write: Data that should be written.
  * @length: Length of the data.
  *
  * Write element data into a buffer.
  */
 static void
-gst_ebml_write_element_data (GstBuffer * buf, guint8 * write, guint64 length)
+gst_ebml_write_element_data (guint8 ** data_inout, guint8 * write,
+    guint64 length)
 {
-  guint8 *data = GST_BUFFER_DATA (buf) + GST_BUFFER_SIZE (buf);
+  memcpy (*data_inout, write, length);
-
+  *data_inout += length;
-  memcpy (data, write, length);
-  GST_BUFFER_SIZE (buf) += length;
 }
 
 
@@ -397,23 +396,34 @@ gst_ebml_write_element_data (GstBuffer * buf, guint8 * write, guint64 length)
  * gst_ebml_write_element_push:
  * @ebml: #GstEbmlWrite
  * @buf: #GstBuffer to be written.
+ * @buf_data: Start of data to push from @buf (or NULL for whole buffer).
+ * @buf_data_end: Data pointer positioned after the last byte in @buf_data (or
+ * NULL for whole buffer).
  * 
  * Write out buffer by moving it to the next element.
  */
 static void
-gst_ebml_write_element_push (GstEbmlWrite * ebml, GstBuffer * buf)
+gst_ebml_write_element_push (GstEbmlWrite * ebml, GstBuffer * buf,
+    guint8 * buf_data, guint8 * buf_data_end)
 {
-  guint data_size = GST_BUFFER_SIZE (buf);
+  guint data_size;
+
+  if (!buf_data)
+    buf_data = GST_BUFFER_DATA (buf);
+
+  if (buf_data_end)
+    data_size = buf_data_end - buf_data;
+  else
+    data_size = GST_BUFFER_SIZE (buf);
 
   ebml->pos += data_size;
 
   /* if there's no cache, then don't push it! */
   if (ebml->writing_streamheader) {
-    gst_byte_writer_put_data (ebml->streamheader, GST_BUFFER_DATA (buf),
+    gst_byte_writer_put_data (ebml->streamheader, buf_data, data_size);
-        data_size);
   }
   if (ebml->cache) {
-    gst_byte_writer_put_data (ebml->cache, GST_BUFFER_DATA (buf), data_size);
+    gst_byte_writer_put_data (ebml->cache, buf_data, data_size);
     gst_buffer_unref (buf);
     return;
   }
@@ -421,7 +431,7 @@ gst_ebml_write_element_push (GstEbmlWrite * ebml, GstBuffer * buf)
   if (ebml->last_write_result == GST_FLOW_OK) {
     buf = gst_buffer_make_metadata_writable (buf);
     gst_buffer_set_caps (buf, ebml->caps);
-    GST_BUFFER_OFFSET (buf) = ebml->pos - GST_BUFFER_SIZE (buf);
+    GST_BUFFER_OFFSET (buf) = ebml->pos - data_size;
     GST_BUFFER_OFFSET_END (buf) = ebml->pos;
     if (ebml->writing_streamheader) {
       GST_BUFFER_FLAG_SET (buf, GST_BUFFER_FLAG_IN_CAPS);
@@ -508,19 +518,19 @@ gst_ebml_write_get_uint_size (guint64 num)
 
 /**
  * gst_ebml_write_set_uint:
- * @buf: #GstBuffer to which ithe number should be written.
+ * @data_inout: Pointer to data pointer
  * @num: Number to be written.
  * @size: Encoded number length.
  *
  * Write an uint into a buffer.
  */
 static void
-gst_ebml_write_set_uint (GstBuffer * buf, guint64 num, guint size)
+gst_ebml_write_set_uint (guint8 ** data_inout, guint64 num, guint size)
 {
-  guint8 *data;
+  guint8 *data = *data_inout;
+
+  *data_inout += size;
 
-  data = GST_BUFFER_DATA (buf) + GST_BUFFER_SIZE (buf);
-  GST_BUFFER_SIZE (buf) += size;
   while (size-- > 0) {
     data[size] = num & 0xff;
     num >>= 8;
@@ -539,14 +549,18 @@ gst_ebml_write_set_uint (GstBuffer * buf, guint64 num, guint size)
 void
 gst_ebml_write_uint (GstEbmlWrite * ebml, guint32 id, guint64 num)
 {
-  GstBuffer *buf = gst_ebml_write_element_new (ebml, sizeof (num));
+  GstBuffer *buf;
+  guint8 *data_start, *data_end;
   guint size = gst_ebml_write_get_uint_size (num);
 
+  buf = gst_ebml_write_element_new (ebml, &data_start, sizeof (num));
+  data_end = data_start;
+
   /* write */
-  gst_ebml_write_element_id (buf, id);
+  gst_ebml_write_element_id (&data_end, id);
-  gst_ebml_write_element_size (buf, size);
+  gst_ebml_write_element_size (&data_end, size);
-  gst_ebml_write_set_uint (buf, num, size);
+  gst_ebml_write_set_uint (&data_end, num, size);
-  gst_ebml_write_element_push (ebml, buf);
+  gst_ebml_write_element_push (ebml, buf, data_start, data_end);
 }
 
 
@@ -561,8 +575,8 @@ gst_ebml_write_uint (GstEbmlWrite * ebml, guint32 id, guint64 num)
 void
 gst_ebml_write_sint (GstEbmlWrite * ebml, guint32 id, gint64 num)
 {
-  GstBuffer *buf = gst_ebml_write_element_new (ebml, sizeof (num));
+  GstBuffer *buf;
-
+  guint8 *data_start, *data_end;
   /* if the signed number is on the edge of a extra-byte,
    * then we'll fall over when detecting it. Example: if I
    * have a number (-)0x8000 (G_MINSHORT), then my abs()<<1
@@ -570,6 +584,9 @@ gst_ebml_write_sint (GstEbmlWrite * ebml, guint32 id, gint64 num)
   guint64 unum = (num < 0 ? (-num - 1) << 1 : num << 1);
   guint size = gst_ebml_write_get_uint_size (unum);
 
+  buf = gst_ebml_write_element_new (ebml, &data_start, sizeof (num));
+  data_end = data_start;
+
   /* make unsigned */
   if (num >= 0) {
     unum = num;
@@ -580,10 +597,10 @@ gst_ebml_write_sint (GstEbmlWrite * ebml, guint32 id, gint64 num)
   }
 
   /* write */
-  gst_ebml_write_element_id (buf, id);
+  gst_ebml_write_element_id (&data_end, id);
-  gst_ebml_write_element_size (buf, size);
+  gst_ebml_write_element_size (&data_end, size);
-  gst_ebml_write_set_uint (buf, unum, size);
+  gst_ebml_write_set_uint (&data_end, unum, size);
-  gst_ebml_write_element_push (ebml, buf);
+  gst_ebml_write_element_push (ebml, buf, data_start, data_end);
 }
 
 
@@ -598,13 +615,17 @@ gst_ebml_write_sint (GstEbmlWrite * ebml, guint32 id, gint64 num)
 void
 gst_ebml_write_float (GstEbmlWrite * ebml, guint32 id, gdouble num)
 {
-  GstBuffer *buf = gst_ebml_write_element_new (ebml, sizeof (num));
+  GstBuffer *buf;
+  guint8 *data_start, *data_end;
 
-  gst_ebml_write_element_id (buf, id);
+  buf = gst_ebml_write_element_new (ebml, &data_start, sizeof (num));
-  gst_ebml_write_element_size (buf, 8);
+  data_end = data_start;
+
+  gst_ebml_write_element_id (&data_end, id);
+  gst_ebml_write_element_size (&data_end, 8);
   num = GDOUBLE_TO_BE (num);
-  gst_ebml_write_element_data (buf, (guint8 *) & num, 8);
+  gst_ebml_write_element_data (&data_end, (guint8 *) & num, 8);
-  gst_ebml_write_element_push (ebml, buf);
+  gst_ebml_write_element_push (ebml, buf, data_start, data_end);
 }
 
 
@@ -620,12 +641,16 @@ void
 gst_ebml_write_ascii (GstEbmlWrite * ebml, guint32 id, const gchar * str)
 {
   gint len = strlen (str) + 1;  /* add trailing '\0' */
-  GstBuffer *buf = gst_ebml_write_element_new (ebml, len);
+  GstBuffer *buf;
+  guint8 *data_start, *data_end;
 
-  gst_ebml_write_element_id (buf, id);
+  buf = gst_ebml_write_element_new (ebml, &data_start, len);
-  gst_ebml_write_element_size (buf, len);
+  data_end = data_start;
-  gst_ebml_write_element_data (buf, (guint8 *) str, len);
+
-  gst_ebml_write_element_push (ebml, buf);
+  gst_ebml_write_element_id (&data_end, id);
+  gst_ebml_write_element_size (&data_end, len);
+  gst_ebml_write_element_data (&data_end, (guint8 *) str, len);
+  gst_ebml_write_element_push (ebml, buf, data_start, data_end);
 }
 
 
@@ -674,14 +699,17 @@ gst_ebml_write_date (GstEbmlWrite * ebml, guint32 id, gint64 date)
 guint64
 gst_ebml_write_master_start (GstEbmlWrite * ebml, guint32 id)
 {
-  guint64 pos = ebml->pos, t;
+  guint64 pos = ebml->pos;
-  GstBuffer *buf = gst_ebml_write_element_new (ebml, 0);
+  GstBuffer *buf;
+  guint8 *data_start, *data_end;
 
-  t = GST_BUFFER_SIZE (buf);
+  buf = gst_ebml_write_element_new (ebml, &data_start, 0);
-  gst_ebml_write_element_id (buf, id);
+  data_end = data_start;
-  pos += GST_BUFFER_SIZE (buf) - t;
+
-  gst_ebml_write_element_size (buf, GST_EBML_SIZE_UNKNOWN);
+  gst_ebml_write_element_id (&data_end, id);
-  gst_ebml_write_element_push (ebml, buf);
+  pos += data_end - data_start;
+  gst_ebml_write_element_size (&data_end, GST_EBML_SIZE_UNKNOWN);
+  gst_ebml_write_element_push (ebml, buf, data_start, data_end);
 
   return pos;
 }
@@ -703,10 +731,12 @@ gst_ebml_write_master_finish_full (GstEbmlWrite * ebml, guint64 startpos,
   GstBuffer *buf;
 
   gst_ebml_write_seek (ebml, startpos);
+
   buf = gst_buffer_new_and_alloc (8);
   GST_WRITE_UINT64_BE (GST_BUFFER_DATA (buf),
       (G_GINT64_CONSTANT (1) << 56) | (pos - startpos - 8 + extra_size));
-  gst_ebml_write_element_push (ebml, buf);
+
+  gst_ebml_write_element_push (ebml, buf, NULL, NULL);
   gst_ebml_write_seek (ebml, pos);
 }
 
@@ -729,12 +759,16 @@ void
 gst_ebml_write_binary (GstEbmlWrite * ebml,
     guint32 id, guint8 * binary, guint64 length)
 {
-  GstBuffer *buf = gst_ebml_write_element_new (ebml, length);
+  GstBuffer *buf;
+  guint8 *data_start, *data_end;
 
-  gst_ebml_write_element_id (buf, id);
+  buf = gst_ebml_write_element_new (ebml, &data_start, length);
-  gst_ebml_write_element_size (buf, length);
+  data_end = data_start;
-  gst_ebml_write_element_data (buf, binary, length);
+
-  gst_ebml_write_element_push (ebml, buf);
+  gst_ebml_write_element_id (&data_end, id);
+  gst_ebml_write_element_size (&data_end, length);
+  gst_ebml_write_element_data (&data_end, binary, length);
+  gst_ebml_write_element_push (ebml, buf, data_start, data_end);
 }
 
 
@@ -754,25 +788,29 @@ gst_ebml_write_binary (GstEbmlWrite * ebml,
 void
 gst_ebml_write_buffer_header (GstEbmlWrite * ebml, guint32 id, guint64 length)
 {
-  GstBuffer *buf = gst_ebml_write_element_new (ebml, 0);
+  GstBuffer *buf;
+  guint8 *data_start, *data_end;
 
-  gst_ebml_write_element_id (buf, id);
+  buf = gst_ebml_write_element_new (ebml, &data_start, 0);
-  gst_ebml_write_element_size (buf, length);
+  data_end = data_start;
-  gst_ebml_write_element_push (ebml, buf);
+
+  gst_ebml_write_element_id (&data_end, id);
+  gst_ebml_write_element_size (&data_end, length);
+  gst_ebml_write_element_push (ebml, buf, data_start, data_end);
 }
 
 
 /**
  * gst_ebml_write_buffer:
  * @ebml: #GstEbmlWrite
- * @data: #GstBuffer cointaining the data.
+ * @buf: #GstBuffer cointaining the data.
  *
  * Write  binary element (see gst_ebml_write_buffer_header).
  */
 void
-gst_ebml_write_buffer (GstEbmlWrite * ebml, GstBuffer * data)
+gst_ebml_write_buffer (GstEbmlWrite * ebml, GstBuffer * buf)
 {
-  gst_ebml_write_element_push (ebml, data);
+  gst_ebml_write_element_push (ebml, buf, NULL, NULL);
 }
 
 
@@ -796,11 +834,15 @@ gst_ebml_replace_uint (GstEbmlWrite * ebml, guint64 pos, guint64 num)
 {
   guint64 oldpos = ebml->pos;
   GstBuffer *buf = gst_buffer_new_and_alloc (8);
+  guint8 *data_start, *data_end;
+
+  data_start = GST_BUFFER_DATA (buf);
+  data_end = data_start;
 
   gst_ebml_write_seek (ebml, pos);
-  GST_BUFFER_SIZE (buf) = 0;
+  gst_ebml_write_set_uint (&data_end, num, 8);
-  gst_ebml_write_set_uint (buf, num, 8);
+
-  gst_ebml_write_element_push (ebml, buf);
+  gst_ebml_write_element_push (ebml, buf, data_start, data_end);
   gst_ebml_write_seek (ebml, oldpos);
 }
 

gst/matroska/matroska-mux.c

@@ -2594,7 +2594,7 @@ gst_matroska_mux_handle_dirac_packet (GstMatroskaMux * mux,
 
     next_parse_offset = GST_READ_UINT32_BE (data + 5);
 
-    if (G_UNLIKELY (next_parse_offset == 0))
+    if (G_UNLIKELY (next_parse_offset == 0 || next_parse_offset > size))
       break;
 
     data += next_parse_offset;

gst/matroska/matroska-read-common.c

@@ -1547,11 +1547,15 @@ gst_matroska_read_common_parse_metadata (GstMatroskaReadCommon * common,
   return ret;
 }
 
-static const guint8 *
+static GstFlowReturn
 gst_matroska_read_common_peek_adapter (GstMatroskaReadCommon * common, guint
-    peek)
+    peek, const guint8 ** data)
 {
-  return gst_adapter_peek (common->adapter, peek);
+  *data = gst_adapter_peek (common->adapter, peek);
+  if (*data == NULL)
+    return GST_FLOW_UNEXPECTED;
+
+  return GST_FLOW_OK;
 }
 
 /*