From 1b9810f04c902c70193cd770647b7c7efd471482 Mon Sep 17 00:00:00 2001 From: Hamsalekha S Date: Mon, 8 May 2017 17:11:05 +0530 Subject: Decoder: Fix allocation for Mbaff weight matrix Increased the allocation size for Mbaff weight matrix buffer Bug: 36996978 AOSP-Change-Id: I21cf2cb1010abdc6346f743f5237ae1730c4bf41 (cherry picked from commit 07db35ad5af8c4ee2308f983650d9a1b811841ea) CVE-2017-0679 Change-Id: I1a8e38c839eee9887abf2fd99954237db31b2234 --- decoder/ih264d_api.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c index 1d9c9fe..3432039 100644 --- a/decoder/ih264d_api.c +++ b/decoder/ih264d_api.c @@ -1376,9 +1376,8 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv pu1_buf += size / 2; ps_dec->ps_dpb_mgr->ps_init_dpb[1][0] = (struct pic_buffer_t *)pu1_buf; - size = (sizeof(UWORD32) * 3 - * (MAX_FRAMES * MAX_FRAMES)) - << 3; + size = (sizeof(UWORD32) * 2 * 3 + * ((MAX_FRAMES << 1) * (MAX_FRAMES << 1)) * 2); pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size); RETURN_IF((NULL == pv_buf), IV_FAIL); ps_dec->pu4_mbaff_wt_mat = pv_buf; -- cgit v1.2.3