diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-02-21 20:05:43 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-02-21 20:24:31 +0100 |
| commit | 8036ba299d332282dc86a94999f9332d38d47c4e (patch) | |
| tree | 7d4d585b0bdcc8ec241df44abfb75716a2fa8016 /libavcodec/h264.c | |
| parent | 669d50b445960a7929cd4240bd1a086ab7843c92 (diff) | |
| download | ffmpeg-8036ba299d332282dc86a94999f9332d38d47c4e.tar.gz | |
h264: move next/last picture init to decode_slice_header
This is a regression introduced from the h264/mpegvideo split
Fixes out of array reads
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/h264.c')
| -rw-r--r-- | libavcodec/h264.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c index 124215c279..4f38379021 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -1726,6 +1726,8 @@ int ff_h264_frame_start(H264Context *h) h->cur_pic.f.extended_data = h->cur_pic.f.data; ff_er_frame_start(&h->er); + h->er.last_pic = + h->er.next_pic = NULL; assert(h->linesize && h->uvlinesize); @@ -2737,8 +2739,6 @@ static int field_end(H264Context *h, int in_setup) */ if (!FIELD_PICTURE && h->current_slice && !h->sps.new) { h->er.cur_pic = h->cur_pic_ptr; - h->er.last_pic = h->ref_count[0] ? &h->ref_list[0][0] : NULL; - h->er.next_pic = h->ref_count[1] ? &h->ref_list[1][0] : NULL; ff_er_frame_end(&h->er); } emms_c(); @@ -3720,6 +3720,9 @@ static int decode_slice_header(H264Context *h, H264Context *h0) (h->ref_list[j][i].f.reference & 3); } + if (h->ref_count[0]) h->er.last_pic = &h->ref_list[0][0]; + if (h->ref_count[1]) h->er.next_pic = &h->ref_list[1][0]; + if (h->avctx->debug & FF_DEBUG_PICT_INFO) { av_log(h->avctx, AV_LOG_DEBUG, "slice:%d %s mb:%d %c%s%s pps:%u frame:%d poc:%d/%d ref:%d/%d qp:%d loop:%d:%d:%d weight:%d%s %s\n", |