commit c480b08834fdcf788d02ae32ef2f16310ecd50d0
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Fri Dec 30 13:51:34 2016 +0530
committer android-build-team Robot <android-build-team-robot@google.com> Wed May 31 20:24:34 2017 +0000
tree 60446b70e8d242e00557b32ca1302c3babd2d0be
parent 3c73a9d8744d3159713da440870d36daa829e688

Decoder: Fixes in accessing mbaff flag in error cases

ps_dec->ps_cur_slice->u1_mbaff_frame_flag is updated in ih264d_start_of_pic().
So updated value should be used after calling ih264d_start_of_pic()

Bug: 33974623
Test: ran POC from bug
Change-Id: I0f1ff5e01ed39767f493f197791e51b0da74952f
(cherry picked from commit 3f6937a0031e4acadc9228559ae2ae47b992b16a)
(cherry picked from commit 0f2f2b5fde873b8badee949561c17692588647e8)

decoder/ih264d_parse_pslice.c

diff --git a/decoder/ih264d_parse_pslice.c b/decoder/ih264d_parse_pslice.c
index ca3f80b..a78ea97 100644
--- a/decoder/ih264d_parse_pslice.c
+++ b/decoder/ih264d_parse_pslice.c
@@ -1456,7 +1456,7 @@
     UWORD32 u1_inter_mb_type;
     UWORD32 u1_deblk_mb_type;
     UWORD16 u2_total_mbs_coded;
-    UWORD32 u1_mbaff = ps_slice->u1_mbaff_frame_flag;
+    UWORD32 u1_mbaff;
     parse_part_params_t *ps_part_info;
     WORD32 ret;
     UNUSED(u1_is_idr_slice);
@@ -1579,7 +1579,7 @@
         {
             // Slice data corrupted
             // in the case of mbaff, conceal from the even mb.
-            if((u1_mbaff) && (ps_dec->u4_num_mbs_cur_nmb & 1))
+            if((ps_dec->ps_cur_slice->u1_mbaff_frame_flag) && (ps_dec->u4_num_mbs_cur_nmb & 1))
             {
                 ps_dec->u4_num_mbs_cur_nmb = ps_dec->u4_num_mbs_cur_nmb - 1;
                 ps_dec->u2_cur_mb_addr--;
@@ -1626,7 +1626,7 @@
 
                 u1_num_mbs_next = i2_pic_wdin_mbs - ps_dec->u2_mbx - 1;
                 u1_end_of_row = (!u1_num_mbs_next)
-                        && (!(u1_mbaff && (u1_num_mbs & 0x01)));
+                        && (!(ps_dec->ps_cur_slice->u1_mbaff_frame_flag && (u1_num_mbs & 0x01)));
                 u1_slice_end = 1;
                 u1_tfr_n_mb = 1;
                 ps_cur_mb_info->u1_end_of_slice = u1_slice_end;
@@ -1699,7 +1699,7 @@
         pu1_buf += size * ps_dec->u2_cur_slice_num;
         ps_dec->ps_parse_cur_slice->ppv_map_ref_idx_to_poc = (volatile void **)pu1_buf;
     }
-
+    u1_mbaff = ps_slice->u1_mbaff_frame_flag;
     ps_dec->ps_cur_slice->u2_first_mb_in_slice = ps_dec->u2_total_mbs_coded >> u1_mbaff;
     ps_dec->ps_cur_slice->i1_slice_alpha_c0_offset = 0;
     ps_dec->ps_cur_slice->i1_slice_beta_offset = 0;