x265 segmentation fault when using HDR10+ JSON with varying NumberOfAnchors

Hi,

There is a bug within the HDR10+ code of x265 that segfaults when using --dhdr10-info and a JSON containing different NumberOfAnchors.

x265 only segfaults at the end of encoding, when freeing memory:

free(): invalid next size (fast)

The segfault happens with samples over at least 54 frames, but lengths such as 30 do not segfault.

I do not know if the HDR10+ LLC specifications allow varying NumberOfAnchors, but this metadata can currently be found in multiple titles.

The issue can be reproduced with the attached files, x265 3.4 and this CLI:

x265 --y4m --input segfault.y4m --dhdr10-info segfault.json --output out.hevc

Cheers.

Comments (2)