Message ID | 20180103224201.18317-2-michael@niedermayer.cc |
---|---|
State | Accepted |
Commit | 476665d4de989dba48ec1195215ccc8db54538f4 |
Headers | show |
On Wed, Jan 03, 2018 at 11:42:01PM +0100, Michael Niedermayer wrote: > Fixes: null pointer dereference > Fixes: 4698/clusterfuzz-testcase-minimized-5096956322906112 > > This testcase does not reproduce the issue before 03b82b3ab9883cef017e513c7d0b3b986b3b3e7b > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/h264_slice.c | 6 ++++++ > 1 file changed, 6 insertions(+) will apply [...]
diff --git a/libavcodec/h264_slice.c b/libavcodec/h264_slice.c index aad5484588..e6b7998834 100644 --- a/libavcodec/h264_slice.c +++ b/libavcodec/h264_slice.c @@ -1571,6 +1571,12 @@ static int h264_field_start(H264Context *h, const H264SliceContext *sl, * one except for reference purposes. */ h->first_field = 1; h->cur_pic_ptr = NULL; + } else if (h->cur_pic_ptr->reference & DELAYED_PIC_REF) { + /* This frame was already output, we cannot draw into it + * anymore. + */ + h->first_field = 1; + h->cur_pic_ptr = NULL; } else { /* Second field in complementary pair */ h->first_field = 0;
Fixes: null pointer dereference Fixes: 4698/clusterfuzz-testcase-minimized-5096956322906112 This testcase does not reproduce the issue before 03b82b3ab9883cef017e513c7d0b3b986b3b3e7b Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/h264_slice.c | 6 ++++++ 1 file changed, 6 insertions(+)