wrapper/libavc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix signed integer overflow in prev_max_display_seq

Browse source 
Prev_max_display_seq accumulates max_poc, which results in integer overflow.
Resetting it to zero whenever overflow occurs.

Bug: 73337834
Test: boot
Change-Id: Ia3f6d30f1a6e7fac05d073e30e38ce2ca4e4f52a
This commit is contained in:
Ritu Baldwa 2018-04-10 18:20:17 +05:30 • committed by Ray Essick
parent 0c6629c0ed
commit 49afc8f344
2 changed files with 20 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

10
decoder/ih264d_parse_slice.c
View file

@ -1473,9 +1473,13 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice,
/* IDR Picture or POC wrap around */
if(i4_poc == 0)
{
ps_dec->i4_prev_max_display_seq = ps_dec->i4_prev_max_display_seq
+ ps_dec->i4_max_poc
+ ps_dec->u1_max_dec_frame_buffering + 1;
UWORD64 u8_temp;
u8_temp = (UWORD64)ps_dec->i4_prev_max_display_seq
+ ps_dec->i4_max_poc
+ ps_dec->u1_max_dec_frame_buffering + 1;
/*If i4_prev_max_display_seq overflows integer range, reset it */
ps_dec->i4_prev_max_display_seq = (u8_temp > 0x7fffffff)?
0 : u8_temp;
ps_dec->i4_max_poc = 0;
}
}

21
decoder/ih264d_utils.c
View file

@ -1264,6 +1264,7 @@ void ih264d_release_display_bufs(dec_struct_t *ps_dec)
WORD32 i4_min_poc;
WORD32 i4_min_poc_buf_id;
WORD32 i4_min_index;
UWORD64 u8_temp;
dpb_manager_t *ps_dpb_mgr = ps_dec->ps_dpb_mgr;
WORD32 (*i4_poc_buf_id_map)[3] = ps_dpb_mgr->ai4_poc_buf_id_map;
@ -1308,9 +1309,11 @@ void ih264d_release_display_bufs(dec_struct_t *ps_dec)
}
}
ps_dpb_mgr->i1_poc_buf_id_entries = 0;
ps_dec->i4_prev_max_display_seq = ps_dec->i4_prev_max_display_seq
+ ps_dec->i4_max_poc + ps_dec->u1_max_dec_frame_buffering
+ 1;
u8_temp = (UWORD64)ps_dec->i4_prev_max_display_seq + ps_dec->i4_max_poc
+ ps_dec->u1_max_dec_frame_buffering + 1;
/*If i4_prev_max_display_seq overflows integer range, reset it */
ps_dec->i4_prev_max_display_seq = (u8_temp > 0x7fffffff)?
0 : u8_temp;
ps_dec->i4_max_poc = 0;
}
@ -1582,11 +1585,13 @@ WORD32 ih264d_decode_gaps_in_frame_num(dec_struct_t *ps_dec,
/* IDR Picture or POC wrap around */
if(i4_poc == 0)
{
ps_dec->i4_prev_max_display_seq =
ps_dec->i4_prev_max_display_seq
+ ps_dec->i4_max_poc
+ ps_dec->u1_max_dec_frame_buffering
+ 1;
UWORD64 u8_temp;
u8_temp = (UWORD64)ps_dec->i4_prev_max_display_seq
+ ps_dec->i4_max_poc
+ ps_dec->u1_max_dec_frame_buffering + 1;
/*If i4_prev_max_display_seq overflows integer range, reset it */
ps_dec->i4_prev_max_display_seq = (u8_temp > 0x7fffffff)?
0 : u8_temp;
ps_dec->i4_max_poc = 0;
}