wrapper/libavc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Decoder: Increased allocation and added checks in sei parsing. am: f2b70d3537 am: 8d32a711ac

Browse source 
am: a0827a3bb1

Change-Id: I7a686f0252fa8de0bed2f58991ee4351caff8632
This commit is contained in:
Hamsalekha S 2017-10-31 18:07:47 +00:00 • committed by android-build-merger
commit cd831159ce
3 changed files with 9 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

3
decoder/ih264d_api.c
View file

@ -2011,7 +2011,8 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
void *pv_buf; void *pv_buf;
void *pv_mem_ctxt = ps_dec->pv_mem_ctxt; void *pv_mem_ctxt = ps_dec->pv_mem_ctxt;
size = MAX(256000, ps_dec->u2_pic_wd * ps_dec->u2_pic_ht * 3 / 2); size = MAX(256000, ps_dec->u2_pic_wd * ps_dec->u2_pic_ht * 3 / 2);
pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size); pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128,
size + EXTRA_BS_OFFSET);
RETURN_IF((NULL == pv_buf), IV_FAIL); RETURN_IF((NULL == pv_buf), IV_FAIL);
ps_dec->pu1_bits_buf_dynamic = pv_buf; ps_dec->pu1_bits_buf_dynamic = pv_buf;
ps_dec->u4_dynamic_bits_buf_size = size; ps_dec->u4_dynamic_bits_buf_size = size;

3
decoder/ih264d_defs.h
View file

@ -107,6 +107,9 @@
/* For 420SP */ /* For 420SP */
#define YUV420SP_FACTOR 2 #define YUV420SP_FACTOR 2
/*To prevent buffer overflow access; in case the size of nal unit is
* greater than the allocated buffer size*/
#define EXTRA_BS_OFFSET 16*16*2
/** /**
*************************************************************************** ***************************************************************************

7
decoder/ih264d_sei.c
View file

@ -336,7 +336,7 @@ WORD32 ih264d_parse_sei_message(dec_struct_t *ps_dec,
ui4_payload_type = 0; ui4_payload_type = 0;
u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8); u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8);
while(0xff == u4_bits) while(0xff == u4_bits && !EXCEED_OFFSET(ps_bitstrm))
{ {
u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8); u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8);
ui4_payload_type += 255; ui4_payload_type += 255;
@ -345,7 +345,7 @@ WORD32 ih264d_parse_sei_message(dec_struct_t *ps_dec,
ui4_payload_size = 0; ui4_payload_size = 0;
u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8); u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8);
while(0xff == u4_bits) while(0xff == u4_bits && !EXCEED_OFFSET(ps_bitstrm))
{ {
u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8); u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8);
ui4_payload_size += 255; ui4_payload_size += 255;
@ -370,7 +370,8 @@ WORD32 ih264d_parse_sei_message(dec_struct_t *ps_dec,
{ {
H264_DEC_DEBUG_PRINT("\nError in parsing SEI message"); H264_DEC_DEBUG_PRINT("\nError in parsing SEI message");
} }
while(0 == ih264d_check_byte_aligned(ps_bitstrm)) while(0 == ih264d_check_byte_aligned(ps_bitstrm)
&& !EXCEED_OFFSET(ps_bitstrm))
{ {
u4_bits = ih264d_get_bit_h264(ps_bitstrm); u4_bits = ih264d_get_bit_h264(ps_bitstrm);
if(u4_bits) if(u4_bits)