mirror of
https://github.com/hardkernel/linux.git
synced 2026-06-11 05:17:10 +09:00
media: fix unsupport 12bit may crashed bug.
PD#159195 PD#159359 1. unspport 12 bit depth, set fatal_error,when >=10bit; 2. doublewtite 0x100 crash bug. Change-Id: I6366b769c3be75b3cc44e606d3317272053b6723
This commit is contained in:
@@ -5076,6 +5076,17 @@ static int hevc_slice_segment_header_process(struct hevc_state_s *hevc,
|
||||
hevc->fatal_error |= DECODER_FATAL_ERROR_SIZE_OVERFLOW;
|
||||
return 3;
|
||||
}
|
||||
if (hevc->bit_depth_chroma > 10 ||
|
||||
hevc->bit_depth_luma > 10) {
|
||||
pr_info("unsupport bitdepth : %u,%u\n",
|
||||
hevc->bit_depth_chroma,
|
||||
hevc->bit_depth_luma);
|
||||
if (!hevc->m_ins_flag)
|
||||
debug |= (H265_DEBUG_DIS_LOC_ERROR_PROC |
|
||||
H265_DEBUG_DIS_SYS_ERROR_PROC);
|
||||
hevc->fatal_error |= DECODER_FATAL_ERROR_SIZE_OVERFLOW;
|
||||
return 4;
|
||||
}
|
||||
|
||||
/* it will cause divide 0 error */
|
||||
if (hevc->pic_w == 0 || hevc->pic_h == 0) {
|
||||
@@ -5592,6 +5603,13 @@ static int H265_alloc_mmu(struct hevc_state_s *hevc, struct PIC_s *new_pic,
|
||||
decoder_mmu_box_free_idx(hevc->mmu_box, new_pic->index);
|
||||
new_pic->scatter_alloc = 0;
|
||||
}
|
||||
if (cur_mmu_4k_number > MAX_FRAME_4K_NUM) {
|
||||
pr_err("over max !! 0x%x width %d height %d\n",
|
||||
cur_mmu_4k_number,
|
||||
new_pic->width,
|
||||
new_pic->height);
|
||||
return -1;
|
||||
}
|
||||
ret = decoder_mmu_box_alloc_idx(
|
||||
hevc->mmu_box,
|
||||
cur_buf_idx,
|
||||
@@ -8468,7 +8486,12 @@ int vh265_dec_status(struct vdec_s *vdec, struct vdec_info *vstatus)
|
||||
int vh265_dec_status(struct vdec_info *vstatus)
|
||||
#endif
|
||||
{
|
||||
#ifdef MULTI_INSTANCE_SUPPORT
|
||||
struct hevc_state_s *hevc =
|
||||
(struct hevc_state_s *)vdec->private;
|
||||
#else
|
||||
struct hevc_state_s *hevc = &gHevc;
|
||||
#endif
|
||||
vstatus->frame_width = hevc->frame_width;
|
||||
vstatus->frame_height = hevc->frame_height;
|
||||
if (hevc->frame_dur != 0)
|
||||
@@ -8491,9 +8514,10 @@ int vh265_dec_status(struct vdec_info *vstatus)
|
||||
vstatus->samp_cnt = gvs->samp_cnt;
|
||||
vstatus->offset = gvs->offset;
|
||||
}
|
||||
#endif
|
||||
snprintf(vstatus->vdec_name, sizeof(vstatus->vdec_name),
|
||||
"%s", DRIVER_NAME);
|
||||
#endif
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -9499,6 +9523,14 @@ static bool run_ready(struct vdec_s *vdec)
|
||||
|
||||
if (hevc->eos)
|
||||
return 0;
|
||||
if ((hevc->fatal_error &
|
||||
DECODER_FATAL_ERROR_SIZE_OVERFLOW) ||
|
||||
(hevc->fatal_error & DECODER_FATAL_ERROR_UNKNOWN)) {
|
||||
/*decoder fatal error,
|
||||
*disable run.
|
||||
*/
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (disp_vframe_valve_level &&
|
||||
kfifo_len(&hevc->display_q) >=
|
||||
|
||||
@@ -1451,10 +1451,14 @@ static int get_double_write_mode(struct VP9Decoder_s *pbi)
|
||||
u32 dw;
|
||||
if (valid_dw_mode == 0x100) {
|
||||
struct VP9_Common_s *cm = &pbi->common;
|
||||
struct PIC_BUFFER_CONFIG_s *cur_pic_config
|
||||
= &cm->cur_frame->buf;
|
||||
int w = cur_pic_config->y_crop_width;
|
||||
int h = cur_pic_config->y_crop_width;
|
||||
struct PIC_BUFFER_CONFIG_s *cur_pic_config;
|
||||
int w, h;
|
||||
|
||||
if (!cm->cur_frame)
|
||||
return 1;/*no valid frame,*/
|
||||
cur_pic_config = &cm->cur_frame->buf;
|
||||
w = cur_pic_config->y_crop_width;
|
||||
h = cur_pic_config->y_crop_width;
|
||||
if (w > 1920 && h > 1088)
|
||||
dw = 0x4; /*1:2*/
|
||||
else
|
||||
@@ -1514,6 +1518,11 @@ int vp9_alloc_mmu(
|
||||
pr_err("error no mmu box!\n");
|
||||
return -1;
|
||||
}
|
||||
if (bit_depth >= VPX_BITS_12) {
|
||||
pbi->fatal_error = DECODER_FATAL_ERROR_SIZE_OVERFLOW;
|
||||
pr_err("fatal_error, un support bit depth 12!\n\n");
|
||||
return -1;
|
||||
}
|
||||
picture_size = compute_losless_comp_body_size(pic_width, pic_height,
|
||||
bit_depth_10);
|
||||
cur_mmu_4k_number = ((picture_size + (1 << 12) - 1) >> 12);
|
||||
@@ -7435,7 +7444,7 @@ static int amvdec_vp9_probe(struct platform_device *pdev)
|
||||
platform_set_drvdata(pdev, pdata);
|
||||
#endif
|
||||
pbi->double_write_mode = double_write_mode;
|
||||
pbi->mmu_enable = !(get_double_write_mode(pbi) == 0x10);
|
||||
pbi->mmu_enable = !(pbi->double_write_mode == 0x10);
|
||||
if (amvdec_vp9_mmu_init(pbi) < 0) {
|
||||
mutex_unlock(&vvp9_mutex);
|
||||
pr_err("vp9 alloc bmmu box failed!!\n");
|
||||
@@ -8172,7 +8181,7 @@ static int ammvdec_vp9_probe(struct platform_device *pdev)
|
||||
pbi->vvp9_amstream_dec_info.rate = 30;*/
|
||||
pbi->double_write_mode = double_write_mode;
|
||||
}
|
||||
pbi->mmu_enable = !(get_double_write_mode(pbi) == 0x10);
|
||||
pbi->mmu_enable = !(pbi->double_write_mode == 0x10);
|
||||
video_signal_type = pbi->video_signal_type;
|
||||
#if 0
|
||||
pbi->buf_start = pdata->mem_start;
|
||||
|
||||
Reference in New Issue
Block a user