commit e31ce9209fb9ee89602ecc8517735da1774a3cf2
author Naveen Kumar Ponnusamy <naveenkumar.p@ittiam.com> Tue Mar 14 10:06:04 2017 +0530
committer gitbuildkicker <android-build@google.com> Mon Apr 24 12:19:30 2017 -0700
tree 7c0dec52f27529794fbede2810632e3add3179aa
parent 0133b2fd93da5e7d841be134fd3f8a5f54df2363

Check only allocated mv bufs for releasing from reference

When checking mv bufs for releasing from reference, unallocated
mv bufs were also checked. This issue was fixed by restricting
the loop count to allocated number of mv bufs.

Bug: 34896906
Bug: 34819017

Change-Id: If832f590b301f414d4cd5206414efc61a70c17cb
(cherry picked from commit 23bfe3e06d53ea749073a5d7ceda84239742b2c2)

decoder/ihevcd_parse_slice_header.c

diff --git a/decoder/ihevcd_parse_slice_header.c b/decoder/ihevcd_parse_slice_header.c
index 744484e..b372e5d 100644
--- a/decoder/ihevcd_parse_slice_header.c
+++ b/decoder/ihevcd_parse_slice_header.c
@@ -219,7 +219,7 @@
 {
     IHEVCD_ERROR_T ret = (IHEVCD_ERROR_T)IHEVCD_SUCCESS;
     WORD32 value;
-    WORD32 i;
+    WORD32 i, j;
     WORD32 sps_id;
 
     pps_t *ps_pps;
@@ -880,11 +880,11 @@
                     ihevc_dpb_mgr_del_ref((dpb_mgr_t *)ps_codec->pv_dpb_mgr, (buf_mgr_t *)ps_codec->pv_pic_buf_mgr, ps_pic_buf->i4_abs_poc);
                     /* Find buffer id of the MV bank corresponding to the buffer being freed (Buffer with POC of u4_abs_poc) */
                     ps_mv_buf = (mv_buf_t *)ps_codec->ps_mv_buf;
-                    for(i = 0; i < BUF_MGR_MAX_CNT; i++)
+                    for(j = 0; j < ps_codec->i4_max_dpb_size; j++)
                     {
                         if(ps_mv_buf && ps_mv_buf->i4_abs_poc == ps_pic_buf->i4_abs_poc)
                         {
-                            ihevc_buf_mgr_release((buf_mgr_t *)ps_codec->pv_mv_buf_mgr, i, BUF_MGR_REF);
+                            ihevc_buf_mgr_release((buf_mgr_t *)ps_codec->pv_mv_buf_mgr, j, BUF_MGR_REF);
                             break;
                         }
                         ps_mv_buf++;

decoder/ihevcd_ref_list.c

diff --git a/decoder/ihevcd_ref_list.c b/decoder/ihevcd_ref_list.c
index 76bb476..0fe6aa4 100644
--- a/decoder/ihevcd_ref_list.c
+++ b/decoder/ihevcd_ref_list.c
@@ -92,7 +92,7 @@
 
 WORD32 ihevcd_ref_list(codec_t *ps_codec, pps_t *ps_pps, sps_t *ps_sps, slice_header_t *ps_slice_hdr)
 {
-    WORD32 i;
+    WORD32 i, j;
     WORD32 st_rps_idx;
     WORD32 num_neg_pics, num_pos_pics;
     WORD8 *pi1_used;
@@ -503,11 +503,11 @@
 
             /* Find buffer id of the MV bank corresponding to the buffer being freed (Buffer with POC of u4_abs_poc) */
             ps_mv_buf = (mv_buf_t *)ps_codec->ps_mv_buf;
-            for(i = 0; i < BUF_MGR_MAX_CNT; i++)
+            for(j = 0; j < ps_codec->i4_max_dpb_size; j++)
             {
                 if(ps_mv_buf && ps_mv_buf->i4_abs_poc == ps_pic_buf->i4_abs_poc)
                 {
-                    ihevc_buf_mgr_release((buf_mgr_t *)ps_codec->pv_mv_buf_mgr, i, BUF_MGR_REF);
+                    ihevc_buf_mgr_release((buf_mgr_t *)ps_codec->pv_mv_buf_mgr, j, BUF_MGR_REF);
                     break;
                 }
                 ps_mv_buf++;

decoder/ihevcd_structs.h

diff --git a/decoder/ihevcd_structs.h b/decoder/ihevcd_structs.h
index ce0653e..1a46984 100644
--- a/decoder/ihevcd_structs.h
+++ b/decoder/ihevcd_structs.h
@@ -1929,6 +1929,9 @@
      */
     void *ps_mv_buf;
 
+    /** Holds the number of mv_buf_t structures allocated */
+    WORD32 i4_max_dpb_size;
+
     /**
      * Base address for Motion Vector bank buffer
      */

decoder/ihevcd_utils.c

diff --git a/decoder/ihevcd_utils.c b/decoder/ihevcd_utils.c
old mode 100644
new mode 100755
index c6c21f5..797b079
--- a/decoder/ihevcd_utils.c
+++ b/decoder/ihevcd_utils.c
@@ -598,6 +598,8 @@
      */
     max_dpb_size++;
 
+    ps_codec->i4_max_dpb_size = max_dpb_size;
+
     pu1_buf = (UWORD8 *)ps_codec->pv_mv_bank_buf_base;
 
     ps_mv_buf = (mv_buf_t *)pu1_buf;