commit fa13b3087684ffefd82d61c34e61714881674cd3
author Rakesh Kumar <rakesh.kumar@ittiam.com> Wed Apr 28 23:44:50 2021 +0530
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Wed Jun 30 23:58:27 2021 +0000
tree 0a2d7ad1328fea2b091429c242bc26d25bf8d600
parent f7cf75d0eb157c7acbc92209cfc01f49db1aede5

Decoder: Update check for increment u2_cur_slice_num

Increment u2_cur_slice_num only if current slice had atleast
one MB of memory left.

Test: clusterfuzz generated poc in bug
Bug: b/182152757
Bug: b/179938345
Bug: b/185112718

Change-Id: Ic5eb07e961bccb7fde954bcfd791fd879804e335
(cherry picked from commit a88e0683a420d7ee9aa4b6f41f94cb8dc0c5e040)

decoder/ih264d_parse_slice.c

diff --git a/decoder/ih264d_parse_slice.c b/decoder/ih264d_parse_slice.c
index cc1d90f..f922cfe 100644
--- a/decoder/ih264d_parse_slice.c
+++ b/decoder/ih264d_parse_slice.c
@@ -1435,17 +1435,20 @@
         i1_is_end_of_poc = 0;
     }
 
-    if (ps_dec->u4_first_slice_in_pic == 0)
+    /* Increment only if the current slice has atleast 1 more MB */
+    if (ps_dec->u4_first_slice_in_pic == 0 &&
+        (ps_dec->ps_parse_cur_slice->u4_first_mb_in_slice <
+        (UWORD32)(ps_dec->u2_total_mbs_coded >> ps_dec->ps_cur_slice->u1_mbaff_frame_flag)))
     {
         ps_dec->ps_parse_cur_slice++;
         ps_dec->u2_cur_slice_num++;
+        // in the case of single core increment ps_decode_cur_slice
+        if(ps_dec->u1_separate_parse == 0)
+        {
+            ps_dec->ps_decode_cur_slice++;
+        }
     }
 
-    // in the case of single core increment ps_decode_cur_slice
-    if((ps_dec->u1_separate_parse == 0) && (ps_dec->u4_first_slice_in_pic == 0))
-    {
-        ps_dec->ps_decode_cur_slice++;
-    }
     ps_dec->u1_slice_header_done = 0;