From 187696fa72ec47c7151cd3cc708e224fe2eccb55 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Fri, 16 Feb 2007 21:34:21 +0000
Subject: [PATCH] fix 2nd ref_count check add list_count

Originally committed as revision 7998 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
 libavcodec/h264.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/libavcodec/h264.c b/libavcodec/h264.c
index 41bdc220e0..f2630b5e21 100644
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -326,6 +326,7 @@ typedef struct H264Context{
      * num_ref_idx_l0/1_active_minus1 + 1
      */
     unsigned int ref_count[2];   ///< counts frames or fields, depending on current mb mode
+    unsigned int list_count;
     Picture *short_ref[32];
     Picture *long_ref[32];
     Picture default_ref_list[2][32];
@@ -4706,13 +4707,18 @@ static int decode_slice_header(H264Context *h){
             if(h->slice_type==B_TYPE)
                 h->ref_count[1]= get_ue_golomb(&s->gb) + 1;
 
-            if(h->ref_count[0] > 32 || h->ref_count[1] > 32){
+            if(h->ref_count[0]-1 > 32-1 || h->ref_count[1]-1 > 32-1){
                 av_log(h->s.avctx, AV_LOG_ERROR, "reference overflow\n");
                 h->ref_count[0]= h->ref_count[1]= 1;
                 return -1;
             }
         }
-    }
+        if(h->slice_type == B_TYPE)
+            h->list_count= 2;
+        else
+            h->list_count= 1;
+    }else
+        h->list_count= 0;
 
     if(!default_ref_list_done){
         fill_default_ref_list(h);
-- 
GitLab