Check for reference frames so RV 3/4 won't segfault trying to copy data from

nonexisting reference.

Originally committed as revision 22378 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/rv34.c b/libavcodec/rv34.c
index 50ded79..1100fbd 100644 (file)
--- a/libavcodec/rv34.c
+++ b/libavcodec/rv34.c
@@ -1452,8 +1452,12 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
         av_log(avctx, AV_LOG_ERROR, "First slice header is incorrect\n");
         return -1;
     }
+    if((!s->last_picture_ptr || !s->last_picture_ptr->data[0]) && si.type == FF_P_TYPE)
+        return -1;
     if((!s->last_picture_ptr || !s->last_picture_ptr->data[0]) && si.type == FF_B_TYPE)
         return -1;
+    if((!s->next_picture_ptr || !s->next_picture_ptr->data[0]) && si.type == FF_B_TYPE)
+        return -1;
     /* skip b frames if we are in a hurry */
     if(avctx->hurry_up && si.type==FF_B_TYPE) return buf_size;
     if(   (avctx->skip_frame >= AVDISCARD_NONREF && si.type==FF_B_TYPE)