Without this extra allocation, if a nal fills entire bits
buffer, there will be out of bound memory read access.
Bug: 65719872
Test: ran poc before/after on ASAN of master
Change-Id: I9f4fca0739db84db023b1252c1365bfd13355541
Merged-In: I1c36821505bdc4fe6c23f30a02ab2fb0fb657946
For clips with tiles and dimensions >= 4096,
CTB size of 16 can result in tile position > 255.
This is not supported by the decoder
Bug: 37930177
Test: ran poc w/o crashing
Change-Id: I2f223a124c4ea9bfd98343343fd010d80a5dd8bd
In case of error clips, some PUs are marked as skip.
Ensure such PUs stay within the picture
Bug: 37615911
Test: ran POC included with the bug.
Change-Id: Ie0aeccc752cf556f9dea84de61c15a7906e1060b
Bug: 37469795
In pic_init, pic_present was set in the beggining. If pic_present
was set, process and buffer managment were done. For an error
stream, a crash occured when pic_init returned with error after setting
pic_present.
Change-Id: Iea42e6ad2bc5a74517188fa5e4cc434bb96d46c7
Out of bound reads in the following variables are fixed
scaling_mat_offset in ihevcd_iquant_itrans_recon_ctb()
ai1_offset_y, ai1_offset_cb and ai1_offset_cr in ihevcd_sao_shift_ctb()
These values were read but not used
Bug: 34819017
Change-Id: Ic00e713b2c61d6793e1e097f852f0d1b3f913712
Bug: 34896431
The arrays in hrd are of size MAX_CPB_CNT. If cpb cnt is more
than MAX_CPB_CNT, more data is parsed and the subsequent buffer
is corrupted.
Change-Id: I74c01b8c7142b67a358eb5e36b160a7fbf2b69e4
If previous slice is not completed, update the current slice
ctb_x and ctb_y so that while filling the previous slice,
the parse slice code can break properly.
Bug: 32322258
Test: boot, ran POC supplied with bug
Change-Id: Ie9090694514a018268851560a3f056194ff6fc91
When checking mv bufs for releasing from reference, unallocated
mv bufs were also checked. This issue was fixed by restricting
the loop count to allocated number of mv bufs.
Bug: 34896906
Bug: 34819017
Change-Id: If832f590b301f414d4cd5206414efc61a70c17cb
The error returned by ref_list function was not handled by the
caller parse_slice_header.
Bug: 34672748
Change-Id: I55f6cb0e651746e77f7ff3375115894ec3964203
When the offset was greater than range, the bitstream was read
more than the valid range in leaf-level cabac parsing modules.
Error check was added to cabac init to fix this issue. Additionally
end of slice and slice error were signalled to suppress further
parsing of current slice.
Bug: 34897036
Change-Id: I1263f1d1219684ffa6e952c76e5a08e9a933c9d2
(cherry picked from commit 3b175da88a1807d19cdd248b74bce60e57f05c6a)
Change I59c996161053e313c873381c5bf6f8c36488483f aligned the number
of luma samples to 64byte boundaries when calculating and creating
the buffers. Unfortunately, it doesn't change all instances of that
calculation, leading to mismatches between creation/allocation/destruction.
Fixes android.media.cts.DecoderTest#testEOSBehaviorHEVC and
android.media.cts.DecoderTest#testCodecEarlyEOSHEVC
Bug: 24686670
Bug: 25070493
Bug: 25995793
Bug: 26217939
Bug: 26239053
Change-Id: I5b9dd682e08cfb03d2bc54829c4908976251dee7
