ref: 936aa281b589e312aeaca2e7db0ec9dc87a2f99a
parent: 0ef72720d0c54be9faa8287652eeab7b4cd5b7fb
author: Jingning Han <jingning@google.com>
date: Wed Feb 20 10:32:17 EST 2013
Fixed the buffer overflow issue The issue that potentially broke the encoding process was due to the fact that the length of token link is calculated from the total number of tokens coded, while it is possible, in high bit-rate setting, this length is greater than the buffer length initially assigned to the cpi->tok. This patch increases the initially allocated buffer length assigned to cpi->tok from (mb_rows * mb_cols * 24 * 16) to (mb_rows * mb_cols * (1 + 24 * 16)). It resolves the buffer overflow problem. Change-Id: I8661a8d39ea0a3c24303e3f71a170787a1d5b1df
--- a/vp9/encoder/vp9_onyx_if.c
+++ b/vp9/encoder/vp9_onyx_if.c
@@ -1148,7 +1148,7 @@
vpx_free(cpi->tok);
{- unsigned int tokens = cm->mb_rows * cm->mb_cols * 24 * 16;
+ unsigned int tokens = cm->mb_rows * cm->mb_cols * (24 * 16 + 1);
CHECK_MEM_ERROR(cpi->tok, vpx_calloc(tokens, sizeof(*cpi->tok)));
}
--
⑨