DO NOT MERGE: Merge Oreo MR1 into master

Exempt-From-Owner-Approval: Changes already landed internally
Change-Id: I45a371544e31ec927ede372c7e2d0c8e786d47d4
diff --git a/Android.bp b/Android.bp
index 80332d6..579771c 100644
--- a/Android.bp
+++ b/Android.bp
@@ -1,5 +1,6 @@
 cc_library_static {
     name: "libhevcdec",
+    vendor_available: true,
 
     cflags: [
         "-D_LIB",
diff --git a/decoder/ihevcd_api.c b/decoder/ihevcd_api.c
index c349fcb..a0d82dd 100644
--- a/decoder/ihevcd_api.c
+++ b/decoder/ihevcd_api.c
@@ -1215,7 +1215,7 @@
 
     /* Request memory for static bitstream buffer which holds bitstream after emulation prevention */
     size = MIN_BITSBUF_SIZE;
-    pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
+    pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size + 16); //Alloc extra for parse optimization
     RETURN_IF((NULL == pv_buf), IV_FAIL);
     ps_codec->pu1_bitsbuf_static = pv_buf;
     ps_codec->u4_bitsbuf_size_static = size;
@@ -1871,10 +1871,10 @@
     }
 
     /* Max CTBs in a row */
-    size  = wd / MIN_CTB_SIZE + 2 /* Top row and bottom row extra. This ensures accessing left,top in first row
-                                              and right in last row will not result in invalid access*/;
+    size  = wd / MIN_CTB_SIZE;
     /* Max CTBs in a column */
-    size *= ht / MIN_CTB_SIZE;
+    size *= (ht / MIN_CTB_SIZE + 2) /* Top row and bottom row extra. This ensures accessing left,top in first row
+                                              and right in last row will not result in invalid access*/;
 
     size *= sizeof(UWORD16);
     pv_buf = ps_codec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
@@ -1912,7 +1912,7 @@
     size = wd * ht;
     if(size > MIN_BITSBUF_SIZE)
     {
-        pv_buf = ps_codec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
+        pv_buf = ps_codec->pf_aligned_alloc(pv_mem_ctxt, 128, size + 16); //Alloc extra for parse optimization
         RETURN_IF((NULL == pv_buf), IV_FAIL);
         ps_codec->pu1_bitsbuf_dynamic = pv_buf;
         ps_codec->u4_bitsbuf_size_dynamic = size;
diff --git a/decoder/ihevcd_decode.c b/decoder/ihevcd_decode.c
index dfb5042..6f38e90 100644
--- a/decoder/ihevcd_decode.c
+++ b/decoder/ihevcd_decode.c
@@ -456,7 +456,8 @@
     if(0 == ps_codec->i4_share_disp_buf && ps_codec->i4_header_mode == 0)
     {
         UWORD32 i;
-        if(ps_dec_ip->s_out_buffer.u4_num_bufs == 0)
+        if((ps_dec_ip->s_out_buffer.u4_num_bufs <= 0) ||
+           (ps_dec_ip->s_out_buffer.u4_num_bufs > IVD_VIDDEC_MAX_IO_BUFFERS))
         {
             ps_dec_op->u4_error_code |= 1 << IVD_UNSUPPORTEDPARAM;
             ps_dec_op->u4_error_code |= IVD_DISP_FRM_ZERO_OP_BUFS;
diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index afa6de3..a7ec5ad 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1439,12 +1439,16 @@
 
     /* Check if sps_max_dec_pic_buffering or sps_max_num_reorder_pics
        has changed */
-    if(0 != ps_codec->i4_first_pic_done)
+    if(0 != ps_codec->u4_allocate_dynamic_done)
     {
         sps_t *ps_sps_old = ps_codec->s_parse.ps_sps;
         if(ps_sps_old->ai1_sps_max_dec_pic_buffering[ps_sps_old->i1_sps_max_sub_layers - 1] !=
                     ps_sps->ai1_sps_max_dec_pic_buffering[ps_sps->i1_sps_max_sub_layers - 1])
         {
+            if(0 == ps_codec->i4_first_pic_done)
+            {
+                return IHEVCD_INVALID_PARAMETER;
+            }
             ps_codec->i4_reset_flag = 1;
             return (IHEVCD_ERROR_T)IVD_RES_CHANGED;
         }
@@ -1452,6 +1456,10 @@
         if(ps_sps_old->ai1_sps_max_num_reorder_pics[ps_sps_old->i1_sps_max_sub_layers - 1] !=
                     ps_sps->ai1_sps_max_num_reorder_pics[ps_sps->i1_sps_max_sub_layers - 1])
         {
+            if(0 == ps_codec->i4_first_pic_done)
+            {
+                return IHEVCD_INVALID_PARAMETER;
+            }
             ps_codec->i4_reset_flag = 1;
             return (IHEVCD_ERROR_T)IVD_RES_CHANGED;
         }
@@ -1625,10 +1633,14 @@
         ps_sps->i2_pic_ht_in_min_cb = numerator  /
                         (1 << ps_sps->i1_log2_min_coding_block_size);
     }
-    if((0 != ps_codec->i4_first_pic_done) &&
+    if((0 != ps_codec->u4_allocate_dynamic_done) &&
                     ((ps_codec->i4_wd != ps_sps->i2_pic_width_in_luma_samples) ||
                     (ps_codec->i4_ht != ps_sps->i2_pic_height_in_luma_samples)))
     {
+        if(0 == ps_codec->i4_first_pic_done)
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
         ps_codec->i4_reset_flag = 1;
         return (IHEVCD_ERROR_T)IVD_RES_CHANGED;
     }
@@ -2325,9 +2337,18 @@
         if(ps_vui_hdr->u1_sub_pic_cpb_params_present_flag
                         && ps_vui_hdr->u1_sub_pic_cpb_params_in_pic_timing_sei_flag)
         {
+            UWORD32 num_units_minus1;
+            UWORD32 array_size;
+
             UEV_PARSE("num_decoding_units_minus1", value, ps_bitstrm);
             ps_pic_timing->u4_num_decoding_units_minus1 = value;
 
+            num_units_minus1 = ps_pic_timing->u4_num_decoding_units_minus1;
+            array_size = (sizeof(ps_pic_timing->au4_num_nalus_in_du_minus1)
+                       / sizeof(ps_pic_timing->au4_num_nalus_in_du_minus1[0]));
+            num_units_minus1 = CLIP3(num_units_minus1, 0,(array_size - 1));
+            ps_pic_timing->u4_num_decoding_units_minus1 = num_units_minus1;
+
             BITS_PARSE("du_common_cpb_removal_delay_flag", value, ps_bitstrm, 1);
             ps_pic_timing->u1_du_common_cpb_removal_delay_flag = value;
 
@@ -2604,8 +2625,20 @@
 
             case SEI_USER_DATA_REGISTERED_ITU_T_T35:
                 ps_parse->s_sei_params.i1_sei_parameters_present_flag = 1;
-                ihevcd_parse_user_data_registered_itu_t_t35(ps_codec,
-                                                            u4_payload_size);
+                if(ps_parse->s_sei_params.i4_sei_user_data_cnt >= USER_DATA_MAX)
+                {
+                    for(i = 0; i < u4_payload_size / 4; i++)
+                    {
+                        ihevcd_bits_flush(ps_bitstrm, 4 * 8);
+                    }
+
+                    ihevcd_bits_flush(ps_bitstrm, (u4_payload_size - i * 4) * 8);
+                }
+                else
+                {
+                    ihevcd_parse_user_data_registered_itu_t_t35(ps_codec,
+                                                                u4_payload_size);
+                }
                 break;
 
             default:
@@ -2622,8 +2655,20 @@
         {
             case SEI_USER_DATA_REGISTERED_ITU_T_T35:
                 ps_parse->s_sei_params.i1_sei_parameters_present_flag = 1;
-                ihevcd_parse_user_data_registered_itu_t_t35(ps_codec,
-                                                            u4_payload_size);
+                if(ps_parse->s_sei_params.i4_sei_user_data_cnt >= USER_DATA_MAX)
+                {
+                    for(i = 0; i < u4_payload_size / 4; i++)
+                    {
+                        ihevcd_bits_flush(ps_bitstrm, 4 * 8);
+                    }
+
+                    ihevcd_bits_flush(ps_bitstrm, (u4_payload_size - i * 4) * 8);
+                }
+                else
+                {
+                    ihevcd_parse_user_data_registered_itu_t_t35(ps_codec,
+                                                                u4_payload_size);
+                }
                 break;
 
             default: