h264: correct ref count check and limit, fix out of array accesses.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
12 years ago · d6c184880e
parent 2d5f1addbe
commit d6c184880e
1 changed files with 1 additions and 1 deletions
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@ -2935,7 +2935,7 @@ static int decode_slice_header(H264Context *h, H264Context *h0)
                h->ref_count[1] = get_ue_golomb(&s->gb) + 1;
            else
                // full range is spec-ok in this case, even for frames
-                max[1] = 31;
+                h->ref_count[1] = 1;
        }

        if (h->ref_count[0]-1 > max[0] || h->ref_count[1]-1 > max[1]){