diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-02-08 01:59:16 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-02-08 02:27:27 +0100 |
| commit | de6df46120367b7d49d9d7c0971cbe36368b840a (patch) | |
| tree | de98aa92e41ea3a3962b09d1c1fa2a3c9c8e62a0 /libavcodec/h264_picture.c | |
| parent | ecfd48dc065bf279acc6281416e883246884db21 (diff) | |
| download | ffmpeg-de6df46120367b7d49d9d7c0971cbe36368b840a.tar.gz | |
avcodec/h264: Setup decoder to have matching reference to the EC code
Also move EC ref initialization to where the EC code is called.
Fixes out of array read
Fixes: asan_heap-uaf_143f420_142_20110805_112659_ch0.mkv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/h264_picture.c')
| -rw-r--r-- | libavcodec/h264_picture.c | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/libavcodec/h264_picture.c b/libavcodec/h264_picture.c index b6bdae491b..30ac65c8d5 100644 --- a/libavcodec/h264_picture.c +++ b/libavcodec/h264_picture.c @@ -197,8 +197,26 @@ int ff_h264_field_end(H264Context *h, int in_setup) * causes problems for the first MB line, too. */ if (!FIELD_PICTURE(h) && h->current_slice && !h->sps.new) { + int use_last_pic = h->last_pic_for_ec.f.buf[0] && !h->ref_count[0]; + ff_h264_set_erpic(&h->er.cur_pic, h->cur_pic_ptr); + + if (use_last_pic) { + ff_h264_set_erpic(&h->er.last_pic, &h->last_pic_for_ec); + COPY_PICTURE(&h->ref_list[0][0], &h->last_pic_for_ec); + } else if (h->ref_count[0]) { + ff_h264_set_erpic(&h->er.last_pic, &h->ref_list[0][0]); + } else + ff_h264_set_erpic(&h->er.last_pic, NULL); + + if (h->ref_count[1]) + ff_h264_set_erpic(&h->er.next_pic, &h->ref_list[1][0]); + + h->er.ref_count = h->ref_count[0]; + ff_er_frame_end(&h->er); + if (use_last_pic) + memset(&h->ref_list[0][0], 0, sizeof(h->last_pic_for_ec)); } #endif /* CONFIG_ERROR_RESILIENCE */ |