avcodec/h264, videotoolbox: do not return invalid frames on failure

If videotoolbox_common_end_frame failed, then the AVFrame was returned
to the API user with the dummy buffer (in AVFrame.buf[0]) still set, and
the decode call indicating success.

These "half-set" AVFrames with dummy buffer are a videotoolbox specific
hack, because the decoder requires an allocated AVFrame for its internal
logic. Videotoolbox on the other hand allocates its frame itself
internally, and outputs it only on end_frame. At this point, the dummy
buffer is replaced with the real frame (unless decoding fails).

diff --git a/libavcodec/h264_refs.c b/libavcodec/h264_refs.c
index 619f2edf8448c947d253719421c47fe792554281..9d0641a0dbea58a11b5ec6f8806486b19903766f 100644 (file)
--- a/libavcodec/h264_refs.c
+++ b/libavcodec/h264_refs.c
@@ -515,7 +515,8 @@ void ff_h264_remove_all_refs(H264Context *h)
 
     if (h->short_ref_count && !h->last_pic_for_ec.f->data[0]) {
         ff_h264_unref_picture(h, &h->last_pic_for_ec);
-        ff_h264_ref_picture(h, &h->last_pic_for_ec, h->short_ref[0]);
+        if (h->short_ref[0]->f->buf[0])
+            ff_h264_ref_picture(h, &h->last_pic_for_ec, h->short_ref[0]);
     }
 
     for (i = 0; i < h->short_ref_count; i++) {

diff --git a/libavcodec/videotoolbox.c b/libavcodec/videotoolbox.c
index cc1e592ac9abaf59a1a207c19be316b521d3ae0f..2f4d5316015903a288c27f885633117ee4dd6b81 100644 (file)
--- a/libavcodec/videotoolbox.c
+++ b/libavcodec/videotoolbox.c
@@ -353,6 +353,8 @@ static int videotoolbox_common_end_frame(AVCodecContext *avctx, AVFrame *frame)
     AVVideotoolboxContext *videotoolbox = avctx->hwaccel_context;
     VTContext *vtctx = avctx->internal->hwaccel_priv_data;
 
+    av_buffer_unref(&frame->buf[0]);
+
     if (!videotoolbox->session || !vtctx->bitstream)
         return AVERROR_INVALIDDATA;