Adding Internal Input Buffer

Allocating a input buffer in the decoder context and copying all input
to this buffer before using. This will ensure that we do not access
memory out of bounds because of our bit read optimisations.

Bug: 72764648
Test: poc before/after
Change-Id: Ide6c58291fa1d0472a9589c95aba231d13122a19
(cherry picked from commit 1532e414898ae7c0abc44cab66681054edceb1f7)

4 files changed, 25 insertions, 9 deletions

diff --git a/decoder/impeg2d_api.h b/decoder/impeg2d_api.h
index 3fa098b..f239637 100644
--- a/decoder/impeg2d_api.h
+++ b/decoder/impeg2d_api.h
@@ -50,7 +50,7 @@
 
 
 
-#define NUM_MEM_RECORDS                 4 * MAX_THREADS + NUM_INT_FRAME_BUFFERS + 5 + 2
+#define NUM_MEM_RECORDS                 4 * MAX_THREADS + NUM_INT_FRAME_BUFFERS + 5 + 2 + 1
 
 
 #define SETBIT(a,i)   ((a) |= (1 << i))
diff --git a/decoder/impeg2d_api_main.c b/decoder/impeg2d_api_main.c
index 871945b..e4f3c1c 100644
--- a/decoder/impeg2d_api_main.c
+++ b/decoder/impeg2d_api_main.c
@@ -598,7 +598,11 @@ void impeg2d_fill_mem_rec(impeg2d_fill_mem_rec_ip_t *ps_ip,
         }
     }
 
-
+    ps_mem_rec->u4_mem_alignment = 128;
+    ps_mem_rec->e_mem_type       = IV_EXTERNAL_CACHEABLE_PERSISTENT_MEM;
+    ps_mem_rec->u4_mem_size      = MAX_BITSTREAM_BUFFER_SIZE + MIN_BUFFER_BYTES_AT_EOS;
+    ps_mem_rec++;
+    u1_no_rec++;
 
     {
         WORD32 i4_job_queue_size;
@@ -644,6 +648,7 @@ void impeg2d_fill_mem_rec(impeg2d_fill_mem_rec_ip_t *ps_ip,
     ps_mem_rec->u4_mem_size      = sizeof(iv_mem_rec_t) * (NUM_MEM_RECORDS);
     ps_mem_rec++;
     u1_no_rec++;
+
     ps_op->s_ivd_fill_mem_rec_op_t.u4_num_mem_rec_filled = u1_no_rec;
     ps_op->s_ivd_fill_mem_rec_op_t.u4_error_code = 0;
 }
@@ -1914,6 +1919,9 @@ IV_API_CALL_STATUS_T impeg2d_api_init(iv_obj_t *ps_dechdl,
 
     ps_dec_state = ps_dec_state_multi_core->ps_dec_state[0];
 
+    ps_dec_state->pu1_input_buffer = ps_mem_rec->pv_base;
+    u4_num_mem_rec++;
+    ps_mem_rec++;
 
     ps_dec_state->pv_jobq_buf = ps_mem_rec->pv_base;
     ps_dec_state->i4_jobq_buf_size = ps_mem_rec->u4_mem_size;
diff --git a/decoder/impeg2d_decoder.c b/decoder/impeg2d_decoder.c
index e4ff79c..bff8c21 100644
--- a/decoder/impeg2d_decoder.c
+++ b/decoder/impeg2d_decoder.c
@@ -102,12 +102,14 @@ void impeg2d_dec_hdr(void *pv_dec,impeg2d_video_decode_ip_t *ps_ip,
 
     ps_dec = (dec_state_t *)pv_dec;
     ps_op->s_ivd_video_decode_op_t.u4_error_code = 0;
-    if (u4_size >= MAX_BITSTREAM_BUFFER_SIZE)
+    if (u4_size > MAX_BITSTREAM_BUFFER_SIZE)
     {
-        u4_size = MAX_BITSTREAM_BUFFER_SIZE - MIN_BUFFER_BYTES_AT_EOS;
+        u4_size = MAX_BITSTREAM_BUFFER_SIZE;
     }
 
-    impeg2d_bit_stream_init(&(ps_dec->s_bit_stream),ps_ip->s_ivd_video_decode_ip_t.pv_stream_buffer,
+    memcpy(ps_dec->pu1_input_buffer, ps_ip->s_ivd_video_decode_ip_t.pv_stream_buffer, u4_size);
+
+    impeg2d_bit_stream_init(&(ps_dec->s_bit_stream), ps_dec->pu1_input_buffer,
         u4_size);
 
     {
@@ -194,16 +196,19 @@ void impeg2d_dec_frm(void *pv_dec,impeg2d_video_decode_ip_t *ps_ip,
     ps_op->s_ivd_video_decode_op_t.u4_num_bytes_consumed = 0;
 
     IMPEG2D_FRM_NUM_SET();
-    if (u4_size >= MAX_BITSTREAM_BUFFER_SIZE)
+    if (u4_size > MAX_BITSTREAM_BUFFER_SIZE)
     {
-        u4_size = MAX_BITSTREAM_BUFFER_SIZE - MIN_BUFFER_BYTES_AT_EOS;
+        u4_size = MAX_BITSTREAM_BUFFER_SIZE;
     }
 
-    ps_dec->pu1_inp_bits_buf = ps_ip->s_ivd_video_decode_ip_t.pv_stream_buffer;
+    memcpy(ps_dec->pu1_input_buffer, ps_ip->s_ivd_video_decode_ip_t.pv_stream_buffer, u4_size);
+
+    ps_dec->pu1_inp_bits_buf = ps_dec->pu1_input_buffer;
+
     ps_dec->u4_num_inp_bytes = u4_size;
     ps_stream  = &ps_dec->s_bit_stream;
 
-    impeg2d_bit_stream_init(ps_stream,ps_ip->s_ivd_video_decode_ip_t.pv_stream_buffer,u4_size);
+    impeg2d_bit_stream_init(ps_stream, ps_dec->pu1_input_buffer, u4_size);
 
     /* @ */ /* Updating the bufferID */
 
diff --git a/decoder/impeg2d_structs.h b/decoder/impeg2d_structs.h
index 971bc91..9d0c756 100644
--- a/decoder/impeg2d_structs.h
+++ b/decoder/impeg2d_structs.h
@@ -337,6 +337,9 @@ typedef struct dec_state_struct_t
     WORD32          i4_start_mb_y;
     WORD32          i4_end_mb_y;
 
+    /* Buffer to store the input stream */
+    UWORD8 *pu1_input_buffer;
+
     /**
      * Job queue buffer base
      */