Merge branch 'security-aosp-qt-release' into int/10/fp2

* security-aosp-qt-release:
  Move slice increments after completing header parsing

Change-Id: I04c0476d5a40c4f36656b3b4c4e7ffa9131f74bc
diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c
index fa5bb26..02b706c 100644
--- a/decoder/ih264d_api.c
+++ b/decoder/ih264d_api.c
@@ -1068,6 +1068,7 @@
     ps_dec->i4_max_poc = 0;
     ps_dec->i4_prev_max_display_seq = 0;
     ps_dec->u1_recon_mb_grp = 4;
+    ps_dec->i4_reorder_depth = -1;
 
     /* Field PIC initializations */
     ps_dec->u1_second_field = 0;
@@ -1851,7 +1852,8 @@
     ps_dec->u1_pic_decode_done = 0;
 
     ps_dec_op->u4_num_bytes_consumed = 0;
-
+    ps_dec_op->i4_reorder_depth = -1;
+    ps_dec_op->i4_display_index = DEFAULT_POC;
     ps_dec->ps_out_buffer = NULL;
 
     if(ps_dec_ip->u4_size
@@ -2040,6 +2042,8 @@
 
         ps_dec_op->u4_pic_wd = (UWORD32)ps_dec->u2_disp_width;
         ps_dec_op->u4_pic_ht = (UWORD32)ps_dec->u2_disp_height;
+        ps_dec_op->i4_reorder_depth = ps_dec->i4_reorder_depth;
+        ps_dec_op->i4_display_index = ps_dec->i4_display_index;
 
         ps_dec_op->u4_new_seq = 0;
 
@@ -2358,6 +2362,7 @@
     {
         ps_dec_op->u4_pic_wd = (UWORD32)ps_dec->u2_disp_width;
         ps_dec_op->u4_pic_ht = (UWORD32)ps_dec->u2_disp_height;
+        ps_dec_op->i4_reorder_depth = ps_dec->i4_reorder_depth;
     }
 
 //Report if header (sps and pps) has not been decoded yet
@@ -3666,6 +3671,8 @@
         ps_dec_op->u4_pic_wd = (UWORD32)ps_dec->u2_disp_width;
         ps_dec_op->u4_pic_ht = (UWORD32)ps_dec->u2_disp_height;
     }
+    ps_dec_op->i4_reorder_depth = ps_dec->i4_reorder_depth;
+    ps_dec_op->i4_display_index = ps_dec->i4_display_index;
     ps_dec_op->e_pic_type = ps_dec->i4_frametype;
 
     ps_dec_op->u4_new_seq = 0;
diff --git a/decoder/ih264d_parse_slice.c b/decoder/ih264d_parse_slice.c
index b578397..00e30d2 100644
--- a/decoder/ih264d_parse_slice.c
+++ b/decoder/ih264d_parse_slice.c
@@ -1029,7 +1029,6 @@
                         ps_st_next_dpb->ps_prev_short = ps_st_curr_dpb->ps_prev_short;
                     }
                     ps_dec->ps_dpb_mgr->u1_num_st_ref_bufs--;
-                    ps_dec->ps_dpb_mgr->u1_num_lt_ref_bufs++;
                     no_of_nodes_deleted++;
                     break;
                 }
@@ -1307,7 +1306,12 @@
 
     if(i1_is_end_of_poc || ps_dec->u1_first_slice_in_stream)
     {
-        if(u2_frame_num != ps_dec->u2_prv_frame_num
+        /* If the current slice is not a field or frame number of the current
+         * slice doesn't match with previous slice, and decoder is expecting
+         * to decode a field i.e. ps_dec->u1_top_bottom_decoded is not 0 and
+         * is not (TOP_FIELD_ONLY | BOT_FIELD_ONLY), treat it as a dangling
+         * field */
+        if((u1_field_pic_flag == 0 || u2_frame_num != ps_dec->u2_prv_frame_num)
                && ps_dec->u1_top_bottom_decoded != 0
                    && ps_dec->u1_top_bottom_decoded
                        != (TOP_FIELD_ONLY | BOT_FIELD_ONLY))
diff --git a/decoder/ih264d_structs.h b/decoder/ih264d_structs.h
index 97e9797..41cc885 100644
--- a/decoder/ih264d_structs.h
+++ b/decoder/ih264d_structs.h
@@ -1053,6 +1053,7 @@
                          struct _DecMbInfo * ps_cur_mb_info,
                          const UWORD16 u2_mbxn_mb);
     UWORD8 u1_init_dec_flag;
+    WORD32 i4_reorder_depth;
     prev_seq_params_t s_prev_seq_params;
     UWORD8 u1_cur_mb_fld_dec_flag; /* current Mb fld or Frm */
 
@@ -1315,7 +1316,7 @@
      *
      */
     WORD32 i4_degrade_pic_cnt;
-
+    WORD32 i4_display_index;
     UWORD32 u4_pic_buf_got;
 
     /**
diff --git a/decoder/ih264d_utils.c b/decoder/ih264d_utils.c
index 56c2a54..28d8db0 100644
--- a/decoder/ih264d_utils.c
+++ b/decoder/ih264d_utils.c
@@ -769,6 +769,7 @@
             else
                 ps_dec->i4_display_delay = ps_seq->s_vui.u4_num_reorder_frames * 2 + 2;
         }
+        ps_dec->i4_reorder_depth = ps_dec->i4_display_delay;
 
         if(IVD_DECODE_FRAME_OUT == ps_dec->e_frm_out_mode)
             ps_dec->i4_display_delay = 0;
@@ -945,6 +946,7 @@
     pv_disp_op->s_disp_frm_buf.pv_y_buf = ps_out_buffer->pu1_bufs[0];
     pv_disp_op->s_disp_frm_buf.pv_u_buf = ps_out_buffer->pu1_bufs[1];
     pv_disp_op->s_disp_frm_buf.pv_v_buf = ps_out_buffer->pu1_bufs[2];
+    ps_dec->i4_display_index  = DEFAULT_POC;
     if(pic_buf != NULL)
     {
         pv_disp_op->e4_fld_type = 0;
@@ -961,6 +963,7 @@
 
         /* ! */
         pv_disp_op->u4_ts = pic_buf->u4_ts;
+        ps_dec->i4_display_index = pic_buf->i4_poc;
 
         /* set the start of the Y, U and V buffer pointer for display    */
         ps_op_frm->pv_y_buf = pic_buf->pu1_buf1 + pic_buf->u2_crop_offset_y;
diff --git a/decoder/ivd.h b/decoder/ivd.h
index 8d304bc..f3a9f62 100644
--- a/decoder/ivd.h
+++ b/decoder/ivd.h
@@ -486,6 +486,17 @@
      * disp_buf_id
      */
     UWORD32                                 u4_disp_buf_id;
+
+    /**
+     * reorder_depth
+     */
+    WORD32                                  i4_reorder_depth;
+
+    /**
+     * disp_buf_id
+     */
+    WORD32                                  i4_display_index;
+
 }ivd_video_decode_op_t;