wrapper/libhevc-mirror
1
0
Fork 0
mirror of https://github.com/ittiam-systems/libhevc.git synced 2026-08-13 06:12:34 +07:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix heap-buffer-overflow in HBD padding due to bit depth change.

Browse source 
Trigger IVD_RES_CHANGED when bit depth or chroma format changes in SPS,
forcing reallocation of picture buffers.

To prevent corrupting the codec state on invalid SPS parses, the updates to
global codec parameters (like i4_pixel_size_y and i4_bit_depth_luma) are
deferred to the end of ihevcd_parse_sps, after all validation checks have
passed. The resolution change check now compares the old active values in
ps_codec against the newly parsed values in the temporary ps_sps structure.

TAG=agy
CONV=2aef6402-f7fc-4ff8-ba56-d78e01754035
This commit is contained in:
Harish Mahendrakar 2026-08-06 19:28:34 -07:00 • committed by Harish Mahendrakar
parent ac413106a1
commit 052d028555
1 changed files with 16 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

26
decoder/ihevcd_parse_headers.c
View file

@ -1648,9 +1648,6 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
break;
}
ps_sps->i1_chroma_format_idc = value;
ps_codec->i4_chroma_array_type = ps_sps->i1_chroma_format_idc;
ps_codec->i4_sub_width_chroma = 2;
ps_codec->i4_sub_height_chroma = (ps_sps->i1_chroma_format_idc == CHROMA_FMT_IDC_YUV422) ? 1 : 2;
#ifdef ENABLE_MAIN_REXT_PROFILE
/* TODO: re enable simd optimizations once they are updated for 422, 444 internal color formats.
@ -1742,9 +1739,6 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
if ( ((1 == i4_profile_idc) && (0 != value)) || ((2 == i4_profile_idc) && (2 < value)) ||
((4 == i4_profile_idc) && (4 < value)) )
return IHEVCD_UNSUPPORTED_BIT_DEPTH;
ps_codec->i4_bit_depth_luma = value + 8;
ps_codec->i4_pixel_size_y = 1 + (value > 0);
ps_codec->i4_qp_bd_offset_y = 6 * value;
ps_sps->i1_bit_depth_luma_minus8 = value;
UEV_PARSE("bit_depth_chroma_minus8", value, ps_bitstrm);
@ -1755,9 +1749,6 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
if ( ((1 == i4_profile_idc) && (0 != value)) || ((2 == i4_profile_idc) && (2 < value)) ||
((4 == i4_profile_idc) && (4 < value)) )
return IHEVCD_UNSUPPORTED_BIT_DEPTH;
ps_codec->i4_bit_depth_chroma = value + 8;
ps_codec->i4_pixel_size_uv = 1 + (value > 0);
ps_codec->i4_qp_bd_offset_uv = 6 * value;
ps_sps->i1_bit_depth_chroma_minus8 = value;
{
@ -2326,7 +2317,10 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
if((0 != ps_codec->u4_allocate_dynamic_done) &&
((ps_codec->i4_disp_wd != disp_wd) ||
(ps_codec->i4_disp_ht != disp_ht)))
(ps_codec->i4_disp_ht != disp_ht) ||
(ps_codec->i4_bit_depth_luma != ps_sps->i1_bit_depth_luma_minus8 + 8) ||
(ps_codec->i4_bit_depth_chroma != ps_sps->i1_bit_depth_chroma_minus8 + 8) ||
(ps_codec->i4_chroma_array_type != ps_sps->i1_chroma_format_idc)))
{
if(0 == ps_codec->i4_first_pic_done)
{
@ -2339,6 +2333,18 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
ps_codec->i4_disp_wd = disp_wd;
ps_codec->i4_disp_ht = disp_ht;
ps_codec->i4_chroma_array_type = ps_sps->i1_chroma_format_idc;
ps_codec->i4_sub_width_chroma = 2;
ps_codec->i4_sub_height_chroma = (ps_sps->i1_chroma_format_idc == CHROMA_FMT_IDC_YUV422) ? 1 : 2;
ps_codec->i4_bit_depth_luma = ps_sps->i1_bit_depth_luma_minus8 + 8;
ps_codec->i4_pixel_size_y = 1 + (ps_sps->i1_bit_depth_luma_minus8 > 0);
ps_codec->i4_qp_bd_offset_y = 6 * ps_sps->i1_bit_depth_luma_minus8;
ps_codec->i4_bit_depth_chroma = ps_sps->i1_bit_depth_chroma_minus8 + 8;
ps_codec->i4_pixel_size_uv = 1 + (ps_sps->i1_bit_depth_chroma_minus8 > 0);
ps_codec->i4_qp_bd_offset_uv = 6 * ps_sps->i1_bit_depth_chroma_minus8;
ps_codec->i4_wd = ps_sps->i2_pic_width_in_luma_samples;
ps_codec->i4_ht = ps_sps->i2_pic_height_in_luma_samples;