Decoder: Adding Error Check for Output Buffer Size in Shared Display Mode.
The output buffer size given by the application, needs to be checked
in every process call. This is required in the case of resolution
change in shared display mode.
Bug: 70294343
Bug: 70350193
Bug: 70526411
Bug: 70526485
Test: manual
Change-Id: I2c1e59425e84ac62a874e5ee180e1b98f0a4058f
diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c
index deeb41c..50e0f8f 100644
--- a/decoder/ih264d_api.c
+++ b/decoder/ih264d_api.c
@@ -2632,8 +2632,8 @@
}
else
{
- /* In case of shared mode, do not check validity of ps_dec->ps_out_buffer */
- return (IV_SUCCESS);
+ pic_wd = ps_dec->u2_frm_wd_y;
+ pic_ht = ps_dec->u2_frm_ht_y;
}
if(ps_dec->u4_app_disp_width > pic_wd)
@@ -2643,14 +2643,34 @@
ps_dec->u1_chroma_format,
&au4_min_out_buf_size[0]);
- if(ps_dec->ps_out_buffer->u4_num_bufs < u4_min_num_out_bufs)
- return IV_FAIL;
- for(i = 0; i < u4_min_num_out_bufs; i++)
+ if(0 == ps_dec->u4_share_disp_buf)
{
- if(ps_dec->ps_out_buffer->u4_min_out_buf_size[i]
- < au4_min_out_buf_size[i])
- return (IV_FAIL);
+ if(ps_dec->ps_out_buffer->u4_num_bufs < u4_min_num_out_bufs)
+ return IV_FAIL;
+
+ for(i = 0; i < u4_min_num_out_bufs; i++)
+ {
+ if(ps_dec->ps_out_buffer->u4_min_out_buf_size[i]
+ < au4_min_out_buf_size[i])
+ return (IV_FAIL);
+ }
+ }
+ else
+ {
+ if(ps_dec->disp_bufs[0].u4_num_bufs < u4_min_num_out_bufs)
+ return IV_FAIL;
+
+ for(i = 0; i < u4_min_num_out_bufs; i++)
+ {
+ /* We need to check only with the disp_buffer[0], because we have
+ * already ensured that all the buffers are of the same size in
+ * ih264d_set_display_frame.
+ */
+ if(ps_dec->disp_bufs[0].u4_bufsize[i] < au4_min_out_buf_size[i])
+ return (IV_FAIL);
+ }
+
}
return (IV_SUCCESS);
@@ -3596,6 +3616,7 @@
void *pv_api_op)
{
+ UWORD32 u4_disp_buf_size[3], u4_num_disp_bufs;
ivd_set_display_frame_ip_t *dec_disp_ip;
ivd_set_display_frame_op_t *dec_disp_op;
@@ -3667,8 +3688,36 @@
u4_num_bufs = MIN(u4_num_bufs, num_mvbank_req);
ps_dec->u4_num_disp_bufs = u4_num_bufs;
+
+ /* Get the number and sizes of the first buffer. Compare this with the
+ * rest to make sure all the buffers are of the same size.
+ */
+ u4_num_disp_bufs = dec_disp_ip->s_disp_buffer[0].u4_num_bufs;
+
+ u4_disp_buf_size[0] =
+ dec_disp_ip->s_disp_buffer[0].u4_min_out_buf_size[0];
+ u4_disp_buf_size[1] =
+ dec_disp_ip->s_disp_buffer[0].u4_min_out_buf_size[1];
+ u4_disp_buf_size[2] =
+ dec_disp_ip->s_disp_buffer[0].u4_min_out_buf_size[2];
+
for(i = 0; i < u4_num_bufs; i++)
{
+ if(dec_disp_ip->s_disp_buffer[i].u4_num_bufs != u4_num_disp_bufs)
+ {
+ return IV_FAIL;
+ }
+
+ if((dec_disp_ip->s_disp_buffer[i].u4_min_out_buf_size[0]
+ != u4_disp_buf_size[0])
+ || (dec_disp_ip->s_disp_buffer[i].u4_min_out_buf_size[1]
+ != u4_disp_buf_size[1])
+ || (dec_disp_ip->s_disp_buffer[i].u4_min_out_buf_size[2]
+ != u4_disp_buf_size[2]))
+ {
+ return IV_FAIL;
+ }
+
ps_dec->disp_bufs[i].u4_num_bufs =
dec_disp_ip->s_disp_buffer[i].u4_num_bufs;