h264_refs: validate the SPS pointer in ff_h264_execute_ref_pic_marking()

Bug-Id: 1036
CC: libav-stable@libav.org

libavcodec/h264_refs.c

@@ -557,6 +557,12 @@ int ff_h264_execute_ref_pic_marking(H264Context *h)
     int current_ref_assigned = 0, err = 0;
     H264Picture *av_uninit(pic);
 
+    if (!h->ps.sps) {
+        av_log(h->avctx, AV_LOG_ERROR, "SPS is unset\n");
+        err = AVERROR_INVALIDDATA;
+        goto out;
+    }
+
     if (!h->explicit_ref_marking)
         generate_sliding_window_mmcos(h);
     mmco_count = h->nb_mmco;
@@ -725,6 +731,7 @@ int ff_h264_execute_ref_pic_marking(H264Context *h)
 
     print_short_term(h);
     print_long_term(h);
+out:
     return (h->avctx->err_recognition & AV_EF_EXPLODE) ? err : 0;
 }