- Changed hardcoded index [0] to loop variable [i] in ithread_mutex_init call
- Ensures correct initialization of both mutexes in the loop
Test: ./avcdec
Change-Id: I95ccd1eec5f18b5391befbcedf3546a119681b54
In some erroneous fuzzer bistreams, the slice data requires more
parsing than what was implied by the distance between successive
start codes. The primary culprit is the NEXTBITS macro which requires
reading 4 additional bytes of the bitstream buffer. To alleviate
this, 4 bytes per 4x4 TU have been additionally allocated to the
bitstream buffer.
Bug = ossfuzz:66989
Test: mvc_dec_fuzzer
After some time of running these in postsubmit, these will be changed
to presubmit.
- Added AvcEncTest to device-tests test suite
- Also run bpfmt on test/Android.bp
Bug: 304383609
Test: atest AvcEncTest
Change-Id: Ic18b25d8ed27313b6e3a984259af1215ae240c9e
Although the fag end of both the NALU and the bitstream buffer
is being parsed, not all FGC SEI symbols would have been
decoded semantically. This commit detects and returns an error
in this situation.
Bug = ossfuzz:65418
Test: mvc_dec_fuzzer
'isvce_svc_rc_params_validate' was not being invoked prior to
call to 'isvce_rc_init'. This resulted in an erroneous state
within RC's context wherein the instantaneous estimate for the
texture bits for the frame being processed exceeded INT_MAX.
'isvce_svc_rc_params_validate' has code that detects such a
state and is now being correctly invoked where apprpriate.
Bug = ossfuzz:63175
Test: svc_enc_fuzzer
There can be cases where there are multiple SEI payloads within a
single SEI NAL. In the particulkar case where the payload comprises
exclusiely of FGC data, the size of the NAL can exceed the size
of the 'dynamic bitstream buffer' which is used to pass the NALU
onto its appropriate parser.
This commit adds 'imvcd_bitstream_buf_realloc' which re-allocates
the 'dynamic bitstream buffer' such that any arbitrarily sized
NALU can be stored without a heap overflow.
Bug = ossfuzz:64286
Test: svc_enc_fuzzer
Before applying the config params (dimensions), the api is validating
the input buffer dimensions. This causes encode fails wrongly. This is
corrected.
The following lines of code have been removed to improve coverage -
[x] Functions -
- isvc_interleaved_copy
- isvc_16bit_interleaved_copy
- isvc_16bit_interleaved_memset
- isvc_iquant_itrans_recon_chroma_4x4_neon
- isvc_iquant_itrans_recon_chroma_4x4_sse42
- isvc_iquant_itrans_recon_4x4_dc_with_res_output_neon
- isvc_iquant_itrans_recon_res_dc_4x4_sse42
- isvc_iquant_itrans_recon_4x4_dc_with_res_accumulate_neon
- isvc_iquant_itrans_recon_res_dc_with_res_acc_4x4_sse42
- isvce_wait_for_thread
[x] Function pointer initialisations for the functions above
Test: svc_enc_fuzzer
For large intra frame intervals or for a choice of bit rate that causes
large bits per frame, it possible that while computing number of bits
available in the gop overflow the datatype bounds. For these
calculations use number_t as this offers wider space
Bug: oss-fuzz-63044
Test: avc_enc_fuzzer
Change-Id: Ifee9130f0021f77905aea67832abc044537088e5
The cases where the value for log2MaxPocLsb was exceeding
'MAX_BITS_IN_POC_LSB' was not being handled correctly,
which was resulting in an integer overflow. This has been
fixed.
Test: mvc_dec_fuzzer
RC uses int32_t to store bitrates and other
parameters internally. For specific magnitudes of
bitrate, framerate, and GOP period, this can
result in signed integer overflow. This is now
detected before calls to RC init.
Note that calls to the 'ISVCE_CMD_CTL_SET_BITRATE' API can also
result in this behaviour but it will be appropriately handled
by 'isvce_svc_frame_params_validate'.
Bug = ossfuzz:63053
Test: svc_enc_fuzzer
This commit does not introduce any new functionality w.r.t previous
commit. But it fixes few things. They are listed below
1. Guard Bands in header files are fixed
2. Header files contains function definition comments. These are same
as in source file. Maintaining same comment at two locations is
unnecessary. These are removed.
3. Maintain Indentation consistency across the code.
4. Remove unused code
This commit does not introduce any new functionality. This is a
cosmetic change. It removes redundant comments, unused variables,
indents to a common guideline.
If the encoder receives inputs that are empty or frames
that have to be skipped due to frame rate pull down,
do not increment picture count.
Bug: oss-fuzz-62827
Test: ./avc-enc-fuzzer
There were cases where errors in a process thread
executing the last MB row would result in the entropy
job list without a terminnating entry, which would
result in a call to ih264_list_dequeue blocking infinitely.
The enum 'ISVCE_ENTROPY_THREAD_STATES_T' is now used to
monitor the eecution state of the entropy thread and handle
the situation described appropriately.
Bug = ossfuzz:62786
Test: svc_enc_fuzzer
avc-qp(QP) scale is logarithmic and Qstep scale is linear.
The translation between log to linear is carried during
rate control modelling.
Look up tables for these translations are modified as per
the literature
The Lambda tables for intra and inter(P) slices are slightly
modified. Lambda tables for B slices is completely replaced
wih new set.
This change is done in accordance with JVT-O079.doc
This commit does not introduce any new functionality w.r.t previous
commit. But it fixes few things. They are listed below:
1. Guard Bands in header files are fixed
2. Header files contains function definition comments. These are same
as in source file. Maintaining same comment at two locations is
unnecessary. These are removed.
3. Improved consistency and code indentation
4. Removed comments that dont align with implementation
5. Grouped headers of a workspace together
When mb qp delta is not signalled due to cbp being zero,
mb qp delta ctxt is not being reset. This is causing bitstream
decode problems when mb qp is enabled
