Snap for 7080740 from c74dab7a5a15190f4066ef080b2cd05475587a7a to mainline-conscrypt-releaseandroid-mainline-11.0.0_r31android-mainline-11.0.0_r20android11-mainline-conscrypt-release

Change-Id: I7995d6285542d45f05561a792a462d78e30ff745

10 files changed, 101 insertions, 38 deletions

diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c
index 3a73938..3dfcbf2 100644
--- a/decoder/ih264d_api.c
+++ b/decoder/ih264d_api.c
@@ -3253,7 +3253,7 @@ WORD32 ih264d_set_params(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
         ret = IV_FAIL;
     }
 
-    if(ps_ctl_ip->u4_disp_wd >= ps_dec->u2_pic_wd)
+    if(ps_ctl_ip->u4_disp_wd >= ps_dec->u2_disp_width)
     {
         ps_dec->u4_app_disp_width = ps_ctl_ip->u4_disp_wd;
     }
diff --git a/decoder/ih264d_bitstrm.h b/decoder/ih264d_bitstrm.h
index 49cd5e7..8bb06fb 100644
--- a/decoder/ih264d_bitstrm.h
+++ b/decoder/ih264d_bitstrm.h
@@ -57,7 +57,7 @@ typedef struct
 {
     UWORD32 u4_ofst; /* Offset in the buffer for the current bit */
     UWORD32 *pu4_buffer; /* Bitstream Buffer  */
-    UWORD32 u4_max_ofst; /* Position of the last bit read in the current buffer */
+    UWORD32 u4_max_ofst; /* points to first bit beyond the buffer */
     void * pv_codec_handle; /* For Error Handling */
 } dec_bit_stream_t;
 
@@ -88,10 +88,13 @@ WORD32 ih264d_flush_bits_h264(dec_bit_stream_t *, WORD32);
  **************************************************************************
  */
 
-#define MORE_RBSP_DATA(ps_bitstrm) \
-  (ps_bitstrm->u4_ofst < ps_bitstrm->u4_max_ofst)
+
 #define EXCEED_OFFSET(ps_bitstrm) \
   (ps_bitstrm->u4_ofst > ps_bitstrm->u4_max_ofst)
+#define CHECK_BITS_SUFFICIENT(ps_bitstrm, bits_to_read) \
+  (ps_bitstrm->u4_ofst + bits_to_read <= ps_bitstrm->u4_max_ofst)
+#define MORE_RBSP_DATA(ps_bitstrm) \
+    CHECK_BITS_SUFFICIENT(ps_bitstrm, 1)
 
 void GoToByteBoundary(dec_bit_stream_t * ps_bitstrm);
 UWORD8 ih264d_check_byte_aligned(dec_bit_stream_t * ps_bitstrm);
diff --git a/decoder/ih264d_cabac.c b/decoder/ih264d_cabac.c
index 38028ae..ef1fafc 100644
--- a/decoder/ih264d_cabac.c
+++ b/decoder/ih264d_cabac.c
@@ -69,7 +69,7 @@ WORD32 ih264d_init_cabac_dec_envirnoment(decoding_envirnoment_t * ps_cab_env,
              32);
     FLUSHBITS(ps_bitstrm->u4_ofst, 9)
 
-    if(ps_bitstrm->u4_ofst > ps_bitstrm->u4_max_ofst)
+    if(EXCEED_OFFSET(ps_bitstrm))
         return ERROR_EOB_FLUSHBITS_T;
 
     ps_cab_env->u4_code_int_val_ofst = u4_code_int_val_ofst;
diff --git a/decoder/ih264d_defs.h b/decoder/ih264d_defs.h
index 2758a59..73604f1 100644
--- a/decoder/ih264d_defs.h
+++ b/decoder/ih264d_defs.h
@@ -45,6 +45,11 @@
 
 #define FMT_CONV_NUM_ROWS       16
 
+/** Decoder currently has an additional latency of 2 pictures when
+  * returning output for display
+  */
+#define DISPLAY_LATENCY         2
+
 /** Bit manipulation macros */
 #define CHECKBIT(a,i) ((a) &  (1 << i))
 #define CLEARBIT(a,i) ((a) &= ~(1 << i))
diff --git a/decoder/ih264d_dpb_manager.h b/decoder/ih264d_dpb_manager.h
index a9539c8..3bf00b7 100644
--- a/decoder/ih264d_dpb_manager.h
+++ b/decoder/ih264d_dpb_manager.h
@@ -50,6 +50,7 @@
 #define RESET_NONREF_PICTURES       7
 #define RESET_ALL_PICTURES          8
 
+#define NO_LONG_TERM_INDICIES      255
 struct field_t
 {
     /* picNum of tbe reference field              */
@@ -93,7 +94,7 @@ typedef struct
   struct dpb_info_t as_dpb_info[MAX_REF_BUFS];       /** Physical storage for dpbInfo for ref bufs */
   UWORD8 u1_num_st_ref_bufs;        /** Number of short term ref. buffers */
   UWORD8 u1_num_lt_ref_bufs;        /** Number of long term ref. buffer */
-  UWORD8 u1_max_lt_pic_idx_plus1;       /** Maximum long term pictures - 0 to max_long_term_pic_idx */
+  UWORD8 u1_max_lt_frame_idx;       /** Maximum long term frame index */
   UWORD8 u1_num_gaps;       /** Total number of outstanding gaps */
   void * pv_codec_handle;             /* For Error Handling */
   WORD32 i4_max_frm_num;        /** Max frame number */
diff --git a/decoder/ih264d_dpb_mgr.c b/decoder/ih264d_dpb_mgr.c
index 0b8426b..28c9619 100644
--- a/decoder/ih264d_dpb_mgr.c
+++ b/decoder/ih264d_dpb_mgr.c
@@ -851,6 +851,8 @@ WORD32 ih264d_ref_idx_reordering(dec_struct_t *ps_dec, UWORD8 uc_lx)
  */
 WORD32 ih264d_read_mmco_commands(struct _DecStruct * ps_dec)
 {
+    dec_pic_params_t *ps_pps = ps_dec->ps_cur_pps;
+    dec_seq_params_t *ps_sps = ps_pps->ps_sps;
     dec_bit_stream_t *ps_bitstrm = ps_dec->ps_bitstrm;
     dpb_commands_t *ps_dpb_cmds = &(ps_dec->s_dpb_cmds_scratch);
     dec_slice_params_t * ps_slice = ps_dec->ps_cur_slice;
@@ -890,7 +892,7 @@ WORD32 ih264d_read_mmco_commands(struct _DecStruct * ps_dec)
             {
                 UWORD32 u4_mmco;
                 UWORD32 u4_diff_pic_num;
-                UWORD32 u4_lt_idx, u4_max_lt_idx;
+                UWORD32 u4_lt_idx, u4_max_lt_idx_plus1;
 
                 u4_mmco = ih264d_uev(pu4_bitstrm_ofst,
                                      pu4_bitstrm_buf);
@@ -933,9 +935,14 @@ WORD32 ih264d_read_mmco_commands(struct _DecStruct * ps_dec)
 
                         case SET_MAX_LT_INDEX:
                         {
-                            u4_max_lt_idx = ih264d_uev(pu4_bitstrm_ofst,
-                                                       pu4_bitstrm_buf);
-                            ps_mmc_params->u4_max_lt_idx_plus1 = u4_max_lt_idx;
+                            u4_max_lt_idx_plus1 = ih264d_uev(pu4_bitstrm_ofst,
+                                                             pu4_bitstrm_buf);
+                            if (u4_max_lt_idx_plus1 > ps_sps->u1_num_ref_frames)
+                            {
+                                /* Invalid max LT ref index */
+                                return -1;
+                            }
+                            ps_mmc_params->u4_max_lt_idx_plus1 = u4_max_lt_idx_plus1;
                             break;
                         }
                         case RESET_REF_PICTURES:
@@ -959,7 +966,6 @@ WORD32 ih264d_read_mmco_commands(struct _DecStruct * ps_dec)
                     j++;
                 }
                 ps_dpb_cmds->u1_num_of_commands = j;
-
             }
         }
         ps_dpb_cmds->u1_dpb_commands_read = 1;
@@ -1243,6 +1249,13 @@ WORD32 ih264d_do_mmco_buffer(dpb_commands_t *ps_dpb_cmds,
                     }
 
                     u4_lt_idx = ps_mmc_params->u4_lt_idx; //Get long term index
+
+                    if((ps_dpb_mgr->u1_max_lt_frame_idx == NO_LONG_TERM_INDICIES) ||
+                        (u4_lt_idx > ps_dpb_mgr->u1_max_lt_frame_idx))
+                    {
+                        return ERROR_DBP_MANAGER_T;
+                    }
+
                     if(ps_dpb_mgr->u1_num_st_ref_bufs > 0)
                     {
                         ret = ih264d_delete_st_node_or_make_lt(ps_dpb_mgr,
@@ -1257,7 +1270,7 @@ WORD32 ih264d_do_mmco_buffer(dpb_commands_t *ps_dpb_cmds,
                 {
                     UWORD8 uc_numLT = ps_dpb_mgr->u1_num_lt_ref_bufs;
                     u4_lt_idx = ps_mmc_params->u4_max_lt_idx_plus1; //Get Max_long_term_index_plus1
-                    if(u4_lt_idx < ps_dpb_mgr->u1_max_lt_pic_idx_plus1
+                    if(u4_lt_idx <= ps_dpb_mgr->u1_max_lt_frame_idx
                                     && uc_numLT > 0)
                     {
                         struct dpb_info_t *ps_nxtDPB;
@@ -1302,13 +1315,25 @@ WORD32 ih264d_do_mmco_buffer(dpb_commands_t *ps_dpb_cmds,
                             ps_nxtDPB->ps_prev_long = NULL;
                         }
                     }
-                    ps_dpb_mgr->u1_max_lt_pic_idx_plus1 = u4_lt_idx;
+                    if(u4_lt_idx == 0)
+                    {
+                        ps_dpb_mgr->u1_max_lt_frame_idx = NO_LONG_TERM_INDICIES;
+                    }
+                    else
+                    {
+                        ps_dpb_mgr->u1_max_lt_frame_idx = u4_lt_idx - 1;
+                    }
 
                     break;
                 }
                 case SET_LT_INDEX:
                 {
                     u4_lt_idx = ps_mmc_params->u4_lt_idx; //Get long term index
+                    if((ps_dpb_mgr->u1_max_lt_frame_idx == NO_LONG_TERM_INDICIES) ||
+                        (u4_lt_idx > ps_dpb_mgr->u1_max_lt_frame_idx))
+                    {
+                        return ERROR_DBP_MANAGER_T;
+                    }
                     ret = ih264d_insert_st_node(ps_dpb_mgr, ps_pic_buf, u1_buf_id,
                                           u4_cur_pic_num);
                     if(ret != OK)
diff --git a/decoder/ih264d_parse_headers.c b/decoder/ih264d_parse_headers.c
index f286e29..160336a 100644
--- a/decoder/ih264d_parse_headers.c
+++ b/decoder/ih264d_parse_headers.c
@@ -463,7 +463,7 @@ WORD32 ih264d_parse_pps(dec_struct_t * ps_dec, dec_bit_stream_t * ps_bitstrm)
 
     /* In case bitstream read has exceeded the filled size, then
        return an error */
-    if(ps_bitstrm->u4_ofst > ps_bitstrm->u4_max_ofst + 8)
+    if(EXCEED_OFFSET(ps_bitstrm))
     {
         return ERROR_INV_SPS_PPS_T;
     }
@@ -1093,7 +1093,7 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
 
     /* In case bitstream read has exceeded the filled size, then
      return an error */
-    if (ps_bitstrm->u4_ofst > ps_bitstrm->u4_max_ofst)
+    if (EXCEED_OFFSET(ps_bitstrm))
     {
         return ERROR_INV_SPS_PPS_T;
     }
@@ -1101,6 +1101,23 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
     /*--------------------------------------------------------------------*/
     /* All initializations to ps_dec are beyond this point                */
     /*--------------------------------------------------------------------*/
+    {
+        WORD32 reorder_depth = ih264d_get_dpb_size(ps_seq);
+        if((1 == ps_seq->u1_vui_parameters_present_flag) &&
+           (1 == ps_seq->s_vui.u1_bitstream_restriction_flag))
+        {
+            reorder_depth = ps_seq->s_vui.u4_num_reorder_frames + 1;
+        }
+
+        if (reorder_depth > H264_MAX_REF_PICS)
+        {
+            return ERROR_INV_SPS_PPS_T;
+        }
+
+        if(ps_seq->u1_frame_mbs_only_flag != 1)
+            reorder_depth *= 2;
+        ps_dec->i4_reorder_depth = reorder_depth + DISPLAY_LATENCY;
+    }
     ps_dec->u2_disp_height = i4_cropped_ht;
     ps_dec->u2_disp_width = i4_cropped_wd;
 
diff --git a/decoder/ih264d_parse_slice.c b/decoder/ih264d_parse_slice.c
index 927f1c0..9879549 100644
--- a/decoder/ih264d_parse_slice.c
+++ b/decoder/ih264d_parse_slice.c
@@ -826,8 +826,8 @@ WORD32 ih264d_end_of_pic_dispbuf_mgr(dec_struct_t * ps_dec)
             ps_cur_pic->u2_crop_offset_uv = ps_dec->u2_crop_offset_uv;
             ps_cur_pic->u1_pic_type = 0;
             {
-                UWORD64 i8_display_poc;
-                i8_display_poc = (UWORD64)ps_dec->i4_prev_max_display_seq +
+                WORD64 i8_display_poc;
+                i8_display_poc = (WORD64)ps_dec->i4_prev_max_display_seq +
                             ps_dec->ps_cur_pic->i4_poc;
                 if(IS_OUT_OF_RANGE_S32(i8_display_poc))
                 {
@@ -1100,7 +1100,7 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice,
     u2_first_mb_in_slice = ih264d_uev(pu4_bitstrm_ofst,
                                      pu4_bitstrm_buf);
     if(u2_first_mb_in_slice
-                    > (ps_dec->u2_frm_ht_in_mbs * ps_dec->u2_frm_wd_in_mbs))
+                    >= (ps_dec->u2_frm_ht_in_mbs * ps_dec->u2_frm_wd_in_mbs))
     {
 
         return ERROR_CORRUPTED_SLICE;
@@ -1495,13 +1495,13 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice,
         /* IDR Picture or POC wrap around */
         if(i4_poc == 0)
         {
-            UWORD64 u8_temp;
-            u8_temp = (UWORD64)ps_dec->i4_prev_max_display_seq
+            WORD64 i8_temp;
+            i8_temp = (WORD64)ps_dec->i4_prev_max_display_seq
                       + ps_dec->i4_max_poc
                       + ps_dec->u1_max_dec_frame_buffering + 1;
             /*If i4_prev_max_display_seq overflows integer range, reset it */
-            ps_dec->i4_prev_max_display_seq = (u8_temp > 0x7fffffff)?
-                                              0 : u8_temp;
+            ps_dec->i4_prev_max_display_seq = IS_OUT_OF_RANGE_S32(i8_temp)?
+                                              0 : i8_temp;
             ps_dec->i4_max_poc = 0;
         }
     }
diff --git a/decoder/ih264d_sei.c b/decoder/ih264d_sei.c
index 4375671..ac4d056 100644
--- a/decoder/ih264d_sei.c
+++ b/decoder/ih264d_sei.c
@@ -759,8 +759,12 @@ WORD32 ih264d_parse_sei_message(dec_struct_t *ps_dec,
     {
         ui4_payload_type = 0;
 
+        if(!CHECK_BITS_SUFFICIENT(ps_bitstrm, 8))
+        {
+            return ERROR_EOB_GETBITS_T;
+        }
         u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8);
-        while(0xff == u4_bits && !EXCEED_OFFSET(ps_bitstrm))
+        while(0xff == u4_bits && CHECK_BITS_SUFFICIENT(ps_bitstrm, 8))
         {
             u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8);
             ui4_payload_type += 255;
@@ -768,14 +772,22 @@ WORD32 ih264d_parse_sei_message(dec_struct_t *ps_dec,
         ui4_payload_type += u4_bits;
 
         ui4_payload_size = 0;
+        if(!CHECK_BITS_SUFFICIENT(ps_bitstrm, 8))
+        {
+            return ERROR_EOB_GETBITS_T;
+        }
         u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8);
-        while(0xff == u4_bits && !EXCEED_OFFSET(ps_bitstrm))
+        while(0xff == u4_bits && CHECK_BITS_SUFFICIENT(ps_bitstrm, 8))
         {
             u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8);
             ui4_payload_size += 255;
         }
         ui4_payload_size += u4_bits;
 
+        if(!CHECK_BITS_SUFFICIENT(ps_bitstrm, (ui4_payload_size << 3)))
+        {
+            return ERROR_EOB_GETBITS_T;
+        }
         i4_status = ih264d_parse_sei_payload(ps_bitstrm, ui4_payload_type,
                                              ui4_payload_size, ps_dec);
         if(i4_status != OK)
@@ -789,7 +801,7 @@ WORD32 ih264d_parse_sei_message(dec_struct_t *ps_dec,
                 H264_DEC_DEBUG_PRINT("\nError in parsing SEI message");
             }
             while(0 == ih264d_check_byte_aligned(ps_bitstrm)
-                            && !EXCEED_OFFSET(ps_bitstrm))
+                            && CHECK_BITS_SUFFICIENT(ps_bitstrm, 1))
             {
                 u4_bits = ih264d_get_bit_h264(ps_bitstrm);
                 if(u4_bits)
@@ -799,7 +811,7 @@ WORD32 ih264d_parse_sei_message(dec_struct_t *ps_dec,
             }
         }
     }
-    while(ps_bitstrm->u4_ofst < ps_bitstrm->u4_max_ofst);
+    while(MORE_RBSP_DATA(ps_bitstrm));
     return (i4_status);
 }
 
diff --git a/decoder/ih264d_utils.c b/decoder/ih264d_utils.c
index 35cd7b9..0893c3f 100644
--- a/decoder/ih264d_utils.c
+++ b/decoder/ih264d_utils.c
@@ -509,6 +509,7 @@ WORD32 ih264d_end_of_pic_processing(dec_struct_t *ps_dec)
                                       ps_dec->ps_cur_pic,
                                       ps_dec->u1_pic_buf_id,
                                       ps_cur_slice->u2_frame_num);
+                ps_dec->ps_dpb_mgr->u1_max_lt_frame_idx = NO_LONG_TERM_INDICIES;
             }
             else
             {
@@ -527,7 +528,7 @@ WORD32 ih264d_end_of_pic_processing(dec_struct_t *ps_dec)
                                     ps_cur_slice->u2_frame_num, 0,
                                     ps_cur_slice->u1_field_pic_flag);
 
-                    ps_dec->ps_dpb_mgr->u1_max_lt_pic_idx_plus1 = 1;
+                    ps_dec->ps_dpb_mgr->u1_max_lt_frame_idx = 0;
                 }
             }
         }
@@ -769,7 +770,6 @@ WORD32 ih264d_init_pic(dec_struct_t *ps_dec,
             else
                 ps_dec->i4_display_delay = ps_seq->s_vui.u4_num_reorder_frames * 2 + 2;
         }
-        ps_dec->i4_reorder_depth = ps_dec->i4_display_delay;
 
         if(IVD_DECODE_FRAME_OUT == ps_dec->e_frm_out_mode)
             ps_dec->i4_display_delay = 0;
@@ -1300,7 +1300,7 @@ void ih264d_release_display_bufs(dec_struct_t *ps_dec)
     WORD32 i4_min_poc;
     WORD32 i4_min_poc_buf_id;
     WORD32 i4_min_index;
-    UWORD64 u8_temp;
+    WORD64 i8_temp;
     dpb_manager_t *ps_dpb_mgr = ps_dec->ps_dpb_mgr;
     WORD32 (*i4_poc_buf_id_map)[3] = ps_dpb_mgr->ai4_poc_buf_id_map;
 
@@ -1347,11 +1347,11 @@ void ih264d_release_display_bufs(dec_struct_t *ps_dec)
         }
     }
     ps_dpb_mgr->i1_poc_buf_id_entries = 0;
-    u8_temp = (UWORD64)ps_dec->i4_prev_max_display_seq + ps_dec->i4_max_poc
+    i8_temp = (WORD64)ps_dec->i4_prev_max_display_seq + ps_dec->i4_max_poc
               + ps_dec->u1_max_dec_frame_buffering + 1;
     /*If i4_prev_max_display_seq overflows integer range, reset it */
-    ps_dec->i4_prev_max_display_seq = (u8_temp > 0x7fffffff)?
-                                      0 : u8_temp;
+    ps_dec->i4_prev_max_display_seq = IS_OUT_OF_RANGE_S32(i8_temp)?
+                                      0 : i8_temp;
     ps_dec->i4_max_poc = 0;
 }
 
@@ -1623,13 +1623,13 @@ WORD32 ih264d_decode_gaps_in_frame_num(dec_struct_t *ps_dec,
             /* IDR Picture or POC wrap around */
             if(i4_poc == 0)
             {
-                UWORD64 u8_temp;
-                u8_temp = (UWORD64)ps_dec->i4_prev_max_display_seq
+                WORD64 i8_temp;
+                i8_temp = (WORD64)ps_dec->i4_prev_max_display_seq
                           + ps_dec->i4_max_poc
                           + ps_dec->u1_max_dec_frame_buffering + 1;
                 /*If i4_prev_max_display_seq overflows integer range, reset it */
-                ps_dec->i4_prev_max_display_seq = (u8_temp > 0x7fffffff)?
-                                                  0 : u8_temp;
+                ps_dec->i4_prev_max_display_seq = IS_OUT_OF_RANGE_S32(i8_temp)?
+                                                  0 : i8_temp;
                 ps_dec->i4_max_poc = 0;
             }
 
@@ -1647,8 +1647,8 @@ WORD32 ih264d_decode_gaps_in_frame_num(dec_struct_t *ps_dec,
         }
 
         {
-            UWORD64 i8_display_poc;
-            i8_display_poc = (UWORD64)ps_dec->i4_prev_max_display_seq +
+            WORD64 i8_display_poc;
+            i8_display_poc = (WORD64)ps_dec->i4_prev_max_display_seq +
                         i4_poc;
             if(IS_OUT_OF_RANGE_S32(i8_display_poc))
             {