diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2018-01-03 23:42:01 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-01-31 22:56:15 +0100 |
| commit | 761362fffb8661be98831234c49eb2314f1802b1 (patch) | |
| tree | c6ba5520c4729aa77356a6407e063069f040eb86 | |
| parent | 0abf465dc561ef219c58318852c624ce29456c01 (diff) | |
| download | ffmpeg-761362fffb8661be98831234c49eb2314f1802b1.tar.gz | |
avcodec/h264_slice: Do not attempt to render into frames already output
Fixes: null pointer dereference
Fixes: 4698/clusterfuzz-testcase-minimized-5096956322906112
This testcase does not reproduce the issue before 03b82b3ab9883cef017e513c7d0b3b986b3b3e7b
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 476665d4de989dba48ec1195215ccc8db54538f4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/h264_slice.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavcodec/h264_slice.c b/libavcodec/h264_slice.c index 033dd2ab85..cbebec3c18 100644 --- a/libavcodec/h264_slice.c +++ b/libavcodec/h264_slice.c @@ -1634,6 +1634,12 @@ int ff_h264_decode_slice_header(H264Context *h, H264SliceContext *sl) h->missing_fields ++; h->cur_pic_ptr = NULL; h->first_field = FIELD_PICTURE(h); + } else if (h->cur_pic_ptr->reference & DELAYED_PIC_REF) { + /* This frame was already output, we cannot draw into it + * anymore. + */ + h->first_field = 1; + h->cur_pic_ptr = NULL; } else { h->missing_fields = 0; if (h->cur_pic_ptr->frame_num != h->frame_num) { |