1 files changed, 15 insertions, 3 deletions

diff --git a/libavcodec/h264_slice.c b/libavcodec/h264_slice.c
index 30dd5c3..0c99523 100644
--- a/libavcodec/h264_slice.c
+++ b/libavcodec/h264_slice.c
@@ -159,6 +159,7 @@ static void release_unused_pictures(H264Context *h, int remove_current)
 
 static int alloc_scratch_buffers(H264SliceContext *sl, int linesize)
 {
+    const H264Context *h = sl->h264;
     int alloc_size = FFALIGN(FFABS(linesize) + 32, 32);
 
     av_fast_malloc(&sl->bipred_scratchpad, &sl->bipred_scratchpad_allocated, 16 * 6 * alloc_size);
@@ -166,11 +167,22 @@ static int alloc_scratch_buffers(H264SliceContext *sl, int linesize)
     // (= 21x21 for  h264)
     av_fast_malloc(&sl->edge_emu_buffer, &sl->edge_emu_buffer_allocated, alloc_size * 2 * 21);
 
-    if (!sl->bipred_scratchpad || !sl->edge_emu_buffer) {
+    av_fast_malloc(&sl->top_borders[0], &sl->top_borders_allocated[0],
+                   h->mb_width * 16 * 3 * sizeof(uint8_t) * 2);
+    av_fast_malloc(&sl->top_borders[1], &sl->top_borders_allocated[1],
+                   h->mb_width * 16 * 3 * sizeof(uint8_t) * 2);
+
+    if (!sl->bipred_scratchpad || !sl->edge_emu_buffer ||
+        !sl->top_borders[0]    || !sl->top_borders[1]) {
         av_freep(&sl->bipred_scratchpad);
         av_freep(&sl->edge_emu_buffer);
+        av_freep(&sl->top_borders[0]);
+        av_freep(&sl->top_borders[1]);
+
         sl->bipred_scratchpad_allocated = 0;
         sl->edge_emu_buffer_allocated   = 0;
+        sl->top_borders_allocated[0]    = 0;
+        sl->top_borders_allocated[1]    = 0;
         return AVERROR(ENOMEM);
     }
 
@@ -714,7 +726,7 @@ static av_always_inline void backup_mb_border(H264Context *h, H264SliceContext *
     if (!simple && FRAME_MBAFF(h)) {
         if (sl->mb_y & 1) {
             if (!MB_MBAFF(sl)) {
-                top_border = h->top_borders[0][sl->mb_x];
+                top_border = sl->top_borders[0][sl->mb_x];
                 AV_COPY128(top_border, src_y + 15 * linesize);
                 if (pixel_shift)
                     AV_COPY128(top_border + 16, src_y + 15 * linesize + 16);
@@ -754,7 +766,7 @@ static av_always_inline void backup_mb_border(H264Context *h, H264SliceContext *
             return;
     }
 
-    top_border = h->top_borders[top_idx][sl->mb_x];
+    top_border = sl->top_borders[top_idx][sl->mb_x];
     /* There are two lines saved, the line above the top macroblock
      * of a pair, and the line above the bottom macroblock. */
     AV_COPY128(top_border, src_y + 16 * linesize);