| Commit message (Collapse) | Author | Age | Files | Lines |
|\
| |
| |
| |
| |
| |
| |
| |
| | |
Android 8.1.0 release 74
* tag 'android-8.1.0_r74':
decoder: Fix minimum poc calculation check while adding to display
Change-Id: Ic6cc11c6b8f69b6eb4aef63c47d639162636f085
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
While adding the decoded buffer to display queue, allow buffer with
poc set to 0x7FFFFFFF
Bug: 145364230
Test: poc in bug
Change-Id: I2a15f73b8422cfa4fd3360bc21c0cea4542a3375
(cherry picked from commit ffcf2a87d66f935210ebd011eed474514d086b40)
|
|\|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Android 8.1.0 release 72
* tag 'android-8.1.0_r72':
decoder: Move initialization of dbp_mgr entries to init_decoder()
Decoder: Delete node from st if lt and st point to same
decoder: Signal IVD_RES_CHANGED error for change in crop params
Decoder: Modify setting short term reference field flag
Encoder: Return error for odd resolution
Decoder: Set prev slice type for I slice.
Decoder: Fixed reset values in parse sps.
Decoder: Fixed memory overflow in shared display mode.
Decoder: Adding Error Check for Output Buffer Size in Shared Display Mode.
Decoder: Modified loop condition while parsing ref_list_reordering.
Decoder: Handle dec_hdl memory allocation failure gracefully
Decoder: Detect change of mbaff flag in SPS
Decoder: Increased allocation and added checks in sei parsing.
Decoder: Fixed incorrect use of mmco parameters.
Change-Id: I5513b7107ce585a657980e911e0e6d5d3cbdad39
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Earlier these were only initialized during static buffer allocations.
Initializing them in init_decoder() will ensure that these get
initialized to default values during reset() as well. Without this,
in some error cases, there is a possibility of heap-use-after free,
when resolution changes and these pointers point to memory that is freed
Bug: 142602711
Test: poc in bug
Change-Id: Ie39fee0eca56bf32cdc558099bf167d05eb89620
(cherry picked from commit 01da7b5a52a76aee615b4e32eeceb4887d3662f0)
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
If lt_list and st_list point to same node then delete it from st.
If there is error while adding a node in bottom field of lt_list (top is
already added) then this node will be pointed by st_list also. So we need
to remove it from st_list
bug: 73552574
Test: poc before/after on Android N security branch
Change-Id: I95304c242c5854b18c5c7220d114ce6215760124
(cherry picked from commit f312a1d305dae23f9f6f663d2157bf9cf47bb92c)
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
IVD_RES_CHANGED was not signaled when crop parameters changed, i.e.
display dimensions changed without change in decode dimensions.
In such cases, if output buffer was allocated as per the current
dimension being decoded, without IVD_RES_CHANGED signalled, there can be
an OOB write if the new buffer is smaller than the frame being returned
as output
Bug: 118399205
Test: vendor
Change-Id: Ia750a99cda08a3254a6f8ea8b55d07e655b34d05
(cherry picked from commit 442a01bf37d5bd97bb6d13b382f00265051abbe8)
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Do not mark bottom field as short term in case of error.
Bug: 73553038
Bug: 73552574
Bug: 73552999
Test: poc before/after
Change-Id: I8576861af36996a361a81f48ba9b251f0ae4e660
(cherry picked from commit 47cc04b40c94b14841d27eb3ac0b01c3f1739180)
|
| |
| |
| |
| |
| |
| |
| | |
Bug: 73625898
Test: ran POC before/after under ASAN
Change-Id: I9765b57f4afc6a2b6ad9cd19c8c7c5000beb9de9
(cherry picked from commit 9fa58d4db3ef176ed54af5f602970b48624be413)
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Fixed initialization of u1_pr_sl_type for I slice.
Bug: 70897454
Test: ran PoC before/after patch
Change-Id: I0c37317513b72236be98c2b25482a67bf2b56052
(cherry picked from commit aecdfd1aff2505da11ad48ad4f9f918054ce0c97)
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Memset to zero whenever new sps occurs.
Bug: 70897394
Test: manual
Change-Id: I5936fd55265ff8ad2b275a72b175cdb540bb7933
(cherry picked from commit 9c32ad7126890dfaa79fd29affaaf07de335fa3a)
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
The factor multiplication should happen only at the source,
not at the destination.
Bug: 71375536
Test: manual
Change-Id: Ib5f00b87150a0533880346fac5464b0b1a802c36
(cherry picked from commit c3b026a87d7da17ca5196e1973137b8691e60bde)
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
The output buffer size given by the application, needs to be checked
in every process call. This is required in the case of resolution
change in shared display mode.
Bug: 70294343
Bug: 70350193
Bug: 70526411
Bug: 70526485
Test: manual
Change-Id: I2c1e59425e84ac62a874e5ee180e1b98f0a4058f
(cherry picked from commit 3692aceb1b244be3e1b36d8e7b804986f593bb69)
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
When ref_pic_list_reordering_flag_l1 is equal to 1, the number of times
that reordering_of_pic_nums_idc is not equal to 3 following
ref_pic_list_reordering_flag_l1 should not exceed
num_ref_idx_l1_active_minus1 + 1.
Bug: 69478425
Change-Id: I031bb744869ac8a57f85bb97574832efd0eefc25
(cherry picked from commit 7ea47d575d26d4d5356670092af26fb6915e75bf)
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
If memory allocation for dec_hdl fails, return gracefully
with an error code. All other allocation failures are
handled correctly.
Bug: 68300072
Test: ran poc before/after
Change-Id: I118ae71f4aded658441f1932bd4ede3536f5028b
(cherry picked from commit 7720b3fe3de04523da3a9ecec2b42a3748529bbd)
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Change in Mbaff flag needs re-initialization of NMB group
and other variables in decoder context.
Bug: 64380237
Test: ran poc on ASAN before/after
Change-Id: I0fc65e4dfc3cc2c15528ec52da1782ecec61feab
(cherry picked from commit d524ba03101c0c662c9d365d7357536b42a0265e)
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This prevents heap overflow while parsing sei_message.
Bug: 63122634
Test: ran PoC on unpatched/patched
Change-Id: I61c1ff4ac053a060be8c24da4671db985cac628c
(cherry picked from commit f2b70d353768af8d4ead7f32497be05f197925ef)
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Added extra structure to read mmco values and copied only once per
picture.
Bug: 65735716
Change-Id: I25b08a37bc78342042c52957774b089abce1a54b
(cherry picked from commit 3c70b9a190875938fc57164d9295a3ec791554df)
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
If lt_list and st_list point to same node then delete it from st.
If there is error while adding a node in bottom field of lt_list (top is
already added) then this node will be pointed by st_list also. So we need
to remove it from st_list
bug: 73552574
Test: poc before/after on Android N security branch
Change-Id: I95304c242c5854b18c5c7220d114ce6215760124
(cherry picked from commit f312a1d305dae23f9f6f663d2157bf9cf47bb92c)
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
IVD_RES_CHANGED was not signaled when crop parameters changed, i.e.
display dimensions changed without change in decode dimensions.
In such cases, if output buffer was allocated as per the current
dimension being decoded, without IVD_RES_CHANGED signalled, there can be
an OOB write if the new buffer is smaller than the frame being returned
as output
Bug: 118399205
Test: vendor
Change-Id: Ia750a99cda08a3254a6f8ea8b55d07e655b34d05
(cherry picked from commit 442a01bf37d5bd97bb6d13b382f00265051abbe8)
|
|\ \
| | |
| | |
| | |
| | |
| | | |
4743082, 4743083, 4741262, 4741263, 4741264, 4741265, 4741266, 4741667, 4743084, 4741242, 4741243, 4741741, 4741742, 4741743, 4741744, 4741822, 4743085, 4741668, 4741338, 4743055, 4743056, 4743070, 4743073, 4743075, 4743076, 4743078, 4743079, 4743161, 4743162, 4743164, 4743165, 4743167, 4743168, 4743169, 4743170, 4741681, 4741682, 4741683, 4741684, 4741685, 4741686, 4741687, 4741688, 4741689, 4741690, 4741691, 4741692, 4741693, 4741694, 4741695, 4741696, 4741697, 4741698, 4741699, 4743240, 4743241, 4743242, 4743243, 4741745, 4741823, 4741824, 4741825, 4741267, 4741268, 4743244, 4743280, 4743281, 4743224, 4743203, 4743204, 4743205, 4741746, 4741747, 4743245, 4741826, 4741827, 4741828, 4741829, 4741748, 4741749, 4741750, 4743233, 4743282, 4741244, 4741245, 4741246, 4741247, 4743206, 4743207, 4743208, 4743209, 4743210, 4743211, 4743212, 4743213, 4743214, 4743215, 4743216, 4743217, 4743218, 4743219, 4743360, 4743361, 4743362, 4743363, 4743364, 4743365, 4743366, 4743367, 4743368, 4743369, 4743370, 4743371, 4743372, 4743373, 4743374, 4743375, 4743376, 4743377, 4743283, 4743284, 4741830, 4742501, 4743246, 4743086, 4743087, 4743378, 4743379, 4741751] into sparse-4749909-L04200000199131547
Change-Id: Ia0ee5cb5c47e1cacbd4fee2accfd393ec2429c78
|
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Bug: 73625898
Test: ran POC before/after under ASAN
Change-Id: I9765b57f4afc6a2b6ad9cd19c8c7c5000beb9de9
(cherry picked from commit 9fa58d4db3ef176ed54af5f602970b48624be413)
|
|/ /
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Do not mark bottom field as short term in case of error.
Bug: 73553038
Bug: 73552574
Bug: 73552999
Test: poc before/after
Change-Id: I8576861af36996a361a81f48ba9b251f0ae4e660
(cherry picked from commit 47cc04b40c94b14841d27eb3ac0b01c3f1739180)
|
|\ \
| | |
| | |
| | | |
Change-Id: I7be4232516e384de4fd0c30d653a71751d5c8bd4
|
| |\ \
| | | |
| | | |
| | | |
| | | |
| | | | |
3580658, 3580382, 3580474, 3580475, 3581039, 3581040, 3580476, 3580206, 3581527, 3580955, 3580956, 3580957, 3580958, 3580959, 3580960, 3580961, 3580962, 3580963, 3580964, 3580965, 3580966, 3581567, 3581568, 3581569, 3581570, 3581571, 3580625, 3580626, 3581587, 3581513, 3581514, 3581515, 3580477, 3581588, 3580659, 3580660, 3580383, 3580384, 3580478, 3580719, 3580479, 3580480, 3581385, 3581528, 3581041, 3581042, 3581043, 3581044, 3581045, 3581046, 3581607, 3580385, 3580481, 3580482, 3580483, 3580661, 3580662, 3580663, 3580664, 3580665, 3580484, 3580485, 3581608, 3581609, 3581610, 3581611, 3581612, 3581589, 3581613, 3580486, 3581519, 3581627, 3581628, 3581529, 3581530, 3581531, 3581629, 3581630] into oc-mr1-release
Change-Id: I2db591a1dbcb585780479caafca71b08419e62f8
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Memset to zero whenever new sps occurs.
Bug: 70897394
Test: manual
Change-Id: I5936fd55265ff8ad2b275a72b175cdb540bb7933
(cherry picked from commit 9c32ad7126890dfaa79fd29affaaf07de335fa3a)
|
| |/ /
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Fixed initialization of u1_pr_sl_type for I slice.
Bug: 70897454
Test: ran PoC before/after patch
Change-Id: I0c37317513b72236be98c2b25482a67bf2b56052
(cherry picked from commit aecdfd1aff2505da11ad48ad4f9f918054ce0c97)
|
| |\ \
| | | |
| | | |
| | | |
| | | |
| | | | |
3478393, 3478134, 3478135, 3478213, 3478214, 3478215, 3478233, 3478234, 3478235, 3478251, 3478252, 3478253, 3478254, 3478394, 3478395, 3478396, 3478397, 3478398, 3478399, 3478400, 3478401, 3478402, 3478403, 3478292, 3478293, 3478312, 3478136, 3477911] into oc-mr1-release
Change-Id: I1dbb4215694209fcf2dee7df2c464468978942fc
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
The output buffer size given by the application, needs to be checked
in every process call. This is required in the case of resolution
change in shared display mode.
Bug: 70294343
Bug: 70350193
Bug: 70526411
Bug: 70526485
Test: manual
Change-Id: I2c1e59425e84ac62a874e5ee180e1b98f0a4058f
(cherry picked from commit 3692aceb1b244be3e1b36d8e7b804986f593bb69)
|
| |/ /
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
The factor multiplication should happen only at the source,
not at the destination.
Bug: 71375536
Test: manual
Change-Id: Ib5f00b87150a0533880346fac5464b0b1a802c36
(cherry picked from commit c3b026a87d7da17ca5196e1973137b8691e60bde)
|
|\ \ \
| | | |
| | | |
| | | |
| | | |
| | | | |
3555207, 3555208, 3555209, 3555210, 3552110, 3555154, 3555155] into oc-m2-release
Change-Id: Ia208272a5bcd3840b8785bc72a5652ac80e1b616
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Memset to zero whenever new sps occurs.
Bug: 70897394
Test: manual
Change-Id: I5936fd55265ff8ad2b275a72b175cdb540bb7933
(cherry picked from commit 9c32ad7126890dfaa79fd29affaaf07de335fa3a)
|
|/ / /
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Fixed initialization of u1_pr_sl_type for I slice.
Bug: 70897454
Test: ran PoC before/after patch
Change-Id: I0c37317513b72236be98c2b25482a67bf2b56052
(cherry picked from commit aecdfd1aff2505da11ad48ad4f9f918054ce0c97)
|
|\ \ \
| | | |
| | | |
| | | |
| | | |
| | | | |
3478654, 3478655, 3478656, 3479494, 3479495, 3478933, 3478934, 3479496, 3479497, 3479498, 3478160, 3478161, 3478162, 3478876, 3478877, 3478878, 3478241, 3478163, 3478164, 3478165, 3478166, 3478167, 3478168, 3478169, 3479990, 3479991, 3479992, 3480010, 3480011, 3480012] into oc-m2-release
Change-Id: I8c38068be410e0733acf7b47e7b72eecc94ad463
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
The output buffer size given by the application, needs to be checked
in every process call. This is required in the case of resolution
change in shared display mode.
Bug: 70294343
Bug: 70350193
Bug: 70526411
Bug: 70526485
Test: manual
Change-Id: I2c1e59425e84ac62a874e5ee180e1b98f0a4058f
(cherry picked from commit 3692aceb1b244be3e1b36d8e7b804986f593bb69)
|
|/ / /
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
The factor multiplication should happen only at the source,
not at the destination.
Bug: 71375536
Test: manual
Change-Id: Ib5f00b87150a0533880346fac5464b0b1a802c36
(cherry picked from commit c3b026a87d7da17ca5196e1973137b8691e60bde)
|
|\| |
| | |
| | |
| | | |
Change-Id: Ie789845d24eb2e1ee832d31304a070652f776dc5
|
| |\ \
| | | |
| | | |
| | | |
| | | |
| | | | |
3366918, 3365573, 3365589, 3365590, 3366938, 3366902, 3365574, 3365575, 3365576, 3365577, 3366958, 3365824, 3365591, 3366959, 3366960, 3366961, 3366962, 3366963, 3366964, 3366965, 3366919, 3366966, 3366967, 3366968, 3366969, 3366970, 3367018, 3367019, 3365592, 3365593, 3366985, 3365825, 3366988, 3366989, 3366990, 3366991, 3366992, 3366993, 3366994, 3367004, 3367005, 3367006, 3367007, 3367008, 3367009, 3367010, 3367011, 3367012, 3367013, 3367014, 3367015, 3367016, 3367017, 3367038, 3367039, 3367040, 3367041, 3367042, 3367044, 3367045, 3367046, 3367049, 3367050, 3367052, 3367053, 3367054, 3367055, 3367056, 3366920, 3366921, 3366922, 3367079] into oc-mr1-release
Change-Id: I3372a0e26b4e2176c727f3698b35151e7f6cc803
|
| |/ /
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
When ref_pic_list_reordering_flag_l1 is equal to 1, the number of times
that reordering_of_pic_nums_idc is not equal to 3 following
ref_pic_list_reordering_flag_l1 should not exceed
num_ref_idx_l1_active_minus1 + 1.
Bug: 69478425
Change-Id: I031bb744869ac8a57f85bb97574832efd0eefc25
(cherry picked from commit 7ea47d575d26d4d5356670092af26fb6915e75bf)
|
|\| |
| | |
| | |
| | | |
Change-Id: I4a674f713e1852a807543349da7a663932c5c58b
|
| |\ \
| | |/
| |/|
| | |
| | |
| | | |
3278010, 3277767, 3277768, 3277769, 3277770, 3276509, 3276510, 3278011, 3278012, 3278013, 3278014, 3278099, 3278100, 3278101, 3278102, 3278103, 3278104, 3278105, 3278106, 3277800, 3276474, 3278015, 3278016, 3278017, 3278118, 3278119, 3278120, 3278121, 3278122, 3277946, 3277905, 3277947, 3277906, 3277751, 3278123, 3277752, 3278110, 3277771, 3277907, 3278095, 3277908, 3278111, 3277772, 3276475, 3276476] into oc-mr1-release
Change-Id: I26938a88f84d29ba2623432f2b7207a86b2ee93c
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
If memory allocation for dec_hdl fails, return gracefully
with an error code. All other allocation failures are
handled correctly.
Bug: 68300072
Test: ran poc before/after
Change-Id: I118ae71f4aded658441f1932bd4ede3536f5028b
(cherry picked from commit 7720b3fe3de04523da3a9ecec2b42a3748529bbd)
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Added extra structure to read mmco values and copied only once per
picture.
Bug: 65735716
Change-Id: I25b08a37bc78342042c52957774b089abce1a54b
(cherry picked from commit 3c70b9a190875938fc57164d9295a3ec791554df)
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
This prevents heap overflow while parsing sei_message.
Bug: 63122634
Test: ran PoC on unpatched/patched
Change-Id: I61c1ff4ac053a060be8c24da4671db985cac628c
(cherry picked from commit f2b70d353768af8d4ead7f32497be05f197925ef)
|
| |/
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Change in Mbaff flag needs re-initialization of NMB group
and other variables in decoder context.
Bug: 64380237
Test: ran poc on ASAN before/after
Change-Id: I0fc65e4dfc3cc2c15528ec52da1782ecec61feab
(cherry picked from commit d524ba03101c0c662c9d365d7357536b42a0265e)
|
|\|
| |
| |
| | |
Change-Id: Ib4a133d1e43f47b5a892f64b71fc34601c0e3759
|
| |\
| | |
| | |
| | | |
Change-Id: Ib88fca8164e0a459338c57ffb17952ce72772ee0
|
| | |\
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
api." into mnc-dev am: 6a09a35355 -s ours am: b288f51729 -s ours am: 458c4a866c -s ours am: e8235bbcea -s ours am: 23d505806b -s ours am: d570b32872 -s ours am: 82e6cbe7e2 -s ours am: 16aecc3c23 -s ours am: 4a356a0170 -s ours am: 301a5d4bdc -s ours
am: c68f846406 -s ours
Change-Id: I4cba680e65e9c0eb3317c0b03b4a03c9dc4196e1
|
| | | |\
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
api." into mnc-dev am: 6a09a35355 -s ours am: b288f51729 -s ours am: 458c4a866c -s ours am: e8235bbcea -s ours am: 23d505806b -s ours am: d570b32872 -s ours am: 82e6cbe7e2 -s ours am: 16aecc3c23 -s ours am: 4a356a0170 -s ours
am: 301a5d4bdc -s ours
Change-Id: I9cfb90eaf44441ab12098b14c5f050b4f4e10e35
|
| | | | |\
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
api." into mnc-dev am: 6a09a35355 -s ours am: b288f51729 -s ours am: 458c4a866c -s ours am: e8235bbcea -s ours am: 23d505806b -s ours am: d570b32872 -s ours am: 82e6cbe7e2 -s ours am: 16aecc3c23 -s ours
am: 4a356a0170 -s ours
Change-Id: I03e86e7361489a3210ecbeaaff8ddb19da4ae24e
|
| | | | | |\
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | | |
api." into mnc-dev am: 6a09a35355 -s ours am: b288f51729 -s ours am: 458c4a866c -s ours am: e8235bbcea -s ours am: 23d505806b -s ours am: d570b32872 -s ours am: 82e6cbe7e2 -s ours
am: 16aecc3c23 -s ours
Change-Id: I8488f11dc27212fb3ad6cb9f8bab9e64e3b8fd1f
|