[FFmpeg-cvslog] Merge commit 'cb167f2947f1a2c446bd8db196d0e64ef4a6d06b'

[James Almer]

ffmpeg | branch: master | James Almer <jamrial at gmail.com> | Mon Oct 30 20:40:28 2017 -0300| [0e5a47693c4b2e77b3951c209e842b8a72b7b36b] | committer: James Almer

Merge commit 'cb167f2947f1a2c446bd8db196d0e64ef4a6d06b'

* commit 'cb167f2947f1a2c446bd8db196d0e64ef4a6d06b':
  h264_refs: validate the SPS pointer in ff_h264_execute_ref_pic_marking()

Merged-by: James Almer <jamrial at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0e5a47693c4b2e77b3951c209e842b8a72b7b36b
---

 libavcodec/h264_refs.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/libavcodec/h264_refs.c b/libavcodec/h264_refs.c
index af70829594..976044ce2c 100644
--- a/libavcodec/h264_refs.c
+++ b/libavcodec/h264_refs.c
@@ -614,6 +614,12 @@ int ff_h264_execute_ref_pic_marking(H264Context *h)
     int current_ref_assigned = 0, err = 0;
     H264Picture *av_uninit(pic);
 
+    if (!h->ps.sps) {
+        av_log(h->avctx, AV_LOG_ERROR, "SPS is unset\n");
+        err = AVERROR_INVALIDDATA;
+        goto out;
+    }
+
     if (!h->explicit_ref_marking)
         generate_sliding_window_mmcos(h);
     mmco_count = h->nb_mmco;
@@ -817,6 +823,7 @@ int ff_h264_execute_ref_pic_marking(H264Context *h)
             h->frame_recovered |= FRAME_RECOVERED_SEI;
     }
 
+out:
     return (h->avctx->err_recognition & AV_EF_EXPLODE) ? err : 0;
 }
 


======================================================================

diff --cc libavcodec/h264_refs.c
index af70829594,9536c4beaa..976044ce2c
--- a/libavcodec/h264_refs.c
+++ b/libavcodec/h264_refs.c
@@@ -786,37 -729,9 +792,38 @@@ int ff_h264_execute_ref_pic_marking(H26
          }
      }
  
 +    for (i = 0; i<h->short_ref_count; i++) {
 +        pic = h->short_ref[i];
 +        if (pic->invalid_gap) {
 +            int d = av_mod_uintp2(h->cur_pic_ptr->frame_num - pic->frame_num, h->ps.sps->log2_max_frame_num);
 +            if (d > h->ps.sps->ref_frame_count)
 +                remove_short(h, pic->frame_num, 0);
 +        }
 +    }
 +
      print_short_term(h);
      print_long_term(h);
 +
 +    for (i = 0; i < FF_ARRAY_ELEMS(h->ps.pps_list); i++) {
 +        if (h->ps.pps_list[i]) {
 +            const PPS *pps = (const PPS *)h->ps.pps_list[i]->data;
 +            pps_ref_count[0] = FFMAX(pps_ref_count[0], pps->ref_count[0]);
 +            pps_ref_count[1] = FFMAX(pps_ref_count[1], pps->ref_count[1]);
 +        }
 +    }
 +
 +    if (   err >= 0
 +        && h->long_ref_count==0
 +        && (   h->short_ref_count<=2
 +            || pps_ref_count[0] <= 1 + (h->picture_structure != PICT_FRAME) && pps_ref_count[1] <= 1)
 +        && pps_ref_count[0]<=2 + (h->picture_structure != PICT_FRAME) + (2*!h->has_recovery_point)
 +        && h->cur_pic_ptr->f->pict_type == AV_PICTURE_TYPE_I){
 +        h->cur_pic_ptr->recovered |= 1;
 +        if(!h->avctx->has_b_frames)
 +            h->frame_recovered |= FRAME_RECOVERED_SEI;
 +    }
 +
+ out:
      return (h->avctx->err_recognition & AV_EF_EXPLODE) ? err : 0;
  }