Decoder: Adding Error Check for Output Buffer Size in Shared Display Mode.

The output buffer size given by the application, needs to be checked
in every process call. This is required in the case of resolution
change in shared display mode.

Bug: 70294343
Bug: 70350193
Bug: 70526411
Bug: 70526485
Test: manual
Change-Id: I2c1e59425e84ac62a874e5ee180e1b98f0a4058f
(cherry picked from commit 3692aceb1b244be3e1b36d8e7b804986f593bb69)

1 files changed, 57 insertions, 8 deletions

diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c
index 93c8826..3ace427 100644
--- a/decoder/ih264d_api.c
+++ b/decoder/ih264d_api.c
@@ -1698,8 +1698,8 @@ WORD32 check_app_out_buf_size(dec_struct_t *ps_dec)
     }
     else
     {
-        /* In case of shared mode, do not check validity of ps_dec->ps_out_buffer */
-        return (IV_SUCCESS);
+        pic_wd = ps_dec->u2_frm_wd_y;
+        pic_ht = ps_dec->u2_frm_ht_y;
     }
 
     if(ps_dec->u4_app_disp_width > pic_wd)
@@ -1709,14 +1709,34 @@ WORD32 check_app_out_buf_size(dec_struct_t *ps_dec)
                                                  ps_dec->u1_chroma_format,
                                                  &au4_min_out_buf_size[0]);
 
-    if(ps_dec->ps_out_buffer->u4_num_bufs < u4_min_num_out_bufs)
-        return IV_FAIL;
 
-    for(i = 0; i < u4_min_num_out_bufs; i++)
+    if(0 == ps_dec->u4_share_disp_buf)
     {
-        if(ps_dec->ps_out_buffer->u4_min_out_buf_size[i]
-                        < au4_min_out_buf_size[i])
-            return (IV_FAIL);
+        if(ps_dec->ps_out_buffer->u4_num_bufs < u4_min_num_out_bufs)
+            return IV_FAIL;
+
+        for(i = 0; i < u4_min_num_out_bufs; i++)
+        {
+            if(ps_dec->ps_out_buffer->u4_min_out_buf_size[i]
+                            < au4_min_out_buf_size[i])
+                return (IV_FAIL);
+        }
+    }
+    else
+    {
+        if(ps_dec->disp_bufs[0].u4_num_bufs < u4_min_num_out_bufs)
+            return IV_FAIL;
+
+        for(i = 0; i < u4_min_num_out_bufs; i++)
+        {
+            /* We need to check only with the disp_buffer[0], because we have
+             * already ensured that all the buffers are of the same size in
+             * ih264d_set_display_frame.
+             */
+            if(ps_dec->disp_bufs[0].u4_bufsize[i] < au4_min_out_buf_size[i])
+                return (IV_FAIL);
+        }
+
     }
 
     return (IV_SUCCESS);
@@ -2658,6 +2678,7 @@ WORD32 ih264d_set_display_frame(iv_obj_t *dec_hdl,
                                 void *pv_api_op)
 {
 
+    UWORD32 u4_disp_buf_size[3], u4_num_disp_bufs;
     ivd_set_display_frame_ip_t *dec_disp_ip;
     ivd_set_display_frame_op_t *dec_disp_op;
 
@@ -2677,8 +2698,36 @@ WORD32 ih264d_set_display_frame(iv_obj_t *dec_hdl,
         u4_num_bufs = MIN(u4_num_bufs, MAX_DISP_BUFS_NEW);
 
         ps_dec->u4_num_disp_bufs = u4_num_bufs;
+
+        /* Get the number and sizes of the first buffer. Compare this with the
+         * rest to make sure all the buffers are of the same size.
+         */
+        u4_num_disp_bufs = dec_disp_ip->s_disp_buffer[0].u4_num_bufs;
+
+        u4_disp_buf_size[0] =
+          dec_disp_ip->s_disp_buffer[0].u4_min_out_buf_size[0];
+        u4_disp_buf_size[1] =
+          dec_disp_ip->s_disp_buffer[0].u4_min_out_buf_size[1];
+        u4_disp_buf_size[2] =
+          dec_disp_ip->s_disp_buffer[0].u4_min_out_buf_size[2];
+
         for(i = 0; i < u4_num_bufs; i++)
         {
+            if(dec_disp_ip->s_disp_buffer[i].u4_num_bufs != u4_num_disp_bufs)
+            {
+                return IV_FAIL;
+            }
+
+            if((dec_disp_ip->s_disp_buffer[i].u4_min_out_buf_size[0]
+                != u4_disp_buf_size[0])
+                || (dec_disp_ip->s_disp_buffer[i].u4_min_out_buf_size[1]
+                    != u4_disp_buf_size[1])
+                || (dec_disp_ip->s_disp_buffer[i].u4_min_out_buf_size[2]
+                    != u4_disp_buf_size[2]))
+            {
+                return IV_FAIL;
+            }
+
             ps_dec->disp_bufs[i].u4_num_bufs =
                             dec_disp_ip->s_disp_buffer[i].u4_num_bufs;