if (free_rbsp && h->DPB) {
for (i = 0; i < H264_MAX_PICTURE_COUNT; i++)
ff_h264_unref_picture(h, &h->DPB[i]);
+ memset(h->delayed_pic, 0, sizeof(h->delayed_pic));
av_freep(&h->DPB);
} else if (h->DPB) {
for (i = 0; i < H264_MAX_PICTURE_COUNT; i++)
h->luma_log2_weight_denom = get_ue_golomb(&h->gb);
if (h->sps.chroma_format_idc)
h->chroma_log2_weight_denom = get_ue_golomb(&h->gb);
+
+ if (h->luma_log2_weight_denom > 7U) {
+ av_log(h->avctx, AV_LOG_ERROR, "luma_log2_weight_denom %d is out of range\n", h->luma_log2_weight_denom);
+ h->luma_log2_weight_denom = 0;
+ }
+ if (h->chroma_log2_weight_denom > 7U) {
+ av_log(h->avctx, AV_LOG_ERROR, "chroma_log2_weight_denom %d is out of range\n", h->chroma_log2_weight_denom);
+ h->chroma_log2_weight_denom = 0;
+ }
+
luma_def = 1 << h->luma_log2_weight_denom;
chroma_def = 1 << h->chroma_log2_weight_denom;