commit 137754b36243967714bd23e3c02ef0c44bce5b7b
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Tue Sep 01 13:36:06 2015 +0530
committer Marco Nelissen <marcone@google.com> Fri Oct 09 11:44:26 2015 -0700
tree 1dbdb3eb1c2c99902bfd3de893256a1dc07dcca1
parent 2938759aaa3954f320fb08a381b8c67f558cdeb9

Memset 8 extra bytes at the end of internal bitstream buffer

Decoder may read 8 extra bytes at the end of this buffer.
Though it will never be used, setting it to zero will ensure
unitialized reads are avoided

Change-Id: Id7bf81ea73718a677c326e352ad3f4dc1756601a

decoder/ihevcd_decode.c

diff --git a/decoder/ihevcd_decode.c b/decoder/ihevcd_decode.c
index c2cec1e..d12051a 100644
--- a/decoder/ihevcd_decode.c
+++ b/decoder/ihevcd_decode.c
@@ -577,6 +577,13 @@
                                         ps_codec->pu1_bitsbuf,
                                         bytes_remaining,
                                         &nal_len, &bits_len);
+
+            /* Decoder may read upto 8 extra bytes at the end of frame */
+            /* These are not used, but still set them to zero to avoid uninitialized reads */
+            if(bits_len < (WORD32)(ps_codec->u4_bitsbuf_size - 8))
+            {
+                memset(ps_codec->pu1_bitsbuf + bits_len, 0, 2 * sizeof(UWORD32));
+            }
         }
         /* This may be used to update the offsets for tiles and entropy sync row offsets */
         ps_codec->i4_num_emln_bytes = nal_len - bits_len;