summaryrefslogtreecommitdiff
path: root/libavcodec/h264_cabac.c
diff options
context:
space:
mode:
authorRonald S. Bultje <rsbultje@gmail.com>2012-10-03 16:25:14 -0700
committerLuca Barbato <lu_zero@gentoo.org>2012-10-05 02:49:45 +0200
commitf6f7d1504134683c435e2c7d804279d982e52bb4 (patch)
treefff69ec29a5fb7e1feb81abe54f501b04bef52b7 /libavcodec/h264_cabac.c
parenta7329e5fc22433dfeaf7af22fb40fe3cada21385 (diff)
downloadffmpeg-f6f7d1504134683c435e2c7d804279d982e52bb4.tar.gz
h264: don't touch H264Context->ref_count[] during MB decoding
The variable is copied to subsequent threads at the same time, so this may cause wrong ref_count[] values to be copied to subsequent threads. This bug was found using TSAN. Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Diffstat (limited to 'libavcodec/h264_cabac.c')
-rw-r--r--libavcodec/h264_cabac.c41
1 files changed, 16 insertions, 25 deletions
diff --git a/libavcodec/h264_cabac.c b/libavcodec/h264_cabac.c
index f2fea5d3f2..92c1c03740 100644
--- a/libavcodec/h264_cabac.c
+++ b/libavcodec/h264_cabac.c
@@ -2005,11 +2005,6 @@ decode_intra_mb:
return 0;
}
- if(MB_MBAFF){
- h->ref_count[0] <<= 1;
- h->ref_count[1] <<= 1;
- }
-
fill_decode_caches(h, mb_type);
if( IS_INTRA( mb_type ) ) {
@@ -2078,10 +2073,11 @@ decode_intra_mb:
for( i = 0; i < 4; i++ ) {
if(IS_DIRECT(h->sub_mb_type[i])) continue;
if(IS_DIR(h->sub_mb_type[i], 0, list)){
- if( h->ref_count[list] > 1 ){
+ int rc = h->ref_count[list] << MB_MBAFF;
+ if (rc > 1) {
ref[list][i] = decode_cabac_mb_ref( h, list, 4*i );
- if(ref[list][i] >= (unsigned)h->ref_count[list]){
- av_log(s->avctx, AV_LOG_ERROR, "Reference %d >= %d\n", ref[list][i], h->ref_count[list]);
+ if (ref[list][i] >= (unsigned) rc) {
+ av_log(s->avctx, AV_LOG_ERROR, "Reference %d >= %d\n", ref[list][i], rc);
return -1;
}
}else
@@ -2163,11 +2159,11 @@ decode_intra_mb:
if(IS_16X16(mb_type)){
for(list=0; list<h->list_count; list++){
if(IS_DIR(mb_type, 0, list)){
- int ref;
- if(h->ref_count[list] > 1){
+ int ref, rc = h->ref_count[list] << MB_MBAFF;
+ if (rc > 1) {
ref= decode_cabac_mb_ref(h, list, 0);
- if(ref >= (unsigned)h->ref_count[list]){
- av_log(s->avctx, AV_LOG_ERROR, "Reference %d >= %d\n", ref, h->ref_count[list]);
+ if (ref >= (unsigned) rc) {
+ av_log(s->avctx, AV_LOG_ERROR, "Reference %d >= %d\n", ref, rc);
return -1;
}
}else
@@ -2191,11 +2187,11 @@ decode_intra_mb:
for(list=0; list<h->list_count; list++){
for(i=0; i<2; i++){
if(IS_DIR(mb_type, i, list)){
- int ref;
- if(h->ref_count[list] > 1){
+ int ref, rc = h->ref_count[list] << MB_MBAFF;
+ if (rc > 1) {
ref= decode_cabac_mb_ref( h, list, 8*i );
- if(ref >= (unsigned)h->ref_count[list]){
- av_log(s->avctx, AV_LOG_ERROR, "Reference %d >= %d\n", ref, h->ref_count[list]);
+ if (ref >= (unsigned) rc) {
+ av_log(s->avctx, AV_LOG_ERROR, "Reference %d >= %d\n", ref, rc);
return -1;
}
}else
@@ -2226,11 +2222,11 @@ decode_intra_mb:
for(list=0; list<h->list_count; list++){
for(i=0; i<2; i++){
if(IS_DIR(mb_type, i, list)){ //FIXME optimize
- int ref;
- if(h->ref_count[list] > 1){
+ int ref, rc = h->ref_count[list] << MB_MBAFF;
+ if (rc > 1) {
ref= decode_cabac_mb_ref( h, list, 4*i );
- if(ref >= (unsigned)h->ref_count[list]){
- av_log(s->avctx, AV_LOG_ERROR, "Reference %d >= %d\n", ref, h->ref_count[list]);
+ if (ref >= (unsigned) rc) {
+ av_log(s->avctx, AV_LOG_ERROR, "Reference %d >= %d\n", ref, rc);
return -1;
}
}else
@@ -2403,10 +2399,5 @@ decode_intra_mb:
s->current_picture.f.qscale_table[mb_xy] = s->qscale;
write_back_non_zero_count(h);
- if(MB_MBAFF){
- h->ref_count[0] >>= 1;
- h->ref_count[1] >>= 1;
- }
-
return 0;
}