h264: make sure the current picture is not made a long ref multiple times
authorAnton Khirnov <anton@khirnov.net>
Fri, 8 May 2015 17:07:10 +0000 (19:07 +0200)
committerAnton Khirnov <anton@khirnov.net>
Sat, 27 Jun 2015 14:46:01 +0000 (16:46 +0200)
Fixes possible invalid reads, once one of those refs is freed, but the
others remain.
CC: libav-stable@libav.org
libavcodec/h264_refs.c

index 2ddbdb7..adc2213 100644 (file)
@@ -640,6 +640,15 @@ int ff_h264_execute_ref_pic_marking(H264Context *h, MMCO *mmco, int mmco_count)
             if (h->short_ref[0] == h->cur_pic_ptr)
                 remove_short_at_index(h, 0);
 
+            /* make sure the current picture is not already assigned as a long ref */
+            if (h->cur_pic_ptr->long_ref) {
+                for (j = 0; j < FF_ARRAY_ELEMS(h->long_ref); j++) {
+                    if (h->long_ref[j] == h->cur_pic_ptr)
+                        remove_long(h, j, 0);
+                }
+            }
+
+
             if (h->long_ref[mmco[i].long_arg] != h->cur_pic_ptr) {
                 remove_long(h, mmco[i].long_arg, 0);