Harish Mahendrakar
356364edaa
Merge "memset SPS to zero" into lmp-dev am: 31e21c5134 am: c1c11822d6
...
am: bb4f42afa0
2017-05-16 22:29:22 +00:00
Harish Mahendrakar
c1c11822d6
Merge "memset SPS to zero" into lmp-dev
...
am: 31e21c5134
2017-05-16 22:23:52 +00:00
TreeHugger Robot
31e21c5134
Merge "memset SPS to zero" into lmp-dev
2017-05-16 22:18:29 +00:00
Harish Mahendrakar
2e0e75aede
memset SPS to zero
...
SPS structure is memset to zero in parse_sps()
Bug: 33966031
Bug: 37458993
Change-Id: I7d4c04d2d25d7e9c8f581bd470260fc4394a564b
2017-05-12 16:21:21 -07:00
Marco Nelissen
e4ca1d697d
Merge "Fixed out of bound reads in stack variables" into lmp-dev
...
am: 4629c5cebf
2017-05-12 20:48:11 +00:00
Marco Nelissen
4629c5cebf
Merge "Fixed out of bound reads in stack variables" into lmp-dev
2017-05-12 20:45:19 +00:00
Wonsik Kim
4490398c88
Merge "DO NOT MERGE Check for cpb cnt in hrd parsing" into lmp-dev
2017-05-10 23:48:22 +00:00
Wonsik Kim
8dc7b42e65
Merge "DO NOT MERGE Check for cpb cnt in hrd parsing" into mnc-dev
2017-05-10 23:48:16 +00:00
Harish Mahendrakar
c9834edd64
Fixed out of bound reads in stack variables
...
Out of bound reads in the following variables are fixed
scaling_mat_offset in ihevcd_iquant_itrans_recon_ctb()
ai1_offset_y, ai1_offset_cb and ai1_offset_cr in ihevcd_sao_shift_ctb()
These values were read but not used
Bug: 34819017
Change-Id: Ic00e713b2c61d6793e1e097f852f0d1b3f913712
2017-05-09 14:28:47 -07:00
Hangyu Kuang
576f2fd4ef
Merge "Correct Tiles rows and cols check" into lmp-dev am: 7e3858b313 am: a78650de6d
...
am: 2bd3c9cd07
2017-04-12 20:21:31 +00:00
Hangyu Kuang
a78650de6d
Merge "Correct Tiles rows and cols check" into lmp-dev
...
am: 7e3858b313
2017-04-12 20:10:01 +00:00
Naveen Kumar Ponnusamy
a56dc1d7d0
Merge "Check only allocated mv bufs for releasing from reference" into lmp-dev am: 397d2f6c42 am: 1ebd5e1d81
...
am: 998a1e26c0
2017-04-12 20:10:00 +00:00
Hangyu Kuang
7e3858b313
Merge "Correct Tiles rows and cols check" into lmp-dev
2017-04-12 20:00:25 +00:00
Naveen Kumar Ponnusamy
1ebd5e1d81
Merge "Check only allocated mv bufs for releasing from reference" into lmp-dev
...
am: 397d2f6c42
2017-04-12 19:59:30 +00:00
TreeHugger Robot
397d2f6c42
Merge "Check only allocated mv bufs for releasing from reference" into lmp-dev
2017-04-12 19:49:50 +00:00
Naveen Kumar P
07ef4e7138
Correct Tiles rows and cols check
...
Bug: 36231493
Bug: 34064500
Change-Id: Ib17b2c68360685c5a2c019e1497612a130f9f76a
2017-04-11 14:12:29 -07:00
Ray Essick
60db7fead3
Merge "Set current slice ctb x and y to fill prev incomplete slice" into lmp-dev am: bfcdbd6a5b am: 88133ef0a3
...
am: 6249eafc05
2017-04-10 23:05:10 +00:00
Ray Essick
88133ef0a3
Merge "Set current slice ctb x and y to fill prev incomplete slice" into lmp-dev
...
am: bfcdbd6a5b
2017-04-10 22:55:39 +00:00
Ray Essick
bfcdbd6a5b
Merge "Set current slice ctb x and y to fill prev incomplete slice" into lmp-dev
2017-04-10 22:46:39 +00:00
Harish Mahendrakar
ad43c8d810
Fixed an out of bound read in accessing inverse scan table am: fed1a3d8d8 am: eb8657808f
...
am: f4dc209cc7
2017-04-10 20:37:00 +00:00
Harish Mahendrakar
eb8657808f
Fixed an out of bound read in accessing inverse scan table
...
am: fed1a3d8d8
2017-04-10 20:27:29 +00:00
Naveen Kumar P
4040554b37
DO NOT MERGE Check for cpb cnt in hrd parsing
...
Bug: 34896431
The arrays in hrd are of size MAX_CPB_CNT. If cpb cnt is more
than MAX_CPB_CNT, more data is parsed and the subsequent buffer
is corrupted.
Change-Id: I74c01b8c7142b67a358eb5e36b160a7fbf2b69e4
2017-04-10 10:22:17 -07:00
Naveen Kumar P
f9aea65f69
DO NOT MERGE Check for cpb cnt in hrd parsing
...
Bug: 34896431
The arrays in hrd are of size MAX_CPB_CNT. If cpb cnt is more
than MAX_CPB_CNT, more data is parsed and the subsequent buffer
is corrupted.
Change-Id: I74c01b8c7142b67a358eb5e36b160a7fbf2b69e4
2017-04-10 10:20:11 -07:00
Naveen Kumar P
830858436b
Set current slice ctb x and y to fill prev incomplete slice
...
If previous slice is not completed, update the current slice
ctb_x and ctb_y so that while filling the previous slice,
the parse slice code can break properly.
Bug: 32322258
Test: boot, ran POC supplied with bug
Change-Id: Ie9090694514a018268851560a3f056194ff6fc91
2017-04-07 20:00:54 +00:00
Harish Mahendrakar
fed1a3d8d8
Fixed an out of bound read in accessing inverse scan table
...
Bug: 34819017
Change-Id: Ib25db1da92eee390a3847df06c0c0675ebcfb1a4
2017-03-22 10:06:35 -07:00
Naveen Kumar Ponnusamy
23bfe3e06d
Check only allocated mv bufs for releasing from reference
...
When checking mv bufs for releasing from reference, unallocated
mv bufs were also checked. This issue was fixed by restricting
the loop count to allocated number of mv bufs.
Bug: 34896906
Bug: 34819017
Change-Id: If832f590b301f414d4cd5206414efc61a70c17cb
2017-03-15 18:13:38 +00:00
Marco Nelissen
d93f4fc0f4
Merge "Handle error return from ref list in slice hdr parsing" into lmp-dev
...
am: fd5656fe76
2017-03-13 23:59:29 +00:00
Marco Nelissen
fd5656fe76
Merge "Handle error return from ref list in slice hdr parsing" into lmp-dev
2017-03-13 23:53:33 +00:00
Marco Nelissen
8883b3e2a3
Merge "Handle error return from ref list in slice hdr parsing" into mnc-dev
2017-03-13 22:52:41 +00:00
Naveen Kumar Ponnusamy
de6bd99214
Merge "Return error from cabac init if offset is greater than range" into lmp-dev am: 09ff5c6298 am: eef834a4d0
...
am: 49e9836a16
2017-03-13 22:49:08 +00:00
Naveen Kumar Ponnusamy
eef834a4d0
Merge "Return error from cabac init if offset is greater than range" into lmp-dev
...
am: 09ff5c6298
2017-03-13 22:40:10 +00:00
Naveen Kumar Ponnusamy
766f97657f
Handle error return from ref list in slice hdr parsing
...
The error returned by ref_list function was not handled by the
caller parse_slice_header.
Bug: 34672748
Change-Id: I55f6cb0e651746e77f7ff3375115894ec3964203
2017-03-13 15:37:19 -07:00
TreeHugger Robot
09ff5c6298
Merge "Return error from cabac init if offset is greater than range" into lmp-dev
2017-03-13 22:31:34 +00:00
Harish Mahendrakar
cac2f841ae
Return error if SPS parsing reads more bytes than the nal length am: 232bbe1908 am: 2f206ceb72
...
am: c7ddfff98c
2017-03-11 00:20:02 +00:00
Harish Mahendrakar
2f206ceb72
Return error if SPS parsing reads more bytes than the nal length
...
am: 232bbe1908
2017-03-11 00:13:01 +00:00
Naveen Kumar Ponnusamy
b92314c860
Return error from cabac init if offset is greater than range
...
When the offset was greater than range, the bitstream was read
more than the valid range in leaf-level cabac parsing modules.
Error check was added to cabac init to fix this issue. Additionally
end of slice and slice error were signalled to suppress further
parsing of current slice.
Bug: 34897036
Change-Id: I1263f1d1219684ffa6e952c76e5a08e9a933c9d2
(cherry picked from commit 3b175da88a1807d19cdd248b74bce60e57f05c6a)
2017-03-10 14:56:09 -08:00
Naveen Kumar Ponnusamy
25206ffa6e
Handle error return from ref list in slice hdr parsing
...
The error returned by ref_list function was not handled by the
caller parse_slice_header.
Bug: 34672748
Change-Id: I55f6cb0e651746e77f7ff3375115894ec3964203
2017-03-10 19:01:38 +00:00
Harish Mahendrakar
232bbe1908
Return error if SPS parsing reads more bytes than the nal length
...
Bug: 35039946
Change-Id: Ia97fa8711f313d0029d2b13e6d150d5e46b2bb99
(cherry picked from commit a6c58e18a49a1ea4929f8345b3c59f900d5813f5)
2017-03-03 11:22:24 -08:00
Marco Nelissen
59b232588b
Merge "Fix in handling wrong cu_qp_delta" into lmp-dev am: 98f9e26d24 am: 10f2b105f5
...
am: b4ddce56d1
2017-02-14 22:59:01 +00:00
Marco Nelissen
10f2b105f5
Merge "Fix in handling wrong cu_qp_delta" into lmp-dev
...
am: 98f9e26d24
2017-02-14 22:54:32 +00:00
Marco Nelissen
98f9e26d24
Merge "Fix in handling wrong cu_qp_delta" into lmp-dev
2017-02-14 22:47:49 +00:00
Harish Mahendrakar
b3169d93df
Handle invalid num_reorder_pics & max_dec_pic_buffering in SPS am: 1ab5ce7e42 am: cb6fa6a0d4
...
am: f5674af080
2017-02-14 21:41:26 +00:00
Harish Mahendrakar
cb6fa6a0d4
Handle invalid num_reorder_pics & max_dec_pic_buffering in SPS
...
am: 1ab5ce7e42
2017-02-14 21:36:55 +00:00
Harish Mahendrakar
1ab5ce7e42
Handle invalid num_reorder_pics & max_dec_pic_buffering in SPS
...
Bug: 33864300
Change-Id: I920e45c3420a1a41a366ad45bd4186c5f6af6d6b
2017-02-13 20:21:01 +00:00
Harish Mahendrakar
01ca88bb6c
Fix in handling wrong cu_qp_delta
...
cu_qp_delta is now checked for the range as specified in the spec
Bug: 33966031
Change-Id: I00420bf68081af92e9f2be9af7ce58d0683094ca
2017-02-13 20:18:51 +00:00
Harish Mahendrakar
b5cae8181e
Added check for invalid log2_max_transform_block_size in SPS
...
Bug: 33918236
Bug: 33964497
Bug: 33965905
Bug: 33862021
Change-Id: If121221d0f6e983c05d95d123af9bed378d1961f
2017-01-17 15:38:38 -08:00
Marco Nelissen
ac029cfa04
Merge changes I662212eb,Ib07e2ed1 into mnc-dev
...
* changes:
Fixed handling invalid chroma tu size for error clips
Fixed out of bound reads in stack variables
2016-12-07 00:28:52 +00:00
Harish Mahendrakar
a76773ab74
Fixed handling invalid chroma tu size for error clips
...
Limit func_idx to valid range to ensure invalid functions are not
called when wrong TU size is signalled for chroma due to error in
parsing
Bug: 32915871
Change-Id: I662212eb2e9b8994e7e85780e667f14df73b5905
2016-12-07 00:28:46 +00:00
Harish Mahendrakar
4def2dfabf
Fixed out of bound reads in stack variables
...
Out of bound reads in the following variables are fixed
scaling_mat_offset in ihevcd_iquant_itrans_recon_ctb()
ai1_offset_y, ai1_offset_cb and ai1_offset_cr in ihevcd_sao_shift_ctb()
These values were read but not used
b/32915871
Change-Id: Ib07e2ed1bdcc600700d4e9e5d970f6cc2164ab1b
2016-12-06 23:55:42 +00:00
Harish Mahendrakar
f4f3556e04
Handle invalid slice_address in slice header
...
If an invalid slice_address was parsed, it was resulting in an incomplete
slice header during decode stage. Fix this by not incrementing slice_idx
for ignore slice error
Bug: 32322258
Change-Id: I8638d7094d65f4409faa9b9e337ef7e7b64505de
2016-11-10 14:59:41 -08:00
