Mercurial > libavcodec.hg
comparison h264.c @ 6018:9d1654835629 libavcodec
Ensure that our total reference frame count does not exceed the SPS
max frame count, which is limited to less than the size of the
reference buffers, thereby preventing overflow.
Part of fix for issue 281.
author | heydowns |
---|---|
date | Fri, 14 Dec 2007 06:25:23 +0000 |
parents | e1404acccac3 |
children | 42de24a34fd2 |
comparison
equal
deleted
inserted
replaced
6017:e1404acccac3 | 6018:9d1654835629 |
---|---|
3610 h->short_ref[0]->long_ref=0; | 3610 h->short_ref[0]->long_ref=0; |
3611 h->short_ref_count++; | 3611 h->short_ref_count++; |
3612 s->current_picture_ptr->reference |= s->picture_structure; | 3612 s->current_picture_ptr->reference |= s->picture_structure; |
3613 } | 3613 } |
3614 | 3614 |
3615 if (h->sps.ref_frame_count && | |
3616 h->long_ref_count + h->short_ref_count == h->sps.ref_frame_count){ | |
3617 | |
3618 /* We have too many reference frames, probably due to corrupted | |
3619 * stream. Need to discard one frame. Prevents overrun of the | |
3620 * short_ref and long_ref buffers. | |
3621 */ | |
3622 av_log(h->s.avctx, AV_LOG_ERROR, | |
3623 "number of reference frames exceeds max (probably " | |
3624 "corrupt input), discarding one\n"); | |
3625 | |
3626 if (h->long_ref_count) { | |
3627 for (i = 0; i < 16; ++i) | |
3628 if (h->long_ref[i]) | |
3629 break; | |
3630 | |
3631 assert(i < 16); | |
3632 remove_long_at_index(h, i); | |
3633 } else { | |
3634 remove_short_at_index(h, h->short_ref_count - 1); | |
3635 } | |
3636 } | |
3637 | |
3615 print_short_term(h); | 3638 print_short_term(h); |
3616 print_long_term(h); | 3639 print_long_term(h); |
3617 return 0; | 3640 return 0; |
3618 } | 3641 } |
3619 | 3642 |