Merge cherrypicks of [2938809, 2937688, 2938829, 2938790, 2938791, 2938792, 2938793, 2938849, 2938850, 2938737, 2938738, 2938739, 2938740, 2938741, 2938204, 2938205, 2938206, 2938207, 2938208, 2938830, 2938831, 2938832, 2938794, 2937966, 2938889, 2938810, 2938833] into oc-r5-release
Change-Id: I4fde13115984bec58c701b9d1b2d351b18a75bee
diff --git a/decoder/ihevcd_api.c b/decoder/ihevcd_api.c
index c349fcb..5289a12 100644
--- a/decoder/ihevcd_api.c
+++ b/decoder/ihevcd_api.c
@@ -1871,10 +1871,10 @@
}
/* Max CTBs in a row */
- size = wd / MIN_CTB_SIZE + 2 /* Top row and bottom row extra. This ensures accessing left,top in first row
- and right in last row will not result in invalid access*/;
+ size = wd / MIN_CTB_SIZE;
/* Max CTBs in a column */
- size *= ht / MIN_CTB_SIZE;
+ size *= (ht / MIN_CTB_SIZE + 2) /* Top row and bottom row extra. This ensures accessing left,top in first row
+ and right in last row will not result in invalid access*/;
size *= sizeof(UWORD16);
pv_buf = ps_codec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
diff --git a/decoder/ihevcd_decode.c b/decoder/ihevcd_decode.c
index dfb5042..6f38e90 100644
--- a/decoder/ihevcd_decode.c
+++ b/decoder/ihevcd_decode.c
@@ -456,7 +456,8 @@
if(0 == ps_codec->i4_share_disp_buf && ps_codec->i4_header_mode == 0)
{
UWORD32 i;
- if(ps_dec_ip->s_out_buffer.u4_num_bufs == 0)
+ if((ps_dec_ip->s_out_buffer.u4_num_bufs <= 0) ||
+ (ps_dec_ip->s_out_buffer.u4_num_bufs > IVD_VIDDEC_MAX_IO_BUFFERS))
{
ps_dec_op->u4_error_code |= 1 << IVD_UNSUPPORTEDPARAM;
ps_dec_op->u4_error_code |= IVD_DISP_FRM_ZERO_OP_BUFS;
