Merge cherrypicks of [2089422, 2053944, 2094094, 2007730, 2072002, 2065088, 1989895, 2080090, 2026590, 2008313, 2089669, 2059276, 2094716, 2066476, 2053983, 2007123, 2017568, 2054111, 2054025, 2095243, 2092431, 2092549, 2025333, 2099168, 2074928] into nyc-mr2-pixel-monthly-release

Change-Id: I8250f80fae05fd0457b2556550cb116d4a0a1016
diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index 97f10ca..b560a39 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1755,6 +1755,12 @@
     ps_pps->i1_loop_filter_across_tiles_enabled_flag = 0;
     if(ps_pps->i1_tiles_enabled_flag)
     {
+        WORD32 wd = ALIGN64(ps_codec->i4_wd);
+        WORD32 ht = ALIGN64(ps_codec->i4_ht);
+
+        WORD32 max_tile_cols = (wd + MIN_TILE_WD - 1) / MIN_TILE_WD;
+        WORD32 max_tile_rows = (ht + MIN_TILE_HT - 1) / MIN_TILE_HT;
+
         UEV_PARSE("num_tile_columns_minus1", value, ps_bitstrm);
         ps_pps->i1_num_tile_columns = value + 1;
 
@@ -1762,9 +1768,9 @@
         ps_pps->i1_num_tile_rows = value + 1;
 
         if((ps_pps->i1_num_tile_columns < 1) ||
-                        (ps_pps->i1_num_tile_columns > ps_sps->i2_pic_wd_in_ctb) ||
+                        (ps_pps->i1_num_tile_columns > max_tile_cols) ||
                         (ps_pps->i1_num_tile_rows < 1) ||
-                        (ps_pps->i1_num_tile_rows > ps_sps->i2_pic_ht_in_ctb))
+                        (ps_pps->i1_num_tile_rows > max_tile_rows))
             return IHEVCD_INVALID_HEADER;
 
         BITS_PARSE("uniform_spacing_flag", value, ps_bitstrm, 1);
diff --git a/decoder/ihevcd_parse_slice_header.c b/decoder/ihevcd_parse_slice_header.c
index 744484e..62ad6c8 100644
--- a/decoder/ihevcd_parse_slice_header.c
+++ b/decoder/ihevcd_parse_slice_header.c
@@ -219,7 +219,7 @@
 {
     IHEVCD_ERROR_T ret = (IHEVCD_ERROR_T)IHEVCD_SUCCESS;
     WORD32 value;
-    WORD32 i;
+    WORD32 i, j;
     WORD32 sps_id;
 
     pps_t *ps_pps;
@@ -729,11 +729,15 @@
             {
                 if(ps_codec->i4_pic_present)
                 {
+                    slice_header_t *ps_slice_hdr_next;
                     ps_codec->i4_slice_error = 1;
                     ps_codec->s_parse.i4_cur_slice_idx--;
                     if(ps_codec->s_parse.i4_cur_slice_idx < 0)
                         ps_codec->s_parse.i4_cur_slice_idx = 0;
 
+                    ps_slice_hdr_next = ps_codec->s_parse.ps_slice_hdr_base + ((ps_codec->s_parse.i4_cur_slice_idx + 1) & (MAX_SLICE_HDR_CNT - 1));
+                    ps_slice_hdr_next->i2_ctb_x = slice_address % ps_sps->i2_pic_wd_in_ctb;
+                    ps_slice_hdr_next->i2_ctb_y = slice_address / ps_sps->i2_pic_wd_in_ctb;
                     return ret;
                 }
                 else
@@ -880,11 +884,11 @@
                     ihevc_dpb_mgr_del_ref((dpb_mgr_t *)ps_codec->pv_dpb_mgr, (buf_mgr_t *)ps_codec->pv_pic_buf_mgr, ps_pic_buf->i4_abs_poc);
                     /* Find buffer id of the MV bank corresponding to the buffer being freed (Buffer with POC of u4_abs_poc) */
                     ps_mv_buf = (mv_buf_t *)ps_codec->ps_mv_buf;
-                    for(i = 0; i < BUF_MGR_MAX_CNT; i++)
+                    for(j = 0; j < ps_codec->i4_max_dpb_size; j++)
                     {
                         if(ps_mv_buf && ps_mv_buf->i4_abs_poc == ps_pic_buf->i4_abs_poc)
                         {
-                            ihevc_buf_mgr_release((buf_mgr_t *)ps_codec->pv_mv_buf_mgr, i, BUF_MGR_REF);
+                            ihevc_buf_mgr_release((buf_mgr_t *)ps_codec->pv_mv_buf_mgr, j, BUF_MGR_REF);
                             break;
                         }
                         ps_mv_buf++;
diff --git a/decoder/ihevcd_ref_list.c b/decoder/ihevcd_ref_list.c
index 76bb476..0fe6aa4 100644
--- a/decoder/ihevcd_ref_list.c
+++ b/decoder/ihevcd_ref_list.c
@@ -92,7 +92,7 @@
 
 WORD32 ihevcd_ref_list(codec_t *ps_codec, pps_t *ps_pps, sps_t *ps_sps, slice_header_t *ps_slice_hdr)
 {
-    WORD32 i;
+    WORD32 i, j;
     WORD32 st_rps_idx;
     WORD32 num_neg_pics, num_pos_pics;
     WORD8 *pi1_used;
@@ -503,11 +503,11 @@
 
             /* Find buffer id of the MV bank corresponding to the buffer being freed (Buffer with POC of u4_abs_poc) */
             ps_mv_buf = (mv_buf_t *)ps_codec->ps_mv_buf;
-            for(i = 0; i < BUF_MGR_MAX_CNT; i++)
+            for(j = 0; j < ps_codec->i4_max_dpb_size; j++)
             {
                 if(ps_mv_buf && ps_mv_buf->i4_abs_poc == ps_pic_buf->i4_abs_poc)
                 {
-                    ihevc_buf_mgr_release((buf_mgr_t *)ps_codec->pv_mv_buf_mgr, i, BUF_MGR_REF);
+                    ihevc_buf_mgr_release((buf_mgr_t *)ps_codec->pv_mv_buf_mgr, j, BUF_MGR_REF);
                     break;
                 }
                 ps_mv_buf++;
diff --git a/decoder/ihevcd_structs.h b/decoder/ihevcd_structs.h
index ce0653e..1a46984 100644
--- a/decoder/ihevcd_structs.h
+++ b/decoder/ihevcd_structs.h
@@ -1929,6 +1929,9 @@
      */
     void *ps_mv_buf;
 
+    /** Holds the number of mv_buf_t structures allocated */
+    WORD32 i4_max_dpb_size;
+
     /**
      * Base address for Motion Vector bank buffer
      */
diff --git a/decoder/ihevcd_utils.c b/decoder/ihevcd_utils.c
old mode 100644
new mode 100755
index c6c21f5..797b079
--- a/decoder/ihevcd_utils.c
+++ b/decoder/ihevcd_utils.c
@@ -598,6 +598,8 @@
      */
     max_dpb_size++;
 
+    ps_codec->i4_max_dpb_size = max_dpb_size;
+
     pu1_buf = (UWORD8 *)ps_codec->pv_mv_bank_buf_base;
 
     ps_mv_buf = (mv_buf_t *)pu1_buf;