From 4be8f62fca27d40794e855d0846ce872fdb8510e Mon Sep 17 00:00:00 2001
From: Ritu Baldwa <ritu.baldwa@ittiam.com>
Date: Thu, 22 Mar 2018 16:37:28 +0530
Subject: [PATCH 01/28] Decoder: Fix undefined left shift

Bug: 73337131
Bug: 71446680
Bug: 73337973
Test: review
Change-Id: Idbbbf9db5f75cedb4a821296ee79c8a47b768a2f
---
 common/x86/ih264_ihadamard_scaling_sse42.c   | 2 +-
 common/x86/ih264_ihadamard_scaling_ssse3.c   | 2 +-
 common/x86/ih264_iquant_itrans_recon_sse42.c | 4 ++--
 common/x86/ih264_iquant_itrans_recon_ssse3.c | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/common/x86/ih264_ihadamard_scaling_sse42.c b/common/x86/ih264_ihadamard_scaling_sse42.c
index d68d105..4065e35 100644
--- a/common/x86/ih264_ihadamard_scaling_sse42.c
+++ b/common/x86/ih264_ihadamard_scaling_sse42.c
@@ -96,7 +96,7 @@ void ih264_ihadamard_scaling_4x4_sse42(WORD16* pi2_src,
     __m128i src_r0_r1, src_r2_r3;
     __m128i src_r0, src_r1, src_r2, src_r3;
     __m128i temp0, temp1, temp2, temp3;
-    __m128i add_rshift = _mm_set1_epi32((1 << (5 - u4_qp_div_6)));
+    __m128i add_rshift = _mm_set1_epi32((u4_qp_div_6 < 6) ? (1 << (5 - u4_qp_div_6)) : 0);
     __m128i mult_val = _mm_set1_epi32(pu2_iscal_mat[0] * pu2_weigh_mat[0]);
     UNUSED (pi4_tmp);
 
diff --git a/common/x86/ih264_ihadamard_scaling_ssse3.c b/common/x86/ih264_ihadamard_scaling_ssse3.c
index 1b940ea..b4d483f 100644
--- a/common/x86/ih264_ihadamard_scaling_ssse3.c
+++ b/common/x86/ih264_ihadamard_scaling_ssse3.c
@@ -96,7 +96,7 @@ void ih264_ihadamard_scaling_4x4_ssse3(WORD16* pi2_src,
     __m128i src_r0_r1, src_r2_r3, sign_reg, zero_8x16b = _mm_setzero_si128();
     __m128i src_r0, src_r1, src_r2, src_r3;
     __m128i temp0, temp1, temp2, temp3;
-    __m128i add_rshift = _mm_set1_epi32((1 << (5 - u4_qp_div_6)));
+    __m128i add_rshift = _mm_set1_epi32((u4_qp_div_6 < 6) ? (1 << (5 - u4_qp_div_6)) : 0);
     __m128i mult_val = _mm_set1_epi32(pu2_iscal_mat[0] * pu2_weigh_mat[0]);
 
     __m128i mask = _mm_set1_epi32(val);
diff --git a/common/x86/ih264_iquant_itrans_recon_sse42.c b/common/x86/ih264_iquant_itrans_recon_sse42.c
index f27111f..a7b9e82 100644
--- a/common/x86/ih264_iquant_itrans_recon_sse42.c
+++ b/common/x86/ih264_iquant_itrans_recon_sse42.c
@@ -118,7 +118,7 @@ void ih264_iquant_itrans_recon_4x4_sse42(WORD16 *pi2_src,
     __m128i zero_8x16b = _mm_setzero_si128();          // all bits reset to zero
     __m128i temp0, temp1, temp2, temp3, temp4, temp5, temp6, temp7;
     __m128i resq_r0, resq_r1, resq_r2, resq_r3;
-    __m128i add_rshift = _mm_set1_epi32((1 << (3 - u4_qp_div_6)));
+    __m128i add_rshift = _mm_set1_epi32((u4_qp_div_6 < 4) ? (1 << (3 - u4_qp_div_6)) : 0);
     __m128i value_32 = _mm_set1_epi32(32);
     UNUSED (pi2_tmp);
 
@@ -367,7 +367,7 @@ void ih264_iquant_itrans_recon_chroma_4x4_sse42(WORD16 *pi2_src,
     __m128i zero_8x16b = _mm_setzero_si128();          // all bits reset to zero
     __m128i temp0, temp1, temp2, temp3, temp4, temp5, temp6, temp7;
     __m128i resq_r0, resq_r1, resq_r2, resq_r3;
-    __m128i add_rshift = _mm_set1_epi32((1 << (3 - u4_qp_div_6)));
+    __m128i add_rshift = _mm_set1_epi32((u4_qp_div_6 < 4) ? (1 << (3 - u4_qp_div_6)) : 0);
     __m128i value_32 = _mm_set1_epi32(32);
     __m128i chroma_mask = _mm_set1_epi16 (0xFF);
     __m128i out_r0, out_r1, out_r2, out_r3;
diff --git a/common/x86/ih264_iquant_itrans_recon_ssse3.c b/common/x86/ih264_iquant_itrans_recon_ssse3.c
index 30f7e59..506be49 100644
--- a/common/x86/ih264_iquant_itrans_recon_ssse3.c
+++ b/common/x86/ih264_iquant_itrans_recon_ssse3.c
@@ -118,7 +118,7 @@ void ih264_iquant_itrans_recon_4x4_ssse3(WORD16 *pi2_src,
     __m128i zero_8x16b = _mm_setzero_si128();          // all bits reset to zero
     __m128i temp0, temp1, temp2, temp3, temp4, temp5, temp6, temp7;
     __m128i resq_r0, resq_r1, resq_r2, resq_r3;
-    __m128i add_rshift = _mm_set1_epi32((1 << (3 - u4_qp_div_6)));
+    __m128i add_rshift = _mm_set1_epi32((u4_qp_div_6 < 4) ? (1 << (3 - u4_qp_div_6)) : 0);
     __m128i value_32 = _mm_set1_epi32(32);
     UNUSED (pi2_tmp);
     UNUSED (pi2_dc_ld_addr);
@@ -384,7 +384,7 @@ void ih264_iquant_itrans_recon_8x8_ssse3(WORD16 *pi2_src,
     // __m128i one_8x16b = _mm_set1_epi8(255); // all bits set to 1
     // __m128i one_zero_mask = _mm_unpacklo_epi16(one_8x16b, zero_8x16b); // 1 0 1 0 1 0 1 0 --- 16 bits size
     __m128i value_32 = _mm_set1_epi32(32);
-    __m128i add_rshift = _mm_set1_epi32((1 << (5 - qp_div)));
+    __m128i add_rshift = _mm_set1_epi32((qp_div < 6) ? (1 << (5 - qp_div)) : 0);
     __m128i dequant_r0;
     __m128i predload_r;
     __m128i pred_r0_1, pred_r1_1, pred_r2_1, pred_r3_1, pred_r4_1, pred_r5_1,

From 9083317185f3ebf2d60f2234fe7abd224b294cf4 Mon Sep 17 00:00:00 2001
From: Ritu Baldwa <ritu.baldwa@ittiam.com>
Date: Tue, 20 Mar 2018 13:49:08 +0530
Subject: [PATCH 02/28] Decoder: Fix CLZ return value

Since left shift by 32 is undefined value, making it 31.

Bug: 73337905
Bug: 73337480
Bug: 73337472
Test: manual
Change-Id: Id03991e75ea32d29bafa2d0bbb2bda7d5876fb03
---
 common/arm/ih264_platform_macros.h   | 7 ++++++-
 common/armv8/ih264_platform_macros.h | 7 ++++++-
 common/mips/ih264_platform_macros.h  | 7 ++++++-
 common/x86/ih264_platform_macros.h   | 7 ++++++-
 4 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/common/arm/ih264_platform_macros.h b/common/arm/ih264_platform_macros.h
index 438e240..ed49db0 100644
--- a/common/arm/ih264_platform_macros.h
+++ b/common/arm/ih264_platform_macros.h
@@ -128,12 +128,17 @@ static __inline UWORD32 ITT_BIG_ENDIAN(UWORD32 x)
 
 #define INLINE inline
 
+/* In normal cases, 0 will not be passed as an argument to CLZ and CTZ.
+As CLZ and CTZ outputs are used as a shift value in few places, these return
+31 for u4_word == 0 case, just to handle error cases gracefully without any
+undefined behaviour */
+
 static INLINE UWORD32 CLZ(UWORD32 u4_word)
 {
     if(u4_word)
         return (__builtin_clz(u4_word));
     else
-        return 32;
+        return 31;
 }
 static INLINE UWORD32 CTZ(UWORD32 u4_word)
 {
diff --git a/common/armv8/ih264_platform_macros.h b/common/armv8/ih264_platform_macros.h
index 438e240..ed49db0 100644
--- a/common/armv8/ih264_platform_macros.h
+++ b/common/armv8/ih264_platform_macros.h
@@ -128,12 +128,17 @@ static __inline UWORD32 ITT_BIG_ENDIAN(UWORD32 x)
 
 #define INLINE inline
 
+/* In normal cases, 0 will not be passed as an argument to CLZ and CTZ.
+As CLZ and CTZ outputs are used as a shift value in few places, these return
+31 for u4_word == 0 case, just to handle error cases gracefully without any
+undefined behaviour */
+
 static INLINE UWORD32 CLZ(UWORD32 u4_word)
 {
     if(u4_word)
         return (__builtin_clz(u4_word));
     else
-        return 32;
+        return 31;
 }
 static INLINE UWORD32 CTZ(UWORD32 u4_word)
 {
diff --git a/common/mips/ih264_platform_macros.h b/common/mips/ih264_platform_macros.h
index d098372..a8d9026 100644
--- a/common/mips/ih264_platform_macros.h
+++ b/common/mips/ih264_platform_macros.h
@@ -69,12 +69,17 @@
 
 #define PLD(a)
 
+/* In normal cases, 0 will not be passed as an argument to CLZ and CTZ.
+As CLZ and CTZ outputs are used as a shift value in few places, these return
+31 for u4_word == 0 case, just to handle error cases gracefully without any
+undefined behaviour */
+
 static __inline UWORD32 CLZ(UWORD32 u4_word)
 {
     if(u4_word)
     return(__builtin_clz(u4_word));
     else
-        return 32;
+        return 31;
 }
 
 static __inline UWORD32 CTZ(UWORD32 u4_word)
diff --git a/common/x86/ih264_platform_macros.h b/common/x86/ih264_platform_macros.h
index 340c5d8..67424aa 100644
--- a/common/x86/ih264_platform_macros.h
+++ b/common/x86/ih264_platform_macros.h
@@ -68,12 +68,17 @@
 
 #define PLD(a)
 
+/* In normal cases, 0 will not be passed as an argument to CLZ and CTZ.
+As CLZ and CTZ outputs are used as a shift value in few places, these return
+31 for u4_word == 0 case, just to handle error cases gracefully without any
+undefined behaviour */
+
 static __inline UWORD32 CLZ(UWORD32 u4_word)
 {
     if(u4_word)
     return(__builtin_clz(u4_word));
     else
-        return 32;
+        return 31;
 }
 
 static __inline UWORD32 CTZ(UWORD32 u4_word)

From 49afc8f344a4906114fc2afa6fc4e91dcf54c17f Mon Sep 17 00:00:00 2001
From: Ritu Baldwa <ritu.baldwa@ittiam.com>
Date: Tue, 10 Apr 2018 18:20:17 +0530
Subject: [PATCH 03/28] Fix signed integer overflow in prev_max_display_seq

Prev_max_display_seq accumulates max_poc, which results in integer overflow.
Resetting it to zero whenever overflow occurs.

Bug: 73337834
Test: boot
Change-Id: Ia3f6d30f1a6e7fac05d073e30e38ce2ca4e4f52a
---
 decoder/ih264d_parse_slice.c | 10 +++++++---
 decoder/ih264d_utils.c       | 21 +++++++++++++--------
 2 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/decoder/ih264d_parse_slice.c b/decoder/ih264d_parse_slice.c
index db02bfe..3608c6c 100644
--- a/decoder/ih264d_parse_slice.c
+++ b/decoder/ih264d_parse_slice.c
@@ -1473,9 +1473,13 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice,
         /* IDR Picture or POC wrap around */
         if(i4_poc == 0)
         {
-            ps_dec->i4_prev_max_display_seq = ps_dec->i4_prev_max_display_seq
-                            + ps_dec->i4_max_poc
-                            + ps_dec->u1_max_dec_frame_buffering + 1;
+            UWORD64 u8_temp;
+            u8_temp = (UWORD64)ps_dec->i4_prev_max_display_seq
+                      + ps_dec->i4_max_poc
+                      + ps_dec->u1_max_dec_frame_buffering + 1;
+            /*If i4_prev_max_display_seq overflows integer range, reset it */
+            ps_dec->i4_prev_max_display_seq = (u8_temp > 0x7fffffff)?
+                                              0 : u8_temp;
             ps_dec->i4_max_poc = 0;
         }
     }
diff --git a/decoder/ih264d_utils.c b/decoder/ih264d_utils.c
index edfb8f1..a2ab8db 100644
--- a/decoder/ih264d_utils.c
+++ b/decoder/ih264d_utils.c
@@ -1264,6 +1264,7 @@ void ih264d_release_display_bufs(dec_struct_t *ps_dec)
     WORD32 i4_min_poc;
     WORD32 i4_min_poc_buf_id;
     WORD32 i4_min_index;
+    UWORD64 u8_temp;
     dpb_manager_t *ps_dpb_mgr = ps_dec->ps_dpb_mgr;
     WORD32 (*i4_poc_buf_id_map)[3] = ps_dpb_mgr->ai4_poc_buf_id_map;
 
@@ -1308,9 +1309,11 @@ void ih264d_release_display_bufs(dec_struct_t *ps_dec)
         }
     }
     ps_dpb_mgr->i1_poc_buf_id_entries = 0;
-    ps_dec->i4_prev_max_display_seq = ps_dec->i4_prev_max_display_seq
-                    + ps_dec->i4_max_poc + ps_dec->u1_max_dec_frame_buffering
-                    + 1;
+    u8_temp = (UWORD64)ps_dec->i4_prev_max_display_seq + ps_dec->i4_max_poc
+              + ps_dec->u1_max_dec_frame_buffering + 1;
+    /*If i4_prev_max_display_seq overflows integer range, reset it */
+    ps_dec->i4_prev_max_display_seq = (u8_temp > 0x7fffffff)?
+                                      0 : u8_temp;
     ps_dec->i4_max_poc = 0;
 }
 
@@ -1582,11 +1585,13 @@ WORD32 ih264d_decode_gaps_in_frame_num(dec_struct_t *ps_dec,
             /* IDR Picture or POC wrap around */
             if(i4_poc == 0)
             {
-                ps_dec->i4_prev_max_display_seq =
-                                ps_dec->i4_prev_max_display_seq
-                                                + ps_dec->i4_max_poc
-                                                + ps_dec->u1_max_dec_frame_buffering
-                                                + 1;
+                UWORD64 u8_temp;
+                u8_temp = (UWORD64)ps_dec->i4_prev_max_display_seq
+                          + ps_dec->i4_max_poc
+                          + ps_dec->u1_max_dec_frame_buffering + 1;
+                /*If i4_prev_max_display_seq overflows integer range, reset it */
+                ps_dec->i4_prev_max_display_seq = (u8_temp > 0x7fffffff)?
+                                                  0 : u8_temp;
                 ps_dec->i4_max_poc = 0;
             }
 

From 0e4598c1c9d8417151b08c57f11a80849488cb68 Mon Sep 17 00:00:00 2001
From: Ritu Baldwa <ritu.baldwa@ittiam.com>
Date: Wed, 28 Mar 2018 10:38:33 +0530
Subject: [PATCH 04/28] Decoder: Return error for invalid vui parameter

Parameter num_reorder_frames should be in the range of
zero to max_dec_frame_buffering, inclusive.

Bug: 73338792
Test: vendor
Change-Id: Ib7d428ea7ac9ad946d09968a8e89ce75bf076292
---
 decoder/ih264d_vui.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/decoder/ih264d_vui.c b/decoder/ih264d_vui.c
index 15bc37d..15f1c00 100644
--- a/decoder/ih264d_vui.c
+++ b/decoder/ih264d_vui.c
@@ -231,6 +231,11 @@ WORD32 ih264d_parse_vui_parametres(vui_t *ps_vu4,
                                                    pu4_bitstrm_buf);
         ps_vu4->u4_max_dec_frame_buffering = ih264d_uev(pu4_bitstrm_ofst,
                                                         pu4_bitstrm_buf);
+        if((ps_vu4->u4_max_dec_frame_buffering > (H264_MAX_REF_PICS * 2)) ||
+           (ps_vu4->u4_num_reorder_frames > ps_vu4->u4_max_dec_frame_buffering))
+        {
+            return ERROR_INV_SPS_PPS_T;
+        }
     }
     else
     {

From ce46181b5f0c54775dedbef94bedf0018bde8ab9 Mon Sep 17 00:00:00 2001
From: Ivan Lozano <ivanlozano@google.com>
Date: Tue, 10 Jul 2018 11:52:52 -0700
Subject: [PATCH 05/28] Enable integer overflow sanitization for libavc.

This enables integer overflow sanitization for libavc, initially in
diagnostics mode.

Bug: 110791537
Test: CTS tests
Change-Id: Ida5679156d866ed24f468867244bb00a10d967ca
---
 Android.bp           |  8 ++++++--
 cfi_blacklist.txt    |  1 -
 libavc_blacklist.txt | 23 +++++++++++++++++++++++
 3 files changed, 29 insertions(+), 3 deletions(-)
 delete mode 100644 cfi_blacklist.txt
 create mode 100644 libavc_blacklist.txt

diff --git a/Android.bp b/Android.bp
index 4abfa16..f898ff0 100644
--- a/Android.bp
+++ b/Android.bp
@@ -234,10 +234,12 @@ cc_library_static {
 
     sanitize: {
     	cfi: true,
+        integer_overflow: true,
         diag: {
             cfi: true,
+            integer_overflow: true,
         },
-        blacklist: "cfi_blacklist.txt",
+        blacklist: "libavc_blacklist.txt",
     },
 }
 
@@ -503,10 +505,12 @@ cc_library_static {
 
     sanitize: {
     	cfi: true,
+        integer_overflow: true,
         diag: {
             cfi: true,
+            integer_overflow: true,
         },
-        blacklist: "cfi_blacklist.txt",
+        blacklist: "libavc_blacklist.txt",
     },
 }
 
diff --git a/cfi_blacklist.txt b/cfi_blacklist.txt
deleted file mode 100644
index 1571e0e..0000000
--- a/cfi_blacklist.txt
+++ /dev/null
@@ -1 +0,0 @@
-src:*external/libavc/*
diff --git a/libavc_blacklist.txt b/libavc_blacklist.txt
new file mode 100644
index 0000000..927dcf2
--- /dev/null
+++ b/libavc_blacklist.txt
@@ -0,0 +1,23 @@
+[cfi]
+src:*external/libavc/*
+
+[integer]
+# decoder/ih264d_dpb_mgr.c:1174: 2 - 3 cannot be represented in type 'unsigned int'
+fun:ih264d_do_mmco_buffer
+# decoder/ih264d_parse_bslice.c:1388:21: 1 + 4294967295 cannot be represented in type 'unsigned int'
+# decoder/ih264d_parse_bslice.c:1391:22: 1 + 4294967295 cannot be represented in type 'unsigned int'
+fun:ih264d_decode_bslice
+# decoder/ih264d_utils.c:389: 0 - 1 cannot be represented in type 'unsigned int'
+fun:ih264d_decode_pic_order_cnt
+# decoder/ih264d_vui.c:76: 1 + 4294967295 cannot be represented in type 'unsigned int'
+fun:ih264d_parse_hrd_parametres
+# decoder/ih264d_dpb_mgr.c:751: 4294967295 + 1 cannot be represented in type 'unsigned int'
+# decoder/ih264d_dpb_mgr.c:755: 1 - 16 cannot be represented in type 'unsigned int'
+# decoder/ih264d_dpb_mgr.c:762: 4294967295 + 1 cannot be represented in type 'unsigned int'
+fun:ih264d_ref_idx_reordering
+# decoder/ih264d_process_bslice.c:785: 5 - 4294967242 cannot be represented in type 'unsigned int'
+# decoder/ih264d_process_bslice.c:796: 3 - 4294967242 cannot be represented in type 'unsigned int'
+fun:ih264d_decode_temporal_direct
+
+# Numerous overflows in multiple functions, CAVLC is a compression technique.
+src:*/decoder/ih264d_parse_cavlc.c

From 36352e2ad4493c818521746fa9060ee4abcca6ec Mon Sep 17 00:00:00 2001
From: Ivan Lozano <ivanlozano@google.com>
Date: Tue, 17 Jul 2018 08:38:46 -0700
Subject: [PATCH 06/28] Don't explicitly enable CFI in libavc.

Previously there was no other sanitization, so in order for the
blacklist to be picked up CFI had to be enabled. With integer_overflow
enabled, we no longer need it enabled explicitly in the build file.
Since libavc is a static library, both CFI and non-CFI variants will
be built and linked accordingly.

If libavc is used as a shared library in the future, we'll need to
explicitly re-enable CFI in the build file.

Bug: 63926619
Test: Library builds.
Change-Id: I2646e1422c29073d2e622ded1a9074426b186130
---
 Android.bp | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Android.bp b/Android.bp
index f898ff0..80bd0a1 100644
--- a/Android.bp
+++ b/Android.bp
@@ -233,10 +233,10 @@ cc_library_static {
     },
 
     sanitize: {
-    	cfi: true,
         integer_overflow: true,
+        // Enable CFI if this becomes a shared library.
+        // cfi: true,
         diag: {
-            cfi: true,
             integer_overflow: true,
         },
         blacklist: "libavc_blacklist.txt",
@@ -504,10 +504,10 @@ cc_library_static {
     },
 
     sanitize: {
-    	cfi: true,
         integer_overflow: true,
+        // Enable CFI if this becomes a shared library.
+        // cfi: true,
         diag: {
-            cfi: true,
             integer_overflow: true,
         },
         blacklist: "libavc_blacklist.txt",

From 837aefa3a281f02fd55f2b3f2cf4de8c579e183d Mon Sep 17 00:00:00 2001
From: Rakesh Kumar <rakesh.kumar@ittiam.com>
Date: Thu, 9 Aug 2018 22:35:46 +0530
Subject: [PATCH 07/28] Fix Compiler warnings

Intrinsic _mm_set_epi8 require char input, converting everything to char.
Including log.h from android library instead of cutils.

Bug: 112316276
Test: before/after object comparison for no diff in generated code.
Change-Id: I82b8c48494619b64465eda2476c7c903652c6066
---
 decoder/ih264d_dpb_mgr.c                    | 2 +-
 encoder/x86/ih264e_intra_modes_eval_ssse3.c | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/decoder/ih264d_dpb_mgr.c b/decoder/ih264d_dpb_mgr.c
index b7ee498..e35cb25 100644
--- a/decoder/ih264d_dpb_mgr.c
+++ b/decoder/ih264d_dpb_mgr.c
@@ -19,7 +19,7 @@
 */
 #ifdef __ANDROID__
 #include "log/log.h"
-#include <cutils/log.h>
+#include <android/log.h>
 #endif
 #include "ih264_typedefs.h"
 #include "ih264_macros.h"
diff --git a/encoder/x86/ih264e_intra_modes_eval_ssse3.c b/encoder/x86/ih264e_intra_modes_eval_ssse3.c
index c11d7f2..ea8a6c8 100644
--- a/encoder/x86/ih264e_intra_modes_eval_ssse3.c
+++ b/encoder/x86/ih264e_intra_modes_eval_ssse3.c
@@ -574,7 +574,7 @@ void ih264e_evaluate_intra_4x4_modes_ssse3(UWORD8 *pu1_src,
             pred2_16x8b = _mm_set1_epi8(dcval);
         }
         else
-            pred2_16x8b = _mm_set1_epi8(128);
+            pred2_16x8b = _mm_set1_epi8(-128);
 
         sad_8x16b = _mm_sad_epu8(src_16x8b, pred2_16x8b);
 
@@ -1135,7 +1135,7 @@ void ih264e_evaluate_intra_chroma_modes_ssse3(UWORD8 *pu1_src,
         }
         else
         {
-            pred1_16x8b = _mm_set1_epi8(128);
+            pred1_16x8b = _mm_set1_epi8(-128);
 
             tmp1_8x16b = _mm_sad_epu8(src1_16x8b, pred1_16x8b);
             tmp2_8x16b = _mm_sad_epu8(src2_16x8b, pred1_16x8b);

From 590ff56ba5d7a37b762ff7b042673eb7d090c2ba Mon Sep 17 00:00:00 2001
From: Rakesh Kumar <rakesh.kumar@ittiam.com>
Date: Wed, 8 Aug 2018 12:30:55 +0530
Subject: [PATCH 08/28] Decoder: Memset allocated dynamic and static buffer to
 zero

Bug: 111407302
Bug: 111208713
Bug: 111128067
Bug: 111762807
Bug: 111762100
Bug: 111761624
Bug: 112328051
Bug: 112329563
Bug: 112326322
Bug: 112205113
Bug: 112204376
Test: manual
Change-Id: I35e6069a26ee5ef4c0fff111df255a5eddff78ae
---
 decoder/ih264d_api.c   | 28 ++++++++++++++++++++++++++++
 decoder/ih264d_utils.c | 13 +++++++++++++
 2 files changed, 41 insertions(+)

diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c
index c6999a6..5500c6a 100644
--- a/decoder/ih264d_api.c
+++ b/decoder/ih264d_api.c
@@ -1235,6 +1235,7 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv
     ps_create_op->s_ivd_create_op_t.pv_handle = NULL;
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, sizeof(iv_obj_t));
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, sizeof(iv_obj_t));
     *dec_hdl = (iv_obj_t *)pv_buf;
     ps_create_op->s_ivd_create_op_t.pv_handle = *dec_hdl;
 
@@ -1272,82 +1273,98 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv
     size = ((sizeof(dec_seq_params_t)) * MAX_NUM_SEQ_PARAMS);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_sps = pv_buf;
 
     size = (sizeof(dec_pic_params_t)) * MAX_NUM_PIC_PARAMS;
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_pps = pv_buf;
 
     size = ithread_get_handle_size();
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pv_dec_thread_handle = pv_buf;
 
     size = ithread_get_handle_size();
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pv_bs_deblk_thread_handle = pv_buf;
 
     size = sizeof(dpb_manager_t);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_dpb_mgr = pv_buf;
 
     size = sizeof(pred_info_t) * 2 * 32;
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_pred = pv_buf;
 
     size = sizeof(disp_mgr_t);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pv_disp_buf_mgr = pv_buf;
 
     size = sizeof(buf_mgr_t) + ithread_get_mutex_lock_size();
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pv_pic_buf_mgr = pv_buf;
 
     size = sizeof(struct pic_buffer_t) * (H264_MAX_REF_PICS * 2);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_pic_buf_base = pv_buf;
 
     size = sizeof(dec_err_status_t);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_dec_err_status = (dec_err_status_t *)pv_buf;
 
     size = sizeof(sei);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_sei = (sei *)pv_buf;
 
     size = sizeof(dpb_commands_t);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_dpb_cmds = (dpb_commands_t *)pv_buf;
 
     size = sizeof(dec_bit_stream_t);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_bitstrm = (dec_bit_stream_t *)pv_buf;
 
     size = sizeof(dec_slice_params_t);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_cur_slice = (dec_slice_params_t *)pv_buf;
 
     size = MAX(sizeof(dec_seq_params_t), sizeof(dec_pic_params_t));
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pv_scratch_sps_pps = pv_buf;
 
 
     ps_dec->u4_static_bits_buf_size = 256000;
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, ps_dec->u4_static_bits_buf_size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, ps_dec->u4_static_bits_buf_size);
     ps_dec->pu1_bits_buf_static = pv_buf;
 
 
@@ -1364,6 +1381,7 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv
     size = (sizeof(bin_ctxt_model_t) * NUM_CABAC_CTXTS);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->p_cabac_ctxt_table_t = pv_buf;
 
 
@@ -1371,6 +1389,7 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv
     size = sizeof(ctxt_inc_mb_info_t);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_left_mb_ctxt_info = pv_buf;
 
 
@@ -1378,6 +1397,7 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv
     size = MAX_REF_BUF_SIZE * 2;
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pu1_ref_buff_base = pv_buf;
     ps_dec->pu1_ref_buff = ps_dec->pu1_ref_buff_base + MAX_REF_BUF_SIZE;
 
@@ -1386,12 +1406,14 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv
                         * PRED_BUFFER_HEIGHT * 2);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pi2_pred1 = pv_buf;
 
 
     size = sizeof(UWORD8) * (MB_LUM_SIZE);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pu1_temp_mc_buffer = pv_buf;
 
 
@@ -1400,6 +1422,7 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv
     size = 8 * MAX_REF_BUFS * sizeof(struct pic_buffer_t);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
 
     ps_dec->pu1_init_dpb_base = pv_buf;
     pu1_buf = pv_buf;
@@ -1412,24 +1435,28 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv
                         * ((MAX_FRAMES << 1) * (MAX_FRAMES << 1)) * 2);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pu4_mbaff_wt_mat = pv_buf;
 
     size = sizeof(UWORD32) * 2 * 3
                         * ((MAX_FRAMES << 1) * (MAX_FRAMES << 1));
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pu4_wts_ofsts_mat = pv_buf;
 
 
     size = (sizeof(neighbouradd_t) << 2);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_left_mvpred_addr = pv_buf;
 
 
     size = sizeof(buf_mgr_t) + ithread_get_mutex_lock_size();
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pv_mv_buf_mgr = pv_buf;
 
 
@@ -2092,6 +2119,7 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
             pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128,
                                               size + EXTRA_BS_OFFSET);
             RETURN_IF((NULL == pv_buf), IV_FAIL);
+            memset(pv_buf, 0, size + EXTRA_BS_OFFSET);
             ps_dec->pu1_bits_buf_dynamic = pv_buf;
             ps_dec->u4_dynamic_bits_buf_size = size;
         }
diff --git a/decoder/ih264d_utils.c b/decoder/ih264d_utils.c
index a2ab8db..bbbf175 100644
--- a/decoder/ih264d_utils.c
+++ b/decoder/ih264d_utils.c
@@ -1835,16 +1835,19 @@ WORD16 ih264d_allocate_dynamic_bufs(dec_struct_t * ps_dec)
     size = u4_total_mbs;
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pu1_dec_mb_map = pv_buf;
 
     size = u4_total_mbs;
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pu1_recon_mb_map = pv_buf;
 
     size = u4_total_mbs * sizeof(UWORD16);
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pu2_slice_num_map = pv_buf;
 
     /************************************************************/
@@ -1866,17 +1869,20 @@ WORD16 ih264d_allocate_dynamic_bufs(dec_struct_t * ps_dec)
                         * ((ps_dec->u1_recon_mb_grp) << 4);
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_parse_part_params = pv_buf;
 
     size = ((u4_wd_mbs * sizeof(deblkmb_neighbour_t)) << uc_frmOrFld);
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_deblk_top_mb = pv_buf;
 
     size = ((sizeof(ctxt_inc_mb_info_t))
                         * (((u4_wd_mbs + 1) << uc_frmOrFld) + 1));
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->p_ctxt_inc_mb_map = pv_buf;
 
     /* 0th entry of CtxtIncMbMap will be always be containing default values
@@ -1887,12 +1893,14 @@ WORD16 ih264d_allocate_dynamic_bufs(dec_struct_t * ps_dec)
                         * 16);
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_mv_p[0] = pv_buf;
 
     size = (sizeof(mv_pred_t) * ps_dec->u1_recon_mb_grp
                         * 16);
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_mv_p[1] = pv_buf;
 
     {
@@ -1903,6 +1911,7 @@ WORD16 ih264d_allocate_dynamic_bufs(dec_struct_t * ps_dec)
                             * ps_dec->u1_recon_mb_grp * 4);
             pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
             RETURN_IF((NULL == pv_buf), IV_FAIL);
+            memset(pv_buf, 0, size);
             ps_dec->ps_mv_top_p[i] = pv_buf;
         }
     }
@@ -1991,6 +2000,7 @@ WORD16 ih264d_allocate_dynamic_bufs(dec_struct_t * ps_dec)
     size = sizeof(pred_info_pkd_t) * num_entries;
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_pred_pkd = pv_buf;
 
     /* Allocate memory for coeff data */
@@ -2004,6 +2014,7 @@ WORD16 ih264d_allocate_dynamic_bufs(dec_struct_t * ps_dec)
     size += u4_total_mbs * 32;
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
 
     ps_dec->pi2_coeff_data = pv_buf;
 
@@ -2025,6 +2036,7 @@ WORD16 ih264d_allocate_dynamic_bufs(dec_struct_t * ps_dec)
         size *= u4_num_bufs;
         pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
         RETURN_IF((NULL == pv_buf), IV_FAIL);
+        memset(pv_buf, 0, size);
         ps_dec->pu1_mv_bank_buf_base = pv_buf;
     }
 
@@ -2058,6 +2070,7 @@ WORD16 ih264d_allocate_dynamic_bufs(dec_struct_t * ps_dec)
     size *= ps_dec->u1_pic_bufs;
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pu1_pic_buf_base = pv_buf;
 
     /* Post allocation Increment Actions */

From def7f774cb32c7644e4aa99a4c7b6396beca2c29 Mon Sep 17 00:00:00 2001
From: Ivan Lozano <ivanlozano@google.com>
Date: Thu, 4 Oct 2018 10:55:09 -0700
Subject: [PATCH 09/28] Enable bounds sanitization in libavc.

Enables bounds sanitization in libavc, initially with diagnostics.

Bug: 117221610
Test: Device boots
Change-Id: Iee99f655c5ea0611d5dc32a121c7f1cf60763c7c
---
 Android.bp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Android.bp b/Android.bp
index 80bd0a1..d08719c 100644
--- a/Android.bp
+++ b/Android.bp
@@ -234,10 +234,12 @@ cc_library_static {
 
     sanitize: {
         integer_overflow: true,
+        misc_undefined: ["bounds"],
         // Enable CFI if this becomes a shared library.
         // cfi: true,
         diag: {
             integer_overflow: true,
+            misc_undefined: ["bounds"],
         },
         blacklist: "libavc_blacklist.txt",
     },
@@ -505,10 +507,12 @@ cc_library_static {
 
     sanitize: {
         integer_overflow: true,
+        misc_undefined: ["bounds"],
         // Enable CFI if this becomes a shared library.
         // cfi: true,
         diag: {
             integer_overflow: true,
+            misc_undefined: ["bounds"],
         },
         blacklist: "libavc_blacklist.txt",
     },

From d387e7f8c360489e4f1e88804aaa88d6971b3015 Mon Sep 17 00:00:00 2001
From: Ivan Lozano <ivanlozano@google.com>
Date: Tue, 16 Oct 2018 09:55:32 -0700
Subject: [PATCH 10/28] Blacklist intsan in libavc encoder functions.

Add some additional functions that need to be blacklisted in the
libavc encoder.

Bug: 110791537
Test: avcenc with test input.
Change-Id: Ia87582c830c51ed6fb737409b757cc759b67c817
---
 libavc_blacklist.txt | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libavc_blacklist.txt b/libavc_blacklist.txt
index 927dcf2..078669f 100644
--- a/libavc_blacklist.txt
+++ b/libavc_blacklist.txt
@@ -18,6 +18,11 @@ fun:ih264d_ref_idx_reordering
 # decoder/ih264d_process_bslice.c:785: 5 - 4294967242 cannot be represented in type 'unsigned int'
 # decoder/ih264d_process_bslice.c:796: 3 - 4294967242 cannot be represented in type 'unsigned int'
 fun:ih264d_decode_temporal_direct
+# encoder/ime.c:153: 0 - 1 cannot be represented in type 'UWORD32'
+fun:ime_diamond_search_16x16
+# encoder/irc_rate_control_api.c:310: 6000000 * 1000 cannot be represented in type 'unsigned int'
+fun:irc_initialise_rate_control
 
 # Numerous overflows in multiple functions, CAVLC is a compression technique.
 src:*/decoder/ih264d_parse_cavlc.c
+src:*/encoder/ih264e_cavlc.c

From 2286dbb91f28a813416a716e11bea9f0e55b154a Mon Sep 17 00:00:00 2001
From: Thomala Srinivas <thomala.srinivas@ittiam.com>
Date: Tue, 9 Oct 2018 18:29:54 +0530
Subject: [PATCH 11/28] Decoder: Initialize some array and structure to zero

In intra_pred_ref_filtering function, initialize the values
of array au1_ngbr_pels to zero and in ih264d_parse_decode_slice
function, initialize the values of struct s_tmp_poc to zero.

Bug: 111762686
Test: vendor
Change-Id: Iac67f5e7d24f821627de64c8570f4be648c296c8
---
 decoder/ih264d_parse_slice.c      | 2 +-
 decoder/ih264d_process_intra_mb.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/decoder/ih264d_parse_slice.c b/decoder/ih264d_parse_slice.c
index 3608c6c..3605b97 100644
--- a/decoder/ih264d_parse_slice.c
+++ b/decoder/ih264d_parse_slice.c
@@ -1000,7 +1000,7 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice,
     dec_pic_params_t *ps_pps;
     dec_seq_params_t *ps_seq;
     dec_slice_params_t *ps_cur_slice = ps_dec->ps_cur_slice;
-    pocstruct_t s_tmp_poc;
+    pocstruct_t s_tmp_poc = {0};
     WORD32 i_delta_poc[2];
     WORD32 i4_poc = 0;
     UWORD16 u2_first_mb_in_slice, u2_frame_num;
diff --git a/decoder/ih264d_process_intra_mb.c b/decoder/ih264d_process_intra_mb.c
index 211d796..2d4d006 100644
--- a/decoder/ih264d_process_intra_mb.c
+++ b/decoder/ih264d_process_intra_mb.c
@@ -1670,7 +1670,7 @@ WORD32 ih264d_process_intra_mb(dec_struct_t * ps_dec,
             {
                 /* Align the size to multiple of 8, so that SIMD functions
                 can read 64 bits at a time. Only 25 bytes are actaully used */
-                UWORD8 au1_ngbr_pels[32];
+                UWORD8 au1_ngbr_pels[32] = {0};
                 WORD32 ngbr_avail;
                 ngbr_avail = u1_is_left_sub_block << 0;
                 ngbr_avail |= u1_is_top_sub_block << 2;

From c8bcfb3f6669e209b8cec9e0f556faaacafb17db Mon Sep 17 00:00:00 2001
From: Ivan Lozano <ivanlozano@google.com>
Date: Mon, 17 Dec 2018 10:14:32 -0800
Subject: [PATCH 12/28] Enforce ubsan sanitizers in libavc.

Keep sanitizers in diagnostics mode but don't recover from them so we
get errors in tombstones.

Bug: 110791537
Test: mma -j

Change-Id: Ib5e7d110ded68e19e276d79f99f648fea3f70078
---
 Android.bp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Android.bp b/Android.bp
index 13bcf26..92050f8 100644
--- a/Android.bp
+++ b/Android.bp
@@ -241,6 +241,7 @@ cc_library_static {
         diag: {
             integer_overflow: true,
             misc_undefined: ["bounds"],
+            no_recover: ["bounds", "integer"],
         },
         blacklist: "libavc_blacklist.txt",
     },
@@ -514,6 +515,7 @@ cc_library_static {
         diag: {
             integer_overflow: true,
             misc_undefined: ["bounds"],
+            no_recover: ["bounds", "integer"],
         },
         blacklist: "libavc_blacklist.txt",
     },

From f28de0366ccd7a59fe5a2e5409a161d01b57267b Mon Sep 17 00:00:00 2001
From: S Hamsalekha <hamsalekha.s@ittiam.com>
Date: Thu, 27 Dec 2018 13:57:55 +0530
Subject: [PATCH 13/28] Decoder: Add null check for scaling matrix.

Also void->word32 return type so failure can be signaled to caller.

Bug: 115743419
Test: vendor + poc
Change-Id: I0a07ac11255c2c672803aab7085824c417bde282
---
 decoder/ih264d_parse_slice.c   | 11 +++++++----
 decoder/ih264d_quant_scaling.c | 18 +++++++++++++-----
 decoder/ih264d_quant_scaling.h |  8 ++++----
 3 files changed, 24 insertions(+), 13 deletions(-)

diff --git a/decoder/ih264d_parse_slice.c b/decoder/ih264d_parse_slice.c
index 3605b97..5282738 100644
--- a/decoder/ih264d_parse_slice.c
+++ b/decoder/ih264d_parse_slice.c
@@ -690,12 +690,12 @@ WORD32 ih264d_start_of_pic(dec_struct_t *ps_dec,
         if((ps_seq->i4_seq_scaling_matrix_present_flag)
                         || (ps_pps->i4_pic_scaling_matrix_present_flag))
         {
-            ih264d_form_scaling_matrix_picture(ps_seq, ps_pps, ps_dec);
+            ret = ih264d_form_scaling_matrix_picture(ps_seq, ps_pps, ps_dec);
             ps_dec->s_high_profile.u1_scaling_present = 1;
         }
         else
         {
-            ih264d_form_default_scaling_matrix(ps_dec);
+            ret = ih264d_form_default_scaling_matrix(ps_dec);
         }
 
         if(ps_pps->i4_transform_8x8_mode_flag)
@@ -705,9 +705,12 @@ WORD32 ih264d_start_of_pic(dec_struct_t *ps_dec,
     }
     else
     {
-        ih264d_form_default_scaling_matrix(ps_dec);
+        ret = ih264d_form_default_scaling_matrix(ps_dec);
     }
-
+    
+    if(ret != OK)
+        return ret;
+ 
     /* required while reading the transform_size_8x8 u4_flag */
     ps_dec->s_high_profile.u1_direct_8x8_inference_flag =
                     ps_seq->u1_direct_8x8_inference_flag;
diff --git a/decoder/ih264d_quant_scaling.c b/decoder/ih264d_quant_scaling.c
index fa9aeb5..1d48907 100644
--- a/decoder/ih264d_quant_scaling.c
+++ b/decoder/ih264d_quant_scaling.c
@@ -74,7 +74,7 @@ void ih264d_scaling_list(WORD16 *pi2_scaling_list,
     }
 }
 
-void ih264d_form_default_scaling_matrix(dec_struct_t *ps_dec)
+WORD32 ih264d_form_default_scaling_matrix(dec_struct_t *ps_dec)
 {
 
     /*************************************************************************/
@@ -108,11 +108,12 @@ void ih264d_form_default_scaling_matrix(dec_struct_t *ps_dec)
             }
         }
     }
+    return OK;
 }
 
-void ih264d_form_scaling_matrix_picture(dec_seq_params_t *ps_seq,
-                                        dec_pic_params_t *ps_pic,
-                                        dec_struct_t *ps_dec)
+WORD32 ih264d_form_scaling_matrix_picture(dec_seq_params_t *ps_seq,
+                                          dec_pic_params_t *ps_pic,
+                                          dec_struct_t *ps_dec)
 {
     /* default scaling matrices */
     WORD32 i4_i;
@@ -216,7 +217,7 @@ void ih264d_form_scaling_matrix_picture(dec_seq_params_t *ps_seq,
             {
                 if(!ps_pic->u1_pic_scaling_list_present_flag[i4_i])
                 {
-                    if(!ps_seq->u1_seq_scaling_list_present_flag[i4_i])
+                    if(!ps_seq->i4_seq_scaling_matrix_present_flag)
                     {
                         ps_dec->s_high_profile.pi2_scale_mat[i4_i] =
                                         (i4_i == 6) ? ((WORD16*)gai2_ih264d_default_intra8x8) : ((WORD16*)gai2_ih264d_default_inter8x8);
@@ -251,6 +252,9 @@ void ih264d_form_scaling_matrix_picture(dec_seq_params_t *ps_seq,
         /* for all 4x4 matrices */
         for(i4_i = 0; i4_i < 6; i4_i++)
         {
+            if(ps_dec->s_high_profile.pi2_scale_mat[i4_i] == NULL)
+                return ERROR_CORRUPTED_SLICE;
+
             for(i4_j = 0; i4_j < 16; i4_j++)
             {
                 ps_dec->s_high_profile.i2_scalinglist4x4[i4_i][pu1_inv_scan_4x4[i4_j]] =
@@ -262,6 +266,9 @@ void ih264d_form_scaling_matrix_picture(dec_seq_params_t *ps_seq,
         /* for all 8x8 matrices */
         for(i4_i = 0; i4_i < 2; i4_i++)
         {
+            if(ps_dec->s_high_profile.pi2_scale_mat[i4_i + 6] == NULL)
+                return ERROR_CORRUPTED_SLICE;
+
             for(i4_j = 0; i4_j < 64; i4_j++)
             {
                 ps_dec->s_high_profile.i2_scalinglist8x8[i4_i][gau1_ih264d_inv_scan_prog8x8_cabac[i4_j]] =
@@ -270,5 +277,6 @@ void ih264d_form_scaling_matrix_picture(dec_seq_params_t *ps_seq,
             }
         }
     }
+    return OK;
 }
 
diff --git a/decoder/ih264d_quant_scaling.h b/decoder/ih264d_quant_scaling.h
index d9bd377..c714c34 100644
--- a/decoder/ih264d_quant_scaling.h
+++ b/decoder/ih264d_quant_scaling.h
@@ -25,11 +25,11 @@ void ih264d_scaling_list(WORD16 *pi2_scaling_list,
                   dec_bit_stream_t *ps_bitstrm);
 
 
-void ih264d_form_scaling_matrix_picture(dec_seq_params_t *ps_seq,
-                                 dec_pic_params_t *ps_pic,
-                                 dec_struct_t *ps_dec);
+WORD32 ih264d_form_scaling_matrix_picture(dec_seq_params_t *ps_seq,
+                                          dec_pic_params_t *ps_pic,
+                                          dec_struct_t *ps_dec);
 
-void ih264d_form_default_scaling_matrix(dec_struct_t *ps_dec);
+WORD32 ih264d_form_default_scaling_matrix(dec_struct_t *ps_dec);
 
 
 

From c82890ed09b9530a1f09c0e98023e3f41e418b32 Mon Sep 17 00:00:00 2001
From: Ivan Lozano <ivanlozano@google.com>
Date: Mon, 7 Jan 2019 10:34:13 -0800
Subject: [PATCH 14/28] Additional libavc blacklisted functions.

Add additional functions to the libavc blacklist. Some of these seem
to be benign overflows, and a couple are performance related.

Bug: 110791537
Test: One of the CTS media tests triggered this overflow.
Change-Id: I4b67171176e27811892495795c1a06b0374c325a
---
 libavc_blacklist.txt | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libavc_blacklist.txt b/libavc_blacklist.txt
index 078669f..5bb3630 100644
--- a/libavc_blacklist.txt
+++ b/libavc_blacklist.txt
@@ -20,9 +20,15 @@ fun:ih264d_ref_idx_reordering
 fun:ih264d_decode_temporal_direct
 # encoder/ime.c:153: 0 - 1 cannot be represented in type 'UWORD32'
 fun:ime_diamond_search_16x16
+# encoder/irc_rate_control_api.c:1251: 1000 * 1065353216 cannot be represented in type 'unsigned int'
+fun:irc_change_frame_rate
 # encoder/irc_rate_control_api.c:310: 6000000 * 1000 cannot be represented in type 'unsigned int'
 fun:irc_initialise_rate_control
 
 # Numerous overflows in multiple functions, CAVLC is a compression technique.
 src:*/decoder/ih264d_parse_cavlc.c
 src:*/encoder/ih264e_cavlc.c
+
+# Performance related
+fun:ih264e_pack_c_mb
+fun:ime_compute_satqd_16x16_lumainter_a9q

From 51f1a220ec2ea632ef45d5875c84653974a77401 Mon Sep 17 00:00:00 2001
From: Sasha Smundak <asmundak@google.com>
Date: Fri, 1 Feb 2019 09:42:34 -0800
Subject: [PATCH 15/28] Explicitly include log/log.h instead of cutils/log.h

Eliminates the warning.
Test: treehugger

Bug: 123758136
Change-Id: Id8940e053c90c45ba39cdd27a44cc83f130487b7
---
 decoder/ih264d_dpb_mgr.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/decoder/ih264d_dpb_mgr.c b/decoder/ih264d_dpb_mgr.c
index e35cb25..74ecdb5 100644
--- a/decoder/ih264d_dpb_mgr.c
+++ b/decoder/ih264d_dpb_mgr.c
@@ -18,8 +18,7 @@
  * Originally developed and contributed by Ittiam Systems Pvt. Ltd, Bangalore
 */
 #ifdef __ANDROID__
-#include "log/log.h"
-#include <android/log.h>
+#include <log/log.h>
 #endif
 #include "ih264_typedefs.h"
 #include "ih264_macros.h"

From 096aa214415a86a24a1945420e4943f8d1313af9 Mon Sep 17 00:00:00 2001
From: Ivan Lozano <ivanlozano@google.com>
Date: Tue, 12 Feb 2019 11:00:38 -0800
Subject: [PATCH 16/28] Remove libavc sanitizer diagnostics.

Remove libavc sanitizer diagnostics.

Bug: 111547941
Test: mma -j
Change-Id: I0d9bce58f23e71a9751c81eea74f48b33307b169
---
 Android.bp | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/Android.bp b/Android.bp
index 92050f8..732d386 100644
--- a/Android.bp
+++ b/Android.bp
@@ -238,11 +238,6 @@ cc_library_static {
         misc_undefined: ["bounds"],
         // Enable CFI if this becomes a shared library.
         // cfi: true,
-        diag: {
-            integer_overflow: true,
-            misc_undefined: ["bounds"],
-            no_recover: ["bounds", "integer"],
-        },
         blacklist: "libavc_blacklist.txt",
     },
 }
@@ -512,11 +507,6 @@ cc_library_static {
         misc_undefined: ["bounds"],
         // Enable CFI if this becomes a shared library.
         // cfi: true,
-        diag: {
-            integer_overflow: true,
-            misc_undefined: ["bounds"],
-            no_recover: ["bounds", "integer"],
-        },
         blacklist: "libavc_blacklist.txt",
     },
 }

From fc7139a53e12b41a622af98eb6c7ba2f42508009 Mon Sep 17 00:00:00 2001
From: Isha Shrikant Kulkarni <isha.kulkarni@ittiam.com>
Date: Fri, 11 Jan 2019 12:13:14 +0530
Subject: [PATCH 17/28] Decoder: Fix Integer Sanitizer issues in
 ih264d_process_bslice

Bug: 118445723
Test: vendor
Change-Id: Ib5d8f72be016330beafa6e7996976eeff1b23c39
---
 common/arm/ih264_platform_macros.h   | 15 +++++++++++++++
 common/armv8/ih264_platform_macros.h | 15 +++++++++++++++
 common/mips/ih264_platform_macros.h  |  3 +++
 common/x86/ih264_platform_macros.h   |  3 +++
 decoder/ih264d_parse_bslice.c        | 15 +++++++--------
 decoder/ih264d_process_bslice.c      | 14 +++++++-------
 6 files changed, 50 insertions(+), 15 deletions(-)

diff --git a/common/arm/ih264_platform_macros.h b/common/arm/ih264_platform_macros.h
index ed49db0..4720100 100644
--- a/common/arm/ih264_platform_macros.h
+++ b/common/arm/ih264_platform_macros.h
@@ -62,6 +62,18 @@ static __inline WORD32 CLIP_S10(WORD32 x)
     return x;
 }
 
+static __inline WORD32 CLIP_U11(WORD32 x)
+{
+    asm("usat %0, #11, %1" : "=r"(x) : "r"(x));
+    return x;
+}
+
+static __inline WORD32 CLIP_S11(WORD32 x)
+{
+    asm("ssat %0, #11, %1" : "=r"(x) : "r"(x));
+    return x;
+}
+
 static __inline WORD32 CLIP_U12(WORD32 x)
 {
     asm("usat %0, #12, %1" : "=r"(x) : "r"(x));
@@ -101,6 +113,9 @@ static __inline UWORD32 ITT_BIG_ENDIAN(UWORD32 x)
 #define CLIP_U10(x) CLIP3(0, 1023, (x))
 #define CLIP_S10(x) CLIP3(-512, 511, (x))
 
+#define CLIP_U11(x) CLIP3(0, 2047, (x))
+#define CLIP_S11(x) CLIP3(-1024, 1023, (x))
+
 #define CLIP_U12(x) CLIP3(0, 4095, (x))
 #define CLIP_S12(x) CLIP3(-2048, 2047, (x))
 
diff --git a/common/armv8/ih264_platform_macros.h b/common/armv8/ih264_platform_macros.h
index ed49db0..4720100 100644
--- a/common/armv8/ih264_platform_macros.h
+++ b/common/armv8/ih264_platform_macros.h
@@ -62,6 +62,18 @@ static __inline WORD32 CLIP_S10(WORD32 x)
     return x;
 }
 
+static __inline WORD32 CLIP_U11(WORD32 x)
+{
+    asm("usat %0, #11, %1" : "=r"(x) : "r"(x));
+    return x;
+}
+
+static __inline WORD32 CLIP_S11(WORD32 x)
+{
+    asm("ssat %0, #11, %1" : "=r"(x) : "r"(x));
+    return x;
+}
+
 static __inline WORD32 CLIP_U12(WORD32 x)
 {
     asm("usat %0, #12, %1" : "=r"(x) : "r"(x));
@@ -101,6 +113,9 @@ static __inline UWORD32 ITT_BIG_ENDIAN(UWORD32 x)
 #define CLIP_U10(x) CLIP3(0, 1023, (x))
 #define CLIP_S10(x) CLIP3(-512, 511, (x))
 
+#define CLIP_U11(x) CLIP3(0, 2047, (x))
+#define CLIP_S11(x) CLIP3(-1024, 1023, (x))
+
 #define CLIP_U12(x) CLIP3(0, 4095, (x))
 #define CLIP_S12(x) CLIP3(-2048, 2047, (x))
 
diff --git a/common/mips/ih264_platform_macros.h b/common/mips/ih264_platform_macros.h
index a8d9026..7d1af43 100644
--- a/common/mips/ih264_platform_macros.h
+++ b/common/mips/ih264_platform_macros.h
@@ -44,6 +44,9 @@
 #define CLIP_U10(x) CLIP3(0, 1023, (x))
 #define CLIP_S10(x) CLIP3(-512, 511, (x))
 
+#define CLIP_U11(x) CLIP3(0, 2047, (x))
+#define CLIP_S11(x) CLIP3(-1024, 1023, (x))
+
 #define CLIP_U12(x) CLIP3(0, 4095, (x))
 #define CLIP_S12(x) CLIP3(-2048, 2047, (x))
 
diff --git a/common/x86/ih264_platform_macros.h b/common/x86/ih264_platform_macros.h
index 67424aa..0bcffde 100644
--- a/common/x86/ih264_platform_macros.h
+++ b/common/x86/ih264_platform_macros.h
@@ -47,6 +47,9 @@
 #define CLIP_U10(x) CLIP3(0, 1023, (x))
 #define CLIP_S10(x) CLIP3(-512, 511, (x))
 
+#define CLIP_U11(x) CLIP3(0, 2047, (x))
+#define CLIP_S11(x) CLIP3(-1024, 1023, (x))
+
 #define CLIP_U12(x) CLIP3(0, 4095, (x))
 #define CLIP_S12(x) CLIP3(-2048, 2047, (x))
 
diff --git a/decoder/ih264d_parse_bslice.c b/decoder/ih264d_parse_bslice.c
index f087f8d..0af4214 100644
--- a/decoder/ih264d_parse_bslice.c
+++ b/decoder/ih264d_parse_bslice.c
@@ -1220,11 +1220,11 @@ void ih264d_get_implicit_weights(dec_struct_t *ps_dec)
             if(i4_poc1 != i4_poc0)
             {
                 i4_tb = ps_dec->ps_cur_pic->i4_poc - i4_poc0;
-                i16_tb = CLIP3(-128, 127, i4_tb);
+                i16_tb = CLIP_S8(i4_tb);
                 i4_td = i4_poc1 - i4_poc0;
-                i16_td = CLIP3(-128, 127, i4_td);
+                i16_td = CLIP_S8(i4_td);
                 i16_tx = (16384 + ABS(SIGN_POW2_DIV(i16_td, 1))) / i16_td;
-                i2_dist_scale_factor = CLIP3(-1024, 1023,
+                i2_dist_scale_factor = CLIP_S11(
                                             (((i16_tb * i16_tx) + 32) >> 6));
 
                 if(/*((u4_poc1 - u4_poc0) == 0) ||*/
@@ -1290,14 +1290,13 @@ void ih264d_get_implicit_weights(dec_struct_t *ps_dec)
                     if(i4_poc1 != i4_poc0)
                     {
                         i4_tb = i4_cur_poc - i4_poc0;
-                        i16_tb = CLIP3(-128, 127, i4_tb);
+                        i16_tb = CLIP_S8(i4_tb);
                         i4_td = i4_poc1 - i4_poc0;
-                        i16_td = CLIP3(-128, 127, i4_td);
+                        i16_td = CLIP_S8(i4_td);
                         i16_tx = (16384 + ABS(SIGN_POW2_DIV(i16_td, 1)))
                                         / i16_td;
-                        i2_dist_scale_factor = CLIP3(
-                                        -1024, 1023,
-                                        (((i16_tb * i16_tx) + 32) >> 6));
+                        i2_dist_scale_factor = CLIP_S11(
+                                                    (((i16_tb * i16_tx) + 32) >> 6));
 
                         if(/*((u4_poc1 - u4_poc0) == 0) ||*/
                         (!(ps_pic_buff1->u1_is_short && ps_pic_buff0->u1_is_short))
diff --git a/decoder/ih264d_process_bslice.c b/decoder/ih264d_process_bslice.c
index 42fad03..3ff15df 100644
--- a/decoder/ih264d_process_bslice.c
+++ b/decoder/ih264d_process_bslice.c
@@ -597,7 +597,7 @@ WORD32 ih264d_decode_temporal_direct(dec_struct_t * ps_dec,
     const UWORD8 *pu1_mb_partw = (const UWORD8 *)gau1_ih264d_mb_partw;
     WORD8 c_refFrm0, c_refFrm1;
     UWORD8 u1_ref_idx0, u1_is_cur_mb_fld;
-    UWORD32 pic0_poc, pic1_poc, cur_poc;
+    WORD32 pic0_poc, pic1_poc, cur_poc;
     WORD32 ret = 0;
 
     u1_is_cur_mb_fld = ps_cur_mb_info->u1_mb_field_decodingflag;
@@ -756,7 +756,7 @@ WORD32 ih264d_decode_temporal_direct(dec_struct_t * ps_dec,
         }
         {
             WORD16 i16_td;
-
+            WORD32 diff;
             if(c_refFrm0 >= 0)
             {
                 i2_mv_x0 = ps_mv->i2_mv[0];
@@ -782,7 +782,8 @@ WORD32 ih264d_decode_temporal_direct(dec_struct_t * ps_dec,
                 i2_mv_y0 *= 2;
             }
 
-            i16_td = pic1_poc - pic0_poc;
+            diff = pic1_poc - pic0_poc;
+            i16_td = CLIP_S8(diff);
             if((ps_pic_buff0->u1_is_short == 0) || (i16_td == 0))
             {
                 i2_mv_x1 = 0;
@@ -792,12 +793,11 @@ WORD32 ih264d_decode_temporal_direct(dec_struct_t * ps_dec,
             {
                 WORD16 i16_tb, i16_tx, i2_dist_scale_factor, i16_temp;
 
-                i16_td = CLIP3(-128, 127, i16_td);
-                i16_tb = cur_poc - pic0_poc;
-                i16_tb = CLIP3(-128, 127, i16_tb);
+                diff = cur_poc - pic0_poc;
+                i16_tb = CLIP_S8(diff);
 
                 i16_tx = (16384 + ABS(SIGN_POW2_DIV(i16_td, 1))) / i16_td;
-                i2_dist_scale_factor = CLIP3(-1024, 1023,
+                i2_dist_scale_factor = CLIP_S11(
                                             (((i16_tb * i16_tx) + 32) >> 6));
                 i16_temp = (i2_mv_x0 * i2_dist_scale_factor + 128) >> 8;
                 i2_mv_x1 = i16_temp - i2_mv_x0;

From 96f7193ba02493e7bb944a3195e25b1301af6416 Mon Sep 17 00:00:00 2001
From: Isha Shrikant Kulkarni <isha.kulkarni@ittiam.com>
Date: Fri, 11 Jan 2019 12:09:22 +0530
Subject: [PATCH 18/28] Decoder: Fix integer sanitizer issues in
 ih264d_parse_cabac

Bug: 118445723
Test: vendor
Change-Id: Icf98785fa474bd9c774ba4282b9c3d73360a69ea
---
 decoder/ih264d_defs.h        |  2 +-
 decoder/ih264d_parse_cabac.c | 18 +++++++++---------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/decoder/ih264d_defs.h b/decoder/ih264d_defs.h
index 260e358..61743be 100644
--- a/decoder/ih264d_defs.h
+++ b/decoder/ih264d_defs.h
@@ -600,7 +600,7 @@ enum
 #endif //DEBLOCK_THREAD
 
 #define NUM_COEFFS_IN_4x4BLK 16
-
+#define CABAC_BITS_TO_READ 23
 
 #define MEMSET_16BYTES(pu4_start,value)                         \
 {                                                               \
diff --git a/decoder/ih264d_parse_cabac.c b/decoder/ih264d_parse_cabac.c
index 9d58f33..c4a3bd5 100644
--- a/decoder/ih264d_parse_cabac.c
+++ b/decoder/ih264d_parse_cabac.c
@@ -400,7 +400,7 @@ UWORD8 ih264d_read_coeff4x4_cabac(dec_bit_stream_t *ps_bitstrm,
                         {
                             UWORD32 uc_bin;
                             UWORD32 bits_to_flush;
-                            UWORD32 max_bits = 32;
+
 
                             bits_to_flush = 0;
                             /*renormalize to ensure there 23 bits more in the u4_code_int_val_ofst*/
@@ -409,7 +409,7 @@ UWORD8 ih264d_read_coeff4x4_cabac(dec_bit_stream_t *ps_bitstrm,
 
                                 u4_clz = CLZ(u4_code_int_range);
                                 FLUSHBITS(u4_offset, u4_clz)
-                                NEXTBITS(read_bits, u4_offset, pu4_buffer, 23)
+                                NEXTBITS(read_bits, u4_offset, pu4_buffer, CABAC_BITS_TO_READ)
                                 u4_code_int_range = u4_code_int_range << u4_clz;
                                 u4_code_int_val_ofst = (u4_code_int_val_ofst
                                                 << u4_clz) | read_bits;
@@ -438,7 +438,7 @@ UWORD8 ih264d_read_coeff4x4_cabac(dec_bit_stream_t *ps_bitstrm,
                                                 ps_cab_env);INC_BYPASS_BINS(ps_cab_env);
 
                             }
-                            while(uc_bin && (bits_to_flush < max_bits));
+                            while(uc_bin && (bits_to_flush < CABAC_BITS_TO_READ));
 
                             u4_value = (bits_to_flush - 1);
 
@@ -459,7 +459,7 @@ UWORD8 ih264d_read_coeff4x4_cabac(dec_bit_stream_t *ps_bitstrm,
 
                                 u4_clz = CLZ(u4_code_int_range);
                                 FLUSHBITS(u4_offset, u4_clz)
-                                NEXTBITS(read_bits, u4_offset, pu4_buffer, 23)
+                                NEXTBITS(read_bits, u4_offset, pu4_buffer, CABAC_BITS_TO_READ)
                                 u4_code_int_range = u4_code_int_range << u4_clz;
                                 u4_code_int_val_ofst = (u4_code_int_val_ofst
                                                 << u4_clz) | read_bits;
@@ -868,7 +868,7 @@ void ih264d_read_coeff8x8_cabac(dec_bit_stream_t *ps_bitstrm,
                         {
                             UWORD32 uc_bin;
                             UWORD32 bits_to_flush;
-                            UWORD32 max_bits = 32;
+
 
                             bits_to_flush = 0;
                             /*renormalize to ensure there 23 bits more in the u4_code_int_val_ofst*/
@@ -877,7 +877,7 @@ void ih264d_read_coeff8x8_cabac(dec_bit_stream_t *ps_bitstrm,
 
                                 u4_clz = CLZ(u4_code_int_range);
                                 FLUSHBITS(u4_offset, u4_clz)
-                                NEXTBITS(read_bits, u4_offset, pu4_buffer, 23)
+                                NEXTBITS(read_bits, u4_offset, pu4_buffer, CABAC_BITS_TO_READ)
                                 u4_code_int_range = u4_code_int_range << u4_clz;
                                 u4_code_int_val_ofst = (u4_code_int_val_ofst
                                                 << u4_clz) | read_bits;
@@ -902,7 +902,7 @@ void ih264d_read_coeff8x8_cabac(dec_bit_stream_t *ps_bitstrm,
                                 }
 
                             }
-                            while(uc_bin && (bits_to_flush < max_bits));
+                            while(uc_bin && (bits_to_flush < CABAC_BITS_TO_READ));
 
                             u4_value = (bits_to_flush - 1);
                         }
@@ -921,7 +921,7 @@ void ih264d_read_coeff8x8_cabac(dec_bit_stream_t *ps_bitstrm,
 
                                 u4_clz = CLZ(u4_code_int_range);
                                 FLUSHBITS(u4_offset, u4_clz)
-                                NEXTBITS(read_bits, u4_offset, pu4_buffer, 23)
+                                NEXTBITS(read_bits, u4_offset, pu4_buffer, CABAC_BITS_TO_READ)
                                 u4_code_int_range = u4_code_int_range << u4_clz;
                                 u4_code_int_val_ofst = (u4_code_int_val_ofst
                                                 << u4_clz) | read_bits;
@@ -967,7 +967,7 @@ void ih264d_read_coeff8x8_cabac(dec_bit_stream_t *ps_bitstrm,
 
                         //Value of K
                         ui16_sufS += u4_value;
-                        i2_abs_lvl += ui16_sufS;
+                        i2_abs_lvl += (WORD32)ui16_sufS;
                     }
                     else
                     {

From 43dc60e81ef64cf5614438c55903c6d9a91345f3 Mon Sep 17 00:00:00 2001
From: Isha Kulkarni <isha.kulkarni@ittiam.com>
Date: Fri, 11 Jan 2019 16:48:08 +0530
Subject: [PATCH 19/28] Decoder: Fix Integer Sanitizer Issues in
 ih264d_parse_cavlc

Bug:118445723
Test: vendor
Change-Id: I71b3c0f548b57c51c80de0bd4c640f56b2f31a55
---
 decoder/ih264d_parse_cavlc.c | 65 +++++++++++++++++++++---------------
 1 file changed, 39 insertions(+), 26 deletions(-)

diff --git a/decoder/ih264d_parse_cavlc.c b/decoder/ih264d_parse_cavlc.c
index b6a0125..d538a4e 100644
--- a/decoder/ih264d_parse_cavlc.c
+++ b/decoder/ih264d_parse_cavlc.c
@@ -474,8 +474,11 @@ WORD32 ih264d_cavlc_4x4res_block_totalcoeff_2to10(UWORD32 u4_isdc,
 
         pi2_trlone_lkup = ppi2_trlone_lkup[(1 << u4_cnt) - 2 + u4_signs];
 
-        while(u4_cnt--)
+        while(u4_cnt)
+        {
             i2_level_arr[i--] = *pi2_trlone_lkup++;
+            u4_cnt--;
+        }
     }
 
     /****************************************************************/
@@ -610,7 +613,7 @@ WORD32 ih264d_cavlc_4x4res_block_totalcoeff_2to10(UWORD32 u4_isdc,
         const UWORD8 *pu1_table_runbefore;
         UWORD32 u4_run;
         WORD32 k;
-        UWORD32 u4_scan_pos = u4_total_coeff + u4_total_zeroes - 1 + u4_isdc;
+        WORD32 u4_scan_pos = u4_total_coeff + u4_total_zeroes - 1 + u4_isdc;
         WORD32 u4_zeroes_left = u4_total_zeroes;
         k = u4_total_coeff - 1;
 
@@ -638,10 +641,13 @@ WORD32 ih264d_cavlc_4x4res_block_totalcoeff_2to10(UWORD32 u4_isdc,
 
             SET_BIT(ps_tu_4x4->u2_sig_coeff_map, u4_scan_pos);
             *pi2_coeff_data++ = i2_level_arr[k--];
-            u4_zeroes_left -= u4_run;
-            u4_scan_pos -= (u4_run + 1);
+            u4_zeroes_left -= (WORD32)u4_run;
+            u4_scan_pos -= (WORD32)(u4_run + 1);
         }
 
+        if (u4_zeroes_left < 0 || u4_scan_pos < 0)
+            return -1;
+
         /**************************************************************/
         /* Decoding Runs for 0 < zeros left <=6                       */
         /**************************************************************/
@@ -658,9 +664,11 @@ WORD32 ih264d_cavlc_4x4res_block_totalcoeff_2to10(UWORD32 u4_isdc,
 
             SET_BIT(ps_tu_4x4->u2_sig_coeff_map, u4_scan_pos);
             *pi2_coeff_data++ = i2_level_arr[k--];
-            u4_zeroes_left -= u4_run;
-            u4_scan_pos -= (u4_run + 1);
+            u4_zeroes_left -= (WORD32)u4_run;
+            u4_scan_pos -= (WORD32)(u4_run + 1);
         }
+        if (u4_zeroes_left < 0 || u4_scan_pos < 0)
+            return -1;
         /**************************************************************/
         /* Decoding Runs End                                          */
         /**************************************************************/
@@ -668,8 +676,6 @@ WORD32 ih264d_cavlc_4x4res_block_totalcoeff_2to10(UWORD32 u4_isdc,
         /**************************************************************/
         /* Copy the remaining coefficients                            */
         /**************************************************************/
-        if(u4_zeroes_left < 0)
-            return -1;
         while(k >= 0)
         {
 
@@ -755,8 +761,11 @@ WORD32 ih264d_cavlc_4x4res_block_totalcoeff_11to16(UWORD32 u4_isdc,
 
         pi2_trlone_lkup = ppi2_trlone_lkup[(1 << u4_cnt) - 2 + u4_signs];
 
-        while(u4_cnt--)
+        while(u4_cnt)
+        {
             i2_level_arr[i--] = *pi2_trlone_lkup++;
+            u4_cnt--;
+        }
     }
 
     /****************************************************************/
@@ -921,7 +930,7 @@ WORD32 ih264d_cavlc_4x4res_block_totalcoeff_11to16(UWORD32 u4_isdc,
         const UWORD8 *pu1_table_runbefore;
         UWORD32 u4_run;
         WORD32 k;
-        UWORD32 u4_scan_pos = u4_total_coeff + u4_total_zeroes - 1 + u4_isdc;
+        WORD32 u4_scan_pos = u4_total_coeff + u4_total_zeroes - 1 + u4_isdc;
         WORD32 u4_zeroes_left = u4_total_zeroes;
         k = u4_total_coeff - 1;
 
@@ -940,9 +949,12 @@ WORD32 ih264d_cavlc_4x4res_block_totalcoeff_11to16(UWORD32 u4_isdc,
             FLUSHBITS(u4_bitstream_offset, (u4_code & 0x03));
             SET_BIT(ps_tu_4x4->u2_sig_coeff_map, u4_scan_pos);
             *pi2_coeff_data++ = i2_level_arr[k--];
-            u4_zeroes_left -= u4_run;
-            u4_scan_pos -= (u4_run + 1);
+            u4_zeroes_left -= (WORD32)u4_run;
+            u4_scan_pos -= (WORD32)(u4_run + 1);
         }
+        if (u4_zeroes_left < 0 || u4_scan_pos < 0)
+          return -1;
+
         /**************************************************************/
         /* Decoding Runs End                                          */
         /**************************************************************/
@@ -950,8 +962,6 @@ WORD32 ih264d_cavlc_4x4res_block_totalcoeff_11to16(UWORD32 u4_isdc,
         /**************************************************************/
         /* Copy the remaining coefficients                            */
         /**************************************************************/
-        if(u4_zeroes_left < 0)
-            return -1;
         while(k >= 0)
         {
             SET_BIT(ps_tu_4x4->u2_sig_coeff_map, u4_scan_pos);
@@ -1031,8 +1041,11 @@ void ih264d_rest_of_residual_cav_chroma_dc_block(UWORD32 u4_total_coeff_trail_on
 
         pi2_trlone_lkup = ppi2_trlone_lkup[(1 << u4_cnt) - 2 + u4_signs];
 
-        while(u4_cnt--)
+        while(u4_cnt)
+        {
             i2_level_arr[i--] = *pi2_trlone_lkup++;
+            u4_cnt--;
+        }
     }
 
     /****************************************************************/
@@ -1154,7 +1167,7 @@ void ih264d_rest_of_residual_cav_chroma_dc_block(UWORD32 u4_total_coeff_trail_on
     {
         const UWORD8 *pu1_table_runbefore;
         UWORD32 u4_run;
-        UWORD32 u4_scan_pos = (u4_total_coeff + u4_total_zeroes - 1);
+        WORD32 u4_scan_pos = (u4_total_coeff + u4_total_zeroes - 1);
         UWORD32 u4_zeroes_left = u4_total_zeroes;
         i = u4_total_coeff - 1;
 
@@ -1173,8 +1186,8 @@ void ih264d_rest_of_residual_cav_chroma_dc_block(UWORD32 u4_total_coeff_trail_on
             FLUSHBITS(u4_bitstream_offset, (u4_code & 0x03));
             SET_BIT(ps_tu_4x4->u2_sig_coeff_map, u4_scan_pos);
             *pi2_coeff_data++ = i2_level_arr[i--];
-            u4_zeroes_left -= u4_run;
-            u4_scan_pos -= (u4_run + 1);
+            u4_zeroes_left -= (WORD32)u4_run;
+            u4_scan_pos -= (WORD32)(u4_run + 1);
         }
         /**************************************************************/
         /* Decoding Runs End                                          */
@@ -1378,10 +1391,10 @@ void ih264d_cavlc_parse_chroma_dc(dec_mb_info_t *ps_cur_mb_info,
         /*-----------------------------------------------------------*/
         /* Scaling and storing the values back                       */
         /*-----------------------------------------------------------*/
-        *pi2_coeff_data++ = ((i_z0 + i_z3) * u4_scale_u) >> 5;
-        *pi2_coeff_data++ = ((i_z0 - i_z3) * u4_scale_u) >> 5;
-        *pi2_coeff_data++ = ((i_z1 + i_z2) * u4_scale_u) >> 5;
-        *pi2_coeff_data++ = ((i_z1 - i_z2) * u4_scale_u) >> 5;
+        *pi2_coeff_data++ = (WORD16)(((i_z0 + i_z3) * (WORD32)u4_scale_u) >> 5);
+        *pi2_coeff_data++ = (WORD16)(((i_z0 - i_z3) * (WORD32)u4_scale_u) >> 5);
+        *pi2_coeff_data++ = (WORD16)(((i_z1 + i_z2) * (WORD32)u4_scale_u) >> 5);
+        *pi2_coeff_data++ = (WORD16)(((i_z1 - i_z2) * (WORD32)u4_scale_u) >> 5);
 
         ps_dec->pv_parse_tu_coeff_data = (void *)pi2_coeff_data;
 
@@ -1441,10 +1454,10 @@ void ih264d_cavlc_parse_chroma_dc(dec_mb_info_t *ps_cur_mb_info,
         /*-----------------------------------------------------------*/
         /* Scaling and storing the values back                       */
         /*-----------------------------------------------------------*/
-        *pi2_coeff_data++ = ((i_z0 + i_z3) * u4_scale_v) >> 5;
-        *pi2_coeff_data++ = ((i_z0 - i_z3) * u4_scale_v) >> 5;
-        *pi2_coeff_data++ = ((i_z1 + i_z2) * u4_scale_v) >> 5;
-        *pi2_coeff_data++ = ((i_z1 - i_z2) * u4_scale_v) >> 5;
+        *pi2_coeff_data++ = (WORD16)(((i_z0 + i_z3) * (WORD32)u4_scale_v) >> 5);
+        *pi2_coeff_data++ = (WORD16)(((i_z0 - i_z3) * (WORD32)u4_scale_v) >> 5);
+        *pi2_coeff_data++ = (WORD16)(((i_z1 + i_z2) * (WORD32)u4_scale_v) >> 5);
+        *pi2_coeff_data++ = (WORD16)(((i_z1 - i_z2) * (WORD32)u4_scale_v) >> 5);
 
         ps_dec->pv_parse_tu_coeff_data = (void *)pi2_coeff_data;
 

From 34769a5b08624ff4f10add43e78d227d2a9d8559 Mon Sep 17 00:00:00 2001
From: Isha Kulkarni <isha.kulkarni@ittiam.com>
Date: Mon, 28 Jan 2019 17:43:35 +0530
Subject: [PATCH 20/28] Decoder: Fix Integer Sanitizer Issues

Bug: 118445723
Test: vendor
Change-Id: I719898beb93ca5d20d9822f685ac6d4920252cdf
---
 common/arm/ih264_platform_macros.h   |  4 +++
 common/armv8/ih264_platform_macros.h |  4 +++
 common/ih264_typedefs.h              | 18 ++++++------
 common/mips/ih264_platform_macros.h  |  2 ++
 common/x86/ih264_platform_macros.h   |  2 ++
 decoder/ih264d_api.c                 | 16 +++++------
 decoder/ih264d_defs.h                |  1 +
 decoder/ih264d_dpb_mgr.c             | 19 +++++++++----
 decoder/ih264d_parse_headers.c       | 41 ++++++++++++++++------------
 decoder/ih264d_sei.c                 | 24 ++++++++--------
 decoder/ih264d_utils.c               | 34 +++++++++++++----------
 11 files changed, 99 insertions(+), 66 deletions(-)

diff --git a/common/arm/ih264_platform_macros.h b/common/arm/ih264_platform_macros.h
index 4720100..a4908ff 100644
--- a/common/arm/ih264_platform_macros.h
+++ b/common/arm/ih264_platform_macros.h
@@ -133,6 +133,10 @@ static __inline UWORD32 ITT_BIG_ENDIAN(UWORD32 x)
 
 #endif
 
+/*saturating instructions are not available for WORD64 in ARMv7, hence we cannot
+ * use inline assembly like other clips*/
+#define CLIP_S32(x) CLIP3(-4294967296, 4294967295, (x))
+
 #define DATA_SYNC() __sync_synchronize()
 
 #define SHL(x,y) (((y) < 32) ? ((x) << (y)) : 0)
diff --git a/common/armv8/ih264_platform_macros.h b/common/armv8/ih264_platform_macros.h
index 4720100..a4908ff 100644
--- a/common/armv8/ih264_platform_macros.h
+++ b/common/armv8/ih264_platform_macros.h
@@ -133,6 +133,10 @@ static __inline UWORD32 ITT_BIG_ENDIAN(UWORD32 x)
 
 #endif
 
+/*saturating instructions are not available for WORD64 in ARMv7, hence we cannot
+ * use inline assembly like other clips*/
+#define CLIP_S32(x) CLIP3(-4294967296, 4294967295, (x))
+
 #define DATA_SYNC() __sync_synchronize()
 
 #define SHL(x,y) (((y) < 32) ? ((x) << (y)) : 0)
diff --git a/common/ih264_typedefs.h b/common/ih264_typedefs.h
index 8e4685a..29138c6 100644
--- a/common/ih264_typedefs.h
+++ b/common/ih264_typedefs.h
@@ -37,23 +37,23 @@
 #ifndef _IH264_TYPEDEFS_H_
 #define _IH264_TYPEDEFS_H_
 
-
+#include <stdint.h>
 /*****************************************************************************/
 /* Unsigned data types                                                       */
 /*****************************************************************************/
-typedef unsigned char   UWORD8;
-typedef unsigned short  UWORD16;
-typedef unsigned int    UWORD32;
-typedef unsigned long long   UWORD64;
+typedef uint8_t   UWORD8;
+typedef uint16_t  UWORD16;
+typedef uint32_t  UWORD32;
+typedef uint64_t  UWORD64;
 
 
 /*****************************************************************************/
 /* Signed data types                                                         */
 /*****************************************************************************/
-typedef signed char     WORD8;
-typedef short           WORD16;
-typedef int             WORD32;
-
+typedef int8_t     WORD8;
+typedef int16_t    WORD16;
+typedef int32_t    WORD32;
+typedef int64_t    WORD64;
 
 /*****************************************************************************/
 /* Miscellaneous data types                                                  */
diff --git a/common/mips/ih264_platform_macros.h b/common/mips/ih264_platform_macros.h
index 7d1af43..a4db20a 100644
--- a/common/mips/ih264_platform_macros.h
+++ b/common/mips/ih264_platform_macros.h
@@ -53,6 +53,8 @@
 #define CLIP_U16(x) CLIP3(0, 65535, (x))
 #define CLIP_S16(x) CLIP3(-32768, 32767, (x))
 
+#define CLIP_S32(x) CLIP3(-4294967296, 4294967295, (x))
+
 #define MEM_ALIGN16 __attribute__ ((aligned (16)))
 
 #define SHL(x,y) (((y) < 32) ? ((x) << (y)) : 0)
diff --git a/common/x86/ih264_platform_macros.h b/common/x86/ih264_platform_macros.h
index 0bcffde..e545114 100644
--- a/common/x86/ih264_platform_macros.h
+++ b/common/x86/ih264_platform_macros.h
@@ -56,6 +56,8 @@
 #define CLIP_U16(x) CLIP3(0, 65535, (x))
 #define CLIP_S16(x) CLIP3(-32768, 32767, (x))
 
+#define CLIP_S32(x) CLIP3(-4294967296, 4294967295, (x))
+
 #define MEM_ALIGN16 __attribute__ ((aligned (16)))
 
 #define SHL(x,y) (((y) < 32) ? ((x) << (y)) : 0)
diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c
index 5500c6a..25ead89 100644
--- a/decoder/ih264d_api.c
+++ b/decoder/ih264d_api.c
@@ -1008,7 +1008,7 @@ void ih264d_init_decoder(void * ps_dec_params)
     ps_dec->u4_total_frames_decoded = 0;
 
     ps_dec->i4_error_code = 0;
-    ps_dec->i4_content_type = -1;
+    ps_dec->i4_content_type = IV_CONTENTTYPE_NA;
     ps_dec->ps_cur_slice->u1_mbaff_frame_flag = 0;
 
     ps_dec->ps_dec_err_status->u1_err_flag = ACCEPT_ALL_PICS; //REJECT_PB_PICS;
@@ -1058,9 +1058,9 @@ void ih264d_init_decoder(void * ps_dec_params)
 
     /* The Initial Frame Rate Info is not Present */
     ps_dec->i4_vui_frame_rate = -1;
-    ps_dec->i4_pic_type = -1;
-    ps_dec->i4_frametype = -1;
-    ps_dec->i4_content_type = -1;
+    ps_dec->i4_pic_type = NA_SLICE;
+    ps_dec->i4_frametype = IV_NA_FRAME;
+    ps_dec->i4_content_type = IV_CONTENTTYPE_NA;
 
     ps_dec->u1_res_changed = 0;
 
@@ -1905,12 +1905,12 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
     ps_dec->u4_ts = ps_dec_ip->u4_ts;
 
     ps_dec_op->u4_error_code = 0;
-    ps_dec_op->e_pic_type = -1;
+    ps_dec_op->e_pic_type = IV_NA_FRAME;
     ps_dec_op->u4_output_present = 0;
     ps_dec_op->u4_frame_decoded_flag = 0;
 
-    ps_dec->i4_frametype = -1;
-    ps_dec->i4_content_type = -1;
+    ps_dec->i4_frametype = IV_NA_FRAME;
+    ps_dec->i4_content_type = IV_CONTENTTYPE_NA;
 
     ps_dec->u4_slice_start_code_found = 0;
 
@@ -3490,7 +3490,7 @@ WORD32 ih264d_rel_display_frame(iv_obj_t *dec_hdl,
     ivd_rel_display_frame_op_t *ps_rel_op;
     UWORD32 buf_released = 0;
 
-    UWORD32 u4_ts = -1;
+    UWORD32 u4_ts = 0;
     dec_struct_t *ps_dec = dec_hdl->pv_codec_handle;
 
     ps_rel_ip = (ivd_rel_display_frame_ip_t *)pv_api_ip;
diff --git a/decoder/ih264d_defs.h b/decoder/ih264d_defs.h
index 61743be..ec3f2af 100644
--- a/decoder/ih264d_defs.h
+++ b/decoder/ih264d_defs.h
@@ -351,6 +351,7 @@ enum
 #define DISP_BOT_FLD    0x01
 
 /** Slice Types */
+#define NA_SLICE -1
 #define P_SLICE  0
 #define B_SLICE  1
 #define I_SLICE  2
diff --git a/decoder/ih264d_dpb_mgr.c b/decoder/ih264d_dpb_mgr.c
index 74ecdb5..af414a5 100644
--- a/decoder/ih264d_dpb_mgr.c
+++ b/decoder/ih264d_dpb_mgr.c
@@ -747,18 +747,22 @@ WORD32 ih264d_ref_idx_reordering(dec_struct_t *ps_dec, UWORD8 uc_lx)
         ui_nextUev = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
         if(ui_remapIdc != 2)
         {
+            if(ui_nextUev > ui_max_frame_num)
+                return ERROR_DBP_MANAGER_T;
+
             ui_nextUev = ui_nextUev + 1;
+
             if(ui_remapIdc == 0)
             {
                 // diffPicNum is -ve
-                i_temp = u2_pred_frame_num - ui_nextUev;
+                i_temp = (WORD32)u2_pred_frame_num - (WORD32)ui_nextUev;
                 if(i_temp < 0)
                     i_temp += ui_max_frame_num;
             }
             else
             {
                 // diffPicNum is +ve
-                i_temp = u2_pred_frame_num + ui_nextUev;
+                i_temp = (WORD32)u2_pred_frame_num + (WORD32)ui_nextUev;
                 if(i_temp >= ui_max_frame_num)
                     i_temp -= ui_max_frame_num;
             }
@@ -786,7 +790,12 @@ WORD32 ih264d_ref_idx_reordering(dec_struct_t *ps_dec, UWORD8 uc_lx)
         }
         else //2
         {
-            UWORD8 u1_lt_idx = (UWORD8)ui_nextUev;
+            UWORD8 u1_lt_idx;
+
+            if(ui_nextUev > (MAX_REF_BUFS + 1))
+                return ERROR_DBP_MANAGER_T;
+
+            u1_lt_idx = (UWORD8)ui_nextUev;
 
             for(i = 0; i < (ps_cur_slice->u1_initial_list_size[uc_lx]); i++)
             {
@@ -1170,7 +1179,7 @@ WORD32 ih264d_do_mmco_buffer(dpb_commands_t *ps_dpb_cmds,
                         u4_diff_pic_num = ps_mmc_params->u4_diff_pic_num; //Get absDiffPicnumMinus1
                         if(u1_fld_pic_flag)
                             i4_cur_pic_num = i4_cur_pic_num * 2 + 1;
-                        i4_pic_num = i4_cur_pic_num - (u4_diff_pic_num + 1);
+                        i4_pic_num = ((WORD32)i4_cur_pic_num - ((WORD32)u4_diff_pic_num + 1));
                     }
 
                     if(ps_dpb_mgr->u1_num_st_ref_bufs > 0)
@@ -1218,7 +1227,7 @@ WORD32 ih264d_do_mmco_buffer(dpb_commands_t *ps_dpb_cmds,
                         if(u1_fld_pic_flag)
                             i4_cur_pic_num = i4_cur_pic_num * 2 + 1;
 
-                        i4_pic_num = i4_cur_pic_num - (u4_diff_pic_num + 1);
+                        i4_pic_num = (WORD32)i4_cur_pic_num - ((WORD32)u4_diff_pic_num + 1);
                     }
 
                     u4_lt_idx = ps_mmc_params->u4_lt_idx; //Get long term index
diff --git a/decoder/ih264d_parse_headers.c b/decoder/ih264d_parse_headers.c
index d9f50f4..a53d7c4 100644
--- a/decoder/ih264d_parse_headers.c
+++ b/decoder/ih264d_parse_headers.c
@@ -488,7 +488,7 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
     UWORD8 u1_frm, uc_constraint_set0_flag, uc_constraint_set1_flag;
     WORD32 i4_cropped_ht, i4_cropped_wd;
     UWORD32 u4_temp;
-    WORD32 pic_height_in_map_units_minus1 = 0;
+    UWORD32 u4_pic_height_in_map_units, u4_pic_width_in_mbs;
     UWORD32 u2_pic_wd = 0;
     UWORD32 u2_pic_ht = 0;
     UWORD32 u2_frm_wd_y = 0;
@@ -498,7 +498,7 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
     UWORD32 u2_crop_offset_y = 0;
     UWORD32 u2_crop_offset_uv = 0;
     WORD32 ret;
-    UWORD32 u4_num_reorder_frames;
+    WORD32 num_reorder_frames;
     /* High profile related syntax element */
     WORD32 i4_i;
     /* G050 */
@@ -771,18 +771,25 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
     /*--------------------------------------------------------------------*/
     /* Decode FrameWidth and FrameHeight and related values               */
     /*--------------------------------------------------------------------*/
-    ps_seq->u2_frm_wd_in_mbs = 1
+    u4_pic_width_in_mbs = 1
                     + ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
     COPYTHECONTEXT("SPS: pic_width_in_mbs_minus1",
-                    ps_seq->u2_frm_wd_in_mbs - 1);
-    u2_pic_wd = (ps_seq->u2_frm_wd_in_mbs << 4);
+                   u4_pic_width_in_mbs - 1);
 
-    pic_height_in_map_units_minus1 = ih264d_uev(pu4_bitstrm_ofst,
+    u4_pic_height_in_map_units = 1 + ih264d_uev(pu4_bitstrm_ofst,
                                                 pu4_bitstrm_buf);
-    ps_seq->u2_frm_ht_in_mbs = 1 + pic_height_in_map_units_minus1;
 
-    u2_pic_ht = (ps_seq->u2_frm_ht_in_mbs << 4);
+    /* Check  for unsupported resolutions*/
+    if((u4_pic_width_in_mbs > (H264_MAX_FRAME_WIDTH >> 4)) ||
+        (u4_pic_height_in_map_units > (H264_MAX_FRAME_HEIGHT >> 4)))
+    {
+        return IVD_STREAM_WIDTH_HEIGHT_NOT_SUPPORTED;
+    }
+    ps_seq->u2_frm_wd_in_mbs = u4_pic_width_in_mbs;
+    ps_seq->u2_frm_ht_in_mbs = u4_pic_height_in_map_units;
 
+    u2_pic_wd = (u4_pic_width_in_mbs << 4);
+    u2_pic_ht = (u4_pic_height_in_map_units << 4);
     /*--------------------------------------------------------------------*/
     /* Get the value of MaxMbAddress and Number of bits needed for it     */
     /*--------------------------------------------------------------------*/
@@ -911,8 +918,8 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
                         + (u2_lft_ofst >> 1) * YUV420SP_FACTOR;
         /* Calculate the display picture width and height based on crop      */
         /* information                                                       */
-        i4_cropped_ht = u2_pic_ht - (u2_btm_ofst + u2_top_ofst);
-        i4_cropped_wd = u2_pic_wd - (u2_rgt_ofst + u2_lft_ofst);
+        i4_cropped_ht = (WORD32)u2_pic_ht - (WORD32)(u2_btm_ofst + u2_top_ofst);
+        i4_cropped_wd = (WORD32)u2_pic_wd - (WORD32)(u2_rgt_ofst + u2_lft_ofst);
 
         if((i4_cropped_ht < MB_SIZE) || (i4_cropped_wd < MB_SIZE))
         {
@@ -943,7 +950,7 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
             return IVD_RES_CHANGED;
         }
 
-        /* Check for unsupported resolutions */
+        /* Check again for unsupported resolutions with updated values*/
         if((u2_pic_wd > H264_MAX_FRAME_WIDTH) || (u2_pic_ht > H264_MAX_FRAME_HEIGHT)
                 || (u2_pic_wd < H264_MIN_FRAME_WIDTH) || (u2_pic_ht < H264_MIN_FRAME_HEIGHT)
                 || (u2_pic_wd * (UWORD32)u2_pic_ht > H264_MAX_FRAME_SIZE))
@@ -962,16 +969,16 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
 
     }
 
-    /* Backup u4_num_reorder_frames if header is already decoded */
+    /* Backup num_reorder_frames if header is already decoded */
     if((ps_dec->i4_header_decoded & 1) &&
                     (1 == ps_seq->u1_vui_parameters_present_flag) &&
                     (1 == ps_seq->s_vui.u1_bitstream_restriction_flag))
     {
-        u4_num_reorder_frames =  ps_seq->s_vui.u4_num_reorder_frames;
+        num_reorder_frames =  (WORD32)ps_seq->s_vui.u4_num_reorder_frames;
     }
     else
     {
-        u4_num_reorder_frames = -1;
+        num_reorder_frames = -1;
     }
     if(1 == ps_seq->u1_vui_parameters_present_flag)
     {
@@ -980,12 +987,12 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
             return ret;
     }
 
-    /* Compare older u4_num_reorder_frames with the new one if header is already decoded */
+    /* Compare older num_reorder_frames with the new one if header is already decoded */
     if((ps_dec->i4_header_decoded & 1) &&
-                    (-1 != (WORD32)u4_num_reorder_frames) &&
+                    (-1 != num_reorder_frames) &&
                     (1 == ps_seq->u1_vui_parameters_present_flag) &&
                     (1 == ps_seq->s_vui.u1_bitstream_restriction_flag) &&
-                    (ps_seq->s_vui.u4_num_reorder_frames != u4_num_reorder_frames))
+                    ((WORD32)ps_seq->s_vui.u4_num_reorder_frames != num_reorder_frames))
     {
         ps_dec->u1_res_changed = 1;
         return IVD_RES_CHANGED;
diff --git a/decoder/ih264d_sei.c b/decoder/ih264d_sei.c
index 098a1f3..39be782 100644
--- a/decoder/ih264d_sei.c
+++ b/decoder/ih264d_sei.c
@@ -197,6 +197,10 @@ WORD32 ih264d_parse_pic_timing(dec_bit_stream_t *ps_bitstrm,
         ps_sei->u1_is_valid = 1;
     }
     u4_bits_consumed = ps_bitstrm->u4_ofst - u4_start_offset;
+
+    if((ui4_payload_size << 3) < u4_bits_consumed)
+        return ERROR_CORRUPTED_SLICE;
+
     ih264d_flush_bits_h264(ps_bitstrm,
                            (ui4_payload_size << 3) - u4_bits_consumed);
 
@@ -275,28 +279,30 @@ WORD32 ih264d_parse_sei_payload(dec_bit_stream_t *ps_bitstrm,
     sei *ps_sei;
     WORD32 i4_status = 0;
     ps_sei = (sei *)ps_dec->ps_sei;
+
+    if(ui4_payload_size == 0)
+        return -1;
+
     switch(ui4_payload_type)
     {
         case SEI_BUF_PERIOD:
 
             i4_status = ih264d_parse_buffering_period(&ps_sei->s_buf_period,
                                                       ps_bitstrm, ps_dec);
-            /*if(i4_status != OK)
-                return i4_status;*/
             break;
         case SEI_PIC_TIMING:
             if(NULL == ps_dec->ps_cur_sps)
-                ih264d_flush_bits_h264(ps_bitstrm, (ui4_payload_size << 3));
+                i4_status = ih264d_flush_bits_h264(ps_bitstrm, (ui4_payload_size << 3));
             else
-                ih264d_parse_pic_timing(ps_bitstrm, ps_dec,
+                i4_status = ih264d_parse_pic_timing(ps_bitstrm, ps_dec,
                                         ui4_payload_size);
             break;
         case SEI_RECOVERY_PT:
-            ih264d_parse_recovery_point(ps_bitstrm, ps_dec,
+            i4_status = ih264d_parse_recovery_point(ps_bitstrm, ps_dec,
                                         ui4_payload_size);
             break;
         default:
-            ih264d_flush_bits_h264(ps_bitstrm, (ui4_payload_size << 3));
+            i4_status = ih264d_flush_bits_h264(ps_bitstrm, (ui4_payload_size << 3));
             break;
     }
     return (i4_status);
@@ -354,12 +360,6 @@ WORD32 ih264d_parse_sei_message(dec_struct_t *ps_dec,
 
         i4_status = ih264d_parse_sei_payload(ps_bitstrm, ui4_payload_type,
                                              ui4_payload_size, ps_dec);
-        if(i4_status == -1)
-        {
-            i4_status = 0;
-            break;
-        }
-
         if(i4_status != OK)
             return i4_status;
 
diff --git a/decoder/ih264d_utils.c b/decoder/ih264d_utils.c
index bbbf175..49b9c08 100644
--- a/decoder/ih264d_utils.c
+++ b/decoder/ih264d_utils.c
@@ -240,8 +240,9 @@ WORD32 ih264d_decode_pic_order_cnt(UWORD8 u1_is_idr_slice,
             WORD32 frame_num_ofst;
             WORD32 abs_frm_num;
             WORD32 poc_cycle_cnt, frame_num_in_poc_cycle;
-            WORD32 expected_delta_poc_cycle;
+            WORD64 i8_expected_delta_poc_cycle;
             WORD32 expected_poc;
+            WORD64 i8_result;
 
             prev_frame_num = (WORD32)ps_cur_slice->u2_frame_num;
             if(!u1_is_idr_slice)
@@ -269,25 +270,25 @@ WORD32 ih264d_decode_pic_order_cnt(UWORD8 u1_is_idr_slice,
             else if(prev_frame_num > ((WORD32)u2_frame_num))
             {
                 frame_num_ofst = i4_prev_frame_num_ofst
-                                + ps_seq->u2_u4_max_pic_num_minus1 + 1;
+                                + (WORD32)ps_seq->u2_u4_max_pic_num_minus1 + 1;
             }
             else
                 frame_num_ofst = i4_prev_frame_num_ofst;
 
             /* 2. Derivation for absFrameNum */
             if(0 != ps_seq->u1_num_ref_frames_in_pic_order_cnt_cycle)
-                abs_frm_num = frame_num_ofst + u2_frame_num;
+                abs_frm_num = frame_num_ofst + (WORD32)u2_frame_num;
             else
                 abs_frm_num = 0;
             if((u1_nal_ref_idc == 0) && (abs_frm_num > 0))
                 abs_frm_num = abs_frm_num - 1;
 
             /* 4. expectedDeltaPerPicOrderCntCycle is derived as */
-            expected_delta_poc_cycle = 0;
+            i8_expected_delta_poc_cycle = 0;
             for(i = 0; i < ps_seq->u1_num_ref_frames_in_pic_order_cnt_cycle;
                             i++)
             {
-                expected_delta_poc_cycle +=
+                i8_expected_delta_poc_cycle +=
                                 ps_seq->i4_ofst_for_ref_frame[i];
             }
 
@@ -303,13 +304,16 @@ WORD32 ih264d_decode_pic_order_cnt(UWORD8 u1_is_idr_slice,
                                 MOD((abs_frm_num - 1),
                                     ps_seq->u1_num_ref_frames_in_pic_order_cnt_cycle);
 
-                expected_poc = poc_cycle_cnt
-                                * expected_delta_poc_cycle;
+                i8_result = poc_cycle_cnt
+                                * i8_expected_delta_poc_cycle;
+
                 for(i = 0; i <= frame_num_in_poc_cycle; i++)
                 {
-                    expected_poc = expected_poc
+                    i8_result = i8_result
                                     + ps_seq->i4_ofst_for_ref_frame[i];
                 }
+
+                expected_poc =(WORD32)CLIP_S32(i8_result);
             }
             else
                 expected_poc = 0;
@@ -376,7 +380,7 @@ WORD32 ih264d_decode_pic_order_cnt(UWORD8 u1_is_idr_slice,
             else if(prev_frame_num > ((WORD32)u2_frame_num))
             {
                 frame_num_ofst = i4_prev_frame_num_ofst
-                                + ps_seq->u2_u4_max_pic_num_minus1 + 1;
+                                + (WORD32)ps_seq->u2_u4_max_pic_num_minus1 + 1;
             }
             else
                 frame_num_ofst = i4_prev_frame_num_ofst;
@@ -385,10 +389,10 @@ WORD32 ih264d_decode_pic_order_cnt(UWORD8 u1_is_idr_slice,
             if(u1_is_idr_slice)
                 tmp_poc = 0;
             else if(u1_nal_ref_idc == 0)
-                tmp_poc = ((frame_num_ofst + u2_frame_num) << 1)
+                tmp_poc = ((frame_num_ofst + (WORD32)u2_frame_num) << 1)
                                 - 1;
             else
-                tmp_poc = ((frame_num_ofst + u2_frame_num) << 1);
+                tmp_poc = ((frame_num_ofst + (WORD32)u2_frame_num) << 1);
 
             /* 6. TopFieldOrderCnt or BottomFieldOrderCnt are derived as */
             if(!u1_field_pic_flag)
@@ -706,9 +710,9 @@ WORD32 ih264d_init_pic(dec_struct_t *ps_dec,
 
     ps_dec->ps_dpb_mgr->u2_pic_ht = ps_dec->u2_pic_ht;
     ps_dec->ps_dpb_mgr->u2_pic_wd = ps_dec->u2_pic_wd;
-    ps_dec->i4_pic_type = -1;
-    ps_dec->i4_frametype = -1;
-    ps_dec->i4_content_type = -1;
+    ps_dec->i4_pic_type = NA_SLICE;
+    ps_dec->i4_frametype = IV_NA_FRAME;
+    ps_dec->i4_content_type = IV_CONTENTTYPE_NA;
 
     /*--------------------------------------------------------------------*/
     /* Get the value of MaxMbAddress and frmheight in Mbs                 */
@@ -909,7 +913,7 @@ WORD32 ih264d_get_next_display_field(dec_struct_t * ps_dec,
                     (disp_mgr_t *)ps_dec->pv_disp_buf_mgr, &i4_disp_buf_id);
     ps_dec->u4_num_fld_in_frm = 0;
     u4_api_ret = -1;
-    pv_disp_op->u4_ts = -1;
+    pv_disp_op->u4_ts = 0;
     pv_disp_op->e_output_format = ps_dec->u1_chroma_format;
 
     pv_disp_op->s_disp_frm_buf.pv_y_buf = ps_out_buffer->pu1_bufs[0];

From 65477dcfb93b4a059ea4e527f4c02e2d301e64cf Mon Sep 17 00:00:00 2001
From: S Hamsalekha <hamsalekha.s@ittiam.com>
Date: Fri, 1 Feb 2019 18:04:23 +0530
Subject: [PATCH 21/28] Decoder: Replacing some numbers with equivalent macros.

Bug: 118445723
Test: vendor
Change-Id: I2dbdf3bf289c34409db341d7c0502cd88a20bab5
---
 common/arm/ih264_platform_macros.h   | 13 ++++++++-----
 common/armv8/ih264_platform_macros.h | 13 ++++++++-----
 common/mips/ih264_platform_macros.h  | 13 ++++++++-----
 common/x86/ih264_platform_macros.h   | 13 +++++++------
 4 files changed, 31 insertions(+), 21 deletions(-)

diff --git a/common/arm/ih264_platform_macros.h b/common/arm/ih264_platform_macros.h
index a4908ff..a4d7f3a 100644
--- a/common/arm/ih264_platform_macros.h
+++ b/common/arm/ih264_platform_macros.h
@@ -36,6 +36,8 @@
 #ifndef _IH264_PLATFORM_MACROS_H_
 #define _IH264_PLATFORM_MACROS_H_
 
+#include <stdint.h>
+
 #ifndef  ARMV8
 
 static __inline WORD32 CLIP_U8(WORD32 x)
@@ -107,8 +109,8 @@ static __inline UWORD32 ITT_BIG_ENDIAN(UWORD32 x)
 
 #else
 
-#define CLIP_U8(x) CLIP3(0, 255, (x))
-#define CLIP_S8(x) CLIP3(-128, 127, (x))
+#define CLIP_U8(x) CLIP3(0, UINT8_MAX, (x))
+#define CLIP_S8(x) CLIP3(INT8_MIN, INT8_MAX, (x))
 
 #define CLIP_U10(x) CLIP3(0, 1023, (x))
 #define CLIP_S10(x) CLIP3(-512, 511, (x))
@@ -119,8 +121,8 @@ static __inline UWORD32 ITT_BIG_ENDIAN(UWORD32 x)
 #define CLIP_U12(x) CLIP3(0, 4095, (x))
 #define CLIP_S12(x) CLIP3(-2048, 2047, (x))
 
-#define CLIP_U16(x) CLIP3(0, 65535, (x))
-#define CLIP_S16(x) CLIP3(-32768, 32767, (x))
+#define CLIP_U16(x) CLIP3(0, UINT16_MAX, (x))
+#define CLIP_S16(x) CLIP3(INT16_MIN, INT16_MAX, (x))
 
 #define ITT_BIG_ENDIAN(x)       __asm__("rev %0, %1" : "=r"(x) : "r"(x));
 
@@ -135,7 +137,8 @@ static __inline UWORD32 ITT_BIG_ENDIAN(UWORD32 x)
 
 /*saturating instructions are not available for WORD64 in ARMv7, hence we cannot
  * use inline assembly like other clips*/
-#define CLIP_S32(x) CLIP3(-4294967296, 4294967295, (x))
+#define CLIP_U32(x) CLIP3(0, UINT32_MAX, (x))
+#define CLIP_S32(x) CLIP3(INT32_MIN, INT32_MAX, (x))
 
 #define DATA_SYNC() __sync_synchronize()
 
diff --git a/common/armv8/ih264_platform_macros.h b/common/armv8/ih264_platform_macros.h
index a4908ff..a4d7f3a 100644
--- a/common/armv8/ih264_platform_macros.h
+++ b/common/armv8/ih264_platform_macros.h
@@ -36,6 +36,8 @@
 #ifndef _IH264_PLATFORM_MACROS_H_
 #define _IH264_PLATFORM_MACROS_H_
 
+#include <stdint.h>
+
 #ifndef  ARMV8
 
 static __inline WORD32 CLIP_U8(WORD32 x)
@@ -107,8 +109,8 @@ static __inline UWORD32 ITT_BIG_ENDIAN(UWORD32 x)
 
 #else
 
-#define CLIP_U8(x) CLIP3(0, 255, (x))
-#define CLIP_S8(x) CLIP3(-128, 127, (x))
+#define CLIP_U8(x) CLIP3(0, UINT8_MAX, (x))
+#define CLIP_S8(x) CLIP3(INT8_MIN, INT8_MAX, (x))
 
 #define CLIP_U10(x) CLIP3(0, 1023, (x))
 #define CLIP_S10(x) CLIP3(-512, 511, (x))
@@ -119,8 +121,8 @@ static __inline UWORD32 ITT_BIG_ENDIAN(UWORD32 x)
 #define CLIP_U12(x) CLIP3(0, 4095, (x))
 #define CLIP_S12(x) CLIP3(-2048, 2047, (x))
 
-#define CLIP_U16(x) CLIP3(0, 65535, (x))
-#define CLIP_S16(x) CLIP3(-32768, 32767, (x))
+#define CLIP_U16(x) CLIP3(0, UINT16_MAX, (x))
+#define CLIP_S16(x) CLIP3(INT16_MIN, INT16_MAX, (x))
 
 #define ITT_BIG_ENDIAN(x)       __asm__("rev %0, %1" : "=r"(x) : "r"(x));
 
@@ -135,7 +137,8 @@ static __inline UWORD32 ITT_BIG_ENDIAN(UWORD32 x)
 
 /*saturating instructions are not available for WORD64 in ARMv7, hence we cannot
  * use inline assembly like other clips*/
-#define CLIP_S32(x) CLIP3(-4294967296, 4294967295, (x))
+#define CLIP_U32(x) CLIP3(0, UINT32_MAX, (x))
+#define CLIP_S32(x) CLIP3(INT32_MIN, INT32_MAX, (x))
 
 #define DATA_SYNC() __sync_synchronize()
 
diff --git a/common/mips/ih264_platform_macros.h b/common/mips/ih264_platform_macros.h
index a4db20a..fa0ba61 100644
--- a/common/mips/ih264_platform_macros.h
+++ b/common/mips/ih264_platform_macros.h
@@ -38,8 +38,10 @@
 #ifndef _IH264_PLATFORM_MACROS_H_
 #define _IH264_PLATFORM_MACROS_H_
 
-#define CLIP_U8(x) CLIP3(0, 255, (x))
-#define CLIP_S8(x) CLIP3(-128, 127, (x))
+#include <stdint.h>
+
+#define CLIP_U8(x) CLIP3(0, UINT8_MAX, (x))
+#define CLIP_S8(x) CLIP3(INT8_MIN, INT8_MAX, (x))
 
 #define CLIP_U10(x) CLIP3(0, 1023, (x))
 #define CLIP_S10(x) CLIP3(-512, 511, (x))
@@ -50,10 +52,11 @@
 #define CLIP_U12(x) CLIP3(0, 4095, (x))
 #define CLIP_S12(x) CLIP3(-2048, 2047, (x))
 
-#define CLIP_U16(x) CLIP3(0, 65535, (x))
-#define CLIP_S16(x) CLIP3(-32768, 32767, (x))
+#define CLIP_U16(x) CLIP3(0, UINT16_MAX, (x))
+#define CLIP_S16(x) CLIP3(INT16_MIN, INT16_MAX, (x))
 
-#define CLIP_S32(x) CLIP3(-4294967296, 4294967295, (x))
+#define CLIP_U32(x) CLIP3(0, UINT32_MAX, (x))
+#define CLIP_S32(x) CLIP3(INT32_MIN, INT32_MAX, (x))
 
 #define MEM_ALIGN16 __attribute__ ((aligned (16)))
 
diff --git a/common/x86/ih264_platform_macros.h b/common/x86/ih264_platform_macros.h
index e545114..54af325 100644
--- a/common/x86/ih264_platform_macros.h
+++ b/common/x86/ih264_platform_macros.h
@@ -38,11 +38,11 @@
 #ifndef _IH264_PLATFORM_MACROS_H_
 #define _IH264_PLATFORM_MACROS_H_
 
+#include <stdint.h>
 #include <immintrin.h>
 
-
-#define CLIP_U8(x) CLIP3(0, 255, (x))
-#define CLIP_S8(x) CLIP3(-128, 127, (x))
+#define CLIP_U8(x) CLIP3(0, UINT8_MAX, (x))
+#define CLIP_S8(x) CLIP3(INT8_MIN, INT8_MAX, (x))
 
 #define CLIP_U10(x) CLIP3(0, 1023, (x))
 #define CLIP_S10(x) CLIP3(-512, 511, (x))
@@ -53,10 +53,11 @@
 #define CLIP_U12(x) CLIP3(0, 4095, (x))
 #define CLIP_S12(x) CLIP3(-2048, 2047, (x))
 
-#define CLIP_U16(x) CLIP3(0, 65535, (x))
-#define CLIP_S16(x) CLIP3(-32768, 32767, (x))
+#define CLIP_U16(x) CLIP3(0, UINT16_MAX, (x))
+#define CLIP_S16(x) CLIP3(INT16_MIN, INT16_MAX, (x))
 
-#define CLIP_S32(x) CLIP3(-4294967296, 4294967295, (x))
+#define CLIP_U32(x) CLIP3(0, UINT32_MAX, (x))
+#define CLIP_S32(x) CLIP3(INT32_MIN, INT32_MAX, (x))
 
 #define MEM_ALIGN16 __attribute__ ((aligned (16)))
 

From fabba6afaf8d870e4c92d9e0c0e2f622625718b9 Mon Sep 17 00:00:00 2001
From: Harish Mahendrakar <harish.mahendrakar@ittiam.com>
Date: Thu, 8 Mar 2018 14:42:15 -0800
Subject: [PATCH 22/28] Encoder: Increased max supported bitrate

Increased max bitrate to 240mbps
Bug: 116040772
Test: CTS test

Change-Id: I87d5e2e540e72d3a41a04becf01ff13965361a23
---
 encoder/ih264e_defs.h | 4 ++--
 test/encoder/app.h    | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/encoder/ih264e_defs.h b/encoder/ih264e_defs.h
index 4537bc2..36ce3e9 100644
--- a/encoder/ih264e_defs.h
+++ b/encoder/ih264e_defs.h
@@ -202,7 +202,7 @@
 #define DEFAULT_RECON_ENABLE            0
 #define DEFAULT_RC                      IVE_RC_STORAGE
 #define DEFAULT_MAX_FRAMERATE           120000
-#define DEFAULT_MAX_BITRATE             50000000
+#define DEFAULT_MAX_BITRATE             240000000
 #define DEFAULT_MAX_NUM_BFRAMES         0
 #define DEFAULT_MAX_SRCH_RANGE_X        256
 #define DEFAULT_MAX_SRCH_RANGE_Y        256
@@ -218,7 +218,7 @@
 #define DEFAULT_AIR_MODE                IVE_AIR_MODE_NONE
 #define DEFAULT_AIR_REFRESH_PERIOD      30
 #define DEFAULT_VBV_DELAY               1000
-#define DEFAULT_VBV_SIZE                16800000 /* level 3.1 */
+#define DEFAULT_VBV_SIZE                240000000 /* level 6.0 */
 #define DEFAULT_NUM_CORES               1
 #define DEFAULT_ME_SPEED_PRESET         100
 #define DEFAULT_HPEL                    1
diff --git a/test/encoder/app.h b/test/encoder/app.h
index 0e9a3df..8a2fb0a 100644
--- a/test/encoder/app.h
+++ b/test/encoder/app.h
@@ -75,7 +75,7 @@
 #define DEFAULT_MAX_REORDER_FRM     0
 #define DEFAULT_QP_MIN              4
 #define DEFAULT_QP_MAX              51
-#define DEFAULT_MAX_BITRATE         50000000
+#define DEFAULT_MAX_BITRATE         240000000
 #define DEFAULT_NUM_BFRAMES         0
 #define DEFAULT_MAX_SRCH_RANGE_X    256
 #define DEFAULT_MAX_SRCH_RANGE_Y    256

From 54160a6d3e6528d75f609f511cea0c8d447de1fa Mon Sep 17 00:00:00 2001
From: Harish Mahendrakar <harish.mahendrakar@ittiam.com>
Date: Tue, 16 Apr 2019 10:51:53 -0700
Subject: [PATCH 23/28] decoder: Treat unsupported feature errors as fatal
 errors

This will ensure clips with supported bitdepth or unsupport color
formats are not attempted to be decoded till end of the sequence.

Bug: 130578045
Test: adb shell stagefright -s -S /sdcard/crowd422_h264.mp4
Test: Ensure decoder doesn't attemp decoding all frames

Change-Id: I118ef2141f77986f6ec65c91dfeaa7ef17646c43
---
 decoder/ih264d.h               | 1 +
 decoder/ih264d_api.c           | 7 +++++--
 decoder/ih264d_parse_headers.c | 6 +++---
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/decoder/ih264d.h b/decoder/ih264d.h
index 7c76296..83f8a1f 100644
--- a/decoder/ih264d.h
+++ b/decoder/ih264d.h
@@ -50,6 +50,7 @@ extern "C" {
 /*****************************************************************************/
 /* Constant Macros                                                           */
 /*****************************************************************************/
+#define IVD_ERROR_MASK 0xFF
 
 /*****************************************************************************/
 /* Function Macros                                                           */
diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c
index 25ead89..dc31632 100644
--- a/decoder/ih264d_api.c
+++ b/decoder/ih264d_api.c
@@ -1549,7 +1549,7 @@ WORD32 ih264d_create(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
             }
         }
         ps_create_op->s_ivd_create_op_t.u4_error_code = IVD_MEM_ALLOC_FAILED;
-        ps_create_op->s_ivd_create_op_t.u4_error_code = 1 << IVD_FATALERROR;
+        ps_create_op->s_ivd_create_op_t.u4_error_code |= 1 << IVD_FATALERROR;
 
         return IV_FAIL;
     }
@@ -1591,6 +1591,8 @@ UWORD32 ih264d_map_error(UWORD32 i4_err_status)
         case ERROR_PROFILE_NOT_SUPPORTED:
         case ERROR_INIT_NOT_DONE:
         case IVD_MEM_ALLOC_FAILED:
+        case ERROR_FEATURE_UNAVAIL:
+        case IVD_STREAM_WIDTH_HEIGHT_NOT_SUPPORTED:
             temp = 1 << IVD_FATALERROR;
             H264_DEC_DEBUG_PRINT("\nFatal Error\n");
             break;
@@ -1625,7 +1627,6 @@ UWORD32 ih264d_map_error(UWORD32 i4_err_status)
             break;
 
         case ERROR_NOT_SUPP_RESOLUTION:
-        case ERROR_FEATURE_UNAVAIL:
         case ERROR_ACTUAL_LEVEL_GREATER_THAN_INIT:
             temp = 1 << IVD_UNSUPPORTEDINPUT;
             break;
@@ -2260,6 +2261,8 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
                             || (ret == ERROR_UNAVAIL_PICBUF_T)
                             || (ret == ERROR_UNAVAIL_MVBUF_T)
                             || (ret == ERROR_INV_SPS_PPS_T)
+                            || (ret == ERROR_FEATURE_UNAVAIL)
+                            || (ret == IVD_STREAM_WIDTH_HEIGHT_NOT_SUPPORTED)
                             || (ret == IVD_DISP_FRM_ZERO_OP_BUF_SIZE))
             {
                 ps_dec->u4_slice_start_code_found = 0;
diff --git a/decoder/ih264d_parse_headers.c b/decoder/ih264d_parse_headers.c
index a53d7c4..4325390 100644
--- a/decoder/ih264d_parse_headers.c
+++ b/decoder/ih264d_parse_headers.c
@@ -608,7 +608,7 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
         /* Monochrome is not supported */
         if(ps_seq->i4_chroma_format_idc != 1)
         {
-            return ERROR_INV_SPS_PPS_T;
+            return ERROR_FEATURE_UNAVAIL;
         }
 
         /* reading bit_depth_luma_minus8   */
@@ -617,7 +617,7 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
 
         if(ps_seq->i4_bit_depth_luma_minus8 != 0)
         {
-            return ERROR_INV_SPS_PPS_T;
+            return ERROR_FEATURE_UNAVAIL;
         }
 
         /* reading bit_depth_chroma_minus8   */
@@ -626,7 +626,7 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
 
         if(ps_seq->i4_bit_depth_chroma_minus8 != 0)
         {
-            return ERROR_INV_SPS_PPS_T;
+            return ERROR_FEATURE_UNAVAIL;
         }
 
         /* reading qpprime_y_zero_transform_bypass_flag   */

From b3427a4c49b844e6f4cd1a3f1c0b7474dda358d6 Mon Sep 17 00:00:00 2001
From: Ritu Baldwa <ritu.baldwa@ittiam.com>
Date: Wed, 28 Mar 2018 13:22:45 +0530
Subject: [PATCH 24/28] Decoder: Add missing error checks for parsing sps or
 pps

Return error to application if valid sps or pps has not been decoded.
Also add check to prevent parsing of pps, if valid sps is not present.

Test: Tested a few clips with missing sps/pps
Bug: 129746168
Bug: 130575087

Change-Id: I1a6409d1cffc66c1b910d2102ab10a94e0227107
---
 decoder/ih264d_api.c           | 8 +-------
 decoder/ih264d_parse_headers.c | 6 ++++++
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c
index 25ead89..91f78a1 100644
--- a/decoder/ih264d_api.c
+++ b/decoder/ih264d_api.c
@@ -2429,16 +2429,10 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
     }
 
 //Report if header (sps and pps) has not been decoded yet
-    if(ps_dec->i4_header_decoded != 3)
-    {
-        ps_dec_op->u4_error_code |= (1 << IVD_INSUFFICIENTDATA);
-
-    }
-
     if(ps_dec->i4_decode_header == 1 && ps_dec->i4_header_decoded != 3)
     {
         ps_dec_op->u4_error_code |= (1 << IVD_INSUFFICIENTDATA);
-
+        api_ret_value = IV_FAIL;
     }
     if(ps_dec->u4_prev_nal_skipped)
     {
diff --git a/decoder/ih264d_parse_headers.c b/decoder/ih264d_parse_headers.c
index a53d7c4..edb51ed 100644
--- a/decoder/ih264d_parse_headers.c
+++ b/decoder/ih264d_parse_headers.c
@@ -205,6 +205,9 @@ WORD32 ih264d_parse_pps(dec_struct_t * ps_dec, dec_bit_stream_t * ps_bitstrm)
     UWORD8 u1_more_data_flag;
     WORD32 i4_i;
 
+    if(!(ps_dec->i4_header_decoded & 1))
+        return ERROR_INV_SPS_PPS_T;
+
     /*--------------------------------------------------------------------*/
     /* Decode pic_parameter_set_id and find corresponding pic params      */
     /*--------------------------------------------------------------------*/
@@ -230,6 +233,9 @@ WORD32 ih264d_parse_pps(dec_struct_t * ps_dec, dec_bit_stream_t * ps_bitstrm)
         return ERROR_INV_SPS_PPS_T;
     COPYTHECONTEXT("PPS: seq_parameter_set_id",u4_temp);
     ps_sps = &ps_dec->ps_sps[u4_temp];
+
+    if(FALSE == ps_sps->u1_is_valid)
+        return ERROR_INV_SPS_PPS_T;
     ps_pps->ps_sps = ps_sps;
 
     /*--------------------------------------------------------------------*/

From 4f95fc0b9cfdebce2adbad847285c69f8247df71 Mon Sep 17 00:00:00 2001
From: Harish Mahendrakar <harish.mahendrakar@ittiam.com>
Date: Mon, 15 Apr 2019 09:29:47 -0700
Subject: [PATCH 25/28] decoder: Remove skip picture support

SKIP_P and SKIP_PB support was experimental and is not used
in libstagefright

Bug: 130541597
Test: poc in bug
Change-Id: If13b435e80d13d57de2fee0aa07ea7e6abca481b
---
 decoder/ih264d_api.c         | 113 +----------------------------------
 decoder/ih264d_parse_slice.c |  56 -----------------
 decoder/ih264d_structs.h     |   4 --
 3 files changed, 2 insertions(+), 171 deletions(-)

diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c
index 25ead89..048792f 100644
--- a/decoder/ih264d_api.c
+++ b/decoder/ih264d_api.c
@@ -975,9 +975,6 @@ void ih264d_init_decoder(void * ps_dec_params)
     ps_dec->i4_degrade_type = 0;
     ps_dec->i4_degrade_pics = 0;
 
-    ps_dec->i4_app_skip_mode = IVD_SKIP_NONE;
-    ps_dec->i4_dec_skip_mode = IVD_SKIP_NONE;
-
     memset(ps_dec->ps_pps, 0,
            ((sizeof(dec_pic_params_t)) * MAX_NUM_PIC_PARAMS));
     memset(ps_dec->ps_sps, 0,
@@ -2073,8 +2070,6 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
         ih264d_init_decoder(ps_dec);
     }
 
-    ps_dec->u4_prev_nal_skipped = 0;
-
     ps_dec->u2_cur_mb_addr = 0;
     ps_dec->u2_total_mbs_coded = 0;
     ps_dec->u2_cur_slice_num = 0;
@@ -2151,51 +2146,6 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
         bytes_consumed = buflen + u4_length_of_start_code;
         ps_dec_op->u4_num_bytes_consumed += bytes_consumed;
 
-        {
-            UWORD8 u1_firstbyte, u1_nal_ref_idc;
-
-            if(ps_dec->i4_app_skip_mode == IVD_SKIP_B)
-            {
-                u1_firstbyte = *(pu1_buf + u4_length_of_start_code);
-                u1_nal_ref_idc = (UWORD8)(NAL_REF_IDC(u1_firstbyte));
-                if(u1_nal_ref_idc == 0)
-                {
-                    /*skip non reference frames*/
-                    cur_slice_is_nonref = 1;
-                    continue;
-                }
-                else
-                {
-                    if(1 == cur_slice_is_nonref)
-                    {
-                        /*We have encountered a referenced frame,return to app*/
-                        ps_dec_op->u4_num_bytes_consumed -=
-                                        bytes_consumed;
-                        ps_dec_op->e_pic_type = IV_B_FRAME;
-                        ps_dec_op->u4_error_code =
-                                        IVD_DEC_FRM_SKIPPED;
-                        ps_dec_op->u4_error_code |= (1
-                                        << IVD_UNSUPPORTEDPARAM);
-                        ps_dec_op->u4_frame_decoded_flag = 0;
-                        ps_dec_op->u4_size =
-                                        sizeof(ivd_video_decode_op_t);
-                        /*signal the decode thread*/
-                        ih264d_signal_decode_thread(ps_dec);
-                        /* close deblock thread if it is not closed yet*/
-                        if(ps_dec->u4_num_cores == 3)
-                        {
-                            ih264d_signal_bs_deblk_thread(ps_dec);
-                        }
-
-                        return (IV_FAIL);
-                    }
-                }
-
-            }
-
-        }
-
-
         if(buflen)
         {
             memcpy(pu1_bitstrm_buf, pu1_buf + u4_length_of_start_code,
@@ -2246,7 +2196,6 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
 
         }
 
-        ps_dec->u4_return_to_app = 0;
         ret = ih264d_parse_nal_unit(dec_hdl, ps_dec_op,
                               pu1_bitstrm_buf, buflen);
         if(ret != OK)
@@ -2281,27 +2230,6 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
 
         }
 
-        if(ps_dec->u4_return_to_app)
-        {
-            /*We have encountered a referenced frame,return to app*/
-            ps_dec_op->u4_num_bytes_consumed -= bytes_consumed;
-            ps_dec_op->u4_error_code = IVD_DEC_FRM_SKIPPED;
-            ps_dec_op->u4_error_code |= (1 << IVD_UNSUPPORTEDPARAM);
-            ps_dec_op->u4_frame_decoded_flag = 0;
-            ps_dec_op->u4_size = sizeof(ivd_video_decode_op_t);
-            /*signal the decode thread*/
-            ih264d_signal_decode_thread(ps_dec);
-            /* close deblock thread if it is not closed yet*/
-            if(ps_dec->u4_num_cores == 3)
-            {
-                ih264d_signal_bs_deblk_thread(ps_dec);
-            }
-            return (IV_FAIL);
-
-        }
-
-
-
         header_data_left = ((ps_dec->i4_decode_header == 1)
                         && (ps_dec->i4_header_decoded != 3)
                         && (ps_dec_op->u4_num_bytes_consumed
@@ -2439,21 +2367,6 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
     {
         ps_dec_op->u4_error_code |= (1 << IVD_INSUFFICIENTDATA);
 
-    }
-    if(ps_dec->u4_prev_nal_skipped)
-    {
-        /*We have encountered a referenced frame,return to app*/
-        ps_dec_op->u4_error_code = IVD_DEC_FRM_SKIPPED;
-        ps_dec_op->u4_error_code |= (1 << IVD_UNSUPPORTEDPARAM);
-        ps_dec_op->u4_frame_decoded_flag = 0;
-        ps_dec_op->u4_size = sizeof(ivd_video_decode_op_t);
-        /* close deblock thread if it is not closed yet*/
-        if(ps_dec->u4_num_cores == 3)
-        {
-            ih264d_signal_bs_deblk_thread(ps_dec);
-        }
-        return (IV_FAIL);
-
     }
 
     if((ps_dec->u4_pic_buf_got == 1)
@@ -3166,32 +3079,10 @@ WORD32 ih264d_set_params(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
 
     ps_ctl_op->u4_error_code = 0;
 
-    ps_dec->i4_app_skip_mode = ps_ctl_ip->e_frm_skip_mode;
-
-    /*Is it really supported test it when you so the corner testing using test app*/
-
     if(ps_ctl_ip->e_frm_skip_mode != IVD_SKIP_NONE)
     {
-
-        if(ps_ctl_ip->e_frm_skip_mode == IVD_SKIP_P)
-            ps_dec->u4_skip_frm_mask |= 1 << P_SLC_BIT;
-        else if(ps_ctl_ip->e_frm_skip_mode == IVD_SKIP_B)
-            ps_dec->u4_skip_frm_mask |= 1 << B_SLC_BIT;
-        else if(ps_ctl_ip->e_frm_skip_mode == IVD_SKIP_PB)
-        {
-            ps_dec->u4_skip_frm_mask |= 1 << B_SLC_BIT;
-            ps_dec->u4_skip_frm_mask |= 1 << P_SLC_BIT;
-        }
-        else if(ps_ctl_ip->e_frm_skip_mode == IVD_SKIP_I)
-            ps_dec->u4_skip_frm_mask |= 1 << I_SLC_BIT;
-        else
-        {
-            //dynamic parameter not supported
-            //Put an appropriate error code to return the error..
-            //when you do the error code tests and after that remove this comment
-            ps_ctl_op->u4_error_code = (1 << IVD_UNSUPPORTEDPARAM);
-            ret = IV_FAIL;
-        }
+        ps_ctl_op->u4_error_code = (1 << IVD_UNSUPPORTEDPARAM);
+        ret = IV_FAIL;
     }
 
     if(ps_ctl_ip->u4_disp_wd >= ps_dec->u2_pic_wd)
diff --git a/decoder/ih264d_parse_slice.c b/decoder/ih264d_parse_slice.c
index 5282738..c384f45 100644
--- a/decoder/ih264d_parse_slice.c
+++ b/decoder/ih264d_parse_slice.c
@@ -1060,62 +1060,6 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice,
         u1_slice_type -= 5;
     }
 
-    {
-        UWORD32 skip;
-
-        if((ps_dec->i4_app_skip_mode == IVD_SKIP_PB)
-                        || (ps_dec->i4_dec_skip_mode == IVD_SKIP_PB))
-        {
-            UWORD32 u4_bit_stream_offset = 0;
-
-            if(ps_dec->u1_nal_unit_type == IDR_SLICE_NAL)
-            {
-                skip = 0;
-
-                ps_dec->i4_dec_skip_mode = IVD_SKIP_NONE;
-            }
-            else if((I_SLICE == u1_slice_type)
-                            && (1 >= ps_dec->ps_cur_sps->u1_num_ref_frames))
-            {
-                skip = 0;
-
-                ps_dec->i4_dec_skip_mode = IVD_SKIP_NONE;
-            }
-            else
-            {
-                skip = 1;
-            }
-
-            /* If one frame worth of data is already skipped, do not skip the next one */
-            if((0 == u2_first_mb_in_slice) && (1 == ps_dec->u4_prev_nal_skipped))
-            {
-                skip = 0;
-            }
-
-            if(skip)
-            {
-                ps_dec->u4_prev_nal_skipped = 1;
-                ps_dec->i4_dec_skip_mode = IVD_SKIP_PB;
-                return 0;
-            }
-            else
-            {
-                /* If the previous NAL was skipped, then
-                 do not process that buffer in this call.
-                 Return to app and process it in the next call.
-                 This is necessary to handle cases where I/IDR is not complete in
-                 the current buffer and application intends to fill the remaining part of the bitstream
-                 later. This ensures we process only frame worth of data in every call */
-                if(1 == ps_dec->u4_prev_nal_skipped)
-                {
-                    ps_dec->u4_return_to_app = 1;
-                    return 0;
-                }
-            }
-        }
-
-    }
-
     u4_temp = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
     if(u4_temp & MASK_ERR_PIC_SET_ID)
         return ERROR_INV_SLICE_HDR_T;
diff --git a/decoder/ih264d_structs.h b/decoder/ih264d_structs.h
index 706fe9d..97e9797 100644
--- a/decoder/ih264d_structs.h
+++ b/decoder/ih264d_structs.h
@@ -1231,7 +1231,6 @@ typedef struct _DecStruct
     UWORD32 u4_num_mbs_cur_nmb;
     UWORD32 u4_app_deblk_disable_level;
     UWORD32 u4_app_disable_deblk_frm;
-    WORD32 i4_app_skip_mode;
     WORD32 i4_mv_frac_mask;
 
     disp_buf_t disp_bufs[MAX_DISP_BUFS_NEW];
@@ -1239,9 +1238,6 @@ typedef struct _DecStruct
     UWORD32 u4_disp_buf_to_be_freed[MAX_DISP_BUFS_NEW];
     UWORD32 u4_share_disp_buf;
     UWORD32 u4_num_disp_bufs;
-    UWORD32 u4_prev_nal_skipped;
-    UWORD32 u4_return_to_app;
-    WORD32 i4_dec_skip_mode;
 
     UWORD32 u4_bs_deblk_thread_created;
     volatile UWORD32 u4_start_recon_deblk;

From f312a1d305dae23f9f6f663d2157bf9cf47bb92c Mon Sep 17 00:00:00 2001
From: Rakesh Kumar <rakesh.kumar@ittiam.com>
Date: Mon, 9 Jul 2018 21:58:44 +0530
Subject: [PATCH 26/28] Decoder: Delete node from st if lt and st point to same

If lt_list and st_list point to same node then delete it from st.
If there is error while adding a node in bottom field of lt_list (top is
already added) then this node will be pointed by st_list also. So we need
to remove it from st_list

bug: 73552574
Test: poc before/after on Android N security branch
Change-Id: I95304c242c5854b18c5c7220d114ce6215760124
---
 decoder/ih264d_parse_slice.c | 67 ++++++++++++++++++++++++++++++++++++
 decoder/ih264d_parse_slice.h |  1 +
 2 files changed, 68 insertions(+)

diff --git a/decoder/ih264d_parse_slice.c b/decoder/ih264d_parse_slice.c
index db02bfe..b477c10 100644
--- a/decoder/ih264d_parse_slice.c
+++ b/decoder/ih264d_parse_slice.c
@@ -979,6 +979,69 @@ WORD32 ih264d_end_of_pic(dec_struct_t *ps_dec)
     return OK;
 }
 
+
+/*!
+ **************************************************************************
+ * \if Function name : ih264d_fix_error_in_dpb \endif
+ *
+ * \brief
+ *    fix error in DPB
+ *
+ * \return
+ *    Number of node(s) deleted
+ **************************************************************************
+ */
+
+WORD32 ih264d_fix_error_in_dpb(dec_struct_t *ps_dec)
+{
+    /*--------------------------------------------------------------------*/
+    /* If there is common node in lt_list and st_list then delete it from */
+    /* st_list                                                            */
+    /*--------------------------------------------------------------------*/
+    UWORD8 no_of_nodes_deleted = 0;
+    UWORD8 lt_ref_num = ps_dec->ps_dpb_mgr->u1_num_lt_ref_bufs;
+    struct dpb_info_t *ps_lt_curr_dpb = ps_dec->ps_dpb_mgr->ps_dpb_ht_head;
+    while(lt_ref_num && ps_lt_curr_dpb)
+    {
+        if(ps_dec->ps_dpb_mgr->ps_dpb_st_head
+                && ((ps_lt_curr_dpb->s_bot_field.u1_reference_info
+                        | ps_lt_curr_dpb->s_top_field.u1_reference_info)
+                        == (IS_SHORT_TERM | IS_LONG_TERM)))
+        {
+            struct dpb_info_t *ps_st_next_dpb = ps_dec->ps_dpb_mgr->ps_dpb_st_head;
+            struct dpb_info_t *ps_st_curr_dpb = ps_dec->ps_dpb_mgr->ps_dpb_st_head;
+            UWORD8 st_ref_num = ps_dec->ps_dpb_mgr->u1_num_st_ref_bufs;
+            while(st_ref_num && ps_st_curr_dpb)
+            {
+                if(ps_st_curr_dpb == ps_lt_curr_dpb)
+                {
+                    if(st_ref_num == ps_dec->ps_dpb_mgr->u1_num_st_ref_bufs)
+                    {
+                        ps_dec->ps_dpb_mgr->ps_dpb_st_head =
+                                ps_dec->ps_dpb_mgr->ps_dpb_st_head->ps_prev_short;
+                        ps_st_curr_dpb = ps_dec->ps_dpb_mgr->ps_dpb_st_head;
+                    }
+                    else
+                    {
+                        ps_st_next_dpb->ps_prev_short = ps_st_curr_dpb->ps_prev_short;
+                    }
+                    ps_dec->ps_dpb_mgr->u1_num_st_ref_bufs--;
+                    ps_dec->ps_dpb_mgr->u1_num_lt_ref_bufs++;
+                    no_of_nodes_deleted++;
+                    break;
+                }
+                ps_st_next_dpb = ps_st_curr_dpb;
+                ps_st_curr_dpb = ps_st_curr_dpb->ps_prev_short;
+                st_ref_num--;
+            }
+        }
+        ps_lt_curr_dpb = ps_lt_curr_dpb->ps_prev_long;
+        lt_ref_num--;
+    }
+    return no_of_nodes_deleted;
+}
+
+
 /*!
  **************************************************************************
  * \if Function name : DecodeSlice \endif
@@ -1821,6 +1884,10 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice,
         ps_dec->pv_proc_tu_coeff_data = ps_dec->pv_parse_tu_coeff_data;
     }
 
+    ret = ih264d_fix_error_in_dpb(ps_dec);
+    if(ret < 0)
+        return ERROR_DBP_MANAGER_T;
+
     if(u1_slice_type == I_SLICE)
     {
         ps_dec->ps_cur_pic->u4_pack_slc_typ |= I_SLC_BIT;
diff --git a/decoder/ih264d_parse_slice.h b/decoder/ih264d_parse_slice.h
index c012062..0f82ec9 100644
--- a/decoder/ih264d_parse_slice.h
+++ b/decoder/ih264d_parse_slice.h
@@ -37,6 +37,7 @@
 #include "ih264_platform_macros.h"
 #include "ih264d_structs.h"
 #include "ih264d_error_handler.h"
+WORD32 ih264d_fix_error_in_dpb(dec_struct_t * ps_dec);
 WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice,
                                  UWORD8 u1_nal_ref_idc,
                                  dec_struct_t * ps_dec );

From 5c3b992b6f10e73a87308bbe6e915d391eb3650e Mon Sep 17 00:00:00 2001
From: Thomala Srinivas <thomala.srinivas@ittiam.com>
Date: Wed, 17 Apr 2019 18:20:04 +0530
Subject: [PATCH 27/28] libavcenc: Fix B frame incomplete subgop issue

The encoder doesn't return remaining frames if last subgop is
incomplete. This problem is solved by swapping last NULL P frame
(as subgop is incomplete last P frame will be NULL) with the
last valid (non- NULL) B frame. Complete subgop swapping is not done.

Also update MAX_NUM_BFRAMES to 8 and added a separate macro to
define maximum number of pictures in input queue

Bug: 132063959
Test: run cts -m CtsMediaTestCases \
 -t android.media.cts.VideoEncoderTest
Change-Id: I9625c5f5f64ec60032c44dad54f735991921d6dd
---
 encoder/ih264e_defs.h    |  7 ++++-
 encoder/ih264e_structs.h |  2 +-
 encoder/ih264e_utils.c   | 58 +++++++++++++++++++++++-----------------
 3 files changed, 41 insertions(+), 26 deletions(-)

diff --git a/encoder/ih264e_defs.h b/encoder/ih264e_defs.h
index 36ce3e9..33fafd1 100644
--- a/encoder/ih264e_defs.h
+++ b/encoder/ih264e_defs.h
@@ -134,7 +134,12 @@
 /**
  *  Maximum number of B pictures between two I/P pictures
  */
-#define MAX_NUM_BFRAMES     10
+#define MAX_NUM_BFRAMES     8
+
+/**
+ *  Maximum number of pictures in input queue
+ */
+#define MAX_NUM_INP_FRAMES  ((MAX_NUM_BFRAMES) + 2)
 
 /**
  *  Maximum number of reference buffers in DPB manager
diff --git a/encoder/ih264e_structs.h b/encoder/ih264e_structs.h
index 125db84..c2e3b89 100644
--- a/encoder/ih264e_structs.h
+++ b/encoder/ih264e_structs.h
@@ -2801,7 +2801,7 @@ struct _codec_t
     /**
      * input buffer queue
      */
-    inp_buf_t as_inp_list[MAX_NUM_BFRAMES];
+    inp_buf_t as_inp_list[MAX_NUM_INP_FRAMES];
 
     /**
      * Flag to indicate if any IDR requests are pending
diff --git a/encoder/ih264e_utils.c b/encoder/ih264e_utils.c
index 455aa9e..c813f57 100644
--- a/encoder/ih264e_utils.c
+++ b/encoder/ih264e_utils.c
@@ -193,7 +193,7 @@ WORD32 ih264e_input_queue_update(codec_t *ps_codec,
     picture_type_e e_pictype;
     WORD32 i4_skip;
     UWORD32 ctxt_sel, u4_pic_id, u4_pic_disp_id;
-    UWORD8 u1_frame_qp;
+    UWORD8 u1_frame_qp, i;
     UWORD32 max_frame_bits = 0x7FFFFFFF;
 
     /*  Mark that the last input frame has been received */
@@ -235,7 +235,7 @@ WORD32 ih264e_input_queue_update(codec_t *ps_codec,
      *Queue the input to the queue
      **************************************************************************/
     ps_inp_buf = &(ps_codec->as_inp_list[ps_codec->i4_pic_cnt
-                                         % MAX_NUM_BFRAMES]);
+                                         % MAX_NUM_INP_FRAMES]);
 
     /* copy input info. to internal structure */
     ps_inp_buf->s_raw_buf = ps_ive_ip->s_inp_buf;
@@ -342,7 +342,7 @@ WORD32 ih264e_input_queue_update(codec_t *ps_codec,
     ps_codec->s_rate_control.pre_encode_skip[ctxt_sel] = i4_skip;
 
     /* Get a buffer to encode */
-    ps_inp_buf = &(ps_codec->as_inp_list[u4_pic_id % MAX_NUM_BFRAMES]);
+    ps_inp_buf = &(ps_codec->as_inp_list[u4_pic_id % MAX_NUM_INP_FRAMES]);
 
     /* copy dequeued input to output */
     ps_enc_buff->s_raw_buf = ps_inp_buf->s_raw_buf;
@@ -400,38 +400,42 @@ WORD32 ih264e_input_queue_update(codec_t *ps_codec,
      *     I/P and I/P.
      */
     if (ps_enc_buff->u4_is_last && (ps_codec->pic_type == PIC_P)
-                    && ps_codec->s_cfg.u4_num_bframes && (ps_codec->i4_poc > 1))
+                    && ps_codec->s_cfg.u4_num_bframes)
     {
-        UWORD32 u4_cntr, u4_lst_bframe;
-        inp_buf_t *ps_swap_buff, *ps_inp_list, *ps_cur_pic;
-
-        u4_cntr = (u4_pic_id + 1) % MAX_NUM_BFRAMES;
-        u4_lst_bframe = u4_pic_id ? ((u4_pic_id - 1) % MAX_NUM_BFRAMES) : (MAX_NUM_BFRAMES - 1);
+        WORD32 cntr;
+        WORD32 lst_bframe = -1;
+        UWORD32 u4_timestamp_low = 0;
+        UWORD32 u4_timestamp_high = 0;
+        inp_buf_t *ps_swap_buff, *ps_inp_list;
 
         ps_inp_list = &ps_codec->as_inp_list[0];
-        ps_cur_pic = &ps_inp_list[u4_pic_id % MAX_NUM_BFRAMES];
 
-        /* Now search the pic in most recent past to current frame */
-        for(; u4_cntr != (u4_pic_id % MAX_NUM_BFRAMES);
-                        u4_cntr = ((u4_cntr + 1) % MAX_NUM_BFRAMES))
+        /* Now search the inp list for highest timestamp */
+        for(cntr = 0; cntr < MAX_NUM_INP_FRAMES; cntr++)
         {
-            if ( (ps_inp_list[u4_cntr].u4_timestamp_low  <= ps_cur_pic->u4_timestamp_low) &&
-                 (ps_inp_list[u4_cntr].u4_timestamp_high <= ps_cur_pic->u4_timestamp_high) &&
-                 (ps_inp_list[u4_cntr].u4_timestamp_low  >= ps_inp_list[u4_lst_bframe].u4_timestamp_low) &&
-                 (ps_inp_list[u4_cntr].u4_timestamp_high >= ps_inp_list[u4_lst_bframe].u4_timestamp_high))
+            if(ps_inp_list[cntr].s_raw_buf.apv_bufs[0] != NULL)
             {
-                u4_lst_bframe = u4_cntr;
+                if ((ps_inp_list[cntr].u4_timestamp_high  > u4_timestamp_high) ||
+                    (ps_inp_list[cntr].u4_timestamp_high  == u4_timestamp_high &&
+                     ps_inp_list[cntr].u4_timestamp_low  > u4_timestamp_low))
+                {
+                    u4_timestamp_low = ps_inp_list[cntr].u4_timestamp_low;
+                    u4_timestamp_high = ps_inp_list[cntr].u4_timestamp_high;
+                    lst_bframe = cntr;
+                }
             }
         }
 
-        ps_swap_buff = &(ps_codec->as_inp_list[u4_lst_bframe]);
+        if(lst_bframe != -1)
+        {
+            ps_swap_buff = &(ps_codec->as_inp_list[lst_bframe]);
 
-        /* copy the last B buffer to output */
-        *ps_enc_buff = *ps_swap_buff;
-
-        /* Store the current buf into the queue in place of last B buf */
-        *ps_swap_buff = *ps_inp_buf;
+            /* copy the last B buffer to output */
+            *ps_enc_buff = *ps_swap_buff;
 
+            /* Store the current buf into the queue in place of last B buf */
+            *ps_swap_buff = *ps_inp_buf;
+        }
     }
 
     if (ps_enc_buff->u4_is_last)
@@ -439,6 +443,12 @@ WORD32 ih264e_input_queue_update(codec_t *ps_codec,
         ps_codec->pic_type = PIC_NA;
     }
 
+    /* The buffer in the queue is set to NULL to specify that encoding is done for that frame */
+    for(i = 0; i < 3; i++)
+    {
+        ps_inp_buf->s_raw_buf.apv_bufs[i] = NULL;
+    }
+
     /* Return the buffer status */
     return (0);
 }

From 89daff526a589a399f409c2dc17237e150d97f20 Mon Sep 17 00:00:00 2001
From: Isha Kulkarni <isha.kulkarni@ittiam.com>
Date: Mon, 13 May 2019 16:53:50 +0530
Subject: [PATCH 28/28] Decoder: Add error check for expected_poc in
 ih264d_decode_pic_order_cnt

Bug: 131625739
Test: Validate with poc in bug

Change-Id: I3e1c132e28ad35541a0b9c4632b1f43611b90dea
---
 decoder/ih264d_defs.h          |  5 +++++
 decoder/ih264d_error_handler.h |  3 ++-
 decoder/ih264d_utils.c         | 38 ++++++++++++++++++++++++++++------
 3 files changed, 39 insertions(+), 7 deletions(-)

diff --git a/decoder/ih264d_defs.h b/decoder/ih264d_defs.h
index ec3f2af..94d0d61 100644
--- a/decoder/ih264d_defs.h
+++ b/decoder/ih264d_defs.h
@@ -34,6 +34,8 @@
  *
  ************************************************************************
  */
+#include <stdint.h>
+
 #define H264_MAX_FRAME_WIDTH                4080
 #define H264_MAX_FRAME_HEIGHT               4080
 #define H264_MAX_FRAME_SIZE                 (4096 * 2048)
@@ -47,6 +49,9 @@
 #define CHECKBIT(a,i) ((a) &  (1 << i))
 #define CLEARBIT(a,i) ((a) &= ~(1 << i))
 
+/** Macro to check if a number lies in the valid integer range */
+#define IS_OUT_OF_RANGE_S32(a) (((a) < INT32_MIN) || ((a) > INT32_MAX))
+
 /** Macro to convert a integer to a boolean value */
 #define BOOLEAN(x) (!!(x))
 
diff --git a/decoder/ih264d_error_handler.h b/decoder/ih264d_error_handler.h
index 586fe8a..a3764c6 100644
--- a/decoder/ih264d_error_handler.h
+++ b/decoder/ih264d_error_handler.h
@@ -113,7 +113,8 @@ typedef enum
     ERROR_IN_LAST_SLICE_OF_PIC = 0x93,
     ERROR_NEW_FRAME_EXPECTED = 0x94,
     ERROR_INCOMPLETE_FRAME = 0x95,
-    ERROR_VUI_PARAMS_NOT_FOUND = 0x96
+    ERROR_VUI_PARAMS_NOT_FOUND = 0x96,
+    ERROR_INV_POC = 0x97
 
 } h264_decoder_error_code_t;
 
diff --git a/decoder/ih264d_utils.c b/decoder/ih264d_utils.c
index 49b9c08..0381763 100644
--- a/decoder/ih264d_utils.c
+++ b/decoder/ih264d_utils.c
@@ -313,36 +313,62 @@ WORD32 ih264d_decode_pic_order_cnt(UWORD8 u1_is_idr_slice,
                                     + ps_seq->i4_ofst_for_ref_frame[i];
                 }
 
-                expected_poc =(WORD32)CLIP_S32(i8_result);
+                if(IS_OUT_OF_RANGE_S32(i8_result))
+                    return ERROR_INV_POC;
+
+                expected_poc = (WORD32)i8_result;
+
             }
             else
                 expected_poc = 0;
 
             if(u1_nal_ref_idc == 0)
             {
-                expected_poc = expected_poc
+                i8_result = expected_poc
                                 + ps_seq->i4_ofst_for_non_ref_pic;
+
+                if(IS_OUT_OF_RANGE_S32(i8_result))
+                    return ERROR_INV_POC;
+
+                expected_poc = (WORD32)i8_result;
             }
 
             /* 6. TopFieldOrderCnt or BottomFieldOrderCnt are derived as */
             if(!u1_field_pic_flag)
             {
-                i4_top_field_order_cnt = expected_poc
+                i8_result = expected_poc
                                 + ps_cur_poc->i4_delta_pic_order_cnt[0];
-                i4_bottom_field_order_cnt = i4_top_field_order_cnt
+
+                if(IS_OUT_OF_RANGE_S32(i8_result))
+                    return ERROR_INV_POC;
+                i4_top_field_order_cnt = (WORD32)i8_result;
+
+                i8_result = i4_top_field_order_cnt
                                 + ps_seq->i4_ofst_for_top_to_bottom_field
                                 + ps_cur_poc->i4_delta_pic_order_cnt[1];
+
+                if(IS_OUT_OF_RANGE_S32(i8_result))
+                    return ERROR_INV_POC;
+                i4_bottom_field_order_cnt = (WORD32)i8_result;
             }
             else if(!u1_bottom_field_flag)
             {
-                i4_top_field_order_cnt = expected_poc
+                i8_result = expected_poc
                                 + ps_cur_poc->i4_delta_pic_order_cnt[0];
+
+                if(IS_OUT_OF_RANGE_S32(i8_result))
+                    return ERROR_INV_POC;
+                i4_top_field_order_cnt = (WORD32)i8_result;
             }
             else
             {
-                i4_bottom_field_order_cnt = expected_poc
+                i8_result = expected_poc
                                 + ps_seq->i4_ofst_for_top_to_bottom_field
                                 + ps_cur_poc->i4_delta_pic_order_cnt[0];
+
+                if(IS_OUT_OF_RANGE_S32(i8_result))
+                    return ERROR_INV_POC;
+                i4_bottom_field_order_cnt = (WORD32)i8_result;
             }
             /* Copy the current POC info into Previous POC structure */
             ps_cur_poc->i4_prev_frame_num_ofst = frame_num_ofst;