diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-15 01:21:16 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-03-15 01:27:10 +0100 |
| commit | 67235dfa1d2b4bab2c8015e5b8e43ea63a681892 (patch) | |
| tree | 6de0622de5bbdf40c5770899bcfb989b31bcd2a4 /libavcodec/h264.c | |
| parent | 9e2ee46206a5a4db91ee4d26737b515797e6b08e (diff) | |
| parent | e0febda22d0e0fab094a9c886b0e0f0f662df1ef (diff) | |
| download | ffmpeg-67235dfa1d2b4bab2c8015e5b8e43ea63a681892.tar.gz | |
Merge remote-tracking branch 'qatar/master'
* qatar/master:
h264: stricter reference limit enforcement.
h264: increase reference poc list from 16 to 32.
xa_adpcm: limit filter to prevent xa_adpcm_table[] array bounds overruns.
snow: check reference frame indices.
snow: reject unsupported chroma shifts.
Add ffvhuff encoding and decoding regression test
anm: convert to bytestream2 API
bytestream: add more unchecked variants for bytestream2 API
jvdec: unbreak video decoding
jv demux: set video stream duration
fate: add pam image regression test
Conflicts:
libavcodec/adpcm.c
libavcodec/anm.c
libavcodec/h264.c
libavcodec/mpegvideo.h
libavcodec/snowdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/h264.c')
| -rw-r--r-- | libavcodec/h264.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c index 2cb56028de..66174778df 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -3034,7 +3034,8 @@ static int decode_slice_header(H264Context *h, H264Context *h0){ h->ref_count[1]= h->pps.ref_count[1]; if(h->slice_type_nos != AV_PICTURE_TYPE_I){ - unsigned max= (16<<(s->picture_structure != PICT_FRAME))-1; + unsigned max= s->picture_structure == PICT_FRAME ? 15 : 31; + if(h->slice_type_nos == AV_PICTURE_TYPE_B){ h->direct_spatial_mv_pred= get_bits1(&s->gb); } @@ -3044,13 +3045,14 @@ static int decode_slice_header(H264Context *h, H264Context *h0){ h->ref_count[0]= get_ue_golomb(&s->gb) + 1; if(h->slice_type_nos==AV_PICTURE_TYPE_B) h->ref_count[1]= get_ue_golomb(&s->gb) + 1; - } - if(h->ref_count[0]-1 > max || h->ref_count[1]-1 > max){ + + if (h->ref_count[0]-1 > max || h->ref_count[1]-1 > max){ av_log(h->s.avctx, AV_LOG_ERROR, "reference overflow\n"); - h->ref_count[0]= h->ref_count[1]= 1; - return -1; + h->ref_count[0] = h->ref_count[1] = 1; + return AVERROR_INVALIDDATA; } + if(h->slice_type_nos == AV_PICTURE_TYPE_B) h->list_count= 2; else |