diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-03-29 00:09:01 +0400 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-03-29 00:09:47 +0400 |
| commit | 92002db3eb437414281ad4fb6e84e34862f7fc92 (patch) | |
| tree | a5747a17530bdc79f4faad736fe9d769ff9be2c9 /libavcodec/h264_refs.c | |
| parent | dd17843b8ab3e1357f33069dae9af8e5b4e43d11 (diff) | |
h264_refs: Check for attempts to assign pictures to short & long.
Fixes null pointer dereference
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/h264_refs.c')
| -rw-r--r-- | libavcodec/h264_refs.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/h264_refs.c b/libavcodec/h264_refs.c index c3e7b7cfee..44d84d134d 100644 --- a/libavcodec/h264_refs.c +++ b/libavcodec/h264_refs.c @@ -626,6 +626,9 @@ int ff_h264_execute_ref_pic_marking(H264Context *h, MMCO *mmco, int mmco_count) if (h->long_ref[mmco[i].long_arg] != h->cur_pic_ptr) { remove_long(h, mmco[i].long_arg, 0); + if (remove_short(h, h->cur_pic_ptr->frame_num, 0)) { + av_log(h->avctx, AV_LOG_ERROR, "mmco: cannot assign current picture to short and long at the same time\n"); + } h->long_ref[mmco[i].long_arg] = h->cur_pic_ptr; h->long_ref[mmco[i].long_arg]->long_ref = 1; |