release-request-f4ecf242-5d1c-45e0-8c7c-ede48d1a9e82-for-git_oc-release-4111650 snap-temp-L02200000075283731

Change-Id: I0bbf414695429ff2b99bdd7137ec065d018f5bb5
diff --git a/decoder/ihevcd_decode.c b/decoder/ihevcd_decode.c
index e51b11a..28455e0 100644
--- a/decoder/ihevcd_decode.c
+++ b/decoder/ihevcd_decode.c
@@ -81,6 +81,7 @@
 #define NUM_FRAMES_LIMIT 0x7FFFFFFF
 #endif
 
+IHEVCD_ERROR_T ihevcd_check_out_buf_size(codec_t *ps_codec);
 IHEVCD_ERROR_T ihevcd_fmt_conv(codec_t *ps_codec,
                                process_ctxt_t *ps_proc,
                                UWORD8 *pu1_y_dst,
@@ -506,6 +507,10 @@
                 ihevcd_init_proc_ctxt(ps_proc, 0);
             }
 
+            /* Output buffer check */
+            ret = ihevcd_check_out_buf_size(ps_codec);
+            RETURN_IF((ret != (IHEVCD_ERROR_T)IHEVCD_SUCCESS), ret);
+
             /* Set remaining number of rows to be processed */
             ret = ihevcd_fmt_conv(ps_codec, &ps_codec->as_process[prev_proc_idx],
                                   ps_dec_ip->s_out_buffer.pu1_bufs[0],
diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index 2faddd7..28ab962 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1363,15 +1363,31 @@
     {
 
         UEV_PARSE("pic_crop_left_offset", value, ps_bitstrm);
+        if (value >= ps_sps->i2_pic_width_in_luma_samples)
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
         ps_sps->i2_pic_crop_left_offset = value;
 
         UEV_PARSE("pic_crop_right_offset", value, ps_bitstrm);
+        if (value >= ps_sps->i2_pic_width_in_luma_samples)
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
         ps_sps->i2_pic_crop_right_offset = value;
 
         UEV_PARSE("pic_crop_top_offset", value, ps_bitstrm);
+        if (value >= ps_sps->i2_pic_height_in_luma_samples)
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
         ps_sps->i2_pic_crop_top_offset = value;
 
         UEV_PARSE("pic_crop_bottom_offset", value, ps_bitstrm);
+        if (value >= ps_sps->i2_pic_height_in_luma_samples)
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
         ps_sps->i2_pic_crop_bottom_offset = value;
     }
     else
diff --git a/decoder/ihevcd_utils.c b/decoder/ihevcd_utils.c
index c5c457d..5e27885 100755
--- a/decoder/ihevcd_utils.c
+++ b/decoder/ihevcd_utils.c
@@ -703,6 +703,103 @@
 *******************************************************************************
 *
 * @brief
+*  Output buffer check
+*
+* @par Description:
+*  Check for the number of buffers and buffer sizes of output buffer
+*
+* @param[in] ps_codec
+*  Pointer to codec context
+*
+* @returns  Error from IHEVCD_ERROR_T
+*
+* @remarks
+*
+*
+*******************************************************************************
+*/
+IHEVCD_ERROR_T ihevcd_check_out_buf_size(codec_t *ps_codec)
+{
+    ivd_out_bufdesc_t *ps_out_buffer = ps_codec->ps_out_buffer;
+    UWORD32 au4_min_out_buf_size[IVD_VIDDEC_MAX_IO_BUFFERS];
+    UWORD32 u4_min_num_out_bufs = 0, i;
+    UWORD32 wd, ht;
+
+    if(0 == ps_codec->i4_share_disp_buf)
+    {
+        wd = ps_codec->i4_disp_wd;
+        ht = ps_codec->i4_disp_ht;
+    }
+    else
+    {
+        /* In case of shared mode, do not check validity of ps_codec->ps_out_buffer */
+        return (IHEVCD_ERROR_T)IHEVCD_SUCCESS;
+    }
+
+    if(ps_codec->e_chroma_fmt == IV_YUV_420P)
+        u4_min_num_out_bufs = MIN_OUT_BUFS_420;
+    else if(ps_codec->e_chroma_fmt == IV_YUV_422ILE)
+        u4_min_num_out_bufs = MIN_OUT_BUFS_422ILE;
+    else if(ps_codec->e_chroma_fmt == IV_RGB_565)
+        u4_min_num_out_bufs = MIN_OUT_BUFS_RGB565;
+    else if(ps_codec->e_chroma_fmt == IV_RGBA_8888)
+        u4_min_num_out_bufs = MIN_OUT_BUFS_RGBA8888;
+    else if((ps_codec->e_chroma_fmt == IV_YUV_420SP_UV)
+                    || (ps_codec->e_chroma_fmt == IV_YUV_420SP_VU))
+        u4_min_num_out_bufs = MIN_OUT_BUFS_420SP;
+
+    if(ps_codec->e_chroma_fmt == IV_YUV_420P)
+    {
+        au4_min_out_buf_size[0] = (wd * ht);
+        au4_min_out_buf_size[1] = (wd * ht) >> 2;
+        au4_min_out_buf_size[2] = (wd * ht) >> 2;
+    }
+    else if(ps_codec->e_chroma_fmt == IV_YUV_422ILE)
+    {
+        au4_min_out_buf_size[0] = (wd * ht) * 2;
+        au4_min_out_buf_size[1] =
+                        au4_min_out_buf_size[2] = 0;
+    }
+    else if(ps_codec->e_chroma_fmt == IV_RGB_565)
+    {
+        au4_min_out_buf_size[0] = (wd * ht) * 2;
+        au4_min_out_buf_size[1] =
+                        au4_min_out_buf_size[2] = 0;
+    }
+    else if(ps_codec->e_chroma_fmt == IV_RGBA_8888)
+    {
+        au4_min_out_buf_size[0] = (wd * ht) * 4;
+        au4_min_out_buf_size[1] =
+                        au4_min_out_buf_size[2] = 0;
+    }
+    else if((ps_codec->e_chroma_fmt == IV_YUV_420SP_UV)
+                    || (ps_codec->e_chroma_fmt == IV_YUV_420SP_VU))
+    {
+        au4_min_out_buf_size[0] = (wd * ht);
+        au4_min_out_buf_size[1] = (wd * ht) >> 1;
+        au4_min_out_buf_size[2] = 0;
+    }
+
+    if(ps_out_buffer->u4_num_bufs < u4_min_num_out_bufs)
+    {
+        return (IHEVCD_ERROR_T)IV_FAIL;
+    }
+
+    for (i = 0 ; i < u4_min_num_out_bufs; i++)
+    {
+        if(ps_out_buffer->u4_min_out_buf_size[i] < au4_min_out_buf_size[i])
+        {
+            return (IHEVCD_ERROR_T)IV_FAIL;
+        }
+    }
+
+    return (IHEVCD_ERROR_T)IHEVCD_SUCCESS;
+}
+
+/**
+*******************************************************************************
+*
+* @brief
 *  Picture level initializations required during parsing
 *
 * @par Description:
@@ -754,6 +851,10 @@
         ps_codec->s_parse.i4_first_pic_init = 1;
     }
 
+    /* Output buffer check */
+    ret = ihevcd_check_out_buf_size(ps_codec);
+    RETURN_IF((ret != (IHEVCD_ERROR_T)IHEVCD_SUCCESS), ret);
+
     /* Initialize all the slice headers' slice addresses to zero */
     {
         WORD32 slice_idx;