h264: disable ER by default

The way it is currently designed is fundamentally unsafe and cannot be
reasonably fixed without completely rewriting it.

libavcodec/h264.c

@@ -28,6 +28,7 @@
 #include "libavutil/avassert.h"
 #include "libavutil/display.h"
 #include "libavutil/imgutils.h"
+#include "libavutil/opt.h"
 #include "libavutil/stereo3d.h"
 #include "libavutil/timer.h"
 #include "internal.h"
@@ -666,6 +667,12 @@ av_cold int ff_h264_decode_init(AVCodecContext *avctx)
 
     avctx->internal->allocate_progress = 1;
 
+    if (h->enable_er) {
+        av_log(avctx, AV_LOG_WARNING,
+               "Error resilience is enabled. It is unsafe and unsupported and may crash. "
+               "Use it at your own risk\n");
+    }
+
     return 0;
 }
 
@@ -1786,6 +1793,20 @@ static av_cold int h264_decode_end(AVCodecContext *avctx)
     return 0;
 }
 
+#define OFFSET(x) offsetof(H264Context, x)
+#define VD AV_OPT_FLAG_VIDEO_PARAM | AV_OPT_FLAG_DECODING_PARAM
+static const AVOption h264_options[] = {
+    { "enable_er", "Enable error resilience on damaged frames (unsafe)", OFFSET(enable_er), AV_OPT_TYPE_INT, { .i64 = 0 }, 0, 1, VD },
+    { NULL },
+};
+
+static const AVClass h264_class = {
+    .class_name = "h264",
+    .item_name  = av_default_item_name,
+    .option     = h264_options,
+    .version    = LIBAVUTIL_VERSION_INT,
+};
+
 static const AVProfile profiles[] = {
     { FF_PROFILE_H264_BASELINE,             "Baseline"              },
     { FF_PROFILE_H264_CONSTRAINED_BASELINE, "Constrained Baseline"  },
@@ -1819,4 +1840,5 @@ AVCodec ff_h264_decoder = {
     .init_thread_copy      = ONLY_IF_THREADS_ENABLED(decode_init_thread_copy),
     .update_thread_context = ONLY_IF_THREADS_ENABLED(ff_h264_update_thread_context),
     .profiles              = NULL_IF_CONFIG_SMALL(profiles),
+    .priv_class            = &h264_class,
 };

libavcodec/h264.h

@@ -727,6 +727,8 @@ typedef struct H264Context {
 
     int cur_chroma_format_idc;
 
+    int enable_er;
+
     AVBufferPool *qscale_table_pool;
     AVBufferPool *mb_type_pool;
     AVBufferPool *motion_val_pool;

libavcodec/h264_picture.c

@@ -184,7 +184,7 @@ int ff_h264_field_end(H264Context *h, H264SliceContext *sl, int in_setup)
      * past end by one (callers fault) and resync_mb_y != 0
      * causes problems for the first MB line, too.
      */
-    if (!FIELD_PICTURE(h)) {
+    if (!FIELD_PICTURE(h) && h->enable_er) {
         h264_set_erpic(&sl->er.cur_pic, h->cur_pic_ptr);
         h264_set_erpic(&sl->er.last_pic,
                        sl->ref_count[0] ? sl->ref_list[0][0].parent : NULL);

libavcodec/h264_slice.c

@@ -530,6 +530,7 @@ int ff_h264_update_thread_context(AVCodecContext *dst,
             return ret;
     }
 
+    h->enable_er       = h1->enable_er;
     h->workaround_bugs = h1->workaround_bugs;
     h->low_delay       = h1->low_delay;
     h->droppable       = h1->droppable;
@@ -633,7 +634,7 @@ static int h264_frame_start(H264Context *h)
     if ((ret = ff_h264_ref_picture(h, &h->cur_pic, h->cur_pic_ptr)) < 0)
         return ret;
 
-    if (CONFIG_ERROR_RESILIENCE)
+    if (CONFIG_ERROR_RESILIENCE && h->enable_er)
         ff_er_frame_start(&h->slice_ctx[0].er);
 
     for (i = 0; i < 16; i++) {
@@ -2061,6 +2062,9 @@ static void er_add_slice(H264SliceContext *sl,
 #if CONFIG_ERROR_RESILIENCE
     ERContext *er = &sl->er;
 
+    if (!sl->h264->enable_er)
+        return;
+
     er->ref_count = sl->ref_count[0];
     ff_er_add_slice(er, startx, starty, endx, endy, status);
 #endif