[vlc-commits] contrib:ffmpeg: fix crash on bogus frame reference in MPEG-2 with DXVA

[Steve Lhomme]

vlc/vlc-3.0 | branch: master | Steve Lhomme <robux4 at ycbcr.xyz> | Tue Jan 23 13:01:22 2018 +0100| [a06bd2902f9d5896b10b7fb139ff219a1b1cfaee] | committer: Jean-Baptiste Kempf

contrib:ffmpeg: fix crash on bogus frame reference in MPEG-2 with DXVA

same fix that is needed for VC1

Ref #18916

(cherry picked from commit fe922dd6bfa099ba404b6b00a64606a29b80b6a4)
Signed-off-by: Jean-Baptiste Kempf <jb at videolan.org>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=a06bd2902f9d5896b10b7fb139ff219a1b1cfaee
---

 contrib/src/ffmpeg/dxva_vc1_crash.patch | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/contrib/src/ffmpeg/dxva_vc1_crash.patch b/contrib/src/ffmpeg/dxva_vc1_crash.patch
index 2fecce0881..3e5c3ed683 100644
--- a/contrib/src/ffmpeg/dxva_vc1_crash.patch
+++ b/contrib/src/ffmpeg/dxva_vc1_crash.patch
@@ -14,3 +14,19 @@
          pp->wBackwardRefPictureIndex = ff_dxva2_get_surface_index(avctx, ctx, s->next_picture.f);
      else
          pp->wBackwardRefPictureIndex = 0xffff;
+--- ffmpeg/libavcodec/dxva2_mpeg2.c	2018-01-23 12:58:14.672161600 +0100
++++ ffmpeg/libavcodec/dxva2_mpeg2.c.ref	2018-01-23 12:56:45.439743300 +0100
+@@ -51,11 +51,11 @@ static void fill_picture_parameters(AVCo
+     memset(pp, 0, sizeof(*pp));
+     pp->wDecodedPictureIndex         = ff_dxva2_get_surface_index(avctx, ctx, current_picture->f);
+     pp->wDeblockedPictureIndex       = 0;
+-    if (s->pict_type != AV_PICTURE_TYPE_I)
++    if (s->pict_type != AV_PICTURE_TYPE_I && s->last_picture.f->data[0])
+         pp->wForwardRefPictureIndex  = ff_dxva2_get_surface_index(avctx, ctx, s->last_picture.f);
+     else
+         pp->wForwardRefPictureIndex  = 0xffff;
+-    if (s->pict_type == AV_PICTURE_TYPE_B)
++    if (s->pict_type == AV_PICTURE_TYPE_B && s->next_picture.f->data[0])
+         pp->wBackwardRefPictureIndex = ff_dxva2_get_surface_index(avctx, ctx, s->next_picture.f);
+     else
+         pp->wBackwardRefPictureIndex = 0xffff;