[SCM] libav/wheezy-security: mpegvideo: set reference/pict_type on generated reference frames

[siretart at users.alioth.debian.org]

The following commit has been merged in the wheezy-security branch:
commit 07558d0b9fa0923e8b53f6eb7f2b69c4d631f11a
Author: Anton Khirnov <anton at khirnov.net>
Date:   Thu Nov 28 10:54:35 2013 +0100

    mpegvideo: set reference/pict_type on generated reference frames
    
    Otherwise the generic code will unref them, which can then result in
    last_picture_ptr == current_picture_ptr, which causes deadlocks at least
    in rv40.
    
    Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
    CC:libav-stable at libav.org

diff --git a/libavcodec/mpegvideo.c b/libavcodec/mpegvideo.c
index 8df3061..f3e2c12 100644
--- a/libavcodec/mpegvideo.c
+++ b/libavcodec/mpegvideo.c
@@ -1269,6 +1269,10 @@ int MPV_frame_start(MpegEncContext *s, AVCodecContext *avctx)
             /* Allocate a dummy frame */
             i = ff_find_unused_picture(s, 0);
             s->last_picture_ptr = &s->picture[i];
+
+            s->last_picture_ptr->f.reference   = 3;
+            s->last_picture_ptr->f.pict_type = AV_PICTURE_TYPE_I;
+
             if (ff_alloc_picture(s, s->last_picture_ptr, 0) < 0)
                 return -1;
             ff_thread_report_progress((AVFrame *) s->last_picture_ptr,
@@ -1282,6 +1286,10 @@ int MPV_frame_start(MpegEncContext *s, AVCodecContext *avctx)
             /* Allocate a dummy frame */
             i = ff_find_unused_picture(s, 0);
             s->next_picture_ptr = &s->picture[i];
+
+            s->next_picture_ptr->f.reference   = 3;
+            s->next_picture_ptr->f.pict_type = AV_PICTURE_TYPE_I;
+
             if (ff_alloc_picture(s, s->next_picture_ptr, 0) < 0)
                 return -1;
             ff_thread_report_progress((AVFrame *) s->next_picture_ptr,

-- 
Libav/FFmpeg packaging