From 79af5913681dca800f35bee89b5f18c56b8eef45 Mon Sep 17 00:00:00 2001 From: Yaowu Xu Date: Wed, 18 Sep 2013 12:29:32 -0700 Subject: [PATCH] change to avoid invalid memory read. The fake token EOSB may cause invaild memory read in pack token, this commit reworked the loop to avoid such invalid read. Change-Id: I37fdfce869b44a7f90003f82a02f84c45472a457 --- vp9/encoder/vp9_bitstream.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/vp9/encoder/vp9_bitstream.c b/vp9/encoder/vp9_bitstream.c index 957cfd2..622f75f 100644 --- a/vp9/encoder/vp9_bitstream.c +++ b/vp9/encoder/vp9_bitstream.c @@ -283,7 +283,7 @@ static void pack_mb_tokens(vp9_writer* const bc, const TOKENEXTRA *const stop) { TOKENEXTRA *p = *tp; - while (p < stop) { + while (p < stop && p->token != EOSB_TOKEN) { const int t = p->token; const struct vp9_token *const a = vp9_coef_encodings + t; const vp9_extra_bit *const b = vp9_extra_bits + t; @@ -293,10 +293,6 @@ static void pack_mb_tokens(vp9_writer* const bc, int n = a->len; vp9_prob probs[ENTROPY_NODES]; - if (t == EOSB_TOKEN) { - ++p; - break; - } if (t >= TWO_TOKEN) { vp9_model_to_full_probs(p->context_tree, probs); pp = probs; @@ -338,7 +334,7 @@ static void pack_mb_tokens(vp9_writer* const bc, ++p; } - *tp = p; + *tp = p + (p->token == EOSB_TOKEN); } static void write_sb_mv_ref(vp9_writer *w, MB_PREDICTION_MODE mode, -- 2.7.4