shithub: openh264

Download patch

ref: cfb22048d8d8aa6033769f50e726f27d40d0bd5b
parent: 4227bead55e29c15efcf9b9e80db5240f4cf8b28
author: xiaotiansf <xiaotianshimail@gmail.com>
date: Sun Mar 3 07:04:24 EST 2019 

additional fix for ossz-buzz bug 13457.


--- a/codec/decoder/core/src/decoder.cpp
+++ b/codec/decoder/core/src/decoder.cpp
@@ -167,20 +167,20 @@
 
 static void ResetRefPicReferences (const PWelsDecoderContext& pCtx, const PPicture& inPPic) {
   //seach and reset the references of deleted references.
-  if (pCtx->eSliceType != B_SLICE) {
-    return;
-  }
-  for (int32_t list = LIST_0; list < LIST_A; ++list) {
+  int32_t list_count = pCtx->eSliceType == B_SLICE ? 2 : 1;
+  for (int32_t list = LIST_0; list < list_count; ++list) {
     int32_t refIdx = 0;
     PPicture pPic = pCtx->sRefPic.pRefList[list][refIdx];
     while (refIdx < MAX_DPB_COUNT && pPic != NULL) {
       ++refIdx;
-      int32_t ref = 0;
-      while (ref < MAX_DPB_COUNT && *pPic->pRefPic[ref] != NULL) {
-        if (*pPic->pRefPic[ref] == inPPic) {
-          *pPic->pRefPic[ref] = NULL;
+      for (int32_t i = LIST_0; i < LIST_A; ++i) {
+        int32_t ref = 0;
+        while (ref < MAX_DPB_COUNT && pPic->pRefPic[i][ref] != NULL) {
+          if (pPic->pRefPic[i][ref] == inPPic) {
+            pPic->pRefPic[i][ref] = NULL;
+          }
+          ++ref;
         }
-        ++ref;
       }
     }
   }