Avoid reading iCountMbNumInSlice out of bounds on slice realloc

Prior to 7bcb3ba4f4abf18a, pCurLayer->sLayerInfo.pSliceInLayer[uiSliceIdx].iCountMbNumInSlice was read after setting pCurLayer->sLayerInfo.pSliceInLayer to the newly allocated, larger array. After this commit, it is read before the array has been switched, and thus is read from the old array (which only holds elements up to iMaxSliceNumOld, not up to iMaxSliceNum). This fixes reads out of bounds, and crashes in the test suite.

Martin Storsjö committed 10 years ago

Commit 69e3fac1 parent 040974f1 file · +1 −1Browse files

Showing the changes to codec/encoder/core/src/encoder_ext.cpp (1 of 1 file). Show all

Unified · Split

codec/encoder/core/src/encoder_ext.cpp+1−1

@@ -4877,7 +4877,7 @@ int32_t SliceBufferRealloc (sWelsEncCtx* pCtx) { · 4876 unmodified lines
4877	4877	pSliceIdx->sSlicingOverRc.iTotalQpSlice = 0;
4878	4878	pSliceIdx->sSlicingOverRc.iTotalMbSlice = 0;
4879	4879	pSliceIdx->sSlicingOverRc.iTargetBitsSlice = WELS_DIV_ROUND (kiBitsPerMb *
4880		− pCurLayer->sLayerInfo.pSliceInLayer[uiSliceIdx].iCountMbNumInSlice,
	4880	+ pSlice[uiSliceIdx].iCountMbNumInSlice,
4881	4881	INT_MULTIPLY);
4882	4882	pSliceIdx->sSlicingOverRc.iFrameBitsSlice = 0;
4883	4883	pSliceIdx->sSlicingOverRc.iGomBitsSlice = 0;

Avoid reading iCountMbNumInSlice out of bounds on slice realloc

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code