diff options
| author | Rakesh Kumar <rakesh.kumar@ittiam.com> | 2018-11-12 18:00:27 +0530 |
|---|---|---|
| committer | Tim Schumacher <timschumi@gmx.de> | 2019-04-13 00:14:36 +0200 |
| commit | fc1a05c9894743339c5dbef76c4c36876dfa4540 (patch) | |
| tree | aea14e5dd7e6ad9af61ee41f86ded5fcc7fdbfc2 | |
| parent | 9601147d8f8e78c5790a8f6a162b73b26f37aa04 (diff) | |
| download | android_external_libhevc-cm-13.0.tar.gz android_external_libhevc-cm-13.0.tar.bz2 android_external_libhevc-cm-13.0.zip | |
Decoder: Signal IVD_RES_CHANGED error for change in crop paramsHEADreplicant-6.0-0004-transitionreplicant-6.0-0004-rc6replicant-6.0-0004-rc5-transitionreplicant-6.0-0004-rc5replicant-6.0-0004-rc4replicant-6.0-0004-rc3replicant-6.0-0004-rc2replicant-6.0-0004cm-13.0
IVD_RES_CHANGED was not signaled when crop parameters changed, i.e.
display dimensions changed without change in decode dimensions.
In such cases, if output buffer was allocated as per the current
dimension being decoded, without IVD_RES_CHANGED signalled, there can be
an OOB write if the new buffer is smaller than the frame being returned
as output
Bug: 118453553
Test: vendor
Change-Id: Ic74c6fb9612403f75a8f9ddb3a93861bca82cf16
(cherry picked from commit fdbbd60bfebe48c0539897d7eeeeb5816e59ce1b)
| -rw-r--r-- | decoder/ihevcd_parse_headers.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c index c7b1d9c..6052dda 100644 --- a/decoder/ihevcd_parse_headers.c +++ b/decoder/ihevcd_parse_headers.c @@ -1594,6 +1594,18 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) if((0 >= disp_wd) || (0 >= disp_ht)) return IHEVCD_INVALID_PARAMETER; + if((0 != ps_codec->u4_allocate_dynamic_done) && + ((ps_codec->i4_disp_wd != disp_wd) || + (ps_codec->i4_disp_ht != disp_ht))) + { + if(0 == ps_codec->i4_first_pic_done) + { + return IHEVCD_INVALID_PARAMETER; + } + ps_codec->i4_reset_flag = 1; + return (IHEVCD_ERROR_T)IVD_RES_CHANGED; + } + ps_codec->i4_disp_wd = disp_wd; ps_codec->i4_disp_ht = disp_ht; |