h264: reset first_field if frame_start() fails for missing refs
authorAnton Khirnov <anton@khirnov.net>
Thu, 28 Nov 2013 09:54:35 +0000 (10:54 +0100)
committerAnton Khirnov <anton@khirnov.net>
Sat, 18 Jan 2014 19:41:24 +0000 (20:41 +0100)
In this case we may not have a current frame, while first_field being
set implies we do.

Fixes invalid reads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org

libavcodec/h264.c

index 7d49d48..47fb76d 100644 (file)
@@ -3619,8 +3619,11 @@ static int decode_slice_header(H264Context *h, H264Context *h0)
             av_log(h->avctx, AV_LOG_DEBUG, "Frame num gap %d %d\n",
                    h->frame_num, h->prev_frame_num);
             ret = h264_frame_start(h);
-            if (ret < 0)
+            if (ret < 0) {
+                h0->first_field = 0;
                 return ret;
+            }
+
             h->prev_frame_num++;
             h->prev_frame_num        %= 1 << h->sps.log2_max_frame_num;
             h->cur_pic_ptr->frame_num = h->prev_frame_num;