Merge tag 'android-13.0.0_r32' into int/13/fp3
Android 13.0.0 release 32
* tag 'android-13.0.0_r32':
avcenc: Fix out of bound read in initialize process context
Change-Id: I1d57cfe6b0d6439b9149f593a60dfbcbcf16c09d
diff --git a/encoder/ih264e_process.c b/encoder/ih264e_process.c
index bf4c1e7..818e192 100644
--- a/encoder/ih264e_process.c
+++ b/encoder/ih264e_process.c
@@ -1329,7 +1329,7 @@
num_rows = MB_SIZE - u4_pad_bottom_sz;
for (i = 0; i < num_rows; i++)
{
- memcpy(pu1_dst, pu1_src, ps_codec->s_cfg.u4_wd);
+ memcpy(pu1_dst, pu1_src, ps_codec->s_cfg.u4_disp_wd);
pu1_src += ps_proc->s_inp_buf.s_raw_buf.au4_strd[0];
pu1_dst += ps_proc->i4_src_strd;
}
@@ -1346,7 +1346,7 @@
num_rows = BLK8x8SIZE;
for (i = 0; i < num_rows; i++)
{
- memcpy(pu1_dst, pu1_src, ps_codec->s_cfg.u4_wd);
+ memcpy(pu1_dst, pu1_src, ps_codec->s_cfg.u4_disp_wd);
pu1_src += ps_proc->s_inp_buf.s_raw_buf.au4_strd[1];
pu1_dst += ps_proc->i4_src_chroma_strd;
}
@@ -1417,7 +1417,7 @@
ps_proc->s_inp_buf.s_raw_buf.au4_strd[0] * (i4_mb_y * MB_SIZE) -
ps_proc->s_inp_buf.s_raw_buf.au4_strd[0];
UWORD8 *pu1_dst = ps_proc->pu1_src_buf_luma - ps_proc->i4_src_strd;
- memcpy(pu1_dst, pu1_src, ps_codec->s_cfg.u4_wd);
+ memcpy(pu1_dst, pu1_src, ps_codec->s_cfg.u4_disp_wd);
if (u4_pad_right_sz && (ps_proc->i4_mb_x == 0)) {
pu1_dst += ps_codec->s_cfg.u4_disp_wd;
memset(pu1_dst, pu1_dst[-1], u4_pad_right_sz);