Fix Half Pel MC on Last Ref Row
If MC is referring to the last MB row, in case of field pictures,
it could incorrectly read up to 8 extra rows in the reference
buffer and 9 rows in case of half_y prediction.
Bug: 63873837
Test: ran POC on patched ASAN-enabled code
Change-Id: I83af03b3c6b7e08a984f7b383bedf706422f6354
(cherry picked from commit 8c0289c09cddd378cd9a321ccdb1c62e7b80f626)
diff --git a/decoder/impeg2d_api_main.c b/decoder/impeg2d_api_main.c
index c0813c4..cfef75d 100644
--- a/decoder/impeg2d_api_main.c
+++ b/decoder/impeg2d_api_main.c
@@ -428,7 +428,11 @@
UWORD32 u4_deinterlace;
UNUSED(u4_deinterlace);
max_frm_width = ALIGN16(ps_ip->s_ivd_fill_mem_rec_ip_t.u4_max_frm_wd);
- max_frm_height = ALIGN16(ps_ip->s_ivd_fill_mem_rec_ip_t.u4_max_frm_ht);
+ /* In error clips with field prediction, the mv may incorrectly refer to
+ * the last MB row, causing an out of bounds read access. Allocating 8 extra
+ * rows to handle this. Adding another extra row to handle half_y prediction.
+ */
+ max_frm_height = ALIGN32(ps_ip->s_ivd_fill_mem_rec_ip_t.u4_max_frm_ht) + 9;
max_frm_size = (max_frm_width * max_frm_height * 3) >> 1;/* 420 P */
