Fix Half Pel MC on Last Ref Row

If MC is referring to the last MB row, in case of field pictures,
it could incorrectly read up to 8 extra rows in the reference
buffer and 9 rows in case of half_y prediction.

Bug: 63873837
Test: ran POC on patched ASAN-enabled code
Change-Id: I83af03b3c6b7e08a984f7b383bedf706422f6354
(cherry picked from commit 8c0289c09cddd378cd9a321ccdb1c62e7b80f626)

decoder/impeg2d_api_main.c

diff --git a/decoder/impeg2d_api_main.c b/decoder/impeg2d_api_main.c
index c0813c4..cfef75d 100644
--- a/decoder/impeg2d_api_main.c
+++ b/decoder/impeg2d_api_main.c
@@ -428,7 +428,11 @@
     UWORD32 u4_deinterlace;
     UNUSED(u4_deinterlace);
     max_frm_width = ALIGN16(ps_ip->s_ivd_fill_mem_rec_ip_t.u4_max_frm_wd);
-    max_frm_height = ALIGN16(ps_ip->s_ivd_fill_mem_rec_ip_t.u4_max_frm_ht);
+    /* In error clips with field prediction, the mv may incorrectly refer to
+    * the last MB row, causing an out of bounds read access. Allocating 8 extra
+    * rows to handle this. Adding another extra row to handle half_y prediction.
+    */
+    max_frm_height = ALIGN32(ps_ip->s_ivd_fill_mem_rec_ip_t.u4_max_frm_ht) + 9;
 
     max_frm_size = (max_frm_width * max_frm_height * 3) >> 1;/* 420 P */