Merge commit '4d388c0cd05dd4de545e8ea333ab4de7d67ad12d'

* commit '4d388c0cd05dd4de545e8ea333ab4de7d67ad12d':
  h264_refs: make sure not to write over the bounds of the default ref list

Conflicts:
	libavcodec/h264_refs.c

This condition should be impossible and was checked for by asserts.
the asserts are moved up in this merge to gurantee that no out of array
access can happen even if the state is "impossible".
Also if such impossible states could somehow be created, that should
be dealt with and not silently ignored.

Merged-by: Michael Niedermayer <michaelni@gmx.at>

diff --cc libavcodec/h264_refs.c
index d989cad,bba77d1..8f86db6
--- 1/libavcodec/h264_refs.c
--- 2/libavcodec/h264_refs.c
+++ b/libavcodec/h264_refs.c
@@@ -78,11 -78,11 +79,13 @@@ static int build_def_list(Picture *def
              i[0]++;
          while (i[1] < len && !(in[i[1]] && (in[i[1]]->reference & (sel ^ 3))))
              i[1]++;
 -        if (i[0] < len && index < def_len) {
 +        if (i[0] < len) {
++            av_assert0(index < def_len);
              in[i[0]]->pic_id = is_long ? i[0] : in[i[0]]->frame_num;
              split_field_copy(&def[index++], in[i[0]++], sel, 1);
          }
 -        if (i[1] < len && index < def_len) {
 +        if (i[1] < len) {
++            av_assert0(index < def_len);
              in[i[1]]->pic_id = is_long ? i[1] : in[i[1]]->frame_num;
              split_field_copy(&def[index++], in[i[1]++], sel ^ 3, 0);
          }
@@@ -130,10 -130,13 +133,14 @@@ int ff_h264_fill_default_ref_list(H264C
          for (list = 0; list < 2; list++) {
              len  = add_sorted(sorted,       h->short_ref, h->short_ref_count, cur_poc, 1 ^ list);
              len += add_sorted(sorted + len, h->short_ref, h->short_ref_count, cur_poc, 0 ^ list);
 -            assert(len <= 32);
 +            av_assert0(len <= 32);
-             len  = build_def_list(h->default_ref_list[list],       sorted,      len, 0, h->picture_structure);
-             len += build_def_list(h->default_ref_list[list] + len, h->long_ref, 16,  1, h->picture_structure);
+ 
+             len  = build_def_list(h->default_ref_list[list], FF_ARRAY_ELEMS(h->default_ref_list[0]),
+                                   sorted, len, 0, h->picture_structure);
+             len += build_def_list(h->default_ref_list[list] + len,
+                                   FF_ARRAY_ELEMS(h->default_ref_list[0]) - len,
+                                   h->long_ref, 16, 1, h->picture_structure);
 +            av_assert0(len <= 32);
  
              if (len < h->ref_count[list])
                  memset(&h->default_ref_list[list][len], 0, sizeof(Picture) * (h->ref_count[list] - len));
@@@ -152,9 -155,12 +159,13 @@@
              }
          }
      } else {
-         len  = build_def_list(h->default_ref_list[0],       h->short_ref, h->short_ref_count, 0, h->picture_structure);
-         len += build_def_list(h->default_ref_list[0] + len, h-> long_ref, 16,                 1, h->picture_structure);
+         len  = build_def_list(h->default_ref_list[0], FF_ARRAY_ELEMS(h->default_ref_list[0]),
+                               h->short_ref, h->short_ref_count, 0, h->picture_structure);
+         len += build_def_list(h->default_ref_list[0] + len,
+                               FF_ARRAY_ELEMS(h->default_ref_list[0]) - len,
+                               h-> long_ref, 16, 1, h->picture_structure);
 +        av_assert0(len <= 32);
+ 
          if (len < h->ref_count[0])
              memset(&h->default_ref_list[0][len], 0, sizeof(Picture) * (h->ref_count[0] - len));
      }