wrapper/libavc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "decoder: fix integer overflow when setting i4_prev_max_display_seq"

Browse source
This commit is contained in:
Ray Essick 2020-07-29 21:29:42 +00:00 • committed by Gerrit Code Review
commit 2c7af2702b
2 changed files with 16 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

12
decoder/ih264d_parse_slice.c
View file

@ -826,8 +826,8 @@ WORD32 ih264d_end_of_pic_dispbuf_mgr(dec_struct_t * ps_dec)
ps_cur_pic->u2_crop_offset_uv = ps_dec->u2_crop_offset_uv; ps_cur_pic->u2_crop_offset_uv = ps_dec->u2_crop_offset_uv;
ps_cur_pic->u1_pic_type = 0; ps_cur_pic->u1_pic_type = 0;
{ {
UWORD64 i8_display_poc; WORD64 i8_display_poc;
i8_display_poc = (UWORD64)ps_dec->i4_prev_max_display_seq + i8_display_poc = (WORD64)ps_dec->i4_prev_max_display_seq +
ps_dec->ps_cur_pic->i4_poc; ps_dec->ps_cur_pic->i4_poc;
if(IS_OUT_OF_RANGE_S32(i8_display_poc)) if(IS_OUT_OF_RANGE_S32(i8_display_poc))
{ {
@ -1495,13 +1495,13 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice,
/* IDR Picture or POC wrap around */ /* IDR Picture or POC wrap around */
if(i4_poc == 0) if(i4_poc == 0)
{ {
UWORD64 u8_temp; WORD64 i8_temp;
u8_temp = (UWORD64)ps_dec->i4_prev_max_display_seq i8_temp = (WORD64)ps_dec->i4_prev_max_display_seq
+ ps_dec->i4_max_poc + ps_dec->i4_max_poc
+ ps_dec->u1_max_dec_frame_buffering + 1; + ps_dec->u1_max_dec_frame_buffering + 1;
/*If i4_prev_max_display_seq overflows integer range, reset it */ /*If i4_prev_max_display_seq overflows integer range, reset it */
ps_dec->i4_prev_max_display_seq = (u8_temp > 0x7fffffff)? ps_dec->i4_prev_max_display_seq = IS_OUT_OF_RANGE_S32(i8_temp)?
0 : u8_temp; 0 : i8_temp;
ps_dec->i4_max_poc = 0; ps_dec->i4_max_poc = 0;
} }
} }

20
decoder/ih264d_utils.c
View file

@ -1301,7 +1301,7 @@ void ih264d_release_display_bufs(dec_struct_t *ps_dec)
WORD32 i4_min_poc; WORD32 i4_min_poc;
WORD32 i4_min_poc_buf_id; WORD32 i4_min_poc_buf_id;
WORD32 i4_min_index; WORD32 i4_min_index;
UWORD64 u8_temp; WORD64 i8_temp;
dpb_manager_t *ps_dpb_mgr = ps_dec->ps_dpb_mgr; dpb_manager_t *ps_dpb_mgr = ps_dec->ps_dpb_mgr;
WORD32 (*i4_poc_buf_id_map)[3] = ps_dpb_mgr->ai4_poc_buf_id_map; WORD32 (*i4_poc_buf_id_map)[3] = ps_dpb_mgr->ai4_poc_buf_id_map;
@ -1348,11 +1348,11 @@ void ih264d_release_display_bufs(dec_struct_t *ps_dec)
} }
} }
ps_dpb_mgr->i1_poc_buf_id_entries = 0; ps_dpb_mgr->i1_poc_buf_id_entries = 0;
u8_temp = (UWORD64)ps_dec->i4_prev_max_display_seq + ps_dec->i4_max_poc i8_temp = (WORD64)ps_dec->i4_prev_max_display_seq + ps_dec->i4_max_poc
+ ps_dec->u1_max_dec_frame_buffering + 1; + ps_dec->u1_max_dec_frame_buffering + 1;
/*If i4_prev_max_display_seq overflows integer range, reset it */ /*If i4_prev_max_display_seq overflows integer range, reset it */
ps_dec->i4_prev_max_display_seq = (u8_temp > 0x7fffffff)? ps_dec->i4_prev_max_display_seq = IS_OUT_OF_RANGE_S32(i8_temp)?
0 : u8_temp; 0 : i8_temp;
ps_dec->i4_max_poc = 0; ps_dec->i4_max_poc = 0;
} }
@ -1624,13 +1624,13 @@ WORD32 ih264d_decode_gaps_in_frame_num(dec_struct_t *ps_dec,
/* IDR Picture or POC wrap around */ /* IDR Picture or POC wrap around */
if(i4_poc == 0) if(i4_poc == 0)
{ {
UWORD64 u8_temp; WORD64 i8_temp;
u8_temp = (UWORD64)ps_dec->i4_prev_max_display_seq i8_temp = (WORD64)ps_dec->i4_prev_max_display_seq
+ ps_dec->i4_max_poc + ps_dec->i4_max_poc
+ ps_dec->u1_max_dec_frame_buffering + 1; + ps_dec->u1_max_dec_frame_buffering + 1;
/*If i4_prev_max_display_seq overflows integer range, reset it */ /*If i4_prev_max_display_seq overflows integer range, reset it */
ps_dec->i4_prev_max_display_seq = (u8_temp > 0x7fffffff)? ps_dec->i4_prev_max_display_seq = IS_OUT_OF_RANGE_S32(i8_temp)?
0 : u8_temp; 0 : i8_temp;
ps_dec->i4_max_poc = 0; ps_dec->i4_max_poc = 0;
} }
@ -1648,8 +1648,8 @@ WORD32 ih264d_decode_gaps_in_frame_num(dec_struct_t *ps_dec,
} }
{ {
UWORD64 i8_display_poc; WORD64 i8_display_poc;
i8_display_poc = (UWORD64)ps_dec->i4_prev_max_display_seq + i8_display_poc = (WORD64)ps_dec->i4_prev_max_display_seq +
i4_poc; i4_poc;
if(IS_OUT_OF_RANGE_S32(i8_display_poc)) if(IS_OUT_OF_RANGE_S32(i8_display_poc))
{ {