Naveen Kumar P
22dfbd2def
Merge "Check for buffer overflow in pps/slice header parsing" into lmp-dev am: 1853d3871a am: f7635dd278 am: 17caa64f8b am: 0b13008b9a am: 76c466f238 am: 94f311a6f2
...
am: d33b4bb164
2017-05-16 22:38:26 +00:00
Harish Mahendrakar
e36fc2b9a6
Merge "memset SPS to zero" into lmp-dev am: 31e21c5134 am: c1c11822d6 am: bb4f42afa0 am: 356364edaa am: 5dbf371a33 am: 1309c741ea
...
am: 8dad755531
2017-05-16 22:38:15 +00:00
Naveen Kumar P
76c466f238
Merge "Check for buffer overflow in pps/slice header parsing" into lmp-dev am: 1853d3871a am: f7635dd278 am: 17caa64f8b
...
am: 0b13008b9a
2017-05-16 22:33:32 +00:00
Harish Mahendrakar
5dbf371a33
Merge "memset SPS to zero" into lmp-dev am: 31e21c5134 am: c1c11822d6 am: bb4f42afa0
...
am: 356364edaa
2017-05-16 22:33:14 +00:00
Naveen Kumar P
0b13008b9a
Merge "Check for buffer overflow in pps/slice header parsing" into lmp-dev am: 1853d3871a am: f7635dd278
...
am: 17caa64f8b
2017-05-16 22:29:43 +00:00
Harish Mahendrakar
356364edaa
Merge "memset SPS to zero" into lmp-dev am: 31e21c5134 am: c1c11822d6
...
am: bb4f42afa0
2017-05-16 22:29:22 +00:00
Naveen Kumar P
f7635dd278
Merge "Check for buffer overflow in pps/slice header parsing" into lmp-dev
...
am: 1853d3871a
2017-05-16 22:24:02 +00:00
Harish Mahendrakar
c1c11822d6
Merge "memset SPS to zero" into lmp-dev
...
am: 31e21c5134
2017-05-16 22:23:52 +00:00
TreeHugger Robot
1853d3871a
Merge "Check for buffer overflow in pps/slice header parsing" into lmp-dev
2017-05-16 22:20:33 +00:00
TreeHugger Robot
31e21c5134
Merge "memset SPS to zero" into lmp-dev
2017-05-16 22:18:29 +00:00
Naveen Kumar P
d61d5e5f6a
Check for buffer overflow in pps/slice header parsing
...
Bug: 36215950
Bug: 36215953
Bug: 36216719
Change-Id: Ibdc05e1d5aa21d060d7c683fd9af4bed8537053f
2017-05-15 15:45:50 -07:00
Harish Mahendrakar
2e0e75aede
memset SPS to zero
...
SPS structure is memset to zero in parse_sps()
Bug: 33966031
Bug: 37458993
Change-Id: I7d4c04d2d25d7e9c8f581bd470260fc4394a564b
2017-05-12 16:21:21 -07:00
Ray Essick
50272c7a39
Merge changes from topic 'b34779227-mnc-dr' into mnc-dr-dev
...
* changes:
Fix reallocation for new sps
DO NOT MERGE Handle streams with change in max_dec_buffering/num_reorder_frames without resolution change
2017-05-12 23:15:16 +00:00
Marco Nelissen
e4ca1d697d
Merge "Fixed out of bound reads in stack variables" into lmp-dev
...
am: 4629c5cebf
2017-05-12 20:48:11 +00:00
Marco Nelissen
4629c5cebf
Merge "Fixed out of bound reads in stack variables" into lmp-dev
2017-05-12 20:45:19 +00:00
TreeHugger Robot
71c0aeaaff
Merge "DO NOT MERGE Handle streams with change in max_dec_buffering/num_reorder_frames without resolution change" into nyc-dev
2017-05-12 20:38:18 +00:00
Wonsik Kim
8f4b305eb1
Merge "Check for cpb cnt in hrd parsing" into nyc-dev
2017-05-11 15:39:40 +00:00
Mark Salyzyn
5e17a2046b
resolve merge conflicts of 8dc7b42 to mnc-dr-dev
...
Test: I solemnly swear I tested this conflict resolution.
Bug: 34896431
Change-Id: I670a2d2025f52b0197651bd4bb2acbc4887e0447
2017-05-11 15:23:00 +00:00
Wonsik Kim
4490398c88
Merge "DO NOT MERGE Check for cpb cnt in hrd parsing" into lmp-dev
2017-05-10 23:48:22 +00:00
Wonsik Kim
8dc7b42e65
Merge "DO NOT MERGE Check for cpb cnt in hrd parsing" into mnc-dev
2017-05-10 23:48:16 +00:00
Harish Mahendrakar
c9834edd64
Fixed out of bound reads in stack variables
...
Out of bound reads in the following variables are fixed
scaling_mat_offset in ihevcd_iquant_itrans_recon_ctb()
ai1_offset_y, ai1_offset_cb and ai1_offset_cr in ihevcd_sao_shift_ctb()
These values were read but not used
Bug: 34819017
Change-Id: Ic00e713b2c61d6793e1e097f852f0d1b3f913712
2017-05-09 14:28:47 -07:00
Harish Mahendrakar
27ad0d7bff
DO NOT MERGE Handle streams with change in max_dec_buffering/num_reorder_frames
...
without resolution change
backported from master as part of fixing a security issue on
nyc-*.
Bug: 34779227
Test: successful re-run of POC after patch
Change-Id: I404099ac24439b5f6eddc9265dc571929433b3ee
2017-05-05 10:16:22 -07:00
Naveen Kumar P
99df61bb9a
Fix reallocation for new sps
...
This works for mnc-dr-dev and later.
Bug: 34779227
Test: re-ran POC before/after patch to verify behavior
Change-Id: Ida0bf6bcc236494c3c89b228039501e287839fbe
2017-05-05 09:50:11 -07:00
Harish Mahendrakar
b62479887e
DO NOT MERGE Handle streams with change in max_dec_buffering/num_reorder_frames
...
without resolution change
backported from master as part of fixing a security issue on mnc-dr.
Bug: 34779227
Test: before/after execution of PIC
Change-Id: I404099ac24439b5f6eddc9265dc571929433b3ee
2017-05-05 09:46:46 -07:00
Hangyu Kuang
af6ce4991f
Merge "Correct Tiles rows and cols check" into lmp-dev am: 7e3858b313 am: a78650de6d am: 2bd3c9cd07
...
am: 576f2fd4ef
2017-04-12 20:26:32 +00:00
Hangyu Kuang
576f2fd4ef
Merge "Correct Tiles rows and cols check" into lmp-dev am: 7e3858b313 am: a78650de6d
...
am: 2bd3c9cd07
2017-04-12 20:21:31 +00:00
Naveen Kumar Ponnusamy
87c7e6a523
Merge "Check only allocated mv bufs for releasing from reference" into lmp-dev am: 397d2f6c42 am: 1ebd5e1d81 am: 998a1e26c0
...
am: a56dc1d7d0
2017-04-12 20:15:31 +00:00
Hangyu Kuang
a78650de6d
Merge "Correct Tiles rows and cols check" into lmp-dev
...
am: 7e3858b313
2017-04-12 20:10:01 +00:00
Naveen Kumar Ponnusamy
a56dc1d7d0
Merge "Check only allocated mv bufs for releasing from reference" into lmp-dev am: 397d2f6c42 am: 1ebd5e1d81
...
am: 998a1e26c0
2017-04-12 20:10:00 +00:00
Hangyu Kuang
7e3858b313
Merge "Correct Tiles rows and cols check" into lmp-dev
2017-04-12 20:00:25 +00:00
Naveen Kumar Ponnusamy
1ebd5e1d81
Merge "Check only allocated mv bufs for releasing from reference" into lmp-dev
...
am: 397d2f6c42
2017-04-12 19:59:30 +00:00
TreeHugger Robot
397d2f6c42
Merge "Check only allocated mv bufs for releasing from reference" into lmp-dev
2017-04-12 19:49:50 +00:00
Naveen Kumar P
07ef4e7138
Correct Tiles rows and cols check
...
Bug: 36231493
Bug: 34064500
Change-Id: Ib17b2c68360685c5a2c019e1497612a130f9f76a
2017-04-11 14:12:29 -07:00
Ray Essick
1f26f4efca
Merge "Set current slice ctb x and y to fill prev incomplete slice" into lmp-dev am: bfcdbd6a5b am: 88133ef0a3 am: 6249eafc05
...
am: 60db7fead3
2017-04-10 23:09:10 +00:00
Ray Essick
60db7fead3
Merge "Set current slice ctb x and y to fill prev incomplete slice" into lmp-dev am: bfcdbd6a5b am: 88133ef0a3
...
am: 6249eafc05
2017-04-10 23:05:10 +00:00
Ray Essick
88133ef0a3
Merge "Set current slice ctb x and y to fill prev incomplete slice" into lmp-dev
...
am: bfcdbd6a5b
2017-04-10 22:55:39 +00:00
Ray Essick
bfcdbd6a5b
Merge "Set current slice ctb x and y to fill prev incomplete slice" into lmp-dev
2017-04-10 22:46:39 +00:00
Harish Mahendrakar
ad43c8d810
Fixed an out of bound read in accessing inverse scan table am: fed1a3d8d8 am: eb8657808f
...
am: f4dc209cc7
2017-04-10 20:37:00 +00:00
Harish Mahendrakar
eb8657808f
Fixed an out of bound read in accessing inverse scan table
...
am: fed1a3d8d8
2017-04-10 20:27:29 +00:00
Naveen Kumar P
4040554b37
DO NOT MERGE Check for cpb cnt in hrd parsing
...
Bug: 34896431
The arrays in hrd are of size MAX_CPB_CNT. If cpb cnt is more
than MAX_CPB_CNT, more data is parsed and the subsequent buffer
is corrupted.
Change-Id: I74c01b8c7142b67a358eb5e36b160a7fbf2b69e4
2017-04-10 10:22:17 -07:00
Naveen Kumar P
f9aea65f69
DO NOT MERGE Check for cpb cnt in hrd parsing
...
Bug: 34896431
The arrays in hrd are of size MAX_CPB_CNT. If cpb cnt is more
than MAX_CPB_CNT, more data is parsed and the subsequent buffer
is corrupted.
Change-Id: I74c01b8c7142b67a358eb5e36b160a7fbf2b69e4
2017-04-10 10:20:11 -07:00
Naveen Kumar P
3e194e0edd
Check for cpb cnt in hrd parsing
...
Bug: 34896431
The arrays in hrd are of size MAX_CPB_CNT. If cpb cnt is more
than MAX_CPB_CNT, more data is parsed and the subsequent buffer
is corrupted.
Change-Id: I74c01b8c7142b67a358eb5e36b160a7fbf2b69e4
2017-04-10 08:58:24 -07:00
Naveen Kumar P
830858436b
Set current slice ctb x and y to fill prev incomplete slice
...
If previous slice is not completed, update the current slice
ctb_x and ctb_y so that while filling the previous slice,
the parse slice code can break properly.
Bug: 32322258
Test: boot, ran POC supplied with bug
Change-Id: Ie9090694514a018268851560a3f056194ff6fc91
2017-04-07 20:00:54 +00:00
Harish Mahendrakar
fed1a3d8d8
Fixed an out of bound read in accessing inverse scan table
...
Bug: 34819017
Change-Id: Ib25db1da92eee390a3847df06c0c0675ebcfb1a4
2017-03-22 10:06:35 -07:00
Naveen Kumar Ponnusamy
23bfe3e06d
Check only allocated mv bufs for releasing from reference
...
When checking mv bufs for releasing from reference, unallocated
mv bufs were also checked. This issue was fixed by restricting
the loop count to allocated number of mv bufs.
Bug: 34896906
Bug: 34819017
Change-Id: If832f590b301f414d4cd5206414efc61a70c17cb
2017-03-15 18:13:38 +00:00
Marco Nelissen
d93f4fc0f4
Merge "Handle error return from ref list in slice hdr parsing" into lmp-dev
...
am: fd5656fe76
2017-03-13 23:59:29 +00:00
Marco Nelissen
fd5656fe76
Merge "Handle error return from ref list in slice hdr parsing" into lmp-dev
2017-03-13 23:53:33 +00:00
Marco Nelissen
667e459e3f
Merge "Handle error return from ref list in slice hdr parsing" into mnc-dev
...
am: 8883b3e2a3
2017-03-13 22:56:54 +00:00
Naveen Kumar Ponnusamy
ee8b0629d9
Merge "Return error from cabac init if offset is greater than range" into lmp-dev am: 09ff5c6298 am: eef834a4d0 am: 49e9836a16
...
am: de6bd99214
2017-03-13 22:53:47 +00:00
Marco Nelissen
8883b3e2a3
Merge "Handle error return from ref list in slice hdr parsing" into mnc-dev
2017-03-13 22:52:41 +00:00
