From 282feacedc77491711ba46f16aa40b5d424b6ed0 Mon Sep 17 00:00:00 2001 From: Harish Mahendrakar Date: Fri, 18 Dec 2015 10:09:18 +0530 Subject: [PATCH] Fixed out of bound reads in stack variables Out of bound reads in the following variables are fixed scaling_mat_offset in ihevcd_iquant_itrans_recon_ctb() ai1_offset_y, ai1_offset_cb and ai1_offset_cr in ihevcd_sao_shift_ctb() These values were read but not used Bug: 34819017 Change-Id: Ib07e2ed1bdcc600700d4e9e5d970f6cc2164ab1b --- decoder/ihevcd_parse_residual.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/decoder/ihevcd_parse_residual.c b/decoder/ihevcd_parse_residual.c index fc84fa3..6e2a39c 100644 --- a/decoder/ihevcd_parse_residual.c +++ b/decoder/ihevcd_parse_residual.c @@ -191,7 +191,7 @@ WORD32 ihevcd_parse_residual_coding(codec_t *ps_codec, bitstrm_t *ps_bitstrm = &ps_codec->s_parse.s_bitstrm; WORD32 last_significant_coeff_x_prefix, last_significant_coeff_y_prefix; WORD32 last_significant_coeff_x, last_significant_coeff_y; - const UWORD8 *pu1_scan_blk, *pu1_scan_coeff; + const UWORD8 *pu1_scan_blk = NULL, *pu1_scan_coeff; WORD32 scan_idx; WORD32 i; WORD32 sign_data_hiding_flag; @@ -387,7 +387,8 @@ WORD32 ihevcd_parse_residual_coding(codec_t *ps_codec, last_scan_pos = pu1_scan_coeff[scan_pos]; } - pu1_scan_blk = (UWORD8 *)gapv_ihevc_invscan[scan_idx * 3 + (log2_trafo_size - 2 - 1)]; + if(log2_trafo_size > 2) + pu1_scan_blk = (UWORD8 *)gapv_ihevc_invscan[scan_idx * 3 + (log2_trafo_size - 2 - 1)]; pu1_scan_coeff = &gau1_ihevc_invscan4x4[scan_idx][0]; /* Set CSBF array to zero */