TreeHugger Robot
71c0aeaaff
Merge "DO NOT MERGE Handle streams with change in max_dec_buffering/num_reorder_frames without resolution change" into nyc-dev
2017-05-12 20:38:18 +00:00
Wonsik Kim
8f4b305eb1
Merge "Check for cpb cnt in hrd parsing" into nyc-dev
2017-05-11 15:39:40 +00:00
Harish Mahendrakar
27ad0d7bff
DO NOT MERGE Handle streams with change in max_dec_buffering/num_reorder_frames
...
without resolution change
backported from master as part of fixing a security issue on
nyc-*.
Bug: 34779227
Test: successful re-run of POC after patch
Change-Id: I404099ac24439b5f6eddc9265dc571929433b3ee
2017-05-05 10:16:22 -07:00
Hangyu Kuang
af6ce4991f
Merge "Correct Tiles rows and cols check" into lmp-dev am: 7e3858b313 am: a78650de6d am: 2bd3c9cd07
...
am: 576f2fd4ef
2017-04-12 20:26:32 +00:00
Hangyu Kuang
576f2fd4ef
Merge "Correct Tiles rows and cols check" into lmp-dev am: 7e3858b313 am: a78650de6d
...
am: 2bd3c9cd07
2017-04-12 20:21:31 +00:00
Naveen Kumar Ponnusamy
87c7e6a523
Merge "Check only allocated mv bufs for releasing from reference" into lmp-dev am: 397d2f6c42 am: 1ebd5e1d81 am: 998a1e26c0
...
am: a56dc1d7d0
2017-04-12 20:15:31 +00:00
Hangyu Kuang
a78650de6d
Merge "Correct Tiles rows and cols check" into lmp-dev
...
am: 7e3858b313
2017-04-12 20:10:01 +00:00
Naveen Kumar Ponnusamy
a56dc1d7d0
Merge "Check only allocated mv bufs for releasing from reference" into lmp-dev am: 397d2f6c42 am: 1ebd5e1d81
...
am: 998a1e26c0
2017-04-12 20:10:00 +00:00
Hangyu Kuang
7e3858b313
Merge "Correct Tiles rows and cols check" into lmp-dev
2017-04-12 20:00:25 +00:00
Naveen Kumar Ponnusamy
1ebd5e1d81
Merge "Check only allocated mv bufs for releasing from reference" into lmp-dev
...
am: 397d2f6c42
2017-04-12 19:59:30 +00:00
TreeHugger Robot
397d2f6c42
Merge "Check only allocated mv bufs for releasing from reference" into lmp-dev
2017-04-12 19:49:50 +00:00
Naveen Kumar P
07ef4e7138
Correct Tiles rows and cols check
...
Bug: 36231493
Bug: 34064500
Change-Id: Ib17b2c68360685c5a2c019e1497612a130f9f76a
2017-04-11 14:12:29 -07:00
Ray Essick
1f26f4efca
Merge "Set current slice ctb x and y to fill prev incomplete slice" into lmp-dev am: bfcdbd6a5b am: 88133ef0a3 am: 6249eafc05
...
am: 60db7fead3
2017-04-10 23:09:10 +00:00
Ray Essick
60db7fead3
Merge "Set current slice ctb x and y to fill prev incomplete slice" into lmp-dev am: bfcdbd6a5b am: 88133ef0a3
...
am: 6249eafc05
2017-04-10 23:05:10 +00:00
Ray Essick
88133ef0a3
Merge "Set current slice ctb x and y to fill prev incomplete slice" into lmp-dev
...
am: bfcdbd6a5b
2017-04-10 22:55:39 +00:00
Ray Essick
bfcdbd6a5b
Merge "Set current slice ctb x and y to fill prev incomplete slice" into lmp-dev
2017-04-10 22:46:39 +00:00
Harish Mahendrakar
ad43c8d810
Fixed an out of bound read in accessing inverse scan table am: fed1a3d8d8 am: eb8657808f
...
am: f4dc209cc7
2017-04-10 20:37:00 +00:00
Harish Mahendrakar
eb8657808f
Fixed an out of bound read in accessing inverse scan table
...
am: fed1a3d8d8
2017-04-10 20:27:29 +00:00
Naveen Kumar P
3e194e0edd
Check for cpb cnt in hrd parsing
...
Bug: 34896431
The arrays in hrd are of size MAX_CPB_CNT. If cpb cnt is more
than MAX_CPB_CNT, more data is parsed and the subsequent buffer
is corrupted.
Change-Id: I74c01b8c7142b67a358eb5e36b160a7fbf2b69e4
2017-04-10 08:58:24 -07:00
Naveen Kumar P
830858436b
Set current slice ctb x and y to fill prev incomplete slice
...
If previous slice is not completed, update the current slice
ctb_x and ctb_y so that while filling the previous slice,
the parse slice code can break properly.
Bug: 32322258
Test: boot, ran POC supplied with bug
Change-Id: Ie9090694514a018268851560a3f056194ff6fc91
2017-04-07 20:00:54 +00:00
Harish Mahendrakar
fed1a3d8d8
Fixed an out of bound read in accessing inverse scan table
...
Bug: 34819017
Change-Id: Ib25db1da92eee390a3847df06c0c0675ebcfb1a4
2017-03-22 10:06:35 -07:00
Naveen Kumar Ponnusamy
23bfe3e06d
Check only allocated mv bufs for releasing from reference
...
When checking mv bufs for releasing from reference, unallocated
mv bufs were also checked. This issue was fixed by restricting
the loop count to allocated number of mv bufs.
Bug: 34896906
Bug: 34819017
Change-Id: If832f590b301f414d4cd5206414efc61a70c17cb
2017-03-15 18:13:38 +00:00
Marco Nelissen
d93f4fc0f4
Merge "Handle error return from ref list in slice hdr parsing" into lmp-dev
...
am: fd5656fe76
2017-03-13 23:59:29 +00:00
Marco Nelissen
fd5656fe76
Merge "Handle error return from ref list in slice hdr parsing" into lmp-dev
2017-03-13 23:53:33 +00:00
Marco Nelissen
667e459e3f
Merge "Handle error return from ref list in slice hdr parsing" into mnc-dev
...
am: 8883b3e2a3
2017-03-13 22:56:54 +00:00
Naveen Kumar Ponnusamy
ee8b0629d9
Merge "Return error from cabac init if offset is greater than range" into lmp-dev am: 09ff5c6298 am: eef834a4d0 am: 49e9836a16
...
am: de6bd99214
2017-03-13 22:53:47 +00:00
Marco Nelissen
8883b3e2a3
Merge "Handle error return from ref list in slice hdr parsing" into mnc-dev
2017-03-13 22:52:41 +00:00
Naveen Kumar Ponnusamy
de6bd99214
Merge "Return error from cabac init if offset is greater than range" into lmp-dev am: 09ff5c6298 am: eef834a4d0
...
am: 49e9836a16
2017-03-13 22:49:08 +00:00
Naveen Kumar Ponnusamy
eef834a4d0
Merge "Return error from cabac init if offset is greater than range" into lmp-dev
...
am: 09ff5c6298
2017-03-13 22:40:10 +00:00
Naveen Kumar Ponnusamy
766f97657f
Handle error return from ref list in slice hdr parsing
...
The error returned by ref_list function was not handled by the
caller parse_slice_header.
Bug: 34672748
Change-Id: I55f6cb0e651746e77f7ff3375115894ec3964203
2017-03-13 15:37:19 -07:00
TreeHugger Robot
09ff5c6298
Merge "Return error from cabac init if offset is greater than range" into lmp-dev
2017-03-13 22:31:34 +00:00
Harish Mahendrakar
c30ceb1eea
Return error if SPS parsing reads more bytes than the nal length am: 232bbe1908 am: 2f206ceb72 am: c7ddfff98c
...
am: cac2f841ae
2017-03-11 00:23:32 +00:00
Harish Mahendrakar
cac2f841ae
Return error if SPS parsing reads more bytes than the nal length am: 232bbe1908 am: 2f206ceb72
...
am: c7ddfff98c
2017-03-11 00:20:02 +00:00
Harish Mahendrakar
2f206ceb72
Return error if SPS parsing reads more bytes than the nal length
...
am: 232bbe1908
2017-03-11 00:13:01 +00:00
Naveen Kumar Ponnusamy
b92314c860
Return error from cabac init if offset is greater than range
...
When the offset was greater than range, the bitstream was read
more than the valid range in leaf-level cabac parsing modules.
Error check was added to cabac init to fix this issue. Additionally
end of slice and slice error were signalled to suppress further
parsing of current slice.
Bug: 34897036
Change-Id: I1263f1d1219684ffa6e952c76e5a08e9a933c9d2
(cherry picked from commit 3b175da88a1807d19cdd248b74bce60e57f05c6a)
2017-03-10 14:56:09 -08:00
Naveen Kumar Ponnusamy
25206ffa6e
Handle error return from ref list in slice hdr parsing
...
The error returned by ref_list function was not handled by the
caller parse_slice_header.
Bug: 34672748
Change-Id: I55f6cb0e651746e77f7ff3375115894ec3964203
2017-03-10 19:01:38 +00:00
Harish Mahendrakar
232bbe1908
Return error if SPS parsing reads more bytes than the nal length
...
Bug: 35039946
Change-Id: Ia97fa8711f313d0029d2b13e6d150d5e46b2bb99
(cherry picked from commit a6c58e18a49a1ea4929f8345b3c59f900d5813f5)
2017-03-03 11:22:24 -08:00
Marco Nelissen
ca85c43d8d
Merge "Fix in handling wrong cu_qp_delta" into lmp-dev am: 98f9e26d24 am: 10f2b105f5 am: b4ddce56d1
...
am: 59b232588b
2017-02-14 23:01:31 +00:00
Marco Nelissen
59b232588b
Merge "Fix in handling wrong cu_qp_delta" into lmp-dev am: 98f9e26d24 am: 10f2b105f5
...
am: b4ddce56d1
2017-02-14 22:59:01 +00:00
Marco Nelissen
10f2b105f5
Merge "Fix in handling wrong cu_qp_delta" into lmp-dev
...
am: 98f9e26d24
2017-02-14 22:54:32 +00:00
Marco Nelissen
98f9e26d24
Merge "Fix in handling wrong cu_qp_delta" into lmp-dev
2017-02-14 22:47:49 +00:00
Harish Mahendrakar
0c49980418
Handle invalid num_reorder_pics & max_dec_pic_buffering in SPS am: 1ab5ce7e42 am: cb6fa6a0d4 am: f5674af080
...
am: b3169d93df
2017-02-14 21:43:30 +00:00
Harish Mahendrakar
b3169d93df
Handle invalid num_reorder_pics & max_dec_pic_buffering in SPS am: 1ab5ce7e42 am: cb6fa6a0d4
...
am: f5674af080
2017-02-14 21:41:26 +00:00
Harish Mahendrakar
cb6fa6a0d4
Handle invalid num_reorder_pics & max_dec_pic_buffering in SPS
...
am: 1ab5ce7e42
2017-02-14 21:36:55 +00:00
Harish Mahendrakar
1ab5ce7e42
Handle invalid num_reorder_pics & max_dec_pic_buffering in SPS
...
Bug: 33864300
Change-Id: I920e45c3420a1a41a366ad45bd4186c5f6af6d6b
2017-02-13 20:21:01 +00:00
Harish Mahendrakar
01ca88bb6c
Fix in handling wrong cu_qp_delta
...
cu_qp_delta is now checked for the range as specified in the spec
Bug: 33966031
Change-Id: I00420bf68081af92e9f2be9af7ce58d0683094ca
2017-02-13 20:18:51 +00:00
Harish Mahendrakar
4b6511b432
Added check for invalid log2_max_transform_block_size in SPS
...
am: b5cae8181e
2017-01-18 18:18:40 +00:00
Harish Mahendrakar
b5cae8181e
Added check for invalid log2_max_transform_block_size in SPS
...
Bug: 33918236
Bug: 33964497
Bug: 33965905
Bug: 33862021
Change-Id: If121221d0f6e983c05d95d123af9bed378d1961f
2017-01-17 15:38:38 -08:00
Harish Mahendrakar
8322418219
Fixed handling invalid chroma tu size for error clips
...
am: a76773ab74
2016-12-07 00:33:46 +00:00
Harish Mahendrakar
d751d3e940
Fixed out of bound reads in stack variables
...
am: 4def2dfabf
2016-12-07 00:33:45 +00:00
