Merge commit '668e16a0dd1ff56d4beeff5c658d8a2a08dbfac8'

* commit '668e16a0dd1ff56d4beeff5c658d8a2a08dbfac8':
  h264: on reference overflow, reset the reference count to 0, not 1.

Conflicts:
	libavcodec/h264.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

diff --cc libavcodec/h264.c
index 56f3c47,7d24df2..be144f5
--- 1/libavcodec/h264.c
--- 2/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@@ -3516,17 -3371,13 +3516,17 @@@ static int decode_slice_header(H264Cont
  
          if (num_ref_idx_active_override_flag) {
              h->ref_count[0] = get_ue_golomb(&h->gb) + 1;
 -            if (h->ref_count[0] < 1)
 -                return AVERROR_INVALIDDATA;
              if (h->slice_type_nos == AV_PICTURE_TYPE_B) {
                  h->ref_count[1] = get_ue_golomb(&h->gb) + 1;
 -                if (h->ref_count[1] < 1)
 -                    return AVERROR_INVALIDDATA;
 -            }
 +            } else
 +                // full range is spec-ok in this case, even for frames
 +                h->ref_count[1] = 1;
 +        }
 +
 +        if (h->ref_count[0]-1 > max[0] || h->ref_count[1]-1 > max[1]){
 +            av_log(h->avctx, AV_LOG_ERROR, "reference overflow %u > %u or %u > %u\n", h->ref_count[0]-1, max[0], h->ref_count[1]-1, max[1]);
-             h->ref_count[0] = h->ref_count[1] = 1;
++            h->ref_count[0] = h->ref_count[1] = 0;
 +            return AVERROR_INVALIDDATA;
          }
  
          if (h->slice_type_nos == AV_PICTURE_TYPE_B)