avcodec/h264_slice: Do not attempt to render into frames already output
authorMichael Niedermayer <michael@niedermayer.cc>
Wed, 3 Jan 2018 22:42:01 +0000 (23:42 +0100)
committerMichael Niedermayer <michael@niedermayer.cc>
Mon, 19 Feb 2018 01:40:54 +0000 (02:40 +0100)
Fixes: null pointer dereference
Fixes: 4698/clusterfuzz-testcase-minimized-5096956322906112

This testcase does not reproduce the issue before 03b82b3ab9883cef017e513c7d0b3b986b3b3e7b

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 476665d4de989dba48ec1195215ccc8db54538f4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/h264_slice.c

index c0b3b67..0afd49b 100644 (file)
@@ -1633,6 +1633,12 @@ int ff_h264_decode_slice_header(H264Context *h, H264SliceContext *sl)
                 h->missing_fields ++;
                 h->cur_pic_ptr = NULL;
                 h->first_field = FIELD_PICTURE(h);
+            } else if (h->cur_pic_ptr->reference & DELAYED_PIC_REF) {
+                /* This frame was already output, we cannot draw into it
+                 * anymore.
+                 */
+                h->first_field = 1;
+                h->cur_pic_ptr = NULL;
             } else {
                 h->missing_fields = 0;
                 if (h->cur_pic_ptr->frame_num != h->frame_num) {