commit 4b58c8f3db9fdfd64230afac3e790c2053cb9cf7
author Ritu Baldwa <ritu.baldwa@ittiam.com> Fri Dec 22 14:20:20 2017 +0530
committer android-build-team Robot <android-build-team-robot@google.com> Thu Jan 18 19:07:15 2018 +0000
tree 434d09f5d9401963be9f298ae5f2b024481d6f5c
parent a7f41c5d3425dbd89da38a4aa8398cf7351406e8

Decoder: Adding Error Check for Output Buffer Size in Shared Display Mode.

The output buffer size given by the application, needs to be checked
in every process call. This is required in the case of resolution
change in shared display mode.

Bug: 70294343
Bug: 70350193
Bug: 70526411
Bug: 70526485
Test: manual
Change-Id: I2c1e59425e84ac62a874e5ee180e1b98f0a4058f
(cherry picked from commit 3692aceb1b244be3e1b36d8e7b804986f593bb69)

decoder/ih264d_api.c

diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c
index 804fdb7..c6999a6 100644
--- a/decoder/ih264d_api.c
+++ b/decoder/ih264d_api.c
@@ -1698,8 +1698,8 @@
     }
     else
     {
-        /* In case of shared mode, do not check validity of ps_dec->ps_out_buffer */
-        return (IV_SUCCESS);
+        pic_wd = ps_dec->u2_frm_wd_y;
+        pic_ht = ps_dec->u2_frm_ht_y;
     }
 
     if(ps_dec->u4_app_disp_width > pic_wd)
@@ -1709,14 +1709,34 @@
                                                  ps_dec->u1_chroma_format,
                                                  &au4_min_out_buf_size[0]);
 
-    if(ps_dec->ps_out_buffer->u4_num_bufs < u4_min_num_out_bufs)
-        return IV_FAIL;
 
-    for(i = 0; i < u4_min_num_out_bufs; i++)
+    if(0 == ps_dec->u4_share_disp_buf)
     {
-        if(ps_dec->ps_out_buffer->u4_min_out_buf_size[i]
-                        < au4_min_out_buf_size[i])
-            return (IV_FAIL);
+        if(ps_dec->ps_out_buffer->u4_num_bufs < u4_min_num_out_bufs)
+            return IV_FAIL;
+
+        for(i = 0; i < u4_min_num_out_bufs; i++)
+        {
+            if(ps_dec->ps_out_buffer->u4_min_out_buf_size[i]
+                            < au4_min_out_buf_size[i])
+                return (IV_FAIL);
+        }
+    }
+    else
+    {
+        if(ps_dec->disp_bufs[0].u4_num_bufs < u4_min_num_out_bufs)
+            return IV_FAIL;
+
+        for(i = 0; i < u4_min_num_out_bufs; i++)
+        {
+            /* We need to check only with the disp_buffer[0], because we have
+             * already ensured that all the buffers are of the same size in
+             * ih264d_set_display_frame.
+             */
+            if(ps_dec->disp_bufs[0].u4_bufsize[i] < au4_min_out_buf_size[i])
+                return (IV_FAIL);
+        }
+
     }
 
     return (IV_SUCCESS);
@@ -2666,6 +2686,7 @@
                                 void *pv_api_op)
 {
 
+    UWORD32 u4_disp_buf_size[3], u4_num_disp_bufs;
     ivd_set_display_frame_ip_t *dec_disp_ip;
     ivd_set_display_frame_op_t *dec_disp_op;
 
@@ -2685,8 +2706,36 @@
         u4_num_bufs = MIN(u4_num_bufs, MAX_DISP_BUFS_NEW);
 
         ps_dec->u4_num_disp_bufs = u4_num_bufs;
+
+        /* Get the number and sizes of the first buffer. Compare this with the
+         * rest to make sure all the buffers are of the same size.
+         */
+        u4_num_disp_bufs = dec_disp_ip->s_disp_buffer[0].u4_num_bufs;
+
+        u4_disp_buf_size[0] =
+          dec_disp_ip->s_disp_buffer[0].u4_min_out_buf_size[0];
+        u4_disp_buf_size[1] =
+          dec_disp_ip->s_disp_buffer[0].u4_min_out_buf_size[1];
+        u4_disp_buf_size[2] =
+          dec_disp_ip->s_disp_buffer[0].u4_min_out_buf_size[2];
+
         for(i = 0; i < u4_num_bufs; i++)
         {
+            if(dec_disp_ip->s_disp_buffer[i].u4_num_bufs != u4_num_disp_bufs)
+            {
+                return IV_FAIL;
+            }
+
+            if((dec_disp_ip->s_disp_buffer[i].u4_min_out_buf_size[0]
+                != u4_disp_buf_size[0])
+                || (dec_disp_ip->s_disp_buffer[i].u4_min_out_buf_size[1]
+                    != u4_disp_buf_size[1])
+                || (dec_disp_ip->s_disp_buffer[i].u4_min_out_buf_size[2]
+                    != u4_disp_buf_size[2]))
+            {
+                return IV_FAIL;
+            }
+
             ps_dec->disp_bufs[i].u4_num_bufs =
                             dec_disp_ip->s_disp_buffer[i].u4_num_bufs;