From 01da7b5a52a76aee615b4e32eeceb4887d3662f0 Mon Sep 17 00:00:00 2001 From: Harish Mahendrakar Date: Tue, 22 Oct 2019 16:01:37 -0700 Subject: [PATCH 1/2] decoder: Move initialization of dbp_mgr entries to init_decoder() Earlier these were only initialized during static buffer allocations. Initializing them in init_decoder() will ensure that these get initialized to default values during reset() as well. Without this, in some error cases, there is a possibility of heap-use-after free, when resolution changes and these pointers point to memory that is freed Bug: 142602711 Test: poc in bug Change-Id: Ie39fee0eca56bf32cdc558099bf167d05eb89620 --- decoder/ih264d_api.c | 47 ++++++++++++++++++++++---------------------- 1 file changed, 24 insertions(+), 23 deletions(-) diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c index c6999a6..2ebf386 100644 --- a/decoder/ih264d_api.c +++ b/decoder/ih264d_api.c @@ -963,6 +963,30 @@ void ih264d_init_decoder(void * ps_dec_params) /* Free any dynamic buffers that are allocated */ ih264d_free_dynamic_bufs(ps_dec); + { + UWORD8 i; + struct pic_buffer_t *ps_init_dpb; + ps_init_dpb = ps_dec->ps_dpb_mgr->ps_init_dpb[0][0]; + for(i = 0; i < 2 * MAX_REF_BUFS; i++) + { + ps_init_dpb->pu1_buf1 = NULL; + ps_init_dpb->u1_long_term_frm_idx = MAX_REF_BUFS + 1; + ps_dec->ps_dpb_mgr->ps_init_dpb[0][i] = ps_init_dpb; + ps_dec->ps_dpb_mgr->ps_mod_dpb[0][i] = ps_init_dpb; + ps_init_dpb++; + } + + ps_init_dpb = ps_dec->ps_dpb_mgr->ps_init_dpb[1][0]; + for(i = 0; i < 2 * MAX_REF_BUFS; i++) + { + ps_init_dpb->pu1_buf1 = NULL; + ps_init_dpb->u1_long_term_frm_idx = MAX_REF_BUFS + 1; + ps_dec->ps_dpb_mgr->ps_init_dpb[1][i] = ps_init_dpb; + ps_dec->ps_dpb_mgr->ps_mod_dpb[1][i] = ps_init_dpb; + ps_init_dpb++; + } + } + ps_cur_slice = ps_dec->ps_cur_slice; ps_dec->init_done = 0; @@ -1439,29 +1463,6 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv ps_dec->ps_col_mv_base = pv_buf; memset(ps_dec->ps_col_mv_base, 0, size); - { - UWORD8 i; - struct pic_buffer_t *ps_init_dpb; - ps_init_dpb = ps_dec->ps_dpb_mgr->ps_init_dpb[0][0]; - for(i = 0; i < 2 * MAX_REF_BUFS; i++) - { - ps_init_dpb->pu1_buf1 = NULL; - ps_init_dpb->u1_long_term_frm_idx = MAX_REF_BUFS + 1; - ps_dec->ps_dpb_mgr->ps_init_dpb[0][i] = ps_init_dpb; - ps_dec->ps_dpb_mgr->ps_mod_dpb[0][i] = ps_init_dpb; - ps_init_dpb++; - } - - ps_init_dpb = ps_dec->ps_dpb_mgr->ps_init_dpb[1][0]; - for(i = 0; i < 2 * MAX_REF_BUFS; i++) - { - ps_init_dpb->pu1_buf1 = NULL; - ps_init_dpb->u1_long_term_frm_idx = MAX_REF_BUFS + 1; - ps_dec->ps_dpb_mgr->ps_init_dpb[1][i] = ps_init_dpb; - ps_dec->ps_dpb_mgr->ps_mod_dpb[1][i] = ps_init_dpb; - ps_init_dpb++; - } - } ih264d_init_decoder(ps_dec); return IV_SUCCESS; From ffcf2a87d66f935210ebd011eed474514d086b40 Mon Sep 17 00:00:00 2001 From: Harish Mahendrakar Date: Tue, 17 Dec 2019 15:42:03 -0800 Subject: [PATCH 2/2] decoder: Fix minimum poc calculation check while adding to display While adding the decoded buffer to display queue, allow buffer with poc set to 0x7FFFFFFF Bug: 145364230 Test: poc in bug Change-Id: I2a15f73b8422cfa4fd3360bc21c0cea4542a3375 --- decoder/ih264d_utils.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/decoder/ih264d_utils.c b/decoder/ih264d_utils.c index 9958f9b..4bcedd7 100644 --- a/decoder/ih264d_utils.c +++ b/decoder/ih264d_utils.c @@ -1227,7 +1227,9 @@ WORD32 ih264d_assign_display_seq(dec_struct_t *ps_dec) && (DO_NOT_DISP != ps_dpb_mgr->ai4_poc_buf_id_map[i][0])) { - if(i4_poc_buf_id_map[i][1] < i4_min_poc) + /* Checking for <= is necessary to handle cases where there is one + valid buffer with poc set to 0x7FFFFFFF. */ + if(i4_poc_buf_id_map[i][1] <= i4_min_poc) { i4_min_poc = i4_poc_buf_id_map[i][1]; i4_min_poc_buf_id = i4_poc_buf_id_map[i][0]; @@ -1290,8 +1292,8 @@ void ih264d_release_display_bufs(dec_struct_t *ps_dec) WORD32 (*i4_poc_buf_id_map)[3] = ps_dpb_mgr->ai4_poc_buf_id_map; i4_min_poc = 0x7fffffff; - i4_min_poc_buf_id = -1; - i4_min_index = -1; + i4_min_poc_buf_id = 0; + i4_min_index = 0; ih264d_delete_nonref_nondisplay_pics(ps_dpb_mgr); @@ -1302,7 +1304,9 @@ void ih264d_release_display_bufs(dec_struct_t *ps_dec) { if(i4_poc_buf_id_map[i][0] != -1) { - if(i4_poc_buf_id_map[i][1] < i4_min_poc) + /* Checking for <= is necessary to handle cases where there is one + valid buffer with poc set to 0x7FFFFFFF. */ + if(i4_poc_buf_id_map[i][1] <= i4_min_poc) { i4_min_poc = i4_poc_buf_id_map[i][1]; i4_min_poc_buf_id = i4_poc_buf_id_map[i][0];