shithub: openh264

Download patch

ref: 1bf04b1f97fa91a0517184aaeaf8de8423bdbb55
parent: 3bf69ad5bbb66cf8fed3adf9ef3d5eca8c487c6c
author: xiaotiansf <xiaotianshimail@gmail.com>
date: Fri Mar 15 11:12:13 EDT 2019 

Prevent decoded pictures of Scalable Baseline Profile (83) (no b-frame) stream from being buffered for reordering. fix "dec crash for spec bitstream (gop2.h264) cisco#3110".

The crash is caused by trying to flush out previous removed (decoded) picture. Decoder has no idea needs to keep this frame.


--- a/codec/decoder/plus/src/welsDecoderExt.cpp
+++ b/codec/decoder/plus/src/welsDecoderExt.cpp
@@ -754,14 +754,23 @@
 
 DECODING_STATE CWelsDecoder::ReorderPicturesInDisplay (unsigned char** ppDst, SBufferInfo* pDstInfo) {
   DECODING_STATE iRet = dsErrorFree;
-  if (pDstInfo->iBufferStatus == 1 && m_pDecContext->pSps->uiProfileIdc != 66) {
-    if (m_pDecContext->pSliceHeader->iPicOrderCntLsb == 0) {
-      if (m_iNumOfPicts > 0) {
-        m_iLastGOPRemainPicts = m_iNumOfPicts;
-        for (int32_t i = 0; i <= m_iLargestBufferedPicIndex; ++i) {
-          if (m_sPictInfoList[i].iPOC > sIMinInt32) {
-            m_sPictInfoList[i].bLastGOP = true;
-          }
+  if (pDstInfo->iBufferStatus == 1 && m_pDecContext->pSps->uiProfileIdc != 66
+      && m_pDecContext->pSps->uiProfileIdc != 83) {
+    /*if (m_pDecContext->pSliceHeader->iPicOrderCntLsb == 0) {
+      m_LastWrittenPOC = 0;
+      return dsErrorFree;
+    }
+    if (m_iNumOfPicts == 0 && m_pDecContext->pPreviousDecodedPictureInDpb->bNewSeqBegin
+        && m_pDecContext->eSliceType != I_SLICE) {
+      m_LastWrittenPOC = m_pDecContext->pSliceHeader->iPicOrderCntLsb;
+      return dsErrorFree;
+    }*/
+    if (m_iNumOfPicts && m_pDecContext->pPreviousDecodedPictureInDpb
+        && m_pDecContext->pPreviousDecodedPictureInDpb->bNewSeqBegin) {
+      m_iLastGOPRemainPicts = m_iNumOfPicts;
+      for (int32_t i = 0; i <= m_iLargestBufferedPicIndex; ++i) {
+        if (m_sPictInfoList[i].iPOC > sIMinInt32) {
+          m_sPictInfoList[i].bLastGOP = true;
         }
       }
     } else {