avidec: avoid infinite loop due to negative ast->sample_size
[ffmpeg.git] / libavcodec / h264_picture.c
index 127bc45..14d8f19 100644 (file)
@@ -49,7 +49,7 @@ void ff_h264_unref_picture(H264Context *h, H264Picture *pic)
     int off = offsetof(H264Picture, tf) + sizeof(pic->tf);
     int i;
 
-    if (!pic->f.buf[0])
+    if (!pic->f || !pic->f->buf[0])
         return;
 
     ff_thread_release_buffer(h->avctx, &pic->tf);
@@ -69,11 +69,11 @@ int ff_h264_ref_picture(H264Context *h, H264Picture *dst, H264Picture *src)
 {
     int ret, i;
 
-    av_assert0(!dst->f.buf[0]);
-    av_assert0(src->f.buf[0]);
+    av_assert0(!dst->f->buf[0]);
+    av_assert0(src->f->buf[0]);
 
-    src->tf.f = &src->f;
-    dst->tf.f = &dst->f;
+    src->tf.f = src->f;
+    dst->tf.f = dst->f;
     ret = ff_thread_ref_frame(&dst->tf, &src->tf);
     if (ret < 0)
         goto fail;
@@ -114,7 +114,6 @@ int ff_h264_ref_picture(H264Context *h, H264Picture *dst, H264Picture *src)
     dst->long_ref      = src->long_ref;
     dst->mbaff         = src->mbaff;
     dst->field_picture = src->field_picture;
-    dst->needs_realloc = src->needs_realloc;
     dst->reference     = src->reference;
     dst->crop          = src->crop;
     dst->crop_left     = src->crop_left;
@@ -139,7 +138,7 @@ void ff_h264_set_erpic(ERPicture *dst, H264Picture *src)
     if (!src)
         return;
 
-    dst->f = &src->f;
+    dst->f = src->f;
     dst->tf = &src->tf;
 
     for (i = 0; i < 2; i++) {
@@ -170,7 +169,6 @@ int ff_h264_field_end(H264Context *h, H264SliceContext *sl, int in_setup)
         }
         h->prev_frame_num_offset = h->frame_num_offset;
         h->prev_frame_num        = h->frame_num;
-        h->outputed_poc          = h->next_outputed_poc;
     }
 
     if (avctx->hwaccel) {
@@ -184,6 +182,7 @@ int ff_h264_field_end(H264Context *h, H264SliceContext *sl, int in_setup)
         ff_vdpau_h264_picture_complete(h);
 
 #if CONFIG_ERROR_RESILIENCE
+    av_assert0(sl == h->slice_ctx);
     /*
      * FIXME: Error handling code does not seem to support interlaced
      * when slices span multiple rows
@@ -196,16 +195,16 @@ int ff_h264_field_end(H264Context *h, H264SliceContext *sl, int in_setup)
      * past end by one (callers fault) and resync_mb_y != 0
      * causes problems for the first MB line, too.
      */
-    if (!FIELD_PICTURE(h) && h->current_slice && !h->sps.new) {
-        int use_last_pic = h->last_pic_for_ec.f.buf[0] && !sl->ref_count[0];
+    if (!FIELD_PICTURE(h) && h->current_slice && !h->sps.new && h->enable_er) {
+        int use_last_pic = h->last_pic_for_ec.f->buf[0] && !sl->ref_count[0];
 
         ff_h264_set_erpic(&sl->er.cur_pic, h->cur_pic_ptr);
 
         if (use_last_pic) {
             ff_h264_set_erpic(&sl->er.last_pic, &h->last_pic_for_ec);
             sl->ref_list[0][0].parent = &h->last_pic_for_ec;
-            memcpy(sl->ref_list[0][0].data, h->last_pic_for_ec.f.data, sizeof(sl->ref_list[0][0].data));
-            memcpy(sl->ref_list[0][0].linesize, h->last_pic_for_ec.f.linesize, sizeof(sl->ref_list[0][0].linesize));
+            memcpy(sl->ref_list[0][0].data, h->last_pic_for_ec.f->data, sizeof(sl->ref_list[0][0].data));
+            memcpy(sl->ref_list[0][0].linesize, h->last_pic_for_ec.f->linesize, sizeof(sl->ref_list[0][0].linesize));
             sl->ref_list[0][0].reference = h->last_pic_for_ec.reference;
         } else if (sl->ref_count[0]) {
             ff_h264_set_erpic(&sl->er.last_pic, sl->ref_list[0][0].parent);