From 7fd6c9fb49573870b48a995947edc83eedd7e86e Mon Sep 17 00:00:00 2001 From: Anton Khirnov Date: Thu, 28 Nov 2013 10:54:35 +0100 Subject: [PATCH] h264: reset first_field if frame_start() fails for missing refs In this case we may not have a current frame, while first_field being set implies we do. Fixes invalid reads. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC:libav-stable@libav.org --- libavcodec/h264.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavcodec/h264.c b/libavcodec/h264.c index f5f7de4b41..db336f0fc5 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -2910,8 +2910,10 @@ static int decode_slice_header(H264Context *h, H264Context *h0) Picture *prev = h->short_ref_count ? h->short_ref[0] : NULL; av_log(h->s.avctx, AV_LOG_DEBUG, "Frame num gap %d %d\n", h->frame_num, h->prev_frame_num); - if (ff_h264_frame_start(h) < 0) + if (ff_h264_frame_start(h) < 0) { + s0->first_field = 0; return -1; + } h->prev_frame_num++; h->prev_frame_num %= 1 << h->sps.log2_max_frame_num; s->current_picture_ptr->frame_num = h->prev_frame_num;