if (num_ref_idx_active_override_flag) {
h->ref_count[0] = get_ue_golomb(&h->gb) + 1;
- if (h->ref_count[0] < 1)
- return AVERROR_INVALIDDATA;
if (h->slice_type_nos == AV_PICTURE_TYPE_B) {
h->ref_count[1] = get_ue_golomb(&h->gb) + 1;
- if (h->ref_count[1] < 1)
- return AVERROR_INVALIDDATA;
- }
+ } else
+ // full range is spec-ok in this case, even for frames
+ h->ref_count[1] = 1;
+ }
+
+ if (h->ref_count[0]-1 > max[0] || h->ref_count[1]-1 > max[1]){
+ av_log(h->avctx, AV_LOG_ERROR, "reference overflow %u > %u or %u > %u\n", h->ref_count[0]-1, max[0], h->ref_count[1]-1, max[1]);
- h->ref_count[0] = h->ref_count[1] = 1;
++ h->ref_count[0] = h->ref_count[1] = 0;
+ return AVERROR_INVALIDDATA;
}
if (h->slice_type_nos == AV_PICTURE_TYPE_B)