From eb3d11f42f9975359cca672bfb560868a478f12c Mon Sep 17 00:00:00 2001 From: Ashwin Natesan Date: Sat, 13 Aug 2022 12:09:27 +0530 Subject: [PATCH] mvc: Set minimum bitstream buffser size correctly Bug: 242303994 Test: fuzzer poc in bug Change-Id: I7bc7fa05c46d9474db4fa8ee7761cf90fa6d8452 --- decoder/mvc/imvcd_api.c | 2 +- decoder/mvc/imvcd_api_utils.c | 5 +++-- decoder/mvc/imvcd_defs.h | 2 ++ 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/decoder/mvc/imvcd_api.c b/decoder/mvc/imvcd_api.c index 9a0b4e1..ed3161d 100644 --- a/decoder/mvc/imvcd_api.c +++ b/decoder/mvc/imvcd_api.c @@ -242,7 +242,7 @@ static IV_API_CALL_STATUS_T imvcd_view_ctxt_init(imvcd_create_ip_t *ps_ip, memset(pv_buf, 0, i4_mem_size); ps_view_ctxt->pv_scratch_sps_pps = pv_buf; - ps_view_ctxt->u4_static_bits_buf_size = 256000; + ps_view_ctxt->u4_static_bits_buf_size = MIN_BITSTREAMS_BUF_SIZE; pv_buf = pf_aligned_alloc(pv_mem_ctxt, i4_default_alignment, ps_view_ctxt->u4_static_bits_buf_size); RETURN_IF((NULL == pv_buf), IV_FAIL); diff --git a/decoder/mvc/imvcd_api_utils.c b/decoder/mvc/imvcd_api_utils.c index 1f2b269..7d1f309 100644 --- a/decoder/mvc/imvcd_api_utils.c +++ b/decoder/mvc/imvcd_api_utils.c @@ -374,8 +374,9 @@ IV_API_CALL_STATUS_T imvcd_bitstream_buf_alloc(dec_struct_t *ps_view_ctxt, UWORD { UWORD32 u4_size; - u4_size = ((ps_view_ctxt->u2_pic_wd * ps_view_ctxt->u2_pic_ht * 3 / 2) + EXTRA_BS_OFFSET) * - u2_num_views * sizeof(ps_view_ctxt->pu1_bits_buf_dynamic[0]); + u4_size = MAX(MIN_BITSTREAMS_BUF_SIZE, + ((ps_view_ctxt->u2_pic_wd * ps_view_ctxt->u2_pic_ht * 3 / 2) + EXTRA_BS_OFFSET) * + u2_num_views * sizeof(ps_view_ctxt->pu1_bits_buf_dynamic[0])); ps_view_ctxt->pu1_bits_buf_dynamic = ps_view_ctxt->pf_aligned_alloc(ps_view_ctxt->pv_mem_ctxt, 128, u4_size); RETURN_IF((NULL == ps_view_ctxt->pu1_bits_buf_dynamic), IV_FAIL); diff --git a/decoder/mvc/imvcd_defs.h b/decoder/mvc/imvcd_defs.h index aa416bb..2bf5e54 100644 --- a/decoder/mvc/imvcd_defs.h +++ b/decoder/mvc/imvcd_defs.h @@ -34,4 +34,6 @@ is still greater than any possible value of u1_pic_buf_id */ #define IVP_PIC_BUF_ID UINT8_MAX +#define MIN_BITSTREAMS_BUF_SIZE 256000 + #endif