shithub: openh264

Info  •  Files  •  Log  •  Branches

fix overflow issue caused by pCountMbNumInSlice

--- a/codec/encoder/core/src/encoder_ext.cpp

+++ b/codec/encoder/core/src/encoder_ext.cpp

@@ -3803,6 +3803,26 @@

   pMA->WelsFree (pCurLayer->sLayerInfo.pSliceInLayer, "Slice");

   pCurLayer->sLayerInfo.pSliceInLayer = pSlice;

+  int16_t* pFirstMbInSlice = (int16_t*)pMA->WelsMalloc (iMaxSliceNum * sizeof (int16_t), "pSliceSeg->pFirstMbInSlice");

+  if (NULL == pFirstMbInSlice)

+    return ENC_RETURN_MEMALLOCERR;

+  memset(pFirstMbInSlice, 0, sizeof(int16_t) * iMaxSliceNum);

+  memcpy (pFirstMbInSlice, pCurLayer->pSliceEncCtx->pFirstMbInSlice, sizeof (int16_t) * iMaxSliceNumOld);

+  pMA->WelsFree (pCurLayer->pSliceEncCtx->pFirstMbInSlice, "pSliceSeg->pFirstMbInSlice");

+  pCurLayer->pSliceEncCtx->pFirstMbInSlice = pFirstMbInSlice;

+

+  int32_t* pCountMbNumInSlice = (int32_t*)pMA->WelsMalloc (iMaxSliceNum * sizeof (int32_t),"pSliceSeg->pCountMbNumInSlice");

+  if (NULL == pCountMbNumInSlice)

+    return ENC_RETURN_MEMALLOCERR;

+  memcpy (pCountMbNumInSlice, pCurLayer->pSliceEncCtx->pCountMbNumInSlice, sizeof (int32_t) * iMaxSliceNumOld);

+  uiSliceIdx = iMaxSliceNumOld;

+  while (uiSliceIdx < iMaxSliceNum) {

+    pCountMbNumInSlice[uiSliceIdx] = pCurLayer->pSliceEncCtx->iMbNumInFrame;

+    uiSliceIdx++;

+  }

+  pMA->WelsFree (pCurLayer->pSliceEncCtx->pCountMbNumInSlice, "pSliceSeg->pCountMbNumInSlice");

+  pCurLayer->pSliceEncCtx->pCountMbNumInSlice = pCountMbNumInSlice;

+

   SRCSlicing* pSlcingOverRc = (SRCSlicing*)pMA->WelsMalloc (iMaxSliceNum * sizeof (SRCSlicing), "SlicingOverRC");

   if (NULL == pSlcingOverRc)

     return ENC_RETURN_MEMALLOCERR;

@@ -3823,21 +3843,6 @@

   }

   pMA->WelsFree (pCtx->pWelsSvcRc->pSlicingOverRc, "SlicingOverRC");

   pCtx->pWelsSvcRc->pSlicingOverRc = pSlcingOverRc;

-

-  int16_t* pFirstMbInSlice = (int16_t*)pMA->WelsMalloc (iMaxSliceNum * sizeof (int16_t), "pSliceSeg->pFirstMbInSlice");

-  if (NULL == pFirstMbInSlice)

-    return ENC_RETURN_MEMALLOCERR;

-  memcpy (pFirstMbInSlice, pCurLayer->pSliceEncCtx->pFirstMbInSlice, sizeof (int16_t) * iMaxSliceNumOld);

-  pMA->WelsFree (pCurLayer->pSliceEncCtx->pFirstMbInSlice, "pSliceSeg->pFirstMbInSlice");

-  pCurLayer->pSliceEncCtx->pFirstMbInSlice = pFirstMbInSlice;

-

-  int32_t* pCountMbNumInSlice = (int32_t*)pMA->WelsMalloc (iMaxSliceNum * sizeof (int32_t),

-                                "pSliceSeg->pCountMbNumInSlice");

-  if (NULL == pCountMbNumInSlice)

-    return ENC_RETURN_MEMALLOCERR;

-  memcpy (pCountMbNumInSlice, pCurLayer->pSliceEncCtx->pCountMbNumInSlice, sizeof (int32_t) * iMaxSliceNumOld);

-  pMA->WelsFree (pCurLayer->pSliceEncCtx->pCountMbNumInSlice, "pSliceSeg->pCountMbNumInSlice");

-  pCurLayer->pSliceEncCtx->pCountMbNumInSlice = pCountMbNumInSlice;

   if (pCtx->iMaxSliceCount < iMaxSliceNum)

     pCtx->iMaxSliceCount = iMaxSliceNum;

--- a/codec/encoder/core/src/svc_enc_slice_segment.cpp

+++ b/codec/encoder/core/src/svc_enc_slice_segment.cpp

@@ -109,6 +109,14 @@

       ++ iSliceIdx;

     } while (iSliceIdx < kiCountSliceNumInFrame && iMbIdx < kiCountNumMbInFrame);

   } else if (SM_DYN_SLICE == pSliceSeg->uiSliceMode) {

+    int32_t iSliceIdx = 0;

+    const int32_t kiMaxSliceNum = pSliceSeg->iMaxSliceNumConstraint;

+    const int32_t kiCountNumMbInFrame = pSliceSeg->iMbNumInFrame;

+    do {

+      pSliceSeg->pFirstMbInSlice[iSliceIdx] = 0;

+      pSliceSeg->pCountMbNumInSlice[iSliceIdx] = kiCountNumMbInFrame;

+      iSliceIdx++;

+    } while (iSliceIdx < kiMaxSliceNum);

   } else {	// any else uiSliceMode?

     assert (0);

   }