Naveen Kumar P
6fbfe55f22
Merge "Set pic_present at end of pic_init instead of beginning" into lmp-dev am: 95cd002d79 am: 18a176494f am: b318a2b6a6 am: ab634125fb am: 66ae5b6dc1 am: f82e8aa4b8 am: 67f15e8623
...
am: f70d327289
2017-06-06 20:15:10 +00:00
Naveen Kumar P
f70d327289
Merge "Set pic_present at end of pic_init instead of beginning" into lmp-dev am: 95cd002d79 am: 18a176494f am: b318a2b6a6 am: ab634125fb am: 66ae5b6dc1 am: f82e8aa4b8
...
am: 67f15e8623
2017-06-06 20:09:09 +00:00
Naveen Kumar P
66ae5b6dc1
Merge "Set pic_present at end of pic_init instead of beginning" into lmp-dev am: 95cd002d79 am: 18a176494f am: b318a2b6a6
...
am: ab634125fb
2017-06-06 19:51:37 +00:00
Naveen Kumar P
ab634125fb
Merge "Set pic_present at end of pic_init instead of beginning" into lmp-dev am: 95cd002d79 am: 18a176494f
...
am: b318a2b6a6
2017-06-06 19:46:07 +00:00
Naveen Kumar P
18a176494f
Merge "Set pic_present at end of pic_init instead of beginning" into lmp-dev
...
am: 95cd002d79
2017-06-06 19:33:37 +00:00
TreeHugger Robot
95cd002d79
Merge "Set pic_present at end of pic_init instead of beginning" into lmp-dev
2017-06-06 19:22:09 +00:00
Naveen Kumar P
6a7bdf2172
Handle error return in parse slice am: 4535874899 am: c83ae25b05 am: 2bdd1d0979 am: f103a876f8 am: 3a53506dd4 am: 416da06611 am: c8ca86237e
...
am: 0806e67ec5
2017-06-01 21:24:25 +00:00
Naveen Kumar P
0806e67ec5
Handle error return in parse slice am: 4535874899 am: c83ae25b05 am: 2bdd1d0979 am: f103a876f8 am: 3a53506dd4 am: 416da06611
...
am: c8ca86237e
2017-06-01 21:22:25 +00:00
Naveen Kumar P
3a53506dd4
Handle error return in parse slice am: 4535874899 am: c83ae25b05 am: 2bdd1d0979
...
am: f103a876f8
2017-06-01 21:13:23 +00:00
Naveen Kumar P
f103a876f8
Handle error return in parse slice am: 4535874899 am: c83ae25b05
...
am: 2bdd1d0979
2017-06-01 21:10:24 +00:00
Naveen Kumar P
c83ae25b05
Handle error return in parse slice
...
am: 4535874899
2017-06-01 21:04:23 +00:00
Naveen Kumar P
4535874899
Handle error return in parse slice
...
Bug: 37430213
Change-Id: I77f5973db54edccc0972649035b0fbde961c10dd
(cherry picked from commit 16c8c8cceeb74c7f4634803723a0b8b1f4881dc9)
2017-05-30 09:38:36 -07:00
Naveen Kumar P
d012a1ffc0
Set pic_present at end of pic_init instead of beginning
...
Bug: 37469795
In pic_init, pic_present was set in the beggining. If pic_present
was set, process and buffer managment were done. For an error
stream, a crash occured when pic_init returned with error after setting
pic_present.
Change-Id: Iea42e6ad2bc5a74517188fa5e4cc434bb96d46c7
2017-05-23 10:32:34 -07:00
Harish Mahendrakar
a22d701d44
Fix heap buffer overflow while searching for valid PPS am: 5204651228 am: 89e719dc77 am: 22af42db03 am: 8108fecdf7 am: a136624479 am: a5f39dc005 am: a4d50ccfc5
...
am: 9c2d2c650b
2017-05-17 10:23:13 +00:00
Harish Mahendrakar
9c2d2c650b
Fix heap buffer overflow while searching for valid PPS am: 5204651228 am: 89e719dc77 am: 22af42db03 am: 8108fecdf7 am: a136624479 am: a5f39dc005
...
am: a4d50ccfc5
2017-05-17 10:20:42 +00:00
Harish Mahendrakar
a136624479
Fix heap buffer overflow while searching for valid PPS am: 5204651228 am: 89e719dc77 am: 22af42db03
...
am: 8108fecdf7
2017-05-17 10:12:42 +00:00
Harish Mahendrakar
8108fecdf7
Fix heap buffer overflow while searching for valid PPS am: 5204651228 am: 89e719dc77
...
am: 22af42db03
2017-05-17 10:10:11 +00:00
Harish Mahendrakar
89e719dc77
Fix heap buffer overflow while searching for valid PPS
...
am: 5204651228
2017-05-17 10:04:11 +00:00
Harish Mahendrakar
5204651228
Fix heap buffer overflow while searching for valid PPS
...
Bug: 37094889
Test: Tested POC on ASAN build
Change-Id: Id4e52cd10a4d5eac015efe4b752162dc39cc30b8
2017-05-16 16:48:29 -07:00
Naveen Kumar P
81f389ea8c
Merge "Check for buffer overflow in pps/slice header parsing" into lmp-dev am: 1853d3871a am: f7635dd278 am: 17caa64f8b am: 0b13008b9a am: 76c466f238 am: 94f311a6f2 am: d33b4bb164
...
am: 22dfbd2def
2017-05-16 22:39:51 +00:00
Harish Mahendrakar
4a3432e190
Merge "memset SPS to zero" into lmp-dev am: 31e21c5134 am: c1c11822d6 am: bb4f42afa0 am: 356364edaa am: 5dbf371a33 am: 1309c741ea am: 8dad755531
...
am: e36fc2b9a6
2017-05-16 22:39:44 +00:00
Naveen Kumar P
22dfbd2def
Merge "Check for buffer overflow in pps/slice header parsing" into lmp-dev am: 1853d3871a am: f7635dd278 am: 17caa64f8b am: 0b13008b9a am: 76c466f238 am: 94f311a6f2
...
am: d33b4bb164
2017-05-16 22:38:26 +00:00
Harish Mahendrakar
e36fc2b9a6
Merge "memset SPS to zero" into lmp-dev am: 31e21c5134 am: c1c11822d6 am: bb4f42afa0 am: 356364edaa am: 5dbf371a33 am: 1309c741ea
...
am: 8dad755531
2017-05-16 22:38:15 +00:00
Naveen Kumar P
76c466f238
Merge "Check for buffer overflow in pps/slice header parsing" into lmp-dev am: 1853d3871a am: f7635dd278 am: 17caa64f8b
...
am: 0b13008b9a
2017-05-16 22:33:32 +00:00
Harish Mahendrakar
5dbf371a33
Merge "memset SPS to zero" into lmp-dev am: 31e21c5134 am: c1c11822d6 am: bb4f42afa0
...
am: 356364edaa
2017-05-16 22:33:14 +00:00
Naveen Kumar P
0b13008b9a
Merge "Check for buffer overflow in pps/slice header parsing" into lmp-dev am: 1853d3871a am: f7635dd278
...
am: 17caa64f8b
2017-05-16 22:29:43 +00:00
Harish Mahendrakar
356364edaa
Merge "memset SPS to zero" into lmp-dev am: 31e21c5134 am: c1c11822d6
...
am: bb4f42afa0
2017-05-16 22:29:22 +00:00
Naveen Kumar P
f7635dd278
Merge "Check for buffer overflow in pps/slice header parsing" into lmp-dev
...
am: 1853d3871a
2017-05-16 22:24:02 +00:00
Harish Mahendrakar
c1c11822d6
Merge "memset SPS to zero" into lmp-dev
...
am: 31e21c5134
2017-05-16 22:23:52 +00:00
TreeHugger Robot
1853d3871a
Merge "Check for buffer overflow in pps/slice header parsing" into lmp-dev
2017-05-16 22:20:33 +00:00
TreeHugger Robot
31e21c5134
Merge "memset SPS to zero" into lmp-dev
2017-05-16 22:18:29 +00:00
Naveen Kumar P
d61d5e5f6a
Check for buffer overflow in pps/slice header parsing
...
Bug: 36215950
Bug: 36215953
Bug: 36216719
Change-Id: Ibdc05e1d5aa21d060d7c683fd9af4bed8537053f
2017-05-15 15:45:50 -07:00
Harish Mahendrakar
2e0e75aede
memset SPS to zero
...
SPS structure is memset to zero in parse_sps()
Bug: 33966031
Bug: 37458993
Change-Id: I7d4c04d2d25d7e9c8f581bd470260fc4394a564b
2017-05-12 16:21:21 -07:00
Ray Essick
50272c7a39
Merge changes from topic 'b34779227-mnc-dr' into mnc-dr-dev
...
* changes:
Fix reallocation for new sps
DO NOT MERGE Handle streams with change in max_dec_buffering/num_reorder_frames without resolution change
2017-05-12 23:15:16 +00:00
Marco Nelissen
e4ca1d697d
Merge "Fixed out of bound reads in stack variables" into lmp-dev
...
am: 4629c5cebf
2017-05-12 20:48:11 +00:00
Harish Mahendrakar
135d508cba
Merge "DO NOT MERGE Handle streams with change in max_dec_buffering/num_reorder_frames without resolution change" into nyc-dev
...
am: 71c0aeaaff
2017-05-12 20:48:11 +00:00
Marco Nelissen
4629c5cebf
Merge "Fixed out of bound reads in stack variables" into lmp-dev
2017-05-12 20:45:19 +00:00
TreeHugger Robot
71c0aeaaff
Merge "DO NOT MERGE Handle streams with change in max_dec_buffering/num_reorder_frames without resolution change" into nyc-dev
2017-05-12 20:38:18 +00:00
Wonsik Kim
b8ea9ac092
Merge "Check for cpb cnt in hrd parsing" into nyc-dev
...
am: 8f4b305eb1
2017-05-11 15:49:59 +00:00
Wonsik Kim
8f4b305eb1
Merge "Check for cpb cnt in hrd parsing" into nyc-dev
2017-05-11 15:39:40 +00:00
Mark Salyzyn
5e17a2046b
resolve merge conflicts of 8dc7b42 to mnc-dr-dev
...
Test: I solemnly swear I tested this conflict resolution.
Bug: 34896431
Change-Id: I670a2d2025f52b0197651bd4bb2acbc4887e0447
2017-05-11 15:23:00 +00:00
Wonsik Kim
4490398c88
Merge "DO NOT MERGE Check for cpb cnt in hrd parsing" into lmp-dev
2017-05-10 23:48:22 +00:00
Wonsik Kim
8dc7b42e65
Merge "DO NOT MERGE Check for cpb cnt in hrd parsing" into mnc-dev
2017-05-10 23:48:16 +00:00
Harish Mahendrakar
c9834edd64
Fixed out of bound reads in stack variables
...
Out of bound reads in the following variables are fixed
scaling_mat_offset in ihevcd_iquant_itrans_recon_ctb()
ai1_offset_y, ai1_offset_cb and ai1_offset_cr in ihevcd_sao_shift_ctb()
These values were read but not used
Bug: 34819017
Change-Id: Ic00e713b2c61d6793e1e097f852f0d1b3f913712
2017-05-09 14:28:47 -07:00
Harish Mahendrakar
27ad0d7bff
DO NOT MERGE Handle streams with change in max_dec_buffering/num_reorder_frames
...
without resolution change
backported from master as part of fixing a security issue on
nyc-*.
Bug: 34779227
Test: successful re-run of POC after patch
Change-Id: I404099ac24439b5f6eddc9265dc571929433b3ee
2017-05-05 10:16:22 -07:00
Naveen Kumar P
99df61bb9a
Fix reallocation for new sps
...
This works for mnc-dr-dev and later.
Bug: 34779227
Test: re-ran POC before/after patch to verify behavior
Change-Id: Ida0bf6bcc236494c3c89b228039501e287839fbe
2017-05-05 09:50:11 -07:00
Harish Mahendrakar
b62479887e
DO NOT MERGE Handle streams with change in max_dec_buffering/num_reorder_frames
...
without resolution change
backported from master as part of fixing a security issue on mnc-dr.
Bug: 34779227
Test: before/after execution of PIC
Change-Id: I404099ac24439b5f6eddc9265dc571929433b3ee
2017-05-05 09:46:46 -07:00
Hangyu Kuang
da794ae209
Merge "Correct Tiles rows and cols check" into lmp-dev am: 7e3858b313 am: a78650de6d am: 2bd3c9cd07 am: 576f2fd4ef am: af6ce4991f am: 98c1c3e1c1 am: 16db19a2f9
...
am: bfb52f7f70
2017-04-12 20:48:34 +00:00
Naveen Kumar Ponnusamy
a77d63eb88
Merge "Check only allocated mv bufs for releasing from reference" into lmp-dev am: 397d2f6c42 am: 1ebd5e1d81 am: 998a1e26c0 am: a56dc1d7d0 am: 87c7e6a523 am: c9375442de am: 993a3e498a
...
am: 4dbd4142e5
2017-04-12 20:37:32 +00:00
Hangyu Kuang
af6ce4991f
Merge "Correct Tiles rows and cols check" into lmp-dev am: 7e3858b313 am: a78650de6d am: 2bd3c9cd07
...
am: 576f2fd4ef
2017-04-12 20:26:32 +00:00
