diff --git a/media/gpu/vaapi/av1_vaapi_video_encoder_delegate.cc b/media/gpu/vaapi/av1_vaapi_video_encoder_delegate.cc index 71cad35d3cf88..4450399f574f0 100644 --- a/media/gpu/vaapi/av1_vaapi_video_encoder_delegate.cc +++ b/media/gpu/vaapi/av1_vaapi_video_encoder_delegate.cc @@ -648,6 +648,13 @@ AV1VaapiVideoEncoderDelegate::PrepareEncodeJob(EncodeJob& encode_job) { .spatial_layer_id = 0, .temporal_layer_id = temporal_idx.value_or(0), }; + // |rate_ctrl_| was created with |num_temporal_layers_| layers. Passing a + // larger temporal_layer_id causes an OOB write in libaom's + // AV1RateControlRTC::ComputeQP / av1_save_layer_context. |svc_layers_| can + // be recreated with a larger T via UpdateRates() without |num_temporal_layers_| + // (and therefore |rate_ctrl_|'s allocation) being updated. + CHECK_LT(frame_params.temporal_layer_id, + static_cast(num_temporal_layers_)); if (rate_ctrl_->ComputeQP(frame_params) == aom::kFrameDropDecisionDrop) { CHECK(!encode_job.IsKeyframeRequested()); DVLOGF(3) << "Drop frame";