UMC H263 Encoder output buffer overrun

[jjculbert]

Hello,

We are finding that the UMC H263 Encoder can overrun the MediaData output buffer provided to GetFrame.

In ippVideoEncoderH263::EncodeFrame there is the following logic to check the buffer size.

[bash]if (mRateControl)
    minBufSize = IPP_MIN(mBitsDesired * 2, mBPPmax);
else
    minBufSize = mBPPmax;
...
bufTooSmall = (cBS.mBuffSize - cBS.GetFullness() < minBufSize);
...
if (bufTooSmall)
    return H263_STS_ERR_BUFOVER;[/bash]

In our use mRateControl = 1, and minBufSize is set to mBitsDesired*2.

The mBitDesired variable is set to average number of bits per frame (based on the BitRate). Of course, for an IFrame the bits per frame can be much larger than the average. GetFrame seems to have no other check on output bufer size. In our use, BitRate=200000, buffer size is around 12000, IFrames are sometimes larger, and GetFrame writes beyond the end of the buffer. GetFrame returns non-error. The pOut->SetDataSize() call near the end of GetFrame actually fails but the return code is not checked.

Of course we can avoid the problem by making the buffer big enough.

We are using UMC version 6.1.6. Has anything changed in the area of output buffer size checking in the H263 Encoder current code?

Thanks,

Jeff