commit 986b1ff02fbf8551e92e6ba9cf64d5fca47957af
author Neelkamal Semwal <neelkamal.semwal@ittiam.com> Fri Mar 12 10:15:49 2021 +0530
committer android-build-team Robot <android-build-team-robot@google.com> Thu May 20 00:00:29 2021 +0000
tree cf422ff3a605ec349b9cd3b7248b4e92495df819
parent 97883bc82b2aaa0f9f3f3c6e7b1a9f14ed6903f6

encoder: fix invalid free of raw buffers

Return current input buffer as buffer to be freed in case
of errors that are seen before picking up the input buffer
to be from the input queue.
Once a buffer is picked up from the queue, that is returned
as the buffer to be freed.

There is no need to return a buffer from ps_proc context

Bug: 180643802

Test: poc in the bug description
Test: atest CtsMediaV2TestCases:CodecEncoderTest
Test: atest VtsHalMediaC2V1_0TargetVideoEncTest

Change-Id: I1671ca1e82f522004d1f070df89b256b856f75b8
(cherry picked from commit 3e73f0d56298ba6256927928669d0cc6e4b1c9ee)

encoder/ih264e_encode.c

diff --git a/encoder/ih264e_encode.c b/encoder/ih264e_encode.c
index fb37765..fe23841 100644
--- a/encoder/ih264e_encode.c
+++ b/encoder/ih264e_encode.c
@@ -228,6 +228,9 @@
     ps_video_encode_op->s_ive_op.output_present  = 0;
     ps_video_encode_op->s_ive_op.dump_recon = 0;
     ps_video_encode_op->s_ive_op.u4_encoded_frame_type = IV_NA_FRAME;
+    /* By default set the current input buffer as the buffer to be freed */
+    /* This will later be updated to the actual input that gets encoded */
+    ps_video_encode_op->s_ive_op.s_inp_buf = ps_video_encode_ip->s_ive_ip.s_inp_buf;
 
     /* Check for output memory allocation size */
     if (ps_video_encode_ip->s_ive_ip.s_out_buf.u4_bufsize < MIN_STREAM_SIZE)
@@ -474,6 +477,9 @@
     s_out_buf.u4_is_last = s_inp_buf.u4_is_last;
     ps_video_encode_op->s_ive_op.u4_is_last = s_inp_buf.u4_is_last;
 
+    /* Send the input to application so that it can free it */
+    ps_video_encode_op->s_ive_op.s_inp_buf = s_inp_buf.s_raw_buf;
+
     /* Only encode if the current frame is not pre-encode skip */
     if (!i4_rc_pre_enc_skip && s_inp_buf.s_raw_buf.apv_bufs[0])
     {
@@ -774,12 +780,6 @@
     }
     else
     {
-        /* proc ctxt base idx */
-        WORD32 proc_ctxt_select = ctxt_sel * MAX_PROCESS_THREADS;
-
-        /* proc ctxt */
-        process_ctxt_t *ps_proc = &ps_codec->as_process[proc_ctxt_select];
-
         /* receive output back from codec */
         s_out_buf = ps_codec->as_out_buf[ctxt_sel];
 
@@ -790,18 +790,11 @@
         ps_video_encode_op->s_ive_op.u4_timestamp_low = 0;
         ps_video_encode_op->s_ive_op.u4_timestamp_high = 0;
 
-        /* receive input back from codec and send it to app */
-        s_inp_buf = ps_proc->s_inp_buf;
-        ps_video_encode_op->s_ive_op.s_inp_buf = s_inp_buf.s_raw_buf;
-
         ps_video_encode_op->s_ive_op.u4_encoded_frame_type =  IV_NA_FRAME;
 
     }
 
-    /* Send the input to encoder so that it can free it if possible */
     ps_video_encode_op->s_ive_op.s_out_buf = s_out_buf.s_bits_buf;
-    ps_video_encode_op->s_ive_op.s_inp_buf = s_inp_buf.s_raw_buf;
-
 
     if (1 == s_inp_buf.u4_is_last)
     {