1 /*
2  * H.26L/H.264/AVC/JVT/14496-10/... reference picture handling
3  * Copyright (c) 2003 Michael Niedermayer <michaelni@gmx.at>
4  *
5  * This file is part of FFmpeg.
6  *
7  * FFmpeg is free software; you can redistribute it and/or
8  * modify it under the terms of the GNU Lesser General Public
9  * License as published by the Free Software Foundation; either
10  * version 2.1 of the License, or (at your option) any later version.
11  *
12  * FFmpeg is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15  * Lesser General Public License for more details.
16  *
17  * You should have received a copy of the GNU Lesser General Public
18  * License along with FFmpeg; if not, write to the Free Software
19  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20  */
21 
22 /**
23  * @file
24  * H.264 / AVC / MPEG-4 part10  reference picture handling.
25  * @author Michael Niedermayer <michaelni@gmx.at>
26  */
27 
28 #include <inttypes.h>
29 
30 #include "libavutil/avassert.h"
31 #include "avcodec.h"
32 #include "h264.h"
33 #include "h264dec.h"
34 #include "golomb.h"
35 #include "mpegutils.h"
36 
37 #include <assert.h>
38 
pic_as_field(H264Ref *pic, const int parity)39 static void pic_as_field(H264Ref *pic, const int parity)
40 {
41     int i;
42     for (i = 0; i < FF_ARRAY_ELEMS(pic->data); ++i) {
43         if (parity == PICT_BOTTOM_FIELD)
44             pic->data[i]   += pic->linesize[i];
45         pic->reference      = parity;
46         pic->linesize[i] *= 2;
47     }
48     pic->poc = pic->parent->field_poc[parity == PICT_BOTTOM_FIELD];
49 }
50 
ref_from_h264pic(H264Ref *dst, H264Picture *src)51 static void ref_from_h264pic(H264Ref *dst, H264Picture *src)
52 {
53     memcpy(dst->data,     src->f->data,     sizeof(dst->data));
54     memcpy(dst->linesize, src->f->linesize, sizeof(dst->linesize));
55     dst->reference = src->reference;
56     dst->poc       = src->poc;
57     dst->pic_id    = src->pic_id;
58     dst->parent = src;
59 }
60 
split_field_copy(H264Ref *dest, H264Picture *src, int parity, int id_add)61 static int split_field_copy(H264Ref *dest, H264Picture *src, int parity, int id_add)
62 {
63     int match = !!(src->reference & parity);
64 
65     if (match) {
66         ref_from_h264pic(dest, src);
67         if (parity != PICT_FRAME) {
68             pic_as_field(dest, parity);
69             dest->pic_id *= 2;
70             dest->pic_id += id_add;
71         }
72     }
73 
74     return match;
75 }
76 
build_def_list(H264Ref *def, int def_len, H264Picture * const *in, int len, int is_long, int sel)77 static int build_def_list(H264Ref *def, int def_len,
78                           H264Picture * const *in, int len, int is_long, int sel)
79 {
80     int  i[2] = { 0 };
81     int index = 0;
82 
83     while (i[0] < len || i[1] < len) {
84         while (i[0] < len && !(in[i[0]] && (in[i[0]]->reference & sel)))
85             i[0]++;
86         while (i[1] < len && !(in[i[1]] && (in[i[1]]->reference & (sel ^ 3))))
87             i[1]++;
88         if (i[0] < len) {
89             av_assert0(index < def_len);
90             in[i[0]]->pic_id = is_long ? i[0] : in[i[0]]->frame_num;
91             split_field_copy(&def[index++], in[i[0]++], sel, 1);
92         }
93         if (i[1] < len) {
94             av_assert0(index < def_len);
95             in[i[1]]->pic_id = is_long ? i[1] : in[i[1]]->frame_num;
96             split_field_copy(&def[index++], in[i[1]++], sel ^ 3, 0);
97         }
98     }
99 
100     return index;
101 }
102 
add_sorted(H264Picture **sorted, H264Picture * const *src, int len, int limit, int dir)103 static int add_sorted(H264Picture **sorted, H264Picture * const *src,
104                       int len, int limit, int dir)
105 {
106     int i, best_poc;
107     int out_i = 0;
108 
109     for (;;) {
110         best_poc = dir ? INT_MIN : INT_MAX;
111 
112         for (i = 0; i < len; i++) {
113             const int poc = src[i]->poc;
114             if (((poc > limit) ^ dir) && ((poc < best_poc) ^ dir)) {
115                 best_poc      = poc;
116                 sorted[out_i] = src[i];
117             }
118         }
119         if (best_poc == (dir ? INT_MIN : INT_MAX))
120             break;
121         limit = sorted[out_i++]->poc - dir;
122     }
123     return out_i;
124 }
125 
mismatches_ref(const H264Context *h, const H264Picture *pic)126 static int mismatches_ref(const H264Context *h, const H264Picture *pic)
127 {
128     const AVFrame *f = pic->f;
129     return (h->cur_pic_ptr->f->width  != f->width ||
130             h->cur_pic_ptr->f->height != f->height ||
131             h->cur_pic_ptr->f->format != f->format);
132 }
133 
h264_initialise_ref_list(H264Context *h, H264SliceContext *sl)134 static void h264_initialise_ref_list(H264Context *h, H264SliceContext *sl)
135 {
136     int i, len;
137     int j;
138 
139     if (sl->slice_type_nos == AV_PICTURE_TYPE_B) {
140         H264Picture *sorted[32];
141         int cur_poc, list;
142         int lens[2];
143 
144         if (FIELD_PICTURE(h))
145             cur_poc = h->cur_pic_ptr->field_poc[h->picture_structure == PICT_BOTTOM_FIELD];
146         else
147             cur_poc = h->cur_pic_ptr->poc;
148 
149         for (list = 0; list < 2; list++) {
150             len  = add_sorted(sorted,       h->short_ref, h->short_ref_count, cur_poc, 1 ^ list);
151             len += add_sorted(sorted + len, h->short_ref, h->short_ref_count, cur_poc, 0 ^ list);
152             av_assert0(len <= 32);
153 
154             len  = build_def_list(sl->ref_list[list], FF_ARRAY_ELEMS(sl->ref_list[0]),
155                                   sorted, len, 0, h->picture_structure);
156             len += build_def_list(sl->ref_list[list] + len,
157                                   FF_ARRAY_ELEMS(sl->ref_list[0]) - len,
158                                   h->long_ref, 16, 1, h->picture_structure);
159             av_assert0(len <= 32);
160 
161             if (len < sl->ref_count[list])
162                 memset(&sl->ref_list[list][len], 0, sizeof(H264Ref) * (sl->ref_count[list] - len));
163             lens[list] = len;
164         }
165 
166         if (lens[0] == lens[1] && lens[1] > 1) {
167             for (i = 0; i < lens[0] &&
168                         sl->ref_list[0][i].parent->f->buf[0]->buffer ==
169                         sl->ref_list[1][i].parent->f->buf[0]->buffer; i++);
170             if (i == lens[0]) {
171                 FFSWAP(H264Ref, sl->ref_list[1][0], sl->ref_list[1][1]);
172             }
173         }
174     } else {
175         len  = build_def_list(sl->ref_list[0], FF_ARRAY_ELEMS(sl->ref_list[0]),
176                               h->short_ref, h->short_ref_count, 0, h->picture_structure);
177         len += build_def_list(sl->ref_list[0] + len,
178                               FF_ARRAY_ELEMS(sl->ref_list[0]) - len,
179                               h-> long_ref, 16, 1, h->picture_structure);
180         av_assert0(len <= 32);
181 
182         if (len < sl->ref_count[0])
183             memset(&sl->ref_list[0][len], 0, sizeof(H264Ref) * (sl->ref_count[0] - len));
184     }
185 #ifdef TRACE
186     for (i = 0; i < sl->ref_count[0]; i++) {
187         ff_tlog(h->avctx, "List0: %s fn:%d 0x%p\n",
188                 (sl->ref_list[0][i].parent ? (sl->ref_list[0][i].parent->long_ref ? "LT" : "ST") : "??"),
189                 sl->ref_list[0][i].pic_id,
190                 sl->ref_list[0][i].data[0]);
191     }
192     if (sl->slice_type_nos == AV_PICTURE_TYPE_B) {
193         for (i = 0; i < sl->ref_count[1]; i++) {
194             ff_tlog(h->avctx, "List1: %s fn:%d 0x%p\n",
195                     (sl->ref_list[1][i].parent ? (sl->ref_list[1][i].parent->long_ref ? "LT" : "ST") : "??"),
196                     sl->ref_list[1][i].pic_id,
197                     sl->ref_list[1][i].data[0]);
198         }
199     }
200 #endif
201 
202     for (j = 0; j<1+(sl->slice_type_nos == AV_PICTURE_TYPE_B); j++) {
203         for (i = 0; i < sl->ref_count[j]; i++) {
204             if (sl->ref_list[j][i].parent) {
205                 if (mismatches_ref(h, sl->ref_list[j][i].parent)) {
206                     av_log(h->avctx, AV_LOG_ERROR, "Discarding mismatching reference\n");
207                     memset(&sl->ref_list[j][i], 0, sizeof(sl->ref_list[j][i]));
208                 }
209             }
210         }
211     }
212     for (i = 0; i < sl->list_count; i++)
213         h->default_ref[i] = sl->ref_list[i][0];
214 }
215 
216 /**
217  * print short term list
218  */
print_short_term(const H264Context *h)219 static void print_short_term(const H264Context *h)
220 {
221     uint32_t i;
222     if (h->avctx->debug & FF_DEBUG_MMCO) {
223         av_log(h->avctx, AV_LOG_DEBUG, "short term list:\n");
224         for (i = 0; i < h->short_ref_count; i++) {
225             H264Picture *pic = h->short_ref[i];
226             av_log(h->avctx, AV_LOG_DEBUG, "%"PRIu32" fn:%d poc:%d %p\n",
227                    i, pic->frame_num, pic->poc, pic->f->data[0]);
228         }
229     }
230 }
231 
232 /**
233  * print long term list
234  */
print_long_term(const H264Context *h)235 static void print_long_term(const H264Context *h)
236 {
237     uint32_t i;
238     if (h->avctx->debug & FF_DEBUG_MMCO) {
239         av_log(h->avctx, AV_LOG_DEBUG, "long term list:\n");
240         for (i = 0; i < 16; i++) {
241             H264Picture *pic = h->long_ref[i];
242             if (pic) {
243                 av_log(h->avctx, AV_LOG_DEBUG, "%"PRIu32" fn:%d poc:%d %p\n",
244                        i, pic->frame_num, pic->poc, pic->f->data[0]);
245             }
246         }
247     }
248 }
249 
250 /**
251  * Extract structure information about the picture described by pic_num in
252  * the current decoding context (frame or field). Note that pic_num is
253  * picture number without wrapping (so, 0<=pic_num<max_pic_num).
254  * @param pic_num picture number for which to extract structure information
255  * @param structure one of PICT_XXX describing structure of picture
256  *                      with pic_num
257  * @return frame number (short term) or long term index of picture
258  *         described by pic_num
259  */
pic_num_extract(const H264Context *h, int pic_num, int *structure)260 static int pic_num_extract(const H264Context *h, int pic_num, int *structure)
261 {
262     *structure = h->picture_structure;
263     if (FIELD_PICTURE(h)) {
264         if (!(pic_num & 1))
265             /* opposite field */
266             *structure ^= PICT_FRAME;
267         pic_num >>= 1;
268     }
269 
270     return pic_num;
271 }
272 
h264_fill_mbaff_ref_list(H264SliceContext *sl)273 static void h264_fill_mbaff_ref_list(H264SliceContext *sl)
274 {
275     int list, i, j;
276     for (list = 0; list < sl->list_count; list++) {
277         for (i = 0; i < sl->ref_count[list]; i++) {
278             H264Ref *frame = &sl->ref_list[list][i];
279             H264Ref *field = &sl->ref_list[list][16 + 2 * i];
280 
281             field[0] = *frame;
282 
283             for (j = 0; j < 3; j++)
284                 field[0].linesize[j] <<= 1;
285             field[0].reference = PICT_TOP_FIELD;
286             field[0].poc       = field[0].parent->field_poc[0];
287 
288             field[1] = field[0];
289 
290             for (j = 0; j < 3; j++)
291                 field[1].data[j] += frame->parent->f->linesize[j];
292             field[1].reference = PICT_BOTTOM_FIELD;
293             field[1].poc       = field[1].parent->field_poc[1];
294         }
295     }
296 }
297 
ff_h264_build_ref_list(H264Context *h, H264SliceContext *sl)298 int ff_h264_build_ref_list(H264Context *h, H264SliceContext *sl)
299 {
300     int list, index, pic_structure;
301 
302     print_short_term(h);
303     print_long_term(h);
304 
305     h264_initialise_ref_list(h, sl);
306 
307     for (list = 0; list < sl->list_count; list++) {
308         int pred = sl->curr_pic_num;
309 
310         for (index = 0; index < sl->nb_ref_modifications[list]; index++) {
311             unsigned int modification_of_pic_nums_idc = sl->ref_modifications[list][index].op;
312             unsigned int                          val = sl->ref_modifications[list][index].val;
313             unsigned int pic_id;
314             int i;
315             H264Picture *ref = NULL;
316 
317             switch (modification_of_pic_nums_idc) {
318             case 0:
319             case 1: {
320                 const unsigned int abs_diff_pic_num = val + 1;
321                 int frame_num;
322 
323                 if (abs_diff_pic_num > sl->max_pic_num) {
324                     av_log(h->avctx, AV_LOG_ERROR,
325                            "abs_diff_pic_num overflow\n");
326                     return AVERROR_INVALIDDATA;
327                 }
328 
329                 if (modification_of_pic_nums_idc == 0)
330                     pred -= abs_diff_pic_num;
331                 else
332                     pred += abs_diff_pic_num;
333                 pred &= sl->max_pic_num - 1;
334 
335                 frame_num = pic_num_extract(h, pred, &pic_structure);
336 
337                 for (i = h->short_ref_count - 1; i >= 0; i--) {
338                     ref = h->short_ref[i];
339                     assert(ref->reference);
340                     assert(!ref->long_ref);
341                     if (ref->frame_num == frame_num &&
342                         (ref->reference & pic_structure))
343                         break;
344                 }
345                 if (i >= 0)
346                     ref->pic_id = pred;
347                 break;
348             }
349             case 2: {
350                 int long_idx;
351                 pic_id = val; // long_term_pic_idx
352 
353                 long_idx = pic_num_extract(h, pic_id, &pic_structure);
354 
355                 if (long_idx > 31U) {
356                     av_log(h->avctx, AV_LOG_ERROR,
357                            "long_term_pic_idx overflow\n");
358                     return AVERROR_INVALIDDATA;
359                 }
360                 ref = h->long_ref[long_idx];
361                 assert(!(ref && !ref->reference));
362                 if (ref && (ref->reference & pic_structure)) {
363                     ref->pic_id = pic_id;
364                     assert(ref->long_ref);
365                     i = 0;
366                 } else {
367                     i = -1;
368                 }
369                 break;
370             }
371             default:
372                 av_assert0(0);
373             }
374 
375             if (i < 0 || mismatches_ref(h, ref)) {
376                 av_log(h->avctx, AV_LOG_ERROR,
377                        i < 0 ? "reference picture missing during reorder\n" :
378                                "mismatching reference\n"
379                       );
380                 memset(&sl->ref_list[list][index], 0, sizeof(sl->ref_list[0][0])); // FIXME
381             } else {
382                 for (i = index; i + 1 < sl->ref_count[list]; i++) {
383                     if (sl->ref_list[list][i].parent &&
384                         ref->long_ref == sl->ref_list[list][i].parent->long_ref &&
385                         ref->pic_id   == sl->ref_list[list][i].pic_id)
386                         break;
387                 }
388                 for (; i > index; i--) {
389                     sl->ref_list[list][i] = sl->ref_list[list][i - 1];
390                 }
391                 ref_from_h264pic(&sl->ref_list[list][index], ref);
392                 if (FIELD_PICTURE(h)) {
393                     pic_as_field(&sl->ref_list[list][index], pic_structure);
394                 }
395             }
396         }
397     }
398     for (list = 0; list < sl->list_count; list++) {
399         for (index = 0; index < sl->ref_count[list]; index++) {
400             if (   !sl->ref_list[list][index].parent
401                 || (!FIELD_PICTURE(h) && (sl->ref_list[list][index].reference&3) != 3)) {
402                 int i;
403                 av_log(h->avctx, AV_LOG_ERROR, "Missing reference picture, default is %d\n", h->default_ref[list].poc);
404                 for (i = 0; i < FF_ARRAY_ELEMS(h->last_pocs); i++)
405                     h->last_pocs[i] = INT_MIN;
406                 if (h->default_ref[list].parent
407                     && !(!FIELD_PICTURE(h) && (h->default_ref[list].reference&3) != 3))
408                     sl->ref_list[list][index] = h->default_ref[list];
409                 else
410                     return -1;
411             }
412             av_assert0(av_buffer_get_ref_count(sl->ref_list[list][index].parent->f->buf[0]) > 0);
413         }
414     }
415 
416     if (FRAME_MBAFF(h))
417         h264_fill_mbaff_ref_list(sl);
418 
419     return 0;
420 }
421 
ff_h264_decode_ref_pic_list_reordering(H264SliceContext *sl, void *logctx)422 int ff_h264_decode_ref_pic_list_reordering(H264SliceContext *sl, void *logctx)
423 {
424     int list, index;
425 
426     sl->nb_ref_modifications[0] = 0;
427     sl->nb_ref_modifications[1] = 0;
428 
429     for (list = 0; list < sl->list_count; list++) {
430         if (!get_bits1(&sl->gb))    // ref_pic_list_modification_flag_l[01]
431             continue;
432 
433         for (index = 0; ; index++) {
434             unsigned int op = get_ue_golomb_31(&sl->gb);
435 
436             if (op == 3)
437                 break;
438 
439             if (index >= sl->ref_count[list]) {
440                 av_log(logctx, AV_LOG_ERROR, "reference count overflow\n");
441                 return AVERROR_INVALIDDATA;
442             } else if (op > 2) {
443                 av_log(logctx, AV_LOG_ERROR,
444                        "illegal modification_of_pic_nums_idc %u\n",
445                        op);
446                 return AVERROR_INVALIDDATA;
447             }
448             sl->ref_modifications[list][index].val = get_ue_golomb_long(&sl->gb);
449             sl->ref_modifications[list][index].op  = op;
450             sl->nb_ref_modifications[list]++;
451         }
452     }
453 
454     return 0;
455 }
456 
457 /**
458  * Mark a picture as no longer needed for reference. The refmask
459  * argument allows unreferencing of individual fields or the whole frame.
460  * If the picture becomes entirely unreferenced, but is being held for
461  * display purposes, it is marked as such.
462  * @param refmask mask of fields to unreference; the mask is bitwise
463  *                anded with the reference marking of pic
464  * @return non-zero if pic becomes entirely unreferenced (except possibly
465  *         for display purposes) zero if one of the fields remains in
466  *         reference
467  */
unreference_pic(H264Context *h, H264Picture *pic, int refmask)468 static inline int unreference_pic(H264Context *h, H264Picture *pic, int refmask)
469 {
470     int i;
471     if (pic->reference &= refmask) {
472         return 0;
473     } else {
474         for(i = 0; h->delayed_pic[i]; i++)
475             if(pic == h->delayed_pic[i]){
476                 pic->reference = DELAYED_PIC_REF;
477                 break;
478             }
479         return 1;
480     }
481 }
482 
483 /**
484  * Find a H264Picture in the short term reference list by frame number.
485  * @param frame_num frame number to search for
486  * @param idx the index into h->short_ref where returned picture is found
487  *            undefined if no picture found.
488  * @return pointer to the found picture, or NULL if no pic with the provided
489  *                 frame number is found
490  */
find_short(H264Context *h, int frame_num, int *idx)491 static H264Picture *find_short(H264Context *h, int frame_num, int *idx)
492 {
493     int i;
494 
495     for (i = 0; i < h->short_ref_count; i++) {
496         H264Picture *pic = h->short_ref[i];
497         if (h->avctx->debug & FF_DEBUG_MMCO)
498             av_log(h->avctx, AV_LOG_DEBUG, "%d %d %p\n", i, pic->frame_num, pic);
499         if (pic->frame_num == frame_num) {
500             *idx = i;
501             return pic;
502         }
503     }
504     return NULL;
505 }
506 
507 /**
508  * Remove a picture from the short term reference list by its index in
509  * that list.  This does no checking on the provided index; it is assumed
510  * to be valid. Other list entries are shifted down.
511  * @param i index into h->short_ref of picture to remove.
512  */
remove_short_at_index(H264Context *h, int i)513 static void remove_short_at_index(H264Context *h, int i)
514 {
515     assert(i >= 0 && i < h->short_ref_count);
516     h->short_ref[i] = NULL;
517     if (--h->short_ref_count)
518         memmove(&h->short_ref[i], &h->short_ref[i + 1],
519                 (h->short_ref_count - i) * sizeof(H264Picture*));
520 }
521 
522 /**
523  * @return the removed picture or NULL if an error occurs
524  */
remove_short(H264Context *h, int frame_num, int ref_mask)525 static H264Picture *remove_short(H264Context *h, int frame_num, int ref_mask)
526 {
527     H264Picture *pic;
528     int i;
529 
530     if (h->avctx->debug & FF_DEBUG_MMCO)
531         av_log(h->avctx, AV_LOG_DEBUG, "remove short %d count %d\n", frame_num, h->short_ref_count);
532 
533     pic = find_short(h, frame_num, &i);
534     if (pic) {
535         if (unreference_pic(h, pic, ref_mask))
536             remove_short_at_index(h, i);
537     }
538 
539     return pic;
540 }
541 
542 /**
543  * Remove a picture from the long term reference list by its index in
544  * that list.
545  * @return the removed picture or NULL if an error occurs
546  */
remove_long(H264Context *h, int i, int ref_mask)547 static H264Picture *remove_long(H264Context *h, int i, int ref_mask)
548 {
549     H264Picture *pic;
550 
551     pic = h->long_ref[i];
552     if (pic) {
553         if (unreference_pic(h, pic, ref_mask)) {
554             assert(h->long_ref[i]->long_ref == 1);
555             h->long_ref[i]->long_ref = 0;
556             h->long_ref[i]           = NULL;
557             h->long_ref_count--;
558         }
559     }
560 
561     return pic;
562 }
563 
ff_h264_remove_all_refs(H264Context *h)564 void ff_h264_remove_all_refs(H264Context *h)
565 {
566     int i;
567 
568     for (i = 0; i < 16; i++) {
569         remove_long(h, i, 0);
570     }
571     assert(h->long_ref_count == 0);
572 
573     if (h->short_ref_count && !h->last_pic_for_ec.f->data[0]) {
574         ff_h264_unref_picture(h, &h->last_pic_for_ec);
575         ff_h264_ref_picture(h, &h->last_pic_for_ec, h->short_ref[0]);
576     }
577 
578     for (i = 0; i < h->short_ref_count; i++) {
579         unreference_pic(h, h->short_ref[i], 0);
580         h->short_ref[i] = NULL;
581     }
582     h->short_ref_count = 0;
583 
584     memset(h->default_ref, 0, sizeof(h->default_ref));
585 }
586 
generate_sliding_window_mmcos(H264Context *h)587 static void generate_sliding_window_mmcos(H264Context *h)
588 {
589     MMCO *mmco = h->mmco;
590     int nb_mmco = 0;
591 
592     if (h->short_ref_count &&
593         h->long_ref_count + h->short_ref_count >= h->ps.sps->ref_frame_count &&
594         !(FIELD_PICTURE(h) && !h->first_field && h->cur_pic_ptr->reference)) {
595         mmco[0].opcode        = MMCO_SHORT2UNUSED;
596         mmco[0].short_pic_num = h->short_ref[h->short_ref_count - 1]->frame_num;
597         nb_mmco               = 1;
598         if (FIELD_PICTURE(h)) {
599             mmco[0].short_pic_num *= 2;
600             mmco[1].opcode         = MMCO_SHORT2UNUSED;
601             mmco[1].short_pic_num  = mmco[0].short_pic_num + 1;
602             nb_mmco                = 2;
603         }
604     }
605 
606     h->nb_mmco = nb_mmco;
607 }
608 
ff_h264_execute_ref_pic_marking(H264Context *h)609 int ff_h264_execute_ref_pic_marking(H264Context *h)
610 {
611     MMCO *mmco = h->mmco;
612     int mmco_count;
613     int i, av_uninit(j);
614     int pps_ref_count[2] = {0};
615     int current_ref_assigned = 0, err = 0;
616     H264Picture *av_uninit(pic);
617 
618     if (!h->ps.sps) {
619         av_log(h->avctx, AV_LOG_ERROR, "SPS is unset\n");
620         err = AVERROR_INVALIDDATA;
621         goto out;
622     }
623 
624     if (!h->explicit_ref_marking)
625         generate_sliding_window_mmcos(h);
626     mmco_count = h->nb_mmco;
627 
628     if ((h->avctx->debug & FF_DEBUG_MMCO) && mmco_count == 0)
629         av_log(h->avctx, AV_LOG_DEBUG, "no mmco here\n");
630 
631     for (i = 0; i < mmco_count; i++) {
632         int av_uninit(structure), av_uninit(frame_num);
633         if (h->avctx->debug & FF_DEBUG_MMCO)
634             av_log(h->avctx, AV_LOG_DEBUG, "mmco:%d %d %d\n", h->mmco[i].opcode,
635                    h->mmco[i].short_pic_num, h->mmco[i].long_arg);
636 
637         if (mmco[i].opcode == MMCO_SHORT2UNUSED ||
638             mmco[i].opcode == MMCO_SHORT2LONG) {
639             frame_num = pic_num_extract(h, mmco[i].short_pic_num, &structure);
640             pic       = find_short(h, frame_num, &j);
641             if (!pic) {
642                 if (mmco[i].opcode != MMCO_SHORT2LONG ||
643                     !h->long_ref[mmco[i].long_arg]    ||
644                     h->long_ref[mmco[i].long_arg]->frame_num != frame_num) {
645                     av_log(h->avctx, h->short_ref_count ? AV_LOG_ERROR : AV_LOG_DEBUG, "mmco: unref short failure\n");
646                     err = AVERROR_INVALIDDATA;
647                 }
648                 continue;
649             }
650         }
651 
652         switch (mmco[i].opcode) {
653         case MMCO_SHORT2UNUSED:
654             if (h->avctx->debug & FF_DEBUG_MMCO)
655                 av_log(h->avctx, AV_LOG_DEBUG, "mmco: unref short %d count %d\n",
656                        h->mmco[i].short_pic_num, h->short_ref_count);
657             remove_short(h, frame_num, structure ^ PICT_FRAME);
658             break;
659         case MMCO_SHORT2LONG:
660                 if (h->long_ref[mmco[i].long_arg] != pic)
661                     remove_long(h, mmco[i].long_arg, 0);
662 
663                 remove_short_at_index(h, j);
664                 h->long_ref[ mmco[i].long_arg ] = pic;
665                 if (h->long_ref[mmco[i].long_arg]) {
666                     h->long_ref[mmco[i].long_arg]->long_ref = 1;
667                     h->long_ref_count++;
668                 }
669             break;
670         case MMCO_LONG2UNUSED:
671             j   = pic_num_extract(h, mmco[i].long_arg, &structure);
672             pic = h->long_ref[j];
673             if (pic) {
674                 remove_long(h, j, structure ^ PICT_FRAME);
675             } else if (h->avctx->debug & FF_DEBUG_MMCO)
676                 av_log(h->avctx, AV_LOG_DEBUG, "mmco: unref long failure\n");
677             break;
678         case MMCO_LONG:
679                     // Comment below left from previous code as it is an interesting note.
680                     /* First field in pair is in short term list or
681                      * at a different long term index.
682                      * This is not allowed; see 7.4.3.3, notes 2 and 3.
683                      * Report the problem and keep the pair where it is,
684                      * and mark this field valid.
685                      */
686             if (h->short_ref[0] == h->cur_pic_ptr) {
687                 av_log(h->avctx, AV_LOG_ERROR, "mmco: cannot assign current picture to short and long at the same time\n");
688                 remove_short_at_index(h, 0);
689             }
690 
691             /* make sure the current picture is not already assigned as a long ref */
692             if (h->cur_pic_ptr->long_ref) {
693                 for (j = 0; j < FF_ARRAY_ELEMS(h->long_ref); j++) {
694                     if (h->long_ref[j] == h->cur_pic_ptr) {
695                         if (j != mmco[i].long_arg)
696                             av_log(h->avctx, AV_LOG_ERROR, "mmco: cannot assign current picture to 2 long term references\n");
697                         remove_long(h, j, 0);
698                     }
699                 }
700             }
701 
702             if (h->long_ref[mmco[i].long_arg] != h->cur_pic_ptr) {
703                 av_assert0(!h->cur_pic_ptr->long_ref);
704                 remove_long(h, mmco[i].long_arg, 0);
705 
706                 h->long_ref[mmco[i].long_arg]           = h->cur_pic_ptr;
707                 h->long_ref[mmco[i].long_arg]->long_ref = 1;
708                 h->long_ref_count++;
709             }
710 
711             h->cur_pic_ptr->reference |= h->picture_structure;
712             current_ref_assigned = 1;
713             break;
714         case MMCO_SET_MAX_LONG:
715             assert(mmco[i].long_arg <= 16);
716             // just remove the long term which index is greater than new max
717             for (j = mmco[i].long_arg; j < 16; j++) {
718                 remove_long(h, j, 0);
719             }
720             break;
721         case MMCO_RESET:
722             while (h->short_ref_count) {
723                 remove_short(h, h->short_ref[0]->frame_num, 0);
724             }
725             for (j = 0; j < 16; j++) {
726                 remove_long(h, j, 0);
727             }
728             h->poc.frame_num = h->cur_pic_ptr->frame_num = 0;
729             h->mmco_reset = 1;
730             h->cur_pic_ptr->mmco_reset = 1;
731             for (j = 0; j < FF_ARRAY_ELEMS(h->last_pocs); j++)
732                 h->last_pocs[j] = INT_MIN;
733             break;
734         default: av_assert0(0);
735         }
736     }
737 
738     if (!current_ref_assigned) {
739         /* Second field of complementary field pair; the first field of
740          * which is already referenced. If short referenced, it
741          * should be first entry in short_ref. If not, it must exist
742          * in long_ref; trying to put it on the short list here is an
743          * error in the encoded bit stream (ref: 7.4.3.3, NOTE 2 and 3).
744          */
745         if (h->short_ref_count && h->short_ref[0] == h->cur_pic_ptr) {
746             /* Just mark the second field valid */
747             h->cur_pic_ptr->reference |= h->picture_structure;
748         } else if (h->cur_pic_ptr->long_ref) {
749             av_log(h->avctx, AV_LOG_ERROR, "illegal short term reference "
750                                            "assignment for second field "
751                                            "in complementary field pair "
752                                            "(first field is long term)\n");
753             err = AVERROR_INVALIDDATA;
754         } else {
755             pic = remove_short(h, h->cur_pic_ptr->frame_num, 0);
756             if (pic) {
757                 av_log(h->avctx, AV_LOG_ERROR, "illegal short term buffer state detected\n");
758                 err = AVERROR_INVALIDDATA;
759             }
760 
761             if (h->short_ref_count)
762                 memmove(&h->short_ref[1], &h->short_ref[0],
763                         h->short_ref_count * sizeof(H264Picture*));
764 
765             h->short_ref[0] = h->cur_pic_ptr;
766             h->short_ref_count++;
767             h->cur_pic_ptr->reference |= h->picture_structure;
768         }
769     }
770 
771     if (h->long_ref_count + h->short_ref_count > FFMAX(h->ps.sps->ref_frame_count, 1)) {
772 
773         /* We have too many reference frames, probably due to corrupted
774          * stream. Need to discard one frame. Prevents overrun of the
775          * short_ref and long_ref buffers.
776          */
777         av_log(h->avctx, AV_LOG_ERROR,
778                "number of reference frames (%d+%d) exceeds max (%d; probably "
779                "corrupt input), discarding one\n",
780                h->long_ref_count, h->short_ref_count, h->ps.sps->ref_frame_count);
781         err = AVERROR_INVALIDDATA;
782 
783         if (h->long_ref_count && !h->short_ref_count) {
784             for (i = 0; i < 16; ++i)
785                 if (h->long_ref[i])
786                     break;
787 
788             assert(i < 16);
789             remove_long(h, i, 0);
790         } else {
791             pic = h->short_ref[h->short_ref_count - 1];
792             remove_short(h, pic->frame_num, 0);
793         }
794     }
795 
796     for (i = 0; i<h->short_ref_count; i++) {
797         pic = h->short_ref[i];
798         if (pic->invalid_gap) {
799             int d = av_mod_uintp2(h->cur_pic_ptr->frame_num - pic->frame_num, h->ps.sps->log2_max_frame_num);
800             if (d > h->ps.sps->ref_frame_count)
801                 remove_short(h, pic->frame_num, 0);
802         }
803     }
804 
805     print_short_term(h);
806     print_long_term(h);
807 
808     for (i = 0; i < FF_ARRAY_ELEMS(h->ps.pps_list); i++) {
809         if (h->ps.pps_list[i]) {
810             const PPS *pps = (const PPS *)h->ps.pps_list[i]->data;
811             pps_ref_count[0] = FFMAX(pps_ref_count[0], pps->ref_count[0]);
812             pps_ref_count[1] = FFMAX(pps_ref_count[1], pps->ref_count[1]);
813         }
814     }
815 
816     // Detect unmarked random access points
817     if (   err >= 0
818         && h->long_ref_count==0
819         && (   h->short_ref_count<=2
820             || pps_ref_count[0] <= 2 && pps_ref_count[1] <= 1 && h->avctx->has_b_frames
821             || pps_ref_count[0] <= 1 + (h->picture_structure != PICT_FRAME) && pps_ref_count[1] <= 1)
822         && pps_ref_count[0]<=2 + (h->picture_structure != PICT_FRAME) + (2*!h->has_recovery_point)
823         && h->cur_pic_ptr->f->pict_type == AV_PICTURE_TYPE_I){
824         h->cur_pic_ptr->recovered |= 1;
825         if(!h->avctx->has_b_frames)
826             h->frame_recovered |= FRAME_RECOVERED_SEI;
827     }
828 
829 out:
830     return (h->avctx->err_recognition & AV_EF_EXPLODE) ? err : 0;
831 }
832 
ff_h264_decode_ref_pic_marking(H264SliceContext *sl, GetBitContext *gb, const H2645NAL *nal, void *logctx)833 int ff_h264_decode_ref_pic_marking(H264SliceContext *sl, GetBitContext *gb,
834                                    const H2645NAL *nal, void *logctx)
835 {
836     int i;
837     MMCO *mmco = sl->mmco;
838     int nb_mmco = 0;
839 
840     if (nal->type == H264_NAL_IDR_SLICE) { // FIXME fields
841         skip_bits1(gb); // broken_link
842         if (get_bits1(gb)) {
843             mmco[0].opcode   = MMCO_LONG;
844             mmco[0].long_arg = 0;
845             nb_mmco          = 1;
846         }
847         sl->explicit_ref_marking = 1;
848     } else {
849         sl->explicit_ref_marking = get_bits1(gb);
850         if (sl->explicit_ref_marking) {
851             for (i = 0; i < FF_ARRAY_ELEMS(sl->mmco); i++) {
852                 MMCOOpcode opcode = get_ue_golomb_31(gb);
853 
854                 mmco[i].opcode = opcode;
855                 if (opcode == MMCO_SHORT2UNUSED || opcode == MMCO_SHORT2LONG) {
856                     mmco[i].short_pic_num =
857                         (sl->curr_pic_num - get_ue_golomb_long(gb) - 1) &
858                             (sl->max_pic_num - 1);
859                 }
860                 if (opcode == MMCO_SHORT2LONG || opcode == MMCO_LONG2UNUSED ||
861                     opcode == MMCO_LONG || opcode == MMCO_SET_MAX_LONG) {
862                     unsigned int long_arg = get_ue_golomb_31(gb);
863                     if (long_arg >= 32 ||
864                         (long_arg >= 16 && !(opcode == MMCO_SET_MAX_LONG &&
865                                              long_arg == 16) &&
866                          !(opcode == MMCO_LONG2UNUSED && FIELD_PICTURE(sl)))) {
867                         av_log(logctx, AV_LOG_ERROR,
868                                "illegal long ref in memory management control "
869                                "operation %d\n", opcode);
870                         sl->nb_mmco = i;
871                         return -1;
872                     }
873                     mmco[i].long_arg = long_arg;
874                 }
875 
876                 if (opcode > (unsigned) MMCO_LONG) {
877                     av_log(logctx, AV_LOG_ERROR,
878                            "illegal memory management control operation %d\n",
879                            opcode);
880                     sl->nb_mmco = i;
881                     return -1;
882                 }
883                 if (opcode == MMCO_END)
884                     break;
885             }
886             nb_mmco = i;
887         }
888     }
889 
890     sl->nb_mmco = nb_mmco;
891 
892     return 0;
893 }
894