check num_entries too to avoid reading over the array end and dont check i>0 it must...

Originally committed as revision 3708 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/mpegvideo.c b/libavcodec/mpegvideo.c
index 3b097e1dffa9513169bf0d21245e7662c57bb159..47d7a9635d36f76bb1637b47a696e293c5f5530e 100644 (file)
--- a/libavcodec/mpegvideo.c
+++ b/libavcodec/mpegvideo.c
@@ -2014,16 +2014,16 @@ static void select_input_picture(MpegEncContext *s){
             if(s->flags&CODEC_FLAG_PASS2){
                 for(i=0; i<s->max_b_frames+1; i++){
                     int pict_num= s->input_picture[0]->display_picture_number + i;
-                    int pict_type= s->rc_context.entry[pict_num].new_pict_type;
 
+                    if(pict_num >= s->rc_context.num_entries) 
+                        break;
                     if(!s->input_picture[i]){
-                        if(i>0)
-                            s->rc_context.entry[pict_num-1].new_pict_type = P_TYPE;
+                        s->rc_context.entry[pict_num-1].new_pict_type = P_TYPE;
                         break;
                     }
-                    s->input_picture[i]->pict_type= pict_type;
-                    
-                    if(i + 1 >= s->rc_context.num_entries) break;
+
+                    s->input_picture[i]->pict_type= 
+                        s->rc_context.entry[pict_num].new_pict_type;
                 }
             }