wrapper/libavc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix stack buffer overflow in ih264d_process_intra_mb am: f69e34419b am: cbaa0dc3f9 am: 943e36e510 am: 6a897f0c3a am: b308dc1318

Browse source 
am: 70d50b4389

Change-Id: Ie29e83676db204e23b29701b3d02c0f0c7c4dd01
This commit is contained in:
Harish Mahendrakar 2017-05-10 16:59:41 +00:00 • committed by android-build-merger
commit 7364b4bcfc
1 changed files with 9 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
decoder/ih264d_process_intra_mb.c
View file

@ -930,7 +930,9 @@ WORD32 ih264d_process_intra_mb(dec_struct_t * ps_dec,
} }
} }
{ {
UWORD8 au1_ngbr_pels[33]; /* Align the size to multiple of 8, so that SIMD functions
can read 64 bits at a time. Only 33 bytes are actaully used */
UWORD8 au1_ngbr_pels[40];
/* Get neighbour pixels */ /* Get neighbour pixels */
/* left pels */ /* left pels */
if(u2_use_left_mb) if(u2_use_left_mb)
@ -1175,7 +1177,9 @@ WORD32 ih264d_process_intra_mb(dec_struct_t * ps_dec,
/* Scan the sub-blocks in Raster Scan Order */ /* Scan the sub-blocks in Raster Scan Order */
for(u1_sub_mb_num = 0; u1_sub_mb_num < 16; u1_sub_mb_num++) for(u1_sub_mb_num = 0; u1_sub_mb_num < 16; u1_sub_mb_num++)
{ {
UWORD8 au1_ngbr_pels[13]; /* Align the size to multiple of 8, so that SIMD functions
can read 64 bits at a time. Only 13 bytes are actaully used */
UWORD8 au1_ngbr_pels[16];
u1_sub_blk_x = u1_sub_mb_num & 0x3; u1_sub_blk_x = u1_sub_mb_num & 0x3;
u1_sub_blk_y = u1_sub_mb_num >> 2; u1_sub_blk_y = u1_sub_mb_num >> 2;
@ -1664,7 +1668,9 @@ WORD32 ih264d_process_intra_mb(dec_struct_t * ps_dec,
} }
{ {
UWORD8 au1_ngbr_pels[25]; /* Align the size to multiple of 8, so that SIMD functions
can read 64 bits at a time. Only 25 bytes are actaully used */
UWORD8 au1_ngbr_pels[32];
WORD32 ngbr_avail; WORD32 ngbr_avail;
ngbr_avail = u1_is_left_sub_block << 0; ngbr_avail = u1_is_left_sub_block << 0;
ngbr_avail |= u1_is_top_sub_block << 2; ngbr_avail |= u1_is_top_sub_block << 2;