diff options
| author | Naveen Kumar P <naveenkumar.p@ittiam.com> | 2017-08-31 14:25:53 +0530 |
|---|---|---|
| committer | Ivan Kutepov <its.kutepov@gmail.com> | 2017-11-10 17:52:28 +0300 |
| commit | e137cae7b673a19a364a0ac20800dd2d938ab37a (patch) | |
| tree | 724884b03cbb408b43210f2ba077113b66f9b25b | |
| parent | 1c71cb5a1c30d78ae632589d8fa58a3713e3252c (diff) | |
| download | android_external_libhevc-e137cae7b673a19a364a0ac20800dd2d938ab37a.tar.gz android_external_libhevc-e137cae7b673a19a364a0ac20800dd2d938ab37a.tar.bz2 android_external_libhevc-e137cae7b673a19a364a0ac20800dd2d938ab37a.zip | |
Fix tile index buf alloc size
Bug: 64893226
Change-Id: Iec02f6a7b65804cc3daadf6e29d57a7ad955d517
CVE-2017-0836
| -rw-r--r-- | decoder/ihevcd_api.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/decoder/ihevcd_api.c b/decoder/ihevcd_api.c index e331337..1cd968e 100644 --- a/decoder/ihevcd_api.c +++ b/decoder/ihevcd_api.c @@ -1839,10 +1839,10 @@ WORD32 ihevcd_allocate_dynamic_bufs(codec_t *ps_codec) } /* Max CTBs in a row */ - size = wd / MIN_CTB_SIZE + 2 /* Top row and bottom row extra. This ensures accessing left,top in first row - and right in last row will not result in invalid access*/; + size = wd / MIN_CTB_SIZE; /* Max CTBs in a column */ - size *= ht / MIN_CTB_SIZE; + size *= (ht / MIN_CTB_SIZE + 2) /* Top row and bottom row extra. This ensures accessing left,top in first row + and right in last row will not result in invalid access*/; size *= sizeof(UWORD16); pv_buf = ps_codec->pf_aligned_alloc(pv_mem_ctxt, 128, size); |