wrapper/libavc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix stack buffer overflow in ih264d_process_intra_mb am: f69e34419b am: cbaa0dc3f9 am: 943e36e510

Browse source 
am: 6a897f0c3a

Change-Id: I75f379b049ee2336b50d0fffe77a6a842896819c
This commit is contained in:
Harish Mahendrakar 2017-05-10 16:43:41 +00:00 • committed by android-build-merger
commit b308dc1318
1 changed files with 9 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
decoder/ih264d_process_intra_mb.c
View file

@ -930,7 +930,9 @@ WORD32 ih264d_process_intra_mb(dec_struct_t * ps_dec,
}
}
{
UWORD8 au1_ngbr_pels[33];
/* Align the size to multiple of 8, so that SIMD functions
can read 64 bits at a time. Only 33 bytes are actaully used */
UWORD8 au1_ngbr_pels[40];
/* Get neighbour pixels */
/* left pels */
if(u2_use_left_mb)
@ -1175,7 +1177,9 @@ WORD32 ih264d_process_intra_mb(dec_struct_t * ps_dec,
/* Scan the sub-blocks in Raster Scan Order */
for(u1_sub_mb_num = 0; u1_sub_mb_num < 16; u1_sub_mb_num++)
{
UWORD8 au1_ngbr_pels[13];
/* Align the size to multiple of 8, so that SIMD functions
can read 64 bits at a time. Only 13 bytes are actaully used */
UWORD8 au1_ngbr_pels[16];
u1_sub_blk_x = u1_sub_mb_num & 0x3;
u1_sub_blk_y = u1_sub_mb_num >> 2;
@ -1664,7 +1668,9 @@ WORD32 ih264d_process_intra_mb(dec_struct_t * ps_dec,
}
{
UWORD8 au1_ngbr_pels[25];
/* Align the size to multiple of 8, so that SIMD functions
can read 64 bits at a time. Only 25 bytes are actaully used */
UWORD8 au1_ngbr_pels[32];
WORD32 ngbr_avail;
ngbr_avail = u1_is_left_sub_block << 0;
ngbr_avail |= u1_is_top_sub_block << 2;