Decoder: Delete node from st if lt and st point to same
If lt_list and st_list point to same node then delete it from st.
If there is error while adding a node in bottom field of lt_list (top is
already added) then this node will be pointed by st_list also. So we need
to remove it from st_list
bug: 73552574
Test: poc before/after on Android N security branch
Change-Id: I95304c242c5854b18c5c7220d114ce6215760124
(cherry picked from commit f312a1d305dae23f9f6f663d2157bf9cf47bb92c)
diff --git a/decoder/ih264d_parse_slice.c b/decoder/ih264d_parse_slice.c
index db02bfe..b477c10 100644
--- a/decoder/ih264d_parse_slice.c
+++ b/decoder/ih264d_parse_slice.c
@@ -979,6 +979,69 @@
return OK;
}
+
+/*!
+ **************************************************************************
+ * \if Function name : ih264d_fix_error_in_dpb \endif
+ *
+ * \brief
+ * fix error in DPB
+ *
+ * \return
+ * Number of node(s) deleted
+ **************************************************************************
+ */
+
+WORD32 ih264d_fix_error_in_dpb(dec_struct_t *ps_dec)
+{
+ /*--------------------------------------------------------------------*/
+ /* If there is common node in lt_list and st_list then delete it from */
+ /* st_list */
+ /*--------------------------------------------------------------------*/
+ UWORD8 no_of_nodes_deleted = 0;
+ UWORD8 lt_ref_num = ps_dec->ps_dpb_mgr->u1_num_lt_ref_bufs;
+ struct dpb_info_t *ps_lt_curr_dpb = ps_dec->ps_dpb_mgr->ps_dpb_ht_head;
+ while(lt_ref_num && ps_lt_curr_dpb)
+ {
+ if(ps_dec->ps_dpb_mgr->ps_dpb_st_head
+ && ((ps_lt_curr_dpb->s_bot_field.u1_reference_info
+ | ps_lt_curr_dpb->s_top_field.u1_reference_info)
+ == (IS_SHORT_TERM | IS_LONG_TERM)))
+ {
+ struct dpb_info_t *ps_st_next_dpb = ps_dec->ps_dpb_mgr->ps_dpb_st_head;
+ struct dpb_info_t *ps_st_curr_dpb = ps_dec->ps_dpb_mgr->ps_dpb_st_head;
+ UWORD8 st_ref_num = ps_dec->ps_dpb_mgr->u1_num_st_ref_bufs;
+ while(st_ref_num && ps_st_curr_dpb)
+ {
+ if(ps_st_curr_dpb == ps_lt_curr_dpb)
+ {
+ if(st_ref_num == ps_dec->ps_dpb_mgr->u1_num_st_ref_bufs)
+ {
+ ps_dec->ps_dpb_mgr->ps_dpb_st_head =
+ ps_dec->ps_dpb_mgr->ps_dpb_st_head->ps_prev_short;
+ ps_st_curr_dpb = ps_dec->ps_dpb_mgr->ps_dpb_st_head;
+ }
+ else
+ {
+ ps_st_next_dpb->ps_prev_short = ps_st_curr_dpb->ps_prev_short;
+ }
+ ps_dec->ps_dpb_mgr->u1_num_st_ref_bufs--;
+ ps_dec->ps_dpb_mgr->u1_num_lt_ref_bufs++;
+ no_of_nodes_deleted++;
+ break;
+ }
+ ps_st_next_dpb = ps_st_curr_dpb;
+ ps_st_curr_dpb = ps_st_curr_dpb->ps_prev_short;
+ st_ref_num--;
+ }
+ }
+ ps_lt_curr_dpb = ps_lt_curr_dpb->ps_prev_long;
+ lt_ref_num--;
+ }
+ return no_of_nodes_deleted;
+}
+
+
/*!
**************************************************************************
* \if Function name : DecodeSlice \endif
@@ -1821,6 +1884,10 @@
ps_dec->pv_proc_tu_coeff_data = ps_dec->pv_parse_tu_coeff_data;
}
+ ret = ih264d_fix_error_in_dpb(ps_dec);
+ if(ret < 0)
+ return ERROR_DBP_MANAGER_T;
+
if(u1_slice_type == I_SLICE)
{
ps_dec->ps_cur_pic->u4_pack_slc_typ |= I_SLC_BIT;
diff --git a/decoder/ih264d_parse_slice.h b/decoder/ih264d_parse_slice.h
index c012062..0f82ec9 100644
--- a/decoder/ih264d_parse_slice.h
+++ b/decoder/ih264d_parse_slice.h
@@ -37,6 +37,7 @@
#include "ih264_platform_macros.h"
#include "ih264d_structs.h"
#include "ih264d_error_handler.h"
+WORD32 ih264d_fix_error_in_dpb(dec_struct_t * ps_dec);
WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice,
UWORD8 u1_nal_ref_idc,
dec_struct_t * ps_dec );
