Slice increments are now done after completing header parse.
Earlier this was done before validating mmco related parameters
and calculating poc. In case there were errors that were detected
at this stage, slice increments were incorrect.
Bug: 199536974
Bug: 199733300
Bug: 205702093
Bug: oss-fuzz#38387
Bug: oss-fuzz#38482
Bug: oss-fuzz#40851
Test: ossfuzz generated poc in bug
Change-Id: I8569e9369e4ab6f6c69c81b937f111c299b7a134
(cherry picked from commit cd0385dc07)
Increment u2_cur_slice_num only if current slice had atleast
one MB of memory left.
Test: clusterfuzz generated poc in bug
Bug: b/182152757
Bug: b/179938345
Bug: b/185112718
Change-Id: Ic5eb07e961bccb7fde954bcfd791fd879804e335
When removing common nodes from short term list if it present in long
term reference list, number of long term buffers was wrongly
incremented. Only decrement of short term buffer count is needed in
such a case.
Bug: 140561484
Bug: 140566606
Bug: 140699853
Bug: 144980954
Bug: 145859214
Test: poc in bug
Change-Id: Iebf7ee7ed65e7b2097a899577982806b03fc6e5d
When decoder is expecting to decode a field, ensure current slice
being decoded is a field and frame number matches with previous slice's
frame number.
Bug: 144687080
Test: poc in bug
Change-Id: I89d9d7b6fc26797de0420ecb0ca7e66b066aa908
While adding the decoded buffer to display queue, allow buffer with
poc set to 0x7FFFFFFF
Bug: 145364230
Test: poc in bug
Change-Id: I2a15f73b8422cfa4fd3360bc21c0cea4542a3375
Earlier these were only initialized during static buffer allocations.
Initializing them in init_decoder() will ensure that these get
initialized to default values during reset() as well. Without this,
in some error cases, there is a possibility of heap-use-after free,
when resolution changes and these pointers point to memory that is freed
Bug: 142602711
Test: poc in bug
Change-Id: Ie39fee0eca56bf32cdc558099bf167d05eb89620
Added support for returning reorder_depth for frames in decode order.
Bug: 138627015
Test: Verify reorder_depth returned for few clips
Change-Id: I9b68a9544d7d011cf93dfccd308c754b8e16e39e
If lt_list and st_list point to same node then delete it from st.
If there is error while adding a node in bottom field of lt_list (top is
already added) then this node will be pointed by st_list also. So we need
to remove it from st_list
bug: 73552574
Test: poc before/after on Android N security branch
Change-Id: I95304c242c5854b18c5c7220d114ce6215760124
SKIP_P and SKIP_PB support was experimental and is not used
in libstagefright
Bug: 130541597
Test: poc in bug
Change-Id: If13b435e80d13d57de2fee0aa07ea7e6abca481b
Return error to application if valid sps or pps has not been decoded.
Also add check to prevent parsing of pps, if valid sps is not present.
Test: Tested a few clips with missing sps/pps
Bug: 129746168
Bug: 130575087
Change-Id: I1a6409d1cffc66c1b910d2102ab10a94e0227107
This will ensure clips with supported bitdepth or unsupport color
formats are not attempted to be decoded till end of the sequence.
Bug: 130578045
Test: adb shell stagefright -s -S /sdcard/crowd422_h264.mp4
Test: Ensure decoder doesn't attemp decoding all frames
Change-Id: I118ef2141f77986f6ec65c91dfeaa7ef17646c43
Also void->word32 return type so failure can be signaled to caller.
Bug: 115743419
Test: vendor + poc
Change-Id: I0a07ac11255c2c672803aab7085824c417bde282
IVD_RES_CHANGED was not signaled when crop parameters changed, i.e.
display dimensions changed without change in decode dimensions.
In such cases, if output buffer was allocated as per the current
dimension being decoded, without IVD_RES_CHANGED signalled, there can be
an OOB write if the new buffer is smaller than the frame being returned
as output
Bug: 118399205
Test: vendor
Change-Id: Ia750a99cda08a3254a6f8ea8b55d07e655b34d05
In intra_pred_ref_filtering function, initialize the values
of array au1_ngbr_pels to zero and in ih264d_parse_decode_slice
function, initialize the values of struct s_tmp_poc to zero.
Bug: 111762686
Test: vendor
Change-Id: Iac67f5e7d24f821627de64c8570f4be648c296c8
Intrinsic _mm_set_epi8 require char input, converting everything to char.
Including log.h from android library instead of cutils.
Bug: 112316276
Test: before/after object comparison for no diff in generated code.
Change-Id: I82b8c48494619b64465eda2476c7c903652c6066
