[FFmpeg-cvslog] h264: use mbaff ref indices in fill_colmap() only for mbaff references

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Thu Oct  6 22:54:00 2011 +0200| [c9aab8a123c0bcf6adeab390db1ec783326456ca] | committer: Janne Grunau

h264: use mbaff ref indices in fill_colmap() only for mbaff references

Prevents writing beyond array bounds.

Signed-off-by: Janne Grunau <janne-libav at jannau.net>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c9aab8a123c0bcf6adeab390db1ec783326456ca
---

 libavcodec/h264_direct.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavcodec/h264_direct.c b/libavcodec/h264_direct.c
index cc6e018..fc429ae 100644
--- a/libavcodec/h264_direct.c
+++ b/libavcodec/h264_direct.c
@@ -89,7 +89,8 @@ static void fill_colmap(H264Context *h, int map[2][16+32], int list, int field,
             for(j=start; j<end; j++){
                 if (4 * h->ref_list[0][j].frame_num + (h->ref_list[0][j].f.reference & 3) == poc) {
                     int cur_ref= mbafi ? (j-16)^field : j;
-                    map[list][2*old_ref + (rfield^field) + 16] = cur_ref;
+                    if (ref1->mbaff)
+                        map[list][2 * old_ref + (rfield^field) + 16] = cur_ref;
                     if(rfield == field || !interl)
                         map[list][old_ref] = cur_ref;
                     break;