The issue is that while decode_slice is guaranteed to never get called without start_frame, end_frame is not. Moreover, it is not guaranteed it won't be called twice. On a badly-broken sample, this is what happens, which leads to a segfault, as vp->slices_buf doesn't exist, as it has been handed off for decoding already and isn't owned by the frame. Return an error as it's indicative that it's a corrupt stream rather than just missing any slices. Prevents a segfault.
Unified · Split
| @@ -520,6 +520,9 @@ static int vk_h264_end_frame(AVCodecContext *avctx) · 519 unmodified lines | |||
| 520 | if (!hp->h264_pic_info.sliceCount) | 520 | if (!hp->h264_pic_info.sliceCount) |
| 521 | return 0; | 521 | return 0; |
| 522 | 522 | ||
| 523 | if (!vp->slices_buf) | ||
| 524 | return AVERROR(EINVAL); | ||
| 525 | |||
| 523 | if (!dec->session_params) { | 526 | if (!dec->session_params) { |
| 524 | int err = vk_h264_create_params(avctx, &dec->session_params); | 527 | int err = vk_h264_create_params(avctx, &dec->session_params); |
| 525 | if (err < 0) | 528 | if (err < 0) |