commit b9982d47ca4bbce08346b50d371cd93901181f33
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Wed Feb 17 18:06:36 2016 +0530
committer Feng Yu <feny@google.com> Wed Feb 24 19:21:05 2016 +0000
tree d15c1d679648903d3827b88e5a3d848c62172d6f
parent d5864009f5a70c95ee025fe850177db35044b405

Decoder: Fix stack underflow in CAVLC 4x4 parse functions

Bug: 26399350
Change-Id: Id768751672a7b093ab6e53d4fc0b3188d470920e
(cherry picked from commit ef3da4e69901b841b397b6e75a42a7c6c3ee32ca)

decoder/ih264d_parse_cavlc.c

diff --git a/decoder/ih264d_parse_cavlc.c b/decoder/ih264d_parse_cavlc.c
index a3f345c..b6a0125 100644
--- a/decoder/ih264d_parse_cavlc.c
+++ b/decoder/ih264d_parse_cavlc.c
@@ -443,7 +443,11 @@
     UWORD32 u4_bitstream_offset = ps_bitstrm->u4_ofst;
     UWORD32 u4_trailing_ones = u4_total_coeff_trail_one & 0xFFFF;
     UWORD32 u4_total_coeff = u4_total_coeff_trail_one >> 16;
-    WORD16 i2_level_arr[16];
+    // To avoid error check at 4x4 level, allocating for 3 extra levels(16+3)
+    // since u4_trailing_ones can at the max be 3. This will be required when
+    // u4_total_coeff is less than u4_trailing_ones
+    WORD16 ai2_level_arr[19];
+    WORD16 *i2_level_arr = &ai2_level_arr[3];
 
     tu_sblk4x4_coeff_data_t *ps_tu_4x4;
     WORD16 *pi2_coeff_data;
@@ -721,7 +725,11 @@
     UWORD32 u4_bitstream_offset = ps_bitstrm->u4_ofst;
     UWORD32 u4_trailing_ones = u4_total_coeff_trail_one & 0xFFFF;
     UWORD32 u4_total_coeff = u4_total_coeff_trail_one >> 16;
-    WORD16 i2_level_arr[16];
+    // To avoid error check at 4x4 level, allocating for 3 extra levels(16+3)
+    // since u4_trailing_ones can at the max be 3. This will be required when
+    // u4_total_coeff is less than u4_trailing_ones
+    WORD16 ai2_level_arr[19];//
+    WORD16 *i2_level_arr = &ai2_level_arr[3];
 
     tu_sblk4x4_coeff_data_t *ps_tu_4x4;
     WORD16 *pi2_coeff_data;
@@ -993,7 +1001,11 @@
     UWORD32 u4_bitstream_offset = ps_bitstrm->u4_ofst;
     UWORD32 u4_trailing_ones = u4_total_coeff_trail_one & 0xFFFF;
     UWORD32 u4_total_coeff = u4_total_coeff_trail_one >> 16;
-    WORD16 i2_level_arr[4];
+    // To avoid error check at 4x4 level, allocating for 3 extra levels(4+3)
+    // since u4_trailing_ones can at the max be 3. This will be required when
+    // u4_total_coeff is less than u4_trailing_ones
+    WORD16 ai2_level_arr[7];//
+    WORD16 *i2_level_arr = &ai2_level_arr[3];
 
     tu_sblk4x4_coeff_data_t *ps_tu_4x4;
     WORD16 *pi2_coeff_data;