From de6df46120367b7d49d9d7c0971cbe36368b840a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 8 Feb 2015 01:59:16 +0100 Subject: avcodec/h264: Setup decoder to have matching reference to the EC code Also move EC ref initialization to where the EC code is called. Fixes out of array read Fixes: asan_heap-uaf_143f420_142_20110805_112659_ch0.mkv Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/h264_picture.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'libavcodec/h264_picture.c') diff --git a/libavcodec/h264_picture.c b/libavcodec/h264_picture.c index b6bdae491b..30ac65c8d5 100644 --- a/libavcodec/h264_picture.c +++ b/libavcodec/h264_picture.c @@ -197,8 +197,26 @@ int ff_h264_field_end(H264Context *h, int in_setup) * causes problems for the first MB line, too. */ if (!FIELD_PICTURE(h) && h->current_slice && !h->sps.new) { + int use_last_pic = h->last_pic_for_ec.f.buf[0] && !h->ref_count[0]; + ff_h264_set_erpic(&h->er.cur_pic, h->cur_pic_ptr); + + if (use_last_pic) { + ff_h264_set_erpic(&h->er.last_pic, &h->last_pic_for_ec); + COPY_PICTURE(&h->ref_list[0][0], &h->last_pic_for_ec); + } else if (h->ref_count[0]) { + ff_h264_set_erpic(&h->er.last_pic, &h->ref_list[0][0]); + } else + ff_h264_set_erpic(&h->er.last_pic, NULL); + + if (h->ref_count[1]) + ff_h264_set_erpic(&h->er.next_pic, &h->ref_list[1][0]); + + h->er.ref_count = h->ref_count[0]; + ff_er_frame_end(&h->er); + if (use_last_pic) + memset(&h->ref_list[0][0], 0, sizeof(h->last_pic_for_ec)); } #endif /* CONFIG_ERROR_RESILIENCE */ -- cgit v1.2.1