webrtcvideoengine2.cc uses a field for parameters_, and doesn't empty
out the current state in functions like SetCodec. In the case of
internal_source, SetCodec only set it for external encoders, which
means that in a switch from an internal-source external encoder to an
internal encoder, the internal_source bit would stay set.
(It's plausible that there are other places that are also unsafe and we
just don't notice because codec switches are uncommon in most usage)
In combination with https://codereview.webrtc.org/2574183002/,
generic_encoder.cc now creates 1x1 uninitialized frames as fake frames
for internal_source keyframe requests. The vp8 software encoder doesn't
deal correctly with frames of resolutions that don't match the
configured resolution (besides a DCHECK) and no longer throws these
away (they used to be 0x0 frames), so this results in the VP8
encoder creating a keyframe of the configured send codec size by reading
random memory off the end of the fake I420 frame. This could either
cause crashes or encoding junk data, depending on where the allocation
was.
BUG=webrtc:6957
Review-Url: https://codereview.webrtc.org/2617003003
Cr-Commit-Position: refs/heads/master@{#15969}
5d3b28b853