From d1b3fabe6945e511bb20fc9ca52b47eb952526ee Mon Sep 17 00:00:00 2001 From: Anton Khirnov Date: Thu, 28 Nov 2013 10:54:35 +0100 Subject: h264: reset first_field if frame_start() fails for missing refs In this case we may not have a current frame, while first_field being set implies we do. Fixes invalid reads. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC:libav-stable@libav.org --- libavcodec/h264.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavcodec/h264.c b/libavcodec/h264.c index 7d49d4877d..47fb76d370 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -3619,8 +3619,11 @@ static int decode_slice_header(H264Context *h, H264Context *h0) av_log(h->avctx, AV_LOG_DEBUG, "Frame num gap %d %d\n", h->frame_num, h->prev_frame_num); ret = h264_frame_start(h); - if (ret < 0) + if (ret < 0) { + h0->first_field = 0; return ret; + } + h->prev_frame_num++; h->prev_frame_num %= 1 << h->sps.log2_max_frame_num; h->cur_pic_ptr->frame_num = h->prev_frame_num; -- cgit v1.2.3