diff options
| author | Harish Mahendrakar <harish.mahendrakar@ittiam.com> | 2016-11-25 17:02:47 +0530 |
|---|---|---|
| committer | Sean McCreary <mccreary@mcwest.org> | 2017-03-22 20:06:56 -0600 |
| commit | b133b420f540eb0bad149236df206f75677e8b58 (patch) | |
| tree | b2f80e3ed762a6ba985a9a08b5c3f605be4dc725 | |
| parent | a9f92961ff040a3ee62c08f7f35cd87ebf5dc029 (diff) | |
| download | android_external_libhevc-b133b420f540eb0bad149236df206f75677e8b58.tar.gz android_external_libhevc-b133b420f540eb0bad149236df206f75677e8b58.tar.bz2 android_external_libhevc-b133b420f540eb0bad149236df206f75677e8b58.zip | |
Fix in Chroma SAO for non-multiple of 8 height
A register was not loaded correctly which was resulting in a crash
for a certain combination of availability flags and block height
Bug: 32873375
Test: Tested manually for the clip associated with the bug
CVE-2017-0407
AOSP Change-Id: I6e0969a1e51c8149853bae226b527411b45ec370
Change-Id: I373d9d862988fc8fed65b1c07cba50d22702bb14
(cherry picked from commit 68215fd9ed309d1f1cc204e96bd788f5c865525c)
(cherry picked from commit 02bcb7ddec84cc08af907231706b0e03e7138cbf)
| -rw-r--r-- | common/arm/ihevc_sao_edge_offset_class3_chroma.s | 2 | ||||
| -rw-r--r-- | common/arm64/ihevc_sao_edge_offset_class3_chroma.s | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/common/arm/ihevc_sao_edge_offset_class3_chroma.s b/common/arm/ihevc_sao_edge_offset_class3_chroma.s index 6561a8a..62f40d1 100644 --- a/common/arm/ihevc_sao_edge_offset_class3_chroma.s +++ b/common/arm/ihevc_sao_edge_offset_class3_chroma.s @@ -703,9 +703,9 @@ WD_16_HT_4_LOOP: SKIP_AU1_MASK_VAL_WD_16_HT_4: LDRB r11,[r5,#2] @pu1_avail[2] + CMP r11,#0 SUBEQ r8,r0,r1 @pu1_src - src_strd - CMP r11,#0 MOVNE r8,r3 VLD1.8 D12,[r0]! @pu1_cur_row = vld1q_u8(pu1_src) VLD1.8 D13,[r0] @pu1_cur_row = vld1q_u8(pu1_src) diff --git a/common/arm64/ihevc_sao_edge_offset_class3_chroma.s b/common/arm64/ihevc_sao_edge_offset_class3_chroma.s index 8e93110..7c9dfd8 100644 --- a/common/arm64/ihevc_sao_edge_offset_class3_chroma.s +++ b/common/arm64/ihevc_sao_edge_offset_class3_chroma.s @@ -775,9 +775,9 @@ WD_16_HT_4_LOOP: SKIP_AU1_MASK_VAL_WD_16_HT_4: LDRB w11,[x5,#2] //pu1_avail[2] SUB x20,x0,x1 //pu1_src - src_strd + CMP x11,#0 csel x8, x20, x8,EQ - CMP x11,#0 csel x8, x3, x8,NE LD1 {v5.16b},[x0] //pu1_cur_row = vld1q_u8(pu1_src) //LD1 {v13.8b},[x0] //pu1_cur_row = vld1q_u8(pu1_src) |