h264: always copy block_offset in thread update

Fixes out of array accesses

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: NMichael Niedermayer <michaelni@gmx.at>

libavcodec/h264.c

@@ -1221,12 +1221,12 @@ static int decode_update_thread_context(AVCodecContext *dst,
         s->linesize   = s1->linesize;
         s->uvlinesize = s1->uvlinesize;
 
-        /* copy block_offset since frame_start may not be called */
-        memcpy(h->block_offset, h1->block_offset, sizeof(h->block_offset));
         h264_set_parameter_from_sps(h);
         //Note we set context_reinitialized which will cause h264_set_parameter_from_sps to be reexecuted
         h->cur_chroma_format_idc = h1->cur_chroma_format_idc;
     }
+    /* copy block_offset since frame_start may not be called */
+    memcpy(h->block_offset, h1->block_offset, sizeof(h->block_offset));
 
     err = ff_mpeg_update_thread_context(dst, src);
     if (err)