diff options
| author | Ritu Baldwa <ritu.baldwa@ittiam.com> | 2017-10-09 13:52:45 +0530 |
|---|---|---|
| committer | mse1969 <mse1969@posteo.de> | 2018-01-10 22:48:58 +0100 |
| commit | bc70c80064e577a31d2acba2c25310ab2630e4a2 (patch) | |
| tree | fe93a7691641fe6c1d1173c44c13f73a67a1743e | |
| parent | 17c125b6515ffe2f4f685d2a025085d9868cb9b7 (diff) | |
| download | android_external_libavc-bc70c80064e577a31d2acba2c25310ab2630e4a2.tar.gz android_external_libavc-bc70c80064e577a31d2acba2c25310ab2630e4a2.tar.bz2 android_external_libavc-bc70c80064e577a31d2acba2c25310ab2630e4a2.zip | |
Decoder: Fixed incorrect use of mmco parameters.
Added extra structure to read mmco values and copied only once per
picture.
Bug: 65735716
Change-Id: I25b08a37bc78342042c52957774b089abce1a54b
(cherry picked from commit 3c70b9a190875938fc57164d9295a3ec791554df)
CVE-2017-13186
| -rw-r--r-- | decoder/ih264d_dpb_mgr.c | 2 | ||||
| -rw-r--r-- | decoder/ih264d_parse_slice.c | 9 | ||||
| -rw-r--r-- | decoder/ih264d_structs.h | 1 |
3 files changed, 11 insertions, 1 deletions
diff --git a/decoder/ih264d_dpb_mgr.c b/decoder/ih264d_dpb_mgr.c index 0a61ffd..998e97a 100644 --- a/decoder/ih264d_dpb_mgr.c +++ b/decoder/ih264d_dpb_mgr.c @@ -842,7 +842,7 @@ WORD32 ih264d_ref_idx_reordering(dec_struct_t *ps_dec, UWORD8 uc_lx) WORD32 ih264d_read_mmco_commands(struct _DecStruct * ps_dec) { dec_bit_stream_t *ps_bitstrm = ps_dec->ps_bitstrm; - dpb_commands_t *ps_dpb_cmds = ps_dec->ps_dpb_cmds; + dpb_commands_t *ps_dpb_cmds = &(ps_dec->s_dpb_cmds_scratch); dec_slice_params_t * ps_slice = ps_dec->ps_cur_slice; WORD32 j; UWORD8 u1_buf_mode; diff --git a/decoder/ih264d_parse_slice.c b/decoder/ih264d_parse_slice.c index 8a7f93a..75bdf7c 100644 --- a/decoder/ih264d_parse_slice.c +++ b/decoder/ih264d_parse_slice.c @@ -1860,6 +1860,15 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice, if(ret != OK) return ret; + if(u1_nal_ref_idc != 0) + { + if(!ps_dec->ps_dpb_cmds->u1_dpb_commands_read) + { + memcpy((void *)ps_dec->ps_dpb_cmds, (void *)(&(ps_dec->s_dpb_cmds_scratch)), + sizeof(dpb_commands_t)); + } + } + /* storing last Mb X and MbY of the slice */ ps_dec->i2_prev_slice_mbx = ps_dec->u2_mbx; ps_dec->i2_prev_slice_mby = ps_dec->u2_mby; diff --git a/decoder/ih264d_structs.h b/decoder/ih264d_structs.h index c83c34e..daf753b 100644 --- a/decoder/ih264d_structs.h +++ b/decoder/ih264d_structs.h @@ -968,6 +968,7 @@ typedef struct _DecStruct /* Variables for Decode Buffer Management */ dpb_manager_t *ps_dpb_mgr; dpb_commands_t *ps_dpb_cmds; + dpb_commands_t s_dpb_cmds_scratch; /* Variables Required for N MB design */ dec_mb_info_t *ps_nmb_info; |