commit 67634723f884351fab3166a487523e01694e33a2
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Wed Oct 24 17:42:25 2018 -0700
committer JP Sugarbroad <jpsugar@google.com> Mon Jan 14 14:54:56 2019 -0800
tree 13c0d0ccc885011a030ecb1098aa7c96f433e4aa
parent 96d563596a4b936fef7c7ed1aaad257b231a245c

decoder: Signal IVD_RES_CHANGED error for change in crop params

IVD_RES_CHANGED was not signaled when crop parameters changed, i.e.
display dimensions changed without change in decode dimensions.

In such cases, if output buffer was allocated as per the current
dimension being decoded, without IVD_RES_CHANGED signalled, there can be
an OOB write if the new buffer is smaller than the frame being returned
as output

Bug: 118399205
Test: vendor
Change-Id: Ia750a99cda08a3254a6f8ea8b55d07e655b34d05
(cherry picked from commit 442a01bf37d5bd97bb6d13b382f00265051abbe8)

decoder/ih264d_parse_headers.c

diff --git a/decoder/ih264d_parse_headers.c b/decoder/ih264d_parse_headers.c
index b669331..ee38315 100644
--- a/decoder/ih264d_parse_headers.c
+++ b/decoder/ih264d_parse_headers.c
@@ -918,12 +918,25 @@
             ps_dec->u1_res_changed = 1;
             return IVD_RES_CHANGED;
         }
+
+        if((ps_dec->i4_header_decoded & 1) && (ps_dec->u2_disp_width != i4_cropped_wd))
+        {
+            ps_dec->u1_res_changed = 1;
+            return IVD_RES_CHANGED;
+        }
+
         if((ps_dec->i4_header_decoded & 1) && (ps_dec->u2_pic_ht != u2_pic_ht))
         {
             ps_dec->u1_res_changed = 1;
             return IVD_RES_CHANGED;
         }
 
+        if((ps_dec->i4_header_decoded & 1) && (ps_dec->u2_disp_height != i4_cropped_ht))
+        {
+            ps_dec->u1_res_changed = 1;
+            return IVD_RES_CHANGED;
+        }
+
         /* Check for unsupported resolutions */
         if((u2_pic_wd > H264_MAX_FRAME_WIDTH) || (u2_pic_ht > H264_MAX_FRAME_HEIGHT))
         {