From fdbbd60bfebe48c0539897d7eeeeb5816e59ce1b Mon Sep 17 00:00:00 2001 From: Rakesh Kumar Date: Mon, 12 Nov 2018 18:00:27 +0530 Subject: Decoder: Signal IVD_RES_CHANGED error for change in crop params IVD_RES_CHANGED was not signaled when crop parameters changed, i.e. display dimensions changed without change in decode dimensions. In such cases, if output buffer was allocated as per the current dimension being decoded, without IVD_RES_CHANGED signalled, there can be an OOB write if the new buffer is smaller than the frame being returned as output Bug: 118453553 Test: vendor Change-Id: Ic74c6fb9612403f75a8f9ddb3a93861bca82cf16 --- decoder/ihevcd_parse_headers.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'decoder') diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c index 22836a0..a50efb8 100644 --- a/decoder/ihevcd_parse_headers.c +++ b/decoder/ihevcd_parse_headers.c @@ -1599,6 +1599,18 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) if((0 >= disp_wd) || (0 >= disp_ht)) return IHEVCD_INVALID_PARAMETER; + if((0 != ps_codec->u4_allocate_dynamic_done) && + ((ps_codec->i4_disp_wd != disp_wd) || + (ps_codec->i4_disp_ht != disp_ht))) + { + if(0 == ps_codec->i4_first_pic_done) + { + return IHEVCD_INVALID_PARAMETER; + } + ps_codec->i4_reset_flag = 1; + return (IHEVCD_ERROR_T)IVD_RES_CHANGED; + } + ps_codec->i4_disp_wd = disp_wd; ps_codec->i4_disp_ht = disp_ht; -- cgit v1.2.3