From 052d028555e50c915c6e903b30affd814475246a Mon Sep 17 00:00:00 2001 From: Harish Mahendrakar Date: Thu, 6 Aug 2026 19:28:34 -0700 Subject: [PATCH] Fix heap-buffer-overflow in HBD padding due to bit depth change. Trigger IVD_RES_CHANGED when bit depth or chroma format changes in SPS, forcing reallocation of picture buffers. To prevent corrupting the codec state on invalid SPS parses, the updates to global codec parameters (like i4_pixel_size_y and i4_bit_depth_luma) are deferred to the end of ihevcd_parse_sps, after all validation checks have passed. The resolution change check now compares the old active values in ps_codec against the newly parsed values in the temporary ps_sps structure. TAG=agy CONV=2aef6402-f7fc-4ff8-ba56-d78e01754035 --- decoder/ihevcd_parse_headers.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c index 52ea306..dcc6838 100644 --- a/decoder/ihevcd_parse_headers.c +++ b/decoder/ihevcd_parse_headers.c @@ -1648,9 +1648,6 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) break; } ps_sps->i1_chroma_format_idc = value; - ps_codec->i4_chroma_array_type = ps_sps->i1_chroma_format_idc; - ps_codec->i4_sub_width_chroma = 2; - ps_codec->i4_sub_height_chroma = (ps_sps->i1_chroma_format_idc == CHROMA_FMT_IDC_YUV422) ? 1 : 2; #ifdef ENABLE_MAIN_REXT_PROFILE /* TODO: re enable simd optimizations once they are updated for 422, 444 internal color formats. @@ -1742,9 +1739,6 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) if ( ((1 == i4_profile_idc) && (0 != value)) || ((2 == i4_profile_idc) && (2 < value)) || ((4 == i4_profile_idc) && (4 < value)) ) return IHEVCD_UNSUPPORTED_BIT_DEPTH; - ps_codec->i4_bit_depth_luma = value + 8; - ps_codec->i4_pixel_size_y = 1 + (value > 0); - ps_codec->i4_qp_bd_offset_y = 6 * value; ps_sps->i1_bit_depth_luma_minus8 = value; UEV_PARSE("bit_depth_chroma_minus8", value, ps_bitstrm); @@ -1755,9 +1749,6 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) if ( ((1 == i4_profile_idc) && (0 != value)) || ((2 == i4_profile_idc) && (2 < value)) || ((4 == i4_profile_idc) && (4 < value)) ) return IHEVCD_UNSUPPORTED_BIT_DEPTH; - ps_codec->i4_bit_depth_chroma = value + 8; - ps_codec->i4_pixel_size_uv = 1 + (value > 0); - ps_codec->i4_qp_bd_offset_uv = 6 * value; ps_sps->i1_bit_depth_chroma_minus8 = value; { @@ -2326,7 +2317,10 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) if((0 != ps_codec->u4_allocate_dynamic_done) && ((ps_codec->i4_disp_wd != disp_wd) || - (ps_codec->i4_disp_ht != disp_ht))) + (ps_codec->i4_disp_ht != disp_ht) || + (ps_codec->i4_bit_depth_luma != ps_sps->i1_bit_depth_luma_minus8 + 8) || + (ps_codec->i4_bit_depth_chroma != ps_sps->i1_bit_depth_chroma_minus8 + 8) || + (ps_codec->i4_chroma_array_type != ps_sps->i1_chroma_format_idc))) { if(0 == ps_codec->i4_first_pic_done) { @@ -2339,6 +2333,18 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) ps_codec->i4_disp_wd = disp_wd; ps_codec->i4_disp_ht = disp_ht; + ps_codec->i4_chroma_array_type = ps_sps->i1_chroma_format_idc; + ps_codec->i4_sub_width_chroma = 2; + ps_codec->i4_sub_height_chroma = (ps_sps->i1_chroma_format_idc == CHROMA_FMT_IDC_YUV422) ? 1 : 2; + + ps_codec->i4_bit_depth_luma = ps_sps->i1_bit_depth_luma_minus8 + 8; + ps_codec->i4_pixel_size_y = 1 + (ps_sps->i1_bit_depth_luma_minus8 > 0); + ps_codec->i4_qp_bd_offset_y = 6 * ps_sps->i1_bit_depth_luma_minus8; + + ps_codec->i4_bit_depth_chroma = ps_sps->i1_bit_depth_chroma_minus8 + 8; + ps_codec->i4_pixel_size_uv = 1 + (ps_sps->i1_bit_depth_chroma_minus8 > 0); + ps_codec->i4_qp_bd_offset_uv = 6 * ps_sps->i1_bit_depth_chroma_minus8; + ps_codec->i4_wd = ps_sps->i2_pic_width_in_luma_samples; ps_codec->i4_ht = ps_sps->i2_pic_height_in_luma_samples;