[FFmpeg-cvslog] Merge commit '70b1dcef2d859ae6b3e21d61de928c3dd0cf1aa4'

[James Almer]

ffmpeg | branch: master | James Almer <jamrial at gmail.com> | Mon Aug  1 13:02:20 2016 -0300| [9ee1f033656374a9f7c9bddcfd85739614580d62] | committer: James Almer

Merge commit '70b1dcef2d859ae6b3e21d61de928c3dd0cf1aa4'

* commit '70b1dcef2d859ae6b3e21d61de928c3dd0cf1aa4':
  h264: tighten the valid range for ref_frame_count

Conflicts:
libavcodec/h264_ps.c

Merged-by: James Almer <jamrial at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9ee1f033656374a9f7c9bddcfd85739614580d62
---

 libavcodec/h264_ps.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/libavcodec/h264_ps.c b/libavcodec/h264_ps.c
index f288ca2..4a5f66e 100644
--- a/libavcodec/h264_ps.c
+++ b/libavcodec/h264_ps.c
@@ -457,8 +457,7 @@ int ff_h264_decode_seq_parameter_set(GetBitContext *gb, AVCodecContext *avctx,
     sps->ref_frame_count = get_ue_golomb_31(gb);
     if (avctx->codec_tag == MKTAG('S', 'M', 'V', '2'))
         sps->ref_frame_count = FFMAX(2, sps->ref_frame_count);
-    if (sps->ref_frame_count > H264_MAX_PICTURE_COUNT - 2 ||
-        sps->ref_frame_count > 16U) {
+    if (sps->ref_frame_count > MAX_DELAYED_PIC_COUNT) {
         av_log(avctx, AV_LOG_ERROR,
                "too many reference frames %d\n", sps->ref_frame_count);
         goto fail;


======================================================================

diff --cc libavcodec/h264_ps.c
index f288ca2,4a56c73..4a5f66e
--- a/libavcodec/h264_ps.c
+++ b/libavcodec/h264_ps.c
@@@ -455,10 -431,7 +455,9 @@@ int ff_h264_decode_seq_parameter_set(Ge
      }
  
      sps->ref_frame_count = get_ue_golomb_31(gb);
 +    if (avctx->codec_tag == MKTAG('S', 'M', 'V', '2'))
 +        sps->ref_frame_count = FFMAX(2, sps->ref_frame_count);
-     if (sps->ref_frame_count > H264_MAX_PICTURE_COUNT - 2 ||
-         sps->ref_frame_count > 16U) {
+     if (sps->ref_frame_count > MAX_DELAYED_PIC_COUNT) {
          av_log(avctx, AV_LOG_ERROR,
                 "too many reference frames %d\n", sps->ref_frame_count);
          goto fail;