summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHamsalekha S <hamsalekha.s@ittiam.com>2017-05-08 17:11:05 +0530
committerMSe <mse1969@posteo.de>2017-07-07 00:12:58 +0200
commit1b9810f04c902c70193cd770647b7c7efd471482 (patch)
treecaf6082da4d9a53df3f046aaa33d3e833cfa72c0
parente04dd6518b85522a26f5d019a9d7db3b419b34ec (diff)
downloadandroid_external_libavc-1b9810f04c902c70193cd770647b7c7efd471482.tar.gz
android_external_libavc-1b9810f04c902c70193cd770647b7c7efd471482.tar.bz2
android_external_libavc-1b9810f04c902c70193cd770647b7c7efd471482.zip
Decoder: Fix allocation for Mbaff weight matrix
Increased the allocation size for Mbaff weight matrix buffer Bug: 36996978 AOSP-Change-Id: I21cf2cb1010abdc6346f743f5237ae1730c4bf41 (cherry picked from commit 07db35ad5af8c4ee2308f983650d9a1b811841ea) CVE-2017-0679 Change-Id: I1a8e38c839eee9887abf2fd99954237db31b2234
-rw-r--r--decoder/ih264d_api.c5
1 files changed, 2 insertions, 3 deletions
diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c
index 1d9c9fe..3432039 100644
--- a/decoder/ih264d_api.c
+++ b/decoder/ih264d_api.c
@@ -1376,9 +1376,8 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv
pu1_buf += size / 2;
ps_dec->ps_dpb_mgr->ps_init_dpb[1][0] = (struct pic_buffer_t *)pu1_buf;
- size = (sizeof(UWORD32) * 3
- * (MAX_FRAMES * MAX_FRAMES))
- << 3;
+ size = (sizeof(UWORD32) * 2 * 3
+ * ((MAX_FRAMES << 1) * (MAX_FRAMES << 1)) * 2);
pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
RETURN_IF((NULL == pv_buf), IV_FAIL);
ps_dec->pu4_mbaff_wt_mat = pv_buf;