It is actually supposed to go negative in the loop over num_negative
pics, but underflow does not break anything as the result is then
assigned to a signed int.
---
libavcodec/hevc_ps.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c
index 1af691414e..d90f172c46 100644
--- a/libavcodec/hevc_ps.c
+++ b/libavcodec/hevc_ps.c
@@ -197,7 +197,8 @@ int ff_hevc_decode_short_term_rps(GetBitContext *gb,
AVCodecContext *avctx,
}
}
} else {
- unsigned int prev, nb_positive_pics;
+ unsigned int nb_positive_pics;
+
rps->num_negative_pics = get_ue_golomb_long(gb);
nb_positive_pics = get_ue_golomb_long(gb);
@@ -209,7 +210,8 @@ int ff_hevc_decode_short_term_rps(GetBitContext *gb,
AVCodecContext *avctx,
rps->num_delta_pocs = rps->num_negative_pics + nb_positive_pics;
if (rps->num_delta_pocs) {
- prev = 0;
+ int prev = 0;
+
for (i = 0; i < rps->num_negative_pics; i++) {
delta_poc = rps->delta_poc_s0[i] = get_ue_golomb_long(gb) + 1;
if (delta_poc < 1 || delta_poc > 32768) {
--
2.43.0
_______________________________________________
ffmpeg-devel mailing list
[email protected]
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
[email protected] with subject "unsubscribe".
