diff options
| author | Naveen Kumar P <naveenkumar.p@ittiam.com> | 2017-04-05 15:46:49 +0530 |
|---|---|---|
| committer | MSe <mse1969@posteo.de> | 2017-07-06 23:54:12 +0200 |
| commit | da51727b114b0fec6fb5fe0a0d3dde06420878d1 (patch) | |
| tree | 416ce914417781215b62ab091fcde7853ea893a4 /decoder | |
| parent | 60615b72a0c5ec729aeb99f637d90e119a9dc7b0 (diff) | |
| download | android_external_libhevc-da51727b114b0fec6fb5fe0a0d3dde06420878d1.tar.gz android_external_libhevc-da51727b114b0fec6fb5fe0a0d3dde06420878d1.tar.bz2 android_external_libhevc-da51727b114b0fec6fb5fe0a0d3dde06420878d1.zip | |
Fix reallocation for new sps
This works for mnc-dr-dev and later.
Bug: 34779227
Test: re-ran POC before/after patch to verify behavior
AOSP-Change-Id: Ida0bf6bcc236494c3c89b228039501e287839fbe
(cherry picked from commit 99df61bb9a89cdd123d4f515c44238b48d62642a)
CVE-2017-0675
Change-Id: I4d0b147b6a8c30ac80174adfd2e950a3fb7e2285
Diffstat (limited to 'decoder')
| -rw-r--r-- | decoder/ihevcd_parse_headers.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c index 6d85601..2f03959 100644 --- a/decoder/ihevcd_parse_headers.c +++ b/decoder/ihevcd_parse_headers.c @@ -1337,12 +1337,16 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) /* Check if sps_max_dec_pic_buffering or sps_max_num_reorder_pics has changed */ - if(0 != ps_codec->i4_first_pic_done) + if(0 != ps_codec->u4_allocate_dynamic_done) { sps_t *ps_sps_old = ps_codec->s_parse.ps_sps; if(ps_sps_old->ai1_sps_max_dec_pic_buffering[ps_sps_old->i1_sps_max_sub_layers - 1] != ps_sps->ai1_sps_max_dec_pic_buffering[ps_sps->i1_sps_max_sub_layers - 1]) { + if(0 == ps_codec->i4_first_pic_done) + { + return IHEVCD_INVALID_PARAMETER; + } ps_codec->i4_reset_flag = 1; return (IHEVCD_ERROR_T)IVD_RES_CHANGED; } @@ -1350,6 +1354,10 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) if(ps_sps_old->ai1_sps_max_num_reorder_pics[ps_sps_old->i1_sps_max_sub_layers - 1] != ps_sps->ai1_sps_max_num_reorder_pics[ps_sps->i1_sps_max_sub_layers - 1]) { + if(0 == ps_codec->i4_first_pic_done) + { + return IHEVCD_INVALID_PARAMETER; + } ps_codec->i4_reset_flag = 1; return (IHEVCD_ERROR_T)IVD_RES_CHANGED; } @@ -1520,10 +1528,14 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) ps_sps->i2_pic_ht_in_min_cb = numerator / (1 << ps_sps->i1_log2_min_coding_block_size); } - if((0 != ps_codec->i4_first_pic_done) && + if((0 != ps_codec->u4_allocate_dynamic_done) && ((ps_codec->i4_wd != ps_sps->i2_pic_width_in_luma_samples) || (ps_codec->i4_ht != ps_sps->i2_pic_height_in_luma_samples))) { + if(0 == ps_codec->i4_first_pic_done) + { + return IHEVCD_INVALID_PARAMETER; + } ps_codec->i4_reset_flag = 1; return (IHEVCD_ERROR_T)IVD_RES_CHANGED; } |