diff options
| author | Anton Khirnov <anton@khirnov.net> | 2013-11-28 10:54:35 +0100 |
|---|---|---|
| committer | Anton Khirnov <anton@khirnov.net> | 2014-01-18 20:41:24 +0100 |
| commit | d1b3fabe6945e511bb20fc9ca52b47eb952526ee (patch) | |
| tree | c7206e21b6114a1fa48b8fe52b46b04b4decdae9 /libavcodec | |
| parent | 210881110d3e22cca36edeaca118b5e22c998266 (diff) | |
h264: reset first_field if frame_start() fails for missing refs
In this case we may not have a current frame, while first_field being
set implies we do.
Fixes invalid reads.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/h264.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c index 7d49d4877d..47fb76d370 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -3619,8 +3619,11 @@ static int decode_slice_header(H264Context *h, H264Context *h0) av_log(h->avctx, AV_LOG_DEBUG, "Frame num gap %d %d\n", h->frame_num, h->prev_frame_num); ret = h264_frame_start(h); - if (ret < 0) + if (ret < 0) { + h0->first_field = 0; return ret; + } + h->prev_frame_num++; h->prev_frame_num %= 1 << h->sps.log2_max_frame_num; h->cur_pic_ptr->frame_num = h->prev_frame_num; |