@@ -1578,6 +1578,8 @@ static int hevc_d_h265_setup(struct hevc_d_ctx *ctx, struct hevc_d_run *run)
15781578 bool slice_temporal_mvp ;
15791579 unsigned int ctb_size_y ;
15801580 bool sps_changed = false;
1581+ /* Old (downstream only) bit size meanings */
1582+ bool old_bits = false;
15811583
15821584 de = dec_env_new (ctx );
15831585 if (!de ) {
@@ -1646,6 +1648,7 @@ static int hevc_d_h265_setup(struct hevc_d_ctx *ctx, struct hevc_d_run *run)
16461648 de -> chroma_stride = de -> luma_stride ;
16471649 de -> frame_chroma_addr = de -> frame_luma_addr +
16481650 (ctx -> dst_fmt .height * 128 );
1651+ old_bits = true;
16491652 break ;
16501653 }
16511654
@@ -1776,15 +1779,24 @@ static int hevc_d_h265_setup(struct hevc_d_ctx *ctx, struct hevc_d_run *run)
17761779 for (i = 0 ; i != run -> h265 .slice_ents ; ++ i ) {
17771780 const struct v4l2_ctrl_hevc_slice_params * const sh = sh0 + i ;
17781781 const bool last_slice = i + 1 == run -> h265 .slice_ents ;
1779- const u32 byte_size = DIV_ROUND_UP (sh -> bit_size , 8 );
1782+ unsigned int bit_size = old_bits ? sh -> bit_size - 8 * sh -> data_byte_offset :
1783+ sh -> bit_size ;
1784+ const u32 byte_size = DIV_ROUND_UP (bit_size , 8 );
17801785 unsigned int j ;
17811786
17821787 s -> sh = sh ;
17831788
1789+ if (old_bits && sh -> bit_size <= 8 * sh -> data_byte_offset ) {
1790+ v4l2_warn (& dev -> v4l2_dev ,
1791+ "data_byte_offset %d * 8 >= bits %d\n" ,
1792+ sh -> data_byte_offset , sh -> bit_size );
1793+ goto fail ;
1794+ }
1795+
17841796 if (sh -> data_byte_offset + byte_size > run -> src -> planes [0 ].bytesused ) {
17851797 v4l2_warn (& dev -> v4l2_dev ,
17861798 "data_byte_offset %d + bits %d (= %d bytes) > bytesused %d\n" ,
1787- sh -> data_byte_offset , sh -> bit_size , byte_size ,
1799+ sh -> data_byte_offset , bit_size , byte_size ,
17881800 run -> src -> planes [0 ].bytesused );
17891801 goto fail ;
17901802 }
@@ -1794,7 +1806,7 @@ static int hevc_d_h265_setup(struct hevc_d_ctx *ctx, struct hevc_d_run *run)
17941806 * actual size of the buffer (which may well be what is used to set
17951807 * bit_size if the caller isn't being very pedantic).
17961808 */
1797- s -> data_len = min (sh -> bit_size / 8 + 1 ,
1809+ s -> data_len = min (bit_size / 8 + 1 ,
17981810 run -> src -> planes [0 ].bytesused - sh -> data_byte_offset );
17991811
18001812 s -> slice_qp = 26 + s -> pps .init_qp_minus26 + sh -> slice_qp_delta ;
0 commit comments