webrtcvideoengine2.cc uses a field for parameters_, and doesn't empty out the current state in functions like SetCodec. In the case of internal_source, SetCodec only set it for external encoders, which means that in a switch from an internal-source external encoder to an internal encoder, the internal_source bit would stay set. (It's plausible that there are other places that are also unsafe and we just don't notice because codec switches are uncommon in most usage) In combination with https://codereview.webrtc.org/2574183002/, generic_encoder.cc now creates 1x1 uninitialized frames as fake frames for internal_source keyframe requests. The vp8 software encoder doesn't deal correctly with frames of resolutions that don't match the configured resolution (besides a DCHECK) and no longer throws these away (they used to be 0x0 frames), so this results in the VP8 encoder creating a keyframe of the configured send codec size by reading random memory off the end of the fake I420 frame. This could either cause crashes or encoding junk data, depending on where the allocation was. BUG=webrtc:6957 Review-Url: https://codereview.webrtc.org/2617003003 Cr-Commit-Position: refs/heads/master@{#15969}
Name: WebRTC URL: http://www.webrtc.org Version: 90 License: BSD License File: LICENSE Description: WebRTC provides real time voice and video processing functionality to enable the implementation of PeerConnection/MediaStream. Third party code used in this project is described in the file LICENSE_THIRD_PARTY.