ma1 pushed to branch tor-browser-147.0a1-16.0-2 at The Tor Project /
Applications / Tor Browser
Commits:
c0dcd202 by Chun-Min Chang at 2026-02-16T21:03:40+01:00
Bug 2014390 r=media-playback-reviewers,padenot a=RyanVM
- - - - -
1 changed file:
- media/libvpx/libvpx/vp9/vp9_cx_iface.c
Changes:
=====================================
media/libvpx/libvpx/vp9/vp9_cx_iface.c
=====================================
@@ -8,7 +8,9 @@
* be found in the AUTHORS file in the root of the source tree.
*/
+#include <assert.h>
#include <limits.h>
+#include <stddef.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
@@ -122,6 +124,7 @@ struct vpx_codec_alg_priv {
VP9_COMP *cpi;
unsigned char *cx_data;
size_t cx_data_sz;
+ // pending_cx_data either is a null pointer or points into the cx_data
buffer.
unsigned char *pending_cx_data;
size_t pending_cx_data_sz;
int pending_frame_count;
@@ -1252,8 +1255,12 @@ static int write_superframe_index(vpx_codec_alg_priv_t
*ctx) {
// Write the index
index_sz = 2 + (mag + 1) * ctx->pending_frame_count;
- if (ctx->pending_cx_data_sz + index_sz < ctx->cx_data_sz) {
- uint8_t *x = ctx->pending_cx_data + ctx->pending_cx_data_sz;
+ unsigned char *cx_data_end = ctx->cx_data + ctx->cx_data_sz;
+ unsigned char *pending_cx_data_end =
+ ctx->pending_cx_data + ctx->pending_cx_data_sz;
+ ptrdiff_t space_remaining = cx_data_end - pending_cx_data_end;
+ if (index_sz <= space_remaining) {
+ uint8_t *x = pending_cx_data_end;
int i, j;
#ifdef TEST_SUPPLEMENTAL_SUPERFRAME_DATA
uint8_t marker_test = 0xc0;
@@ -1284,6 +1291,8 @@ static int write_superframe_index(vpx_codec_alg_priv_t
*ctx) {
#ifdef TEST_SUPPLEMENTAL_SUPERFRAME_DATA
index_sz += index_sz_test;
#endif
+ } else {
+ index_sz = 0;
}
return index_sz;
}
@@ -1621,9 +1630,12 @@ static vpx_codec_err_t
encoder_encode(vpx_codec_alg_priv_t *ctx,
ctx->pending_frame_sizes[ctx->pending_frame_count++] = size;
ctx->pending_frame_magnitude |= size;
ctx->pending_cx_data_sz += size;
- // write the superframe only for the case when
- if (!ctx->output_cx_pkt_cb.output_cx_pkt)
+ // write the superframe only for the case when the callback
function
+ // for getting per-layer packets is not registered.
+ if (!ctx->output_cx_pkt_cb.output_cx_pkt) {
size += write_superframe_index(ctx);
+ assert(size <= cx_data_sz);
+ }
pkt.data.frame.buf = ctx->pending_cx_data;
pkt.data.frame.sz = ctx->pending_cx_data_sz;
ctx->pending_cx_data = NULL;
View it on GitLab:
https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/c0dcd202af7ddf205d15576c07e60a59a84d4bb6
--
View it on GitLab:
https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/c0dcd202af7ddf205d15576c07e60a59a84d4bb6
You're receiving this email because of your account on gitlab.torproject.org.
_______________________________________________
tor-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
