commit c07fc9891f9610225801529daf4cb6f7e4a00e7d
author TreeHugger Robot <treehugger-gerrit@google.com> Tue Jun 06 23:00:21 2017 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Tue Jun 06 23:00:21 2017 +0000
tree da9a33b5b45edb9af187bd98a3ae70062d8d6231
parent eff61103340b26485086ed5890587f01d026badb
parent edfd6f6089d54c9bdf937b614724cb02179ed178

Merge "Correcting NumCoeff Check in VLD" into mnc-dev

decoder/impeg2d_dec_hdr.c

diff --git a/decoder/impeg2d_dec_hdr.c b/decoder/impeg2d_dec_hdr.c
index 50cfd34..2f9db2b 100644
--- a/decoder/impeg2d_dec_hdr.c
+++ b/decoder/impeg2d_dec_hdr.c
@@ -707,11 +707,12 @@
 *  Arguments       :
 *  dec             : Decoder context
 *
-*  Values Returned : None
+*  Values Returned : Error
 *******************************************************************************/
-void impeg2d_dec_pic_coding_ext(dec_state_t *ps_dec)
+IMPEG2D_ERROR_CODES_T impeg2d_dec_pic_coding_ext(dec_state_t *ps_dec)
 {
     stream_t *ps_stream;
+    IMPEG2D_ERROR_CODES_T e_error = (IMPEG2D_ERROR_CODES_T) IV_SUCCESS;
 
     ps_stream = &ps_dec->s_bit_stream;
     impeg2d_bit_stream_flush(ps_stream,START_CODE_LEN);
@@ -724,6 +725,11 @@
     ps_dec->au2_f_code[1][1]             = impeg2d_bit_stream_get(ps_stream,4);
     ps_dec->u2_intra_dc_precision        = impeg2d_bit_stream_get(ps_stream,2);
     ps_dec->u2_picture_structure            = impeg2d_bit_stream_get(ps_stream,2);
+    if (ps_dec->u2_picture_structure < TOP_FIELD ||
+                    ps_dec->u2_picture_structure > FRAME_PICTURE)
+    {
+        return IMPEG2D_FRM_HDR_DECODE_ERR;
+    }
     ps_dec->u2_top_field_first              = impeg2d_bit_stream_get_bit(ps_stream);
     ps_dec->u2_frame_pred_frame_dct         = impeg2d_bit_stream_get_bit(ps_stream);
     ps_dec->u2_concealment_motion_vectors   = impeg2d_bit_stream_get_bit(ps_stream);
@@ -751,6 +757,7 @@
     {
         ps_dec->pu1_inv_scan_matrix = (UWORD8 *)gau1_impeg2_inv_scan_zig_zag;
     }
+    return e_error;
 }
 
 /*******************************************************************************
@@ -801,6 +808,12 @@
     {
         ps_dec->u2_mb_y    = u4_slice_vertical_position;
         ps_dec->u2_mb_x    = 0;
+
+        /* Update the number of MBs left, since we have probably missed a slice
+         * (that's why we see a mismatch between u2_mb_y and current position).
+         */
+        ps_dec->u2_num_mbs_left = (ps_dec->u2_num_vert_mb - ps_dec->u2_mb_y)
+                        * ps_dec->u2_num_horiz_mb;
     }
     ps_dec->u2_first_mb = 1;
 
@@ -1667,7 +1680,11 @@
                 {
                     return e_error;
                 }
-                impeg2d_dec_pic_coding_ext(ps_dec);
+                e_error = impeg2d_dec_pic_coding_ext(ps_dec);
+                if ((IMPEG2D_ERROR_CODES_T)IVD_ERROR_NONE != e_error)
+                {
+                    return e_error;
+                }
                 e_error = impeg2d_dec_pic_ext_data(ps_dec);
                 if ((IMPEG2D_ERROR_CODES_T)IVD_ERROR_NONE != e_error)
                 {