Snap for 4397926 from 5ea5fdc0288058cf73b243c237a057807e721179 to oc-dr2-releaseandroid-8.0.0_r26oreo-dr2-release

Change-Id: Icce2a2530ac4582f66ef3ca80175b64bb24ee348

4 files changed, 40 insertions, 5 deletions

diff --git a/decoder/impeg2d_api_main.c b/decoder/impeg2d_api_main.c
index c0813c4..cfef75d 100644
--- a/decoder/impeg2d_api_main.c
+++ b/decoder/impeg2d_api_main.c
@@ -428,7 +428,11 @@ void impeg2d_fill_mem_rec(impeg2d_fill_mem_rec_ip_t *ps_ip,
     UWORD32 u4_deinterlace;
     UNUSED(u4_deinterlace);
     max_frm_width = ALIGN16(ps_ip->s_ivd_fill_mem_rec_ip_t.u4_max_frm_wd);
-    max_frm_height = ALIGN16(ps_ip->s_ivd_fill_mem_rec_ip_t.u4_max_frm_ht);
+    /* In error clips with field prediction, the mv may incorrectly refer to
+    * the last MB row, causing an out of bounds read access. Allocating 8 extra
+    * rows to handle this. Adding another extra row to handle half_y prediction.
+    */
+    max_frm_height = ALIGN32(ps_ip->s_ivd_fill_mem_rec_ip_t.u4_max_frm_ht) + 9;
 
     max_frm_size = (max_frm_width * max_frm_height * 3) >> 1;/* 420 P */
 
diff --git a/decoder/impeg2d_dec_hdr.c b/decoder/impeg2d_dec_hdr.c
index 19de4c8..46502c4 100644
--- a/decoder/impeg2d_dec_hdr.c
+++ b/decoder/impeg2d_dec_hdr.c
@@ -281,6 +281,8 @@ IMPEG2D_ERROR_CODES_T impeg2d_dec_seq_hdr(dec_state_t *ps_dec)
 IMPEG2D_ERROR_CODES_T impeg2d_dec_seq_ext(dec_state_t *ps_dec)
 {
     stream_t *ps_stream;
+    UWORD16 horizontal_value;
+    UWORD16 vertical_value;
 
     ps_stream = &ps_dec->s_bit_stream;
 
@@ -330,11 +332,30 @@ IMPEG2D_ERROR_CODES_T impeg2d_dec_seq_ext(dec_state_t *ps_dec)
     if(impeg2d_bit_stream_get(ps_stream,2) != 0x1)
         return IMPEG2D_CHROMA_FMT_NOT_SUP;
 
+    /* Error resilience: store the 2 most significant bit in horizontal and vertical   */
+    /* variables.Use it only if adding them to the vertical and horizontal sizes       */
+    /* respectively, doesn't exceed the MAX_WD and MAX_HT supported by the application.*/
+
+
     /* Read the 2 most significant bits from horizontal_size */
-    ps_dec->u2_horizontal_size    += (impeg2d_bit_stream_get(ps_stream,2) << 12);
+    horizontal_value               = (impeg2d_bit_stream_get(ps_stream,2) << 12);
 
     /* Read the 2 most significant bits from vertical_size */
-    ps_dec->u2_vertical_size      += (impeg2d_bit_stream_get(ps_stream,2) << 12);
+    vertical_value                 = (impeg2d_bit_stream_get(ps_stream,2) << 12);
+
+    /* Error resilience: The height and width should not be more than the*/
+    /*max height and width the application can support*/
+    if(ps_dec->u2_create_max_height < (ps_dec->u2_vertical_size + vertical_value))
+    {
+        return (IMPEG2D_ERROR_CODES_T) IVD_STREAM_WIDTH_HEIGHT_NOT_SUPPORTED;
+    }
+
+    if(ps_dec->u2_create_max_width < (ps_dec->u2_horizontal_size + horizontal_value))
+    {
+        return (IMPEG2D_ERROR_CODES_T) IVD_STREAM_WIDTH_HEIGHT_NOT_SUPPORTED;
+    }
+    ps_dec->u2_vertical_size       += vertical_value;
+    ps_dec->u2_horizontal_size     += horizontal_value;
 
     /*-----------------------------------------------------------------------*/
     /* Flush the following as they are not used now                          */
@@ -1747,7 +1768,11 @@ IMPEG2D_ERROR_CODES_T impeg2d_process_video_bit_stream(dec_state_t *ps_dec)
                 {
                     return e_error;
                 }
-                impeg2d_pre_pic_dec_proc(ps_dec);
+                e_error = impeg2d_pre_pic_dec_proc(ps_dec);
+                if ((IMPEG2D_ERROR_CODES_T) IVD_ERROR_NONE != e_error)
+                {
+                    return e_error;
+                }
                 impeg2d_dec_pic_data(ps_dec);
                 impeg2d_post_pic_dec_proc(ps_dec);
                 u4_start_code_found = 1;
diff --git a/decoder/impeg2d_mc.c b/decoder/impeg2d_mc.c
index 79c5ef6..229579c 100644
--- a/decoder/impeg2d_mc.c
+++ b/decoder/impeg2d_mc.c
@@ -1260,7 +1260,7 @@ void impeg2d_mc_fullx_fully(void *pv_dec,
 
         for(i = 0; i < u4_blk_height; i++)
         {
-            memcpy(pu1_out, pu1_ref, u4_blk_width);
+            memmove(pu1_out, pu1_ref, u4_blk_width);
             pu1_ref += u4_ref_wid;
             pu1_out += u4_out_wid;
         }
diff --git a/decoder/impeg2d_pnb_pic.c b/decoder/impeg2d_pnb_pic.c
index 69277e5..570f0d2 100644
--- a/decoder/impeg2d_pnb_pic.c
+++ b/decoder/impeg2d_pnb_pic.c
@@ -77,6 +77,12 @@ WORD32  impeg2d_dec_p_mb_params(dec_state_t *ps_dec)
     else
     {
         u2_mb_addr_incr = impeg2d_get_mb_addr_incr(ps_stream);
+
+        if(!u2_mb_addr_incr)
+        {
+            return IV_FAIL;
+        }
+
         if(0 == ps_dec->u2_first_mb)
         {
             /****************************************************************/