Merge remote-tracking branch 'qatar/master'

* qatar/master:
  h264: stricter reference limit enforcement.
  h264: increase reference poc list from 16 to 32.
  xa_adpcm: limit filter to prevent xa_adpcm_table[] array bounds overruns.
  snow: check reference frame indices.
  snow: reject unsupported chroma shifts.
  Add ffvhuff encoding and decoding regression test
  anm: convert to bytestream2 API
  bytestream: add more unchecked variants for bytestream2 API
  jvdec: unbreak video decoding
  jv demux: set video stream duration
  fate: add pam image regression test

Conflicts:
	libavcodec/adpcm.c
	libavcodec/anm.c
	libavcodec/h264.c
	libavcodec/mpegvideo.h
	libavcodec/snowdec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 7 insertions, 5 deletions

diff --git a/libavcodec/h264.c b/libavcodec/h264.c
index 2cb56028de..66174778df 100644
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -3034,7 +3034,8 @@ static int decode_slice_header(H264Context *h, H264Context *h0){
     h->ref_count[1]= h->pps.ref_count[1];
 
     if(h->slice_type_nos != AV_PICTURE_TYPE_I){
-        unsigned max= (16<<(s->picture_structure != PICT_FRAME))-1;
+        unsigned max= s->picture_structure == PICT_FRAME ? 15 : 31;
+
         if(h->slice_type_nos == AV_PICTURE_TYPE_B){
             h->direct_spatial_mv_pred= get_bits1(&s->gb);
         }
@@ -3044,13 +3045,14 @@ static int decode_slice_header(H264Context *h, H264Context *h0){
             h->ref_count[0]= get_ue_golomb(&s->gb) + 1;
             if(h->slice_type_nos==AV_PICTURE_TYPE_B)
                 h->ref_count[1]= get_ue_golomb(&s->gb) + 1;
-
         }
-        if(h->ref_count[0]-1 > max || h->ref_count[1]-1 > max){
+
+        if (h->ref_count[0]-1 > max || h->ref_count[1]-1 > max){
             av_log(h->s.avctx, AV_LOG_ERROR, "reference overflow\n");
-            h->ref_count[0]= h->ref_count[1]= 1;
-            return -1;
+            h->ref_count[0] = h->ref_count[1] = 1;
+            return AVERROR_INVALIDDATA;
         }
+
         if(h->slice_type_nos == AV_PICTURE_TYPE_B)
             h->list_count= 2;
         else