From d32eaf4029741b8d2f003f77f69fd57b172d1fe2 Mon Sep 17 00:00:00 2001 From: Harish Mahendrakar Date: Mon, 18 Apr 2016 16:38:54 +0530 Subject: [PATCH] Fix stack buffer overflow in ih264d_process_intra_mb Aligned the sizes of au1_ngbr_pels to ensure SSE42 functions do not result in stack buffer overflow Change-Id: I0bfe493f94647046013759b3ec9db3c627ac471e --- decoder/ih264d_process_intra_mb.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/decoder/ih264d_process_intra_mb.c b/decoder/ih264d_process_intra_mb.c index dde2a7e..2510230 100644 --- a/decoder/ih264d_process_intra_mb.c +++ b/decoder/ih264d_process_intra_mb.c @@ -930,7 +930,9 @@ WORD32 ih264d_process_intra_mb(dec_struct_t * ps_dec, } } { - UWORD8 au1_ngbr_pels[33]; + /* Align the size to multiple of 8, so that SIMD functions + can read 64 bits at a time. Only 33 bytes are actaully used */ + UWORD8 au1_ngbr_pels[40]; /* Get neighbour pixels */ /* left pels */ if(u2_use_left_mb) @@ -1175,7 +1177,9 @@ WORD32 ih264d_process_intra_mb(dec_struct_t * ps_dec, /* Scan the sub-blocks in Raster Scan Order */ for(u1_sub_mb_num = 0; u1_sub_mb_num < 16; u1_sub_mb_num++) { - UWORD8 au1_ngbr_pels[13]; + /* Align the size to multiple of 8, so that SIMD functions + can read 64 bits at a time. Only 13 bytes are actaully used */ + UWORD8 au1_ngbr_pels[16]; u1_sub_blk_x = u1_sub_mb_num & 0x3; u1_sub_blk_y = u1_sub_mb_num >> 2; @@ -1662,7 +1666,9 @@ WORD32 ih264d_process_intra_mb(dec_struct_t * ps_dec, } { - UWORD8 au1_ngbr_pels[25]; + /* Align the size to multiple of 8, so that SIMD functions + can read 64 bits at a time. Only 25 bytes are actaully used */ + UWORD8 au1_ngbr_pels[32]; WORD32 ngbr_avail; ngbr_avail = u1_is_left_sub_block << 0; ngbr_avail |= u1_is_top_sub_block << 2;