From 3c70b9a190875938fc57164d9295a3ec791554df Mon Sep 17 00:00:00 2001 From: Ritu Baldwa Date: Mon, 9 Oct 2017 13:52:45 +0530 Subject: [PATCH 01/15] Decoder: Fixed incorrect use of mmco parameters. Added extra structure to read mmco values and copied only once per picture. Bug: 65735716 Change-Id: I25b08a37bc78342042c52957774b089abce1a54b --- decoder/ih264d_dpb_mgr.c | 2 +- decoder/ih264d_parse_slice.c | 9 +++++++++ decoder/ih264d_structs.h | 1 + 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/decoder/ih264d_dpb_mgr.c b/decoder/ih264d_dpb_mgr.c index 0a61ffd..998e97a 100644 --- a/decoder/ih264d_dpb_mgr.c +++ b/decoder/ih264d_dpb_mgr.c @@ -842,7 +842,7 @@ WORD32 ih264d_ref_idx_reordering(dec_struct_t *ps_dec, UWORD8 uc_lx) WORD32 ih264d_read_mmco_commands(struct _DecStruct * ps_dec) { dec_bit_stream_t *ps_bitstrm = ps_dec->ps_bitstrm; - dpb_commands_t *ps_dpb_cmds = ps_dec->ps_dpb_cmds; + dpb_commands_t *ps_dpb_cmds = &(ps_dec->s_dpb_cmds_scratch); dec_slice_params_t * ps_slice = ps_dec->ps_cur_slice; WORD32 j; UWORD8 u1_buf_mode; diff --git a/decoder/ih264d_parse_slice.c b/decoder/ih264d_parse_slice.c index 6b3cb65..e100ceb 100644 --- a/decoder/ih264d_parse_slice.c +++ b/decoder/ih264d_parse_slice.c @@ -1865,6 +1865,15 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice, if(ret != OK) return ret; + if(u1_nal_ref_idc != 0) + { + if(!ps_dec->ps_dpb_cmds->u1_dpb_commands_read) + { + memcpy((void *)ps_dec->ps_dpb_cmds, (void *)(&(ps_dec->s_dpb_cmds_scratch)), + sizeof(dpb_commands_t)); + } + } + /* storing last Mb X and MbY of the slice */ ps_dec->i2_prev_slice_mbx = ps_dec->u2_mbx; ps_dec->i2_prev_slice_mby = ps_dec->u2_mby; diff --git a/decoder/ih264d_structs.h b/decoder/ih264d_structs.h index de87d4c..ef77aa3 100644 --- a/decoder/ih264d_structs.h +++ b/decoder/ih264d_structs.h @@ -987,6 +987,7 @@ typedef struct _DecStruct /* Variables for Decode Buffer Management */ dpb_manager_t *ps_dpb_mgr; dpb_commands_t *ps_dpb_cmds; + dpb_commands_t s_dpb_cmds_scratch; /* Variables Required for N MB design */ dec_mb_info_t *ps_nmb_info; From f2b70d353768af8d4ead7f32497be05f197925ef Mon Sep 17 00:00:00 2001 From: Hamsalekha S Date: Tue, 4 Jul 2017 17:06:50 +0530 Subject: [PATCH 02/15] Decoder: Increased allocation and added checks in sei parsing. This prevents heap overflow while parsing sei_message. Bug: 63122634 Test: ran PoC on unpatched/patched Change-Id: I61c1ff4ac053a060be8c24da4671db985cac628c --- decoder/ih264d_api.c | 3 ++- decoder/ih264d_defs.h | 3 +++ decoder/ih264d_sei.c | 7 ++++--- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c index f4d641f..56945a2 100644 --- a/decoder/ih264d_api.c +++ b/decoder/ih264d_api.c @@ -2011,7 +2011,8 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op) void *pv_buf; void *pv_mem_ctxt = ps_dec->pv_mem_ctxt; size = MAX(256000, ps_dec->u2_pic_wd * ps_dec->u2_pic_ht * 3 / 2); - pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size); + pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, + size + EXTRA_BS_OFFSET); RETURN_IF((NULL == pv_buf), IV_FAIL); ps_dec->pu1_bits_buf_dynamic = pv_buf; ps_dec->u4_dynamic_bits_buf_size = size; diff --git a/decoder/ih264d_defs.h b/decoder/ih264d_defs.h index 0682339..d6e3029 100644 --- a/decoder/ih264d_defs.h +++ b/decoder/ih264d_defs.h @@ -107,6 +107,9 @@ /* For 420SP */ #define YUV420SP_FACTOR 2 +/*To prevent buffer overflow access; in case the size of nal unit is + * greater than the allocated buffer size*/ +#define EXTRA_BS_OFFSET 16*16*2 /** *************************************************************************** diff --git a/decoder/ih264d_sei.c b/decoder/ih264d_sei.c index 800f2c9..098a1f3 100644 --- a/decoder/ih264d_sei.c +++ b/decoder/ih264d_sei.c @@ -336,7 +336,7 @@ WORD32 ih264d_parse_sei_message(dec_struct_t *ps_dec, ui4_payload_type = 0; u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8); - while(0xff == u4_bits) + while(0xff == u4_bits && !EXCEED_OFFSET(ps_bitstrm)) { u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8); ui4_payload_type += 255; @@ -345,7 +345,7 @@ WORD32 ih264d_parse_sei_message(dec_struct_t *ps_dec, ui4_payload_size = 0; u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8); - while(0xff == u4_bits) + while(0xff == u4_bits && !EXCEED_OFFSET(ps_bitstrm)) { u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8); ui4_payload_size += 255; @@ -370,7 +370,8 @@ WORD32 ih264d_parse_sei_message(dec_struct_t *ps_dec, { H264_DEC_DEBUG_PRINT("\nError in parsing SEI message"); } - while(0 == ih264d_check_byte_aligned(ps_bitstrm)) + while(0 == ih264d_check_byte_aligned(ps_bitstrm) + && !EXCEED_OFFSET(ps_bitstrm)) { u4_bits = ih264d_get_bit_h264(ps_bitstrm); if(u4_bits) From 27e6efc8ec6591f2759d7762d60a19378aec9681 Mon Sep 17 00:00:00 2001 From: Ray Essick Date: Tue, 17 Oct 2017 15:09:06 -0700 Subject: [PATCH 03/15] DO NOT MERGE Decoder: Increased allocation and added checks in sei parsing. This prevents heap overflow while parsing sei_message. Bug: 63122634 Test: ran PoC on unpatched/patched Change-Id: I4785927b68cb17a3ca51e23aeaf96aacacf116d3 Merged-In: I61c1ff4ac053a060be8c24da4671db985cac628c --- decoder/ih264d_api.c | 8 ++++++-- decoder/ih264d_defs.h | 3 +++ decoder/ih264d_sei.c | 7 ++++--- 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c index 18de06e..deeb41c 100644 --- a/decoder/ih264d_api.c +++ b/decoder/ih264d_api.c @@ -2290,7 +2290,9 @@ WORD32 ih264d_fill_num_mem_rec(void *pv_api_ip, void *pv_api_op) memTab[MEM_REC_BITSBUF].u4_mem_alignment = (128 * 8) / CHAR_BIT; memTab[MEM_REC_BITSBUF].e_mem_type = IV_EXTERNAL_CACHEABLE_PERSISTENT_MEM; - memTab[MEM_REC_BITSBUF].u4_mem_size = MAX(256000, (luma_width * luma_height * 3 / 2)); + memTab[MEM_REC_BITSBUF].u4_mem_size = MAX( + 256000, + (luma_width * luma_height * 3 / 2)) + EXTRA_BS_OFFSET; { @@ -2994,7 +2996,9 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op) /* Ignore bytes beyond the allocated size of intermediate buffer */ /* Since 8 bytes are read ahead, ensure 8 bytes are free at the end of the buffer, which will be memset to 0 after emulation prevention */ - buflen = MIN(buflen, (WORD32)(ps_dec->ps_mem_tab[MEM_REC_BITSBUF].u4_mem_size - 8)); + buflen = MIN(buflen, + (WORD32)(ps_dec->ps_mem_tab[MEM_REC_BITSBUF].u4_mem_size + - 8 - EXTRA_BS_OFFSET)); bytes_consumed = buflen + u4_length_of_start_code; ps_dec_op->u4_num_bytes_consumed += bytes_consumed; diff --git a/decoder/ih264d_defs.h b/decoder/ih264d_defs.h index 6826baa..64b834a 100644 --- a/decoder/ih264d_defs.h +++ b/decoder/ih264d_defs.h @@ -107,6 +107,9 @@ /* For 420SP */ #define YUV420SP_FACTOR 2 +/*To prevent buffer overflow access; in case the size of nal unit is + * greater than the allocated buffer size*/ +#define EXTRA_BS_OFFSET 16*16*2 /** *************************************************************************** diff --git a/decoder/ih264d_sei.c b/decoder/ih264d_sei.c index 800f2c9..098a1f3 100644 --- a/decoder/ih264d_sei.c +++ b/decoder/ih264d_sei.c @@ -336,7 +336,7 @@ WORD32 ih264d_parse_sei_message(dec_struct_t *ps_dec, ui4_payload_type = 0; u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8); - while(0xff == u4_bits) + while(0xff == u4_bits && !EXCEED_OFFSET(ps_bitstrm)) { u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8); ui4_payload_type += 255; @@ -345,7 +345,7 @@ WORD32 ih264d_parse_sei_message(dec_struct_t *ps_dec, ui4_payload_size = 0; u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8); - while(0xff == u4_bits) + while(0xff == u4_bits && !EXCEED_OFFSET(ps_bitstrm)) { u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8); ui4_payload_size += 255; @@ -370,7 +370,8 @@ WORD32 ih264d_parse_sei_message(dec_struct_t *ps_dec, { H264_DEC_DEBUG_PRINT("\nError in parsing SEI message"); } - while(0 == ih264d_check_byte_aligned(ps_bitstrm)) + while(0 == ih264d_check_byte_aligned(ps_bitstrm) + && !EXCEED_OFFSET(ps_bitstrm)) { u4_bits = ih264d_get_bit_h264(ps_bitstrm); if(u4_bits) From d524ba03101c0c662c9d365d7357536b42a0265e Mon Sep 17 00:00:00 2001 From: Hamsalekha S Date: Wed, 9 Aug 2017 13:41:39 +0530 Subject: [PATCH 04/15] Decoder: Detect change of mbaff flag in SPS Change in Mbaff flag needs re-initialization of NMB group and other variables in decoder context. Bug: 64380237 Test: ran poc on ASAN before/after Change-Id: I0fc65e4dfc3cc2c15528ec52da1782ecec61feab --- decoder/ih264d_parse_headers.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/decoder/ih264d_parse_headers.c b/decoder/ih264d_parse_headers.c index 1deb01a..48c5ebe 100644 --- a/decoder/ih264d_parse_headers.c +++ b/decoder/ih264d_parse_headers.c @@ -479,7 +479,7 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm) { UWORD8 i; dec_seq_params_t *ps_seq = NULL; - UWORD8 u1_profile_idc, u1_level_idc, u1_seq_parameter_set_id; + UWORD8 u1_profile_idc, u1_level_idc, u1_seq_parameter_set_id, u1_mb_aff_flag = 0; UWORD16 i2_max_frm_num; UWORD32 *pu4_bitstrm_buf = ps_bitstrm->pu4_buffer; UWORD32 *pu4_bitstrm_ofst = &ps_bitstrm->u4_ofst; @@ -802,10 +802,20 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm) COPYTHECONTEXT("SPS: frame_mbs_only_flag", u1_frm); + if(!u1_frm) + u1_mb_aff_flag = ih264d_get_bit_h264(ps_bitstrm); + + if((ps_dec->i4_header_decoded & 1) + && (ps_seq->u1_mb_aff_flag != u1_mb_aff_flag)) + { + ps_dec->u1_res_changed = 1; + return IVD_RES_CHANGED; + } + if(!u1_frm) { u2_pic_ht <<= 1; - ps_seq->u1_mb_aff_flag = ih264d_get_bit_h264(ps_bitstrm); + ps_seq->u1_mb_aff_flag = u1_mb_aff_flag; COPYTHECONTEXT("SPS: mb_adaptive_frame_field_flag", ps_seq->u1_mb_aff_flag); From 7720b3fe3de04523da3a9ecec2b42a3748529bbd Mon Sep 17 00:00:00 2001 From: Harish Mahendrakar Date: Thu, 26 Oct 2017 16:13:50 +0530 Subject: [PATCH 05/15] Decoder: Handle dec_hdl memory allocation failure gracefully If memory allocation for dec_hdl fails, return gracefully with an error code. All other allocation failures are handled correctly. Bug: 68300072 Test: ran poc before/after Change-Id: I118ae71f4aded658441f1932bd4ede3536f5028b --- decoder/ih264d_api.c | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c index f4d641f..b4da4db 100644 --- a/decoder/ih264d_api.c +++ b/decoder/ih264d_api.c @@ -1457,20 +1457,37 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv /*****************************************************************************/ WORD32 ih264d_create(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op) { + ih264d_create_ip_t *ps_create_ip; ih264d_create_op_t *ps_create_op; WORD32 ret; + ps_create_ip = (ih264d_create_ip_t *)pv_api_ip; ps_create_op = (ih264d_create_op_t *)pv_api_op; ps_create_op->s_ivd_create_op_t.u4_error_code = 0; - + dec_hdl = NULL; ret = ih264d_allocate_static_bufs(&dec_hdl, pv_api_ip, pv_api_op); /* If allocation of some buffer fails, then free buffers allocated till then */ - if((IV_FAIL == ret) && (NULL != dec_hdl)) + if(IV_FAIL == ret) { - ih264d_free_static_bufs(dec_hdl); + if(dec_hdl) + { + if(dec_hdl->pv_codec_handle) + { + ih264d_free_static_bufs(dec_hdl); + } + else + { + void (*pf_aligned_free)(void *pv_mem_ctxt, void *pv_buf); + void *pv_mem_ctxt; + + pf_aligned_free = ps_create_ip->s_ivd_create_ip_t.pf_aligned_free; + pv_mem_ctxt = ps_create_ip->s_ivd_create_ip_t.pv_mem_ctxt; + pf_aligned_free(pv_mem_ctxt, dec_hdl); + } + } ps_create_op->s_ivd_create_op_t.u4_error_code = IVD_MEM_ALLOC_FAILED; ps_create_op->s_ivd_create_op_t.u4_error_code = 1 << IVD_FATALERROR; From 7ea47d575d26d4d5356670092af26fb6915e75bf Mon Sep 17 00:00:00 2001 From: Ritu Baldwa Date: Tue, 28 Nov 2017 18:38:18 +0530 Subject: [PATCH 06/15] Decoder: Modified loop condition while parsing ref_list_reordering. When ref_pic_list_reordering_flag_l1 is equal to 1, the number of times that reordering_of_pic_nums_idc is not equal to 3 following ref_pic_list_reordering_flag_l1 should not exceed num_ref_idx_l1_active_minus1 + 1. Bug: 69478425 Change-Id: I031bb744869ac8a57f85bb97574832efd0eefc25 --- decoder/ih264d_dpb_mgr.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/decoder/ih264d_dpb_mgr.c b/decoder/ih264d_dpb_mgr.c index 998e97a..8c6bb19 100644 --- a/decoder/ih264d_dpb_mgr.c +++ b/decoder/ih264d_dpb_mgr.c @@ -721,7 +721,7 @@ WORD32 ih264d_ref_idx_reordering(dec_struct_t *ps_dec, UWORD8 uc_lx) UWORD16 ui_max_frame_num = ps_dec->ps_cur_sps->u2_u4_max_pic_num_minus1 + 1; - WORD32 i; + WORD32 i, count = 0; UWORD32 ui_remapIdc, ui_nextUev; WORD16 u2_pred_frame_num = u4_cur_pic_num; WORD32 i_temp; @@ -742,7 +742,8 @@ WORD32 ih264d_ref_idx_reordering(dec_struct_t *ps_dec, UWORD8 uc_lx) ui_remapIdc = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf); - while(ui_remapIdc != 3) + while((ui_remapIdc != 3) + && (count < ps_cur_slice->u1_num_ref_idx_lx_active[uc_lx])) { ui_nextUev = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf); if(ui_remapIdc != 2) @@ -811,6 +812,7 @@ WORD32 ih264d_ref_idx_reordering(dec_struct_t *ps_dec, UWORD8 uc_lx) ui_remapIdc = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf); /* Get the remapping_idc - 0/1/2/3 */ + count++; } //Handle the ref indices that were not remapped From 3692aceb1b244be3e1b36d8e7b804986f593bb69 Mon Sep 17 00:00:00 2001 From: Ritu Baldwa Date: Fri, 22 Dec 2017 14:20:20 +0530 Subject: [PATCH 07/15] Decoder: Adding Error Check for Output Buffer Size in Shared Display Mode. The output buffer size given by the application, needs to be checked in every process call. This is required in the case of resolution change in shared display mode. Bug: 70294343 Bug: 70350193 Bug: 70526411 Bug: 70526485 Test: manual Change-Id: I2c1e59425e84ac62a874e5ee180e1b98f0a4058f --- decoder/ih264d_api.c | 65 ++++++++++++++++++++++++++++++++++++++------ 1 file changed, 57 insertions(+), 8 deletions(-) diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c index deeb41c..50e0f8f 100644 --- a/decoder/ih264d_api.c +++ b/decoder/ih264d_api.c @@ -2632,8 +2632,8 @@ WORD32 check_app_out_buf_size(dec_struct_t *ps_dec) } else { - /* In case of shared mode, do not check validity of ps_dec->ps_out_buffer */ - return (IV_SUCCESS); + pic_wd = ps_dec->u2_frm_wd_y; + pic_ht = ps_dec->u2_frm_ht_y; } if(ps_dec->u4_app_disp_width > pic_wd) @@ -2643,14 +2643,34 @@ WORD32 check_app_out_buf_size(dec_struct_t *ps_dec) ps_dec->u1_chroma_format, &au4_min_out_buf_size[0]); - if(ps_dec->ps_out_buffer->u4_num_bufs < u4_min_num_out_bufs) - return IV_FAIL; - for(i = 0; i < u4_min_num_out_bufs; i++) + if(0 == ps_dec->u4_share_disp_buf) { - if(ps_dec->ps_out_buffer->u4_min_out_buf_size[i] - < au4_min_out_buf_size[i]) - return (IV_FAIL); + if(ps_dec->ps_out_buffer->u4_num_bufs < u4_min_num_out_bufs) + return IV_FAIL; + + for(i = 0; i < u4_min_num_out_bufs; i++) + { + if(ps_dec->ps_out_buffer->u4_min_out_buf_size[i] + < au4_min_out_buf_size[i]) + return (IV_FAIL); + } + } + else + { + if(ps_dec->disp_bufs[0].u4_num_bufs < u4_min_num_out_bufs) + return IV_FAIL; + + for(i = 0; i < u4_min_num_out_bufs; i++) + { + /* We need to check only with the disp_buffer[0], because we have + * already ensured that all the buffers are of the same size in + * ih264d_set_display_frame. + */ + if(ps_dec->disp_bufs[0].u4_bufsize[i] < au4_min_out_buf_size[i]) + return (IV_FAIL); + } + } return (IV_SUCCESS); @@ -3596,6 +3616,7 @@ WORD32 ih264d_set_display_frame(iv_obj_t *dec_hdl, void *pv_api_op) { + UWORD32 u4_disp_buf_size[3], u4_num_disp_bufs; ivd_set_display_frame_ip_t *dec_disp_ip; ivd_set_display_frame_op_t *dec_disp_op; @@ -3667,8 +3688,36 @@ WORD32 ih264d_set_display_frame(iv_obj_t *dec_hdl, u4_num_bufs = MIN(u4_num_bufs, num_mvbank_req); ps_dec->u4_num_disp_bufs = u4_num_bufs; + + /* Get the number and sizes of the first buffer. Compare this with the + * rest to make sure all the buffers are of the same size. + */ + u4_num_disp_bufs = dec_disp_ip->s_disp_buffer[0].u4_num_bufs; + + u4_disp_buf_size[0] = + dec_disp_ip->s_disp_buffer[0].u4_min_out_buf_size[0]; + u4_disp_buf_size[1] = + dec_disp_ip->s_disp_buffer[0].u4_min_out_buf_size[1]; + u4_disp_buf_size[2] = + dec_disp_ip->s_disp_buffer[0].u4_min_out_buf_size[2]; + for(i = 0; i < u4_num_bufs; i++) { + if(dec_disp_ip->s_disp_buffer[i].u4_num_bufs != u4_num_disp_bufs) + { + return IV_FAIL; + } + + if((dec_disp_ip->s_disp_buffer[i].u4_min_out_buf_size[0] + != u4_disp_buf_size[0]) + || (dec_disp_ip->s_disp_buffer[i].u4_min_out_buf_size[1] + != u4_disp_buf_size[1]) + || (dec_disp_ip->s_disp_buffer[i].u4_min_out_buf_size[2] + != u4_disp_buf_size[2])) + { + return IV_FAIL; + } + ps_dec->disp_bufs[i].u4_num_bufs = dec_disp_ip->s_disp_buffer[i].u4_num_bufs; From c3b026a87d7da17ca5196e1973137b8691e60bde Mon Sep 17 00:00:00 2001 From: Ritu Baldwa Date: Wed, 27 Dec 2017 17:45:30 +0530 Subject: [PATCH 08/15] Decoder: Fixed memory overflow in shared display mode. The factor multiplication should happen only at the source, not at the destination. Bug: 71375536 Test: manual Change-Id: Ib5f00b87150a0533880346fac5464b0b1a802c36 --- decoder/ih264d_utils.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/decoder/ih264d_utils.c b/decoder/ih264d_utils.c index 170bc97..d60db67 100644 --- a/decoder/ih264d_utils.c +++ b/decoder/ih264d_utils.c @@ -1267,12 +1267,15 @@ WORD32 ih264d_get_next_display_field(dec_struct_t * ps_dec, buf = ps_dec->disp_bufs[i].buf[1]; buf += ps_dec->disp_bufs[i].u4_ofst[1]; pv_disp_op->s_disp_frm_buf.pv_u_buf = buf - + pic_buf->u2_crop_offset_uv; + + (pic_buf->u2_crop_offset_uv + / YUV420SP_FACTOR); buf = ps_dec->disp_bufs[i].buf[2]; buf += ps_dec->disp_bufs[i].u4_ofst[2]; pv_disp_op->s_disp_frm_buf.pv_v_buf = buf - + pic_buf->u2_crop_offset_uv; + + (pic_buf->u2_crop_offset_uv + / YUV420SP_FACTOR); + } } } From f160a47765b1d44758c73ba29b0a15a72a398c0f Mon Sep 17 00:00:00 2001 From: Hangyu Kuang Date: Wed, 10 Jan 2018 13:47:32 -0800 Subject: [PATCH 09/15] libavc: Add hkuang to owners. Test: None Bug: None Change-Id: I599648459b2c991d8b169bf0d05d77291cf5e3e9 --- OWNERS | 1 + 1 file changed, 1 insertion(+) diff --git a/OWNERS b/OWNERS index 3da5c7a..acffb3a 100644 --- a/OWNERS +++ b/OWNERS @@ -1,3 +1,4 @@ marcone@google.com essick@google.com lajos@google.com +hkuang@google.com From 9c32ad7126890dfaa79fd29affaaf07de335fa3a Mon Sep 17 00:00:00 2001 From: Ritu Baldwa Date: Tue, 16 Jan 2018 13:41:30 +0530 Subject: [PATCH 10/15] Decoder: Fixed reset values in parse sps. Memset to zero whenever new sps occurs. Bug: 70897394 Test: manual Change-Id: I5936fd55265ff8ad2b275a72b175cdb540bb7933 --- decoder/ih264d_parse_headers.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/decoder/ih264d_parse_headers.c b/decoder/ih264d_parse_headers.c index 48c5ebe..5d461f8 100644 --- a/decoder/ih264d_parse_headers.c +++ b/decoder/ih264d_parse_headers.c @@ -30,6 +30,8 @@ * \author AI ************************************************************************** */ +#include + #include "ih264_typedefs.h" #include "ih264_macros.h" #include "ih264_platform_macros.h" @@ -564,6 +566,8 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm) /*--------------------------------------------------------------------*/ ps_seq = ps_dec->pv_scratch_sps_pps; + memset(ps_seq, 0, sizeof(dec_seq_params_t)); + if(ps_dec->i4_header_decoded & 1) { *ps_seq = *ps_dec->ps_cur_sps; From 83355ea81fd26ddb5e755d88d7391cf6b07e8f0e Mon Sep 17 00:00:00 2001 From: Wonsik Kim Date: Mon, 22 Jan 2018 11:33:09 -0800 Subject: [PATCH 11/15] Blacklist cfi for libavc CFI does not recognize assembly functions as valid indirect call targets. Test: no cfi checks in libavcdec/libavcenc Change-Id: I173eeaad0a908bfd055d21a5c7eec9634ba0ac95 --- Android.bp | 16 ++++++++++++++++ cfi_blacklist.txt | 1 + 2 files changed, 17 insertions(+) create mode 100644 cfi_blacklist.txt diff --git a/Android.bp b/Android.bp index 957e253..4abfa16 100644 --- a/Android.bp +++ b/Android.bp @@ -231,6 +231,14 @@ cc_library_static { ], }, }, + + sanitize: { + cfi: true, + diag: { + cfi: true, + }, + blacklist: "cfi_blacklist.txt", + }, } cc_library_static { @@ -492,6 +500,14 @@ cc_library_static { ], }, }, + + sanitize: { + cfi: true, + diag: { + cfi: true, + }, + blacklist: "cfi_blacklist.txt", + }, } subdirs = ["test"] diff --git a/cfi_blacklist.txt b/cfi_blacklist.txt new file mode 100644 index 0000000..1571e0e --- /dev/null +++ b/cfi_blacklist.txt @@ -0,0 +1 @@ +src:*external/libavc/* From aecdfd1aff2505da11ad48ad4f9f918054ce0c97 Mon Sep 17 00:00:00 2001 From: Ritu Baldwa Date: Tue, 16 Jan 2018 13:48:41 +0530 Subject: [PATCH 12/15] Decoder: Set prev slice type for I slice. Fixed initialization of u1_pr_sl_type for I slice. Bug: 70897454 Test: ran PoC before/after patch Change-Id: I0c37317513b72236be98c2b25482a67bf2b56052 --- decoder/ih264d_parse_slice.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/decoder/ih264d_parse_slice.c b/decoder/ih264d_parse_slice.c index e100ceb..48e6d39 100644 --- a/decoder/ih264d_parse_slice.c +++ b/decoder/ih264d_parse_slice.c @@ -1833,7 +1833,7 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice, ps_dec->ps_cur_pic->u4_pack_slc_typ |= I_SLC_BIT; ret = ih264d_parse_islice(ps_dec, u2_first_mb_in_slice); - + ps_dec->u1_pr_sl_type = u1_slice_type; if(ps_dec->i4_pic_type != B_SLICE && ps_dec->i4_pic_type != P_SLICE) ps_dec->i4_pic_type = I_SLICE; From 9fa58d4db3ef176ed54af5f602970b48624be413 Mon Sep 17 00:00:00 2001 From: Akshata Jadhav Date: Wed, 21 Feb 2018 11:39:52 +0530 Subject: [PATCH 13/15] Encoder: Return error for odd resolution Bug: 73625898 Test: ran POC before/after under ASAN Change-Id: I9765b57f4afc6a2b6ad9cd19c8c7c5000beb9de9 --- encoder/ih264e_api.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/encoder/ih264e_api.c b/encoder/ih264e_api.c index c46134d..ac5f43d 100644 --- a/encoder/ih264e_api.c +++ b/encoder/ih264e_api.c @@ -1147,6 +1147,24 @@ static IV_STATUS_T api_check_struct_sanity(iv_obj_t *ps_handle, return (IV_FAIL); } + if(ps_ip->s_ive_ip.u4_wd & 1) + { + ps_op->s_ive_op.u4_error_code |= 1 + << IVE_UNSUPPORTEDPARAM; + ps_op->s_ive_op.u4_error_code |= + IH264E_WIDTH_NOT_SUPPORTED; + return (IV_FAIL); + } + + if(ps_ip->s_ive_ip.u4_ht & 1) + { + ps_op->s_ive_op.u4_error_code |= 1 + << IVE_UNSUPPORTEDPARAM; + ps_op->s_ive_op.u4_error_code |= + IH264E_HEIGHT_NOT_SUPPORTED; + return (IV_FAIL); + } + break; } From 47cc04b40c94b14841d27eb3ac0b01c3f1739180 Mon Sep 17 00:00:00 2001 From: Ritu Baldwa Date: Fri, 9 Mar 2018 16:39:07 +0530 Subject: [PATCH 14/15] Decoder: Modify setting short term reference field flag Do not mark bottom field as short term in case of error. Bug: 73553038 Bug: 73552574 Bug: 73552999 Test: poc before/after Change-Id: I8576861af36996a361a81f48ba9b251f0ae4e660 --- decoder/ih264d_dpb_mgr.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/decoder/ih264d_dpb_mgr.c b/decoder/ih264d_dpb_mgr.c index 8c6bb19..f9124e4 100644 --- a/decoder/ih264d_dpb_mgr.c +++ b/decoder/ih264d_dpb_mgr.c @@ -374,9 +374,6 @@ WORD32 ih264d_insert_st_node(dpb_manager_t *ps_dpb_mgr, if((ps_dpb_info[i].ps_pic_buf == ps_pic_buf) && ps_dpb_info[i].u1_used_as_ref) { - /* Can occur only for field bottom pictures */ - ps_dpb_info[i].s_bot_field.u1_reference_info = IS_SHORT_TERM; - /*signal an error in the case of frame pic*/ if(ps_dpb_info[i].ps_pic_buf->u1_pic_type == FRM_PIC) { @@ -384,6 +381,8 @@ WORD32 ih264d_insert_st_node(dpb_manager_t *ps_dpb_mgr, } else { + /* Can occur only for field bottom pictures */ + ps_dpb_info[i].s_bot_field.u1_reference_info = IS_SHORT_TERM; return OK; } } From 10c1176f1bb631c8b082634170da8ce2d1144d30 Mon Sep 17 00:00:00 2001 From: Hamsalekha S Date: Tue, 21 Feb 2017 16:01:02 +0530 Subject: [PATCH 15/15] Bug fix for flush without valid frames We now return fail and get out of flush mode to accept bitstream in the next call. Bug: 35585952 Bug: 63521984 Test: test case does not hang Change-Id: Id22cc98d4a47714475a67918990a181a805c4c9f --- decoder/ih264d_api.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c index 50e0f8f..38c1da5 100644 --- a/decoder/ih264d_api.c +++ b/decoder/ih264d_api.c @@ -2915,8 +2915,16 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op) } - if(ps_dec->u1_flushfrm && ps_dec->u1_init_dec_flag) + if(ps_dec->u1_flushfrm) { + if(ps_dec->u1_init_dec_flag == 0) + { + /*Come out of flush mode and return*/ + ps_dec->u1_flushfrm = 0; + return (IV_FAIL); + } + + ih264d_get_next_display_field(ps_dec, ps_dec->ps_out_buffer, &(ps_dec->s_disp_op));