avcodec/h264_refs: set last_pic_for_ec only if it has not been set previously
authorMichael Niedermayer <michaelni@gmx.at>
Thu, 5 Feb 2015 13:55:41 +0000 (14:55 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Thu, 5 Feb 2015 13:57:42 +0000 (14:57 +0100)
This ensures we do not loose the frame in case or multiple clears
Fixes out of array read
Fixes: asan_heap-oob_2fa47ea_2100_cov_1278768963_ff_add_pixels_clamped_mmx.m2ts

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/h264_refs.c

index 78c283c..8278a07 100644 (file)
@@ -493,9 +493,10 @@ void ff_h264_remove_all_refs(H264Context *h)
     }
     assert(h->long_ref_count == 0);
 
-    ff_h264_unref_picture(h, &h->last_pic_for_ec);
-    if (h->short_ref_count)
+    if (h->short_ref_count && !h->last_pic_for_ec.f.data[0]) {
+        ff_h264_unref_picture(h, &h->last_pic_for_ec);
         ff_h264_ref_picture(h, &h->last_pic_for_ec, h->short_ref[0]);
+    }
 
     for (i = 0; i < h->short_ref_count; i++) {
         unreference_pic(h, h->short_ref[i], 0);