diff options
| author | Harish Mahendrakar <harish.mahendrakar@ittiam.com> | 2017-01-13 11:26:23 +0530 |
|---|---|---|
| committer | Sean McCreary <mccreary@mcwest.org> | 2017-03-22 12:25:50 -0600 |
| commit | 5b7d233e84151323586440037d8e889857f8f9dc (patch) | |
| tree | 420570ffc75b30e93615c92164ffb294bca7b0bc | |
| parent | e8dccb025d946ad4d2665cadde56118075f5eed9 (diff) | |
| download | android_external_libavc-5b7d233e84151323586440037d8e889857f8f9dc.tar.gz android_external_libavc-5b7d233e84151323586440037d8e889857f8f9dc.tar.bz2 android_external_libavc-5b7d233e84151323586440037d8e889857f8f9dc.zip | |
Decoder: Increase memory allocation for weights & offsets for interlaced clips
Bug: 33816782
CVE-2017-0471
Change-Id: I65a5376f46902139f9fc49a2fff54b53b518d703
(cherry picked from commit bee9b9a54b5f7a30991b630a13659e573f0cb52d)
(cherry picked from commit 4a61d15e7b0ab979ba7e80db8ddbde025c1ce6cc)
| -rw-r--r-- | decoder/ih264d_api.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c index cbfc8ca..b759dda 100644 --- a/decoder/ih264d_api.c +++ b/decoder/ih264d_api.c @@ -1384,7 +1384,7 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv ps_dec->pu4_mbaff_wt_mat = pv_buf; size = sizeof(UWORD32) * 2 * 3 - * (MAX_FRAMES * MAX_FRAMES); + * ((MAX_FRAMES << 1) * (MAX_FRAMES << 1)); pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size); RETURN_IF((NULL == pv_buf), IV_FAIL); ps_dec->pu4_wts_ofsts_mat = pv_buf; |