I discovered some problems with the framebuffer output driver.  The first
problem I had was a segfault when trying to play a 480x360 clip on a 640x480
display.  I traced it to the yuv420_rgb16() color conversion function, which
was overrunning the input buffer (the "y" part of the image).  The reason
was that it was being called downstack from fb_frame_proc_slice(), multiple
times for each 16-pixel high horizontal slice of the image.  When it got to
the last slice, only 8 pixels were left to the bottom but it still tried to
process a 16-pixel high slice.

Nosing around a bit, I compared the configuration of the color converter as
used by the fb driver to the xshm driver and found some oddities:

1) The color converter was configured with a "source height" of 16 pixels no
matter what the size of the image, and a "dest height" based on what was
referred to within video_out_fb.c as a "stripe" -- essentially an input
slice scaled up or down as required by the output size.
2) Apparently to prevent the above from causing problems, the position in
the output buffer was managed by special code -- see the "stripe_incr"
variable.
3) The xshm driver calls yuv2rgb_next_slice() with a NULL argument at the
beginning of each frame to allow the color converter to reset its tracking
of the slice-by-slice progress through the image; the fb driver does not.

I'm not sure exactly why it was done that way, but my best guess would be
that whoever coded it didn't know about the need to call
yuv2rgb_next_slice() with a NULL argument, and the rest was built up to get
it to mostly work without that.

The attached patch changes the behaviour to match that of the xshm driver,
and also removes the reset_dest_pointers() function, replacing its single
invocation with one to fb_frame_field(), which is identical after removing
the "stripe" management.

It fixed my crash.  Can anyone see if I've misunderstood what was going on?
If not, it should probably be applied to the official version.