[FFmpeg-cvslog] avcodec/h264: Clear last_pic_for_ec on seeks and reinits

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Wed Feb 25 03:22:13 2015 +0100| [7296716e355c73650033b57bafe44063d3670117] | committer: Michael Niedermayer

avcodec/h264: Clear last_pic_for_ec on seeks and reinits

Fixes out of array read
Fixes: asan_heap-oob_2ff30d2_3479_cov_3803648058_src13_hrc7_525_420_2.264

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7296716e355c73650033b57bafe44063d3670117
---

 libavcodec/h264.c |    2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/h264.c b/libavcodec/h264.c
index c10bd81..a323098 100644
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -1084,6 +1084,8 @@ void ff_h264_flush_change(H264Context *h)
                 h->delayed_pic[j++] = h->delayed_pic[i];
         h->delayed_pic[j] = NULL;
     }
+    ff_h264_unref_picture(h, &h->last_pic_for_ec);
+
     h->first_field = 0;
     ff_h264_reset_sei(h);
     h->recovery_frame = -1;