Prior to 7bcb3ba4f4abf18a, pCurLayer->sLayerInfo.pSliceInLayer[uiSliceIdx].iCountMbNumInSlice was read after setting pCurLayer->sLayerInfo.pSliceInLayer to the newly allocated, larger array. After this commit, it is read before the array has been switched, and thus is read from the old array (which only holds elements up to iMaxSliceNumOld, not up to iMaxSliceNum). This fixes reads out of bounds, and crashes in the test suite.
Showing the changes to codec/encoder/core/src/encoder_ext.cpp (1 of 1 file). Show all
Unified · Split
| @@ -4877,7 +4877,7 @@ int32_t SliceBufferRealloc (sWelsEncCtx* pCtx) { · 4876 unmodified lines | |||
| 4877 | pSliceIdx->sSlicingOverRc.iTotalQpSlice = 0; | 4877 | pSliceIdx->sSlicingOverRc.iTotalQpSlice = 0; |
| 4878 | pSliceIdx->sSlicingOverRc.iTotalMbSlice = 0; | 4878 | pSliceIdx->sSlicingOverRc.iTotalMbSlice = 0; |
| 4879 | pSliceIdx->sSlicingOverRc.iTargetBitsSlice = WELS_DIV_ROUND (kiBitsPerMb * | 4879 | pSliceIdx->sSlicingOverRc.iTargetBitsSlice = WELS_DIV_ROUND (kiBitsPerMb * |
| 4880 | pCurLayer->sLayerInfo.pSliceInLayer[uiSliceIdx].iCountMbNumInSlice, | 4880 | pSlice[uiSliceIdx].iCountMbNumInSlice, |
| 4881 | INT_MULTIPLY); | 4881 | INT_MULTIPLY); |
| 4882 | pSliceIdx->sSlicingOverRc.iFrameBitsSlice = 0; | 4882 | pSliceIdx->sSlicingOverRc.iFrameBitsSlice = 0; |
| 4883 | pSliceIdx->sSlicingOverRc.iGomBitsSlice = 0; | 4883 | pSliceIdx->sSlicingOverRc.iGomBitsSlice = 0; |