Fix crash running blur on 4K images

bug 11258120

The temporary buffer could be misaligned due to realloc only
aligning to 8 bytes.

Fix issues with with Histogram and 2/3 vector sizes.

Change-Id: I271f4635ead5ff0a7e7f89bb5cfcbc2bba626e22

1 files changed, 6 insertions, 2 deletions

diff --git a/cpu_ref/rsCpuIntrinsicBlur.cpp b/cpu_ref/rsCpuIntrinsicBlur.cpp
index f3a656dc..b2bd3ce8 100644
--- a/cpu_ref/rsCpuIntrinsicBlur.cpp
+++ b/cpu_ref/rsCpuIntrinsicBlur.cpp
@@ -289,10 +289,12 @@ void RsdCpuScriptIntrinsicBlur::kernelU4(const RsForEachStubParamStruct *p,
 
     if (p->dimX > 2048) {
         if ((p->dimX > cp->mScratchSize[p->lid]) || !cp->mScratch[p->lid]) {
-            cp->mScratch[p->lid] = realloc(cp->mScratch[p->lid], p->dimX * 16);
+            // Pad the side of the allocation by one unit to allow alignment later
+            cp->mScratch[p->lid] = realloc(cp->mScratch[p->lid], (p->dimX + 1) * 16);
             cp->mScratchSize[p->lid] = p->dimX;
         }
-        buf = (float4 *)cp->mScratch[p->lid];
+        // realloc only aligns to 8 bytes so we manually align to 16.
+        buf = (float4 *) ((((intptr_t)cp->mScratch[p->lid]) + 15) & ~0xf);
     }
     float4 *fout = (float4 *)buf;
     int y = p->y;
@@ -407,6 +409,8 @@ RsdCpuScriptIntrinsicBlur::RsdCpuScriptIntrinsicBlur(RsdCpuReferenceImpl *ctx,
 
     mScratch = new void *[mCtx->getThreadCount()];
     mScratchSize = new size_t[mCtx->getThreadCount()];
+    memset(mScratch, 0, sizeof(void *) * mCtx->getThreadCount());
+    memset(mScratchSize, 0, sizeof(size_t) * mCtx->getThreadCount());
 
     ComputeGaussianWeights();
 }