Bug-Id: 1036
CC: [email protected]
---
libavcodec/h264_refs.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/libavcodec/h264_refs.c b/libavcodec/h264_refs.c
index b4dc49c..51fce3f 100644
--- a/libavcodec/h264_refs.c
+++ b/libavcodec/h264_refs.c
@@ -556,6 +556,7 @@ int ff_h264_execute_ref_pic_marking(H264Context *h)
int i, av_uninit(j);
int current_ref_assigned = 0, err = 0;
H264Picture *av_uninit(pic);
+ const SPS *sps = h->ps.sps;
if (!h->explicit_ref_marking)
generate_sliding_window_mmcos(h);
@@ -697,8 +698,8 @@ int ff_h264_execute_ref_pic_marking(H264Context *h)
}
}
- if (h->long_ref_count + h->short_ref_count -
- (h->short_ref[0] == h->cur_pic_ptr) > h->ps.sps->ref_frame_count) {
+ if (sps && h->long_ref_count + h->short_ref_count -
+ (h->short_ref[0] == h->cur_pic_ptr) > sps->ref_frame_count) {
/* We have too many reference frames, probably due to corrupted
* stream. Need to discard one frame. Prevents overrun of the
@@ -707,7 +708,7 @@ int ff_h264_execute_ref_pic_marking(H264Context *h)
av_log(h->avctx, AV_LOG_ERROR,
"number of reference frames (%d+%d) exceeds max (%d; probably "
"corrupt input), discarding one\n",
- h->long_ref_count, h->short_ref_count,
h->ps.sps->ref_frame_count);
+ h->long_ref_count, h->short_ref_count, sps->ref_frame_count);
err = AVERROR_INVALIDDATA;
if (h->long_ref_count && !h->short_ref_count) {
@@ -721,6 +722,9 @@ int ff_h264_execute_ref_pic_marking(H264Context *h)
pic = h->short_ref[h->short_ref_count - 1];
remove_short(h, pic->frame_num, 0);
}
+ } else if (!sps) {
+ av_log(h->avctx, AV_LOG_ERROR, "SPS is unset\n");
+ err = AVERROR_INVALIDDATA;
}
print_short_term(h);
--
2.7.4
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
