From 3692aceb1b244be3e1b36d8e7b804986f593bb69 Mon Sep 17 00:00:00 2001
From: Ritu Baldwa <ritu.baldwa@ittiam.com>
Date: Fri, 22 Dec 2017 14:20:20 +0530
Subject: [PATCH] Decoder: Adding Error Check for Output Buffer Size in Shared
 Display Mode.

The output buffer size given by the application, needs to be checked
in every process call. This is required in the case of resolution
change in shared display mode.

Bug: 70294343
Bug: 70350193
Bug: 70526411
Bug: 70526485
Test: manual
Change-Id: I2c1e59425e84ac62a874e5ee180e1b98f0a4058f
---
 decoder/ih264d_api.c | 65 ++++++++++++++++++++++++++++++++++++++------
 1 file changed, 57 insertions(+), 8 deletions(-)

diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c
index deeb41c..50e0f8f 100644
--- a/decoder/ih264d_api.c
+++ b/decoder/ih264d_api.c
@@ -2632,8 +2632,8 @@ WORD32 check_app_out_buf_size(dec_struct_t *ps_dec)
     }
     else
     {
-        /* In case of shared mode, do not check validity of ps_dec->ps_out_buffer */
-        return (IV_SUCCESS);
+        pic_wd = ps_dec->u2_frm_wd_y;
+        pic_ht = ps_dec->u2_frm_ht_y;
     }
 
     if(ps_dec->u4_app_disp_width > pic_wd)
@@ -2643,14 +2643,34 @@ WORD32 check_app_out_buf_size(dec_struct_t *ps_dec)
                                                  ps_dec->u1_chroma_format,
                                                  &au4_min_out_buf_size[0]);
 
-    if(ps_dec->ps_out_buffer->u4_num_bufs < u4_min_num_out_bufs)
-        return IV_FAIL;
 
-    for(i = 0; i < u4_min_num_out_bufs; i++)
+    if(0 == ps_dec->u4_share_disp_buf)
     {
-        if(ps_dec->ps_out_buffer->u4_min_out_buf_size[i]
-                        < au4_min_out_buf_size[i])
-            return (IV_FAIL);
+        if(ps_dec->ps_out_buffer->u4_num_bufs < u4_min_num_out_bufs)
+            return IV_FAIL;
+
+        for(i = 0; i < u4_min_num_out_bufs; i++)
+        {
+            if(ps_dec->ps_out_buffer->u4_min_out_buf_size[i]
+                            < au4_min_out_buf_size[i])
+                return (IV_FAIL);
+        }
+    }
+    else
+    {
+        if(ps_dec->disp_bufs[0].u4_num_bufs < u4_min_num_out_bufs)
+            return IV_FAIL;
+
+        for(i = 0; i < u4_min_num_out_bufs; i++)
+        {
+            /* We need to check only with the disp_buffer[0], because we have
+             * already ensured that all the buffers are of the same size in
+             * ih264d_set_display_frame.
+             */
+            if(ps_dec->disp_bufs[0].u4_bufsize[i] < au4_min_out_buf_size[i])
+                return (IV_FAIL);
+        }
+
     }
 
     return (IV_SUCCESS);
@@ -3596,6 +3616,7 @@ WORD32 ih264d_set_display_frame(iv_obj_t *dec_hdl,
                                 void *pv_api_op)
 {
 
+    UWORD32 u4_disp_buf_size[3], u4_num_disp_bufs;
     ivd_set_display_frame_ip_t *dec_disp_ip;
     ivd_set_display_frame_op_t *dec_disp_op;
 
@@ -3667,8 +3688,36 @@ WORD32 ih264d_set_display_frame(iv_obj_t *dec_hdl,
         u4_num_bufs = MIN(u4_num_bufs, num_mvbank_req);
 
         ps_dec->u4_num_disp_bufs = u4_num_bufs;
+
+        /* Get the number and sizes of the first buffer. Compare this with the
+         * rest to make sure all the buffers are of the same size.
+         */
+        u4_num_disp_bufs = dec_disp_ip->s_disp_buffer[0].u4_num_bufs;
+
+        u4_disp_buf_size[0] =
+          dec_disp_ip->s_disp_buffer[0].u4_min_out_buf_size[0];
+        u4_disp_buf_size[1] =
+          dec_disp_ip->s_disp_buffer[0].u4_min_out_buf_size[1];
+        u4_disp_buf_size[2] =
+          dec_disp_ip->s_disp_buffer[0].u4_min_out_buf_size[2];
+
         for(i = 0; i < u4_num_bufs; i++)
         {
+            if(dec_disp_ip->s_disp_buffer[i].u4_num_bufs != u4_num_disp_bufs)
+            {
+                return IV_FAIL;
+            }
+
+            if((dec_disp_ip->s_disp_buffer[i].u4_min_out_buf_size[0]
+                != u4_disp_buf_size[0])
+                || (dec_disp_ip->s_disp_buffer[i].u4_min_out_buf_size[1]
+                    != u4_disp_buf_size[1])
+                || (dec_disp_ip->s_disp_buffer[i].u4_min_out_buf_size[2]
+                    != u4_disp_buf_size[2]))
+            {
+                return IV_FAIL;
+            }
+
             ps_dec->disp_bufs[i].u4_num_bufs =
                             dec_disp_ip->s_disp_buffer[i].u4_num_bufs;