On 5/7/17 11:18 PM, Sean McGovern wrote:
> Bug-Id: 1036
> CC: libav-sta...@libav.org
> ---
> libavcodec/h264_refs.c | 10 +++++++---
> 1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/libavcodec/h264_refs.c b/libavcodec/h264_refs.c
> index b4dc49c..51fce3f 100644
> --- a/libavcodec/h264_refs.c
> +++ b/libavcodec/h264_refs.c
> @@ -556,6 +556,7 @@ int ff_h264_execute_ref_pic_marking(H264Context *h)
> int i, av_uninit(j);
> int current_ref_assigned = 0, err = 0;
> H264Picture *av_uninit(pic);
> + const SPS *sps = h->ps.sps;
>
> if (!h->explicit_ref_marking)
> generate_sliding_window_mmcos(h);
> @@ -697,8 +698,8 @@ int ff_h264_execute_ref_pic_marking(H264Context *h)
> }
> }
>
> - if (h->long_ref_count + h->short_ref_count -
> - (h->short_ref[0] == h->cur_pic_ptr) > h->ps.sps->ref_frame_count) {
> + if (sps && h->long_ref_count + h->short_ref_count -
> + (h->short_ref[0] == h->cur_pic_ptr) > sps->ref_frame_count) {
>
> /* We have too many reference frames, probably due to corrupted
> * stream. Need to discard one frame. Prevents overrun of the
> @@ -707,7 +708,7 @@ int ff_h264_execute_ref_pic_marking(H264Context *h)
> av_log(h->avctx, AV_LOG_ERROR,
> "number of reference frames (%d+%d) exceeds max (%d; probably
> "
> "corrupt input), discarding one\n",
> - h->long_ref_count, h->short_ref_count,
> h->ps.sps->ref_frame_count);
> + h->long_ref_count, h->short_ref_count, sps->ref_frame_count);
> err = AVERROR_INVALIDDATA;
>
> if (h->long_ref_count && !h->short_ref_count) {
> @@ -721,6 +722,9 @@ int ff_h264_execute_ref_pic_marking(H264Context *h)
> pic = h->short_ref[h->short_ref_count - 1];
> remove_short(h, pic->frame_num, 0);
> }
> + } else if (!sps) {
> + av_log(h->avctx, AV_LOG_ERROR, "SPS is unset\n");
> + err = AVERROR_INVALIDDATA;
> }
>
> print_short_term(h);
>
you could do an early return/goto I think.
lu
_______________________________________________
libav-devel mailing list
libav-devel@libav.org
https://lists.libav.org/mailman/listinfo/libav-devel
