Commit graph

10 commits

Author SHA1 Message Date
Neelkamal Semwal
fcf0c2774c Decoder: Fix integer overflow when scaling motion vectors
Typecast to 64-bits for valid overflowing arithmetic operations

Bug: 143791664
Bug: 150044751

Test: poc in bug description

Change-Id: I1b938c7c2d4d817979fff65ab271a42f6bdc3e89
2020-09-18 22:59:16 +05:30
Harish Mahendrakar
da990db40a Merge "Fix integer overflows while intializing reference lists" am: 47d5e6bb93 am: f374a3c5d1 am: 31d4186111
am: d6ed5b9a0c

Change-Id: I52d3e462e9cb180f943d003a12401d70e448dd42
2019-09-28 10:47:06 -07:00
Harish Mahendrakar
ef807fde69 Fix integer overflows while intializing reference lists
Instead of looping through all poc/pic numbers with an increment
of 1, loop through only valid poc/pic numbers after sorting them.
This prevents integer overflows when poc/pic number is INT32_MIN or
INT32_MAX

This also fixes a timeout issue seen when integer sanitizers are
not enabled

Bug: 135303936
Bug: 136568141
Bug: 141276890
Test: poc in bug

Change-Id: I5db80dd8e811cbb1a9ecd00363fac997551ccaf5
2019-09-26 15:21:02 -07:00
Isha Kulkarni
2f8dcdd41a Decoder: Avoid overlapping memcpy while initializing ref lists
Bug: 117608404
Test: poc with valgrind before/after

Change-Id: I73f2c5302376af11a8f922ceb2e0b1c9cf883f8b
2019-07-16 15:28:02 -07:00
Isha Shrikant Kulkarni
fc7139a53e Decoder: Fix Integer Sanitizer issues in ih264d_process_bslice
Bug: 118445723
Test: vendor
Change-Id: Ib5d8f72be016330beafa6e7996976eeff1b23c39
2019-03-28 14:40:17 -07:00
Hamsalekha S
cbcd2846fa Decoder: Fixed overflow in refernce list creation.
Since the maximum value of long term index is 255,
the loop control variable needs to be 32 bit.

Bug: 38448381
Test: ran POC before/after applying fix
Change-Id: Iae3ecff38d4a922bde10fde33f1cfcafd2ea2680
2017-07-07 10:34:44 -07:00
Hamsalekha S
93954f5e9a Decoder: Fix in reference list initialization.
In the case of error, initialize the new reference list1 with the first
picture in default list0 instead of default list1, as first picture in
list1 could still be invalid.

Bug: 36035074

Change-Id: I7ab493ee7a157cbefcd4da8389ff1ff899c16b7f
2017-03-22 16:55:01 +00:00
Harish Mahendrakar
54cbe1b29b Decoder: Fix initialization of ps_next_dpb during reference list creation
ps_dpb_mgr->ps_dpb_ht_head is a linked list with
ps_dpb_mgr->u1_num_lt_ref_bufs number of valid buffers.
So ps_next_dbp has to be initialized to ps_dpb_mgr->ps_dpb_ht_head
for each u1_lt_index loop iteration

Bug: 33387820
Change-Id: I2dfd962bad5640a829afc123adbd0709e563e621
2016-12-28 12:33:39 -08:00
Lajos Molnar
a2b49e5f05 fix file permissions
Change-Id: Ia4f99d5b963acd8d8a1afc2fbdf06b122d898f63
2015-05-05 17:51:34 +00:00
Hamsalekha S
8d3d303c79 Initial version
Change-Id: I7efe9a589cd24edf86e8d086b40c27cbbf8b4017
2015-04-02 15:59:02 +05:30