diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-10-06 22:54:00 +0200 |
|---|---|---|
| committer | Janne Grunau <janne-libav@jannau.net> | 2012-12-18 11:02:23 +0100 |
| commit | c9aab8a123c0bcf6adeab390db1ec783326456ca (patch) | |
| tree | 69fc664883ab8269beca23ba03cc9a3ec3ff0f4d | |
| parent | 61c6eef5456f2bc8b1dc49a0a759c975551cea29 (diff) | |
| download | ffmpeg-c9aab8a123c0bcf6adeab390db1ec783326456ca.tar.gz | |
h264: use mbaff ref indices in fill_colmap() only for mbaff references
Prevents writing beyond array bounds.
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
| -rw-r--r-- | libavcodec/h264_direct.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavcodec/h264_direct.c b/libavcodec/h264_direct.c index cc6e01861f..fc429aee80 100644 --- a/libavcodec/h264_direct.c +++ b/libavcodec/h264_direct.c @@ -89,7 +89,8 @@ static void fill_colmap(H264Context *h, int map[2][16+32], int list, int field, for(j=start; j<end; j++){ if (4 * h->ref_list[0][j].frame_num + (h->ref_list[0][j].f.reference & 3) == poc) { int cur_ref= mbafi ? (j-16)^field : j; - map[list][2*old_ref + (rfield^field) + 16] = cur_ref; + if (ref1->mbaff) + map[list][2 * old_ref + (rfield^field) + 16] = cur_ref; if(rfield == field || !interl) map[list][old_ref] = cur_ref; break; |