In intra-only mode, frameIntervalP is 0, which means the frame data array is smaller than the number of surfaces. Together with using the wrong size on deallocation of the frame_data_array, this lead to a crash.
Unified · Split
| @@ -1021,7 +1021,7 @@ static av_cold int nvenc_recalc_surfaces(AVCodecContext *avctx) · 1020 unmodified lines | ||
| 1021 | 1021 | |
| 1022 | 1022 | // Output in the worst case will only start when the surface buffer is completely full. |
| 1023 | 1023 | // Hence we need to keep at least the max amount of surfaces plus the max reorder delay around. |
| 1024 | − ctx->frame_data_array_nb = ctx->nb_surfaces + ctx->encode_config.frameIntervalP - 1; | |
| 1024 | + ctx->frame_data_array_nb = FFMAX(ctx->nb_surfaces, ctx->nb_surfaces + ctx->encode_config.frameIntervalP - 1); | |
| 1025 | 1025 | |
| 1026 | 1026 | return 0; |
| 1027 | 1027 | } |
| @@ -1984,7 +1984,7 @@ av_cold int ff_nvenc_encode_close(AVCodecContext *avctx) · 956 unmodified lines | ||
| 1984 | 1984 | av_fifo_freep2(&ctx->unused_surface_queue); |
| 1985 | 1985 | |
| 1986 | 1986 | if (ctx->frame_data_array) { |
| 1987 | − for (i = 0; i < ctx->nb_surfaces; i++) | |
| 1987 | + for (i = 0; i < ctx->frame_data_array_nb; i++) | |
| 1988 | 1988 | av_buffer_unref(&ctx->frame_data_array[i].frame_opaque_ref); |
| 1989 | 1989 | av_freep(&ctx->frame_data_array); |
| 1990 | 1990 | } |