commit 4d1dfa391b2c16a9473c6647f82cc04674d5cad1
author Jayasanker J <jayasanker.j@ittiam.com> Fri Jul 10 21:25:24 2020 +0530
committer Yunqing Wang <yunqingwang@google.com> Fri Jul 10 23:28:38 2020 +0000
tree 8c2f6cf206abc00e05954575e073746c495655d0
parent 66e7624cf76518c9f2dd03fc3ec63a37fc0d2201

Fix an invalid access of saved_wb.bit_buffer

There is an invalid access of saved_wb.bit_buffer in
av1_pack_bitstream() while encoding show_existing_frame.
This CL fixes this issue.

BUG=aomedia:2746

Change-Id: I3d0390f0dd6fd4e5991f3be150e9a6d515de6bd8

av1/encoder/bitstream.c

diff --git a/av1/encoder/bitstream.c b/av1/encoder/bitstream.c
index e9212b3..77a3906 100644
--- a/av1/encoder/bitstream.c
+++ b/av1/encoder/bitstream.c
@@ -3888,7 +3888,8 @@
 
   const int write_frame_header =
       (cpi->num_tg > 1 || encode_show_existing_frame(cm));
-  struct aom_write_bit_buffer saved_wb;
+  struct aom_write_bit_buffer saved_wb = { NULL, 0 };
+  size_t length_field = 0;
   if (write_frame_header) {
     // Write Frame Header OBU.
     fh_info.frame_header = data;
@@ -3897,26 +3898,24 @@
     obu_payload_size =
         write_frame_header_obu(cpi, &saved_wb, data + obu_header_size, 1);
 
-    const size_t length_field_size =
-        obu_memmove(obu_header_size, obu_payload_size, data);
+    length_field = obu_memmove(obu_header_size, obu_payload_size, data);
     if (av1_write_uleb_obu_size(obu_header_size, obu_payload_size, data) !=
         AOM_CODEC_OK) {
       return AOM_CODEC_ERROR;
     }
 
     fh_info.obu_header_byte_offset = 0;
-    fh_info.total_length =
-        obu_header_size + obu_payload_size + length_field_size;
+    fh_info.total_length = obu_header_size + obu_payload_size + length_field;
     data += fh_info.total_length;
-
-    // Since length_field_size is determined adaptively after frame header
-    // encoding, saved_wb must be adjusted accordingly.
-    saved_wb.bit_buffer += length_field_size;
   }
 
   if (encode_show_existing_frame(cm)) {
     data_size = 0;
   } else {
+    // Since length_field is determined adaptively after frame header
+    // encoding, saved_wb must be adjusted accordingly.
+    saved_wb.bit_buffer += length_field;
+
     //  Each tile group obu will be preceded by 4-byte size of the tile group
     //  obu
     data_size = write_tiles_in_tg_obus(