[Decode] VC1 PSIRT FIX

This patch is to fix psirt issue on VC1 It should align the size of slice record buffer and number of slice to avoid memory access out of bound.
intel · Dec 28, 2023 · 10c376f · 10c376f
1 parent 5c70abc
commit 10c376f
Show file tree

Hide file tree

Showing 2 changed files with 29 additions and 8 deletions.
diff --git a/media_driver/agnostic/common/codec/hal/codechal_decode_vc1.cpp b/media_driver/agnostic/common/codec/hal/codechal_decode_vc1.cpp
@@ -750,7 +750,7 @@ void CodechalDecodeVc1::PackMotionVectors(
     }
     else
     {
-        // default settings for frame pictures, relevant MVs will be reset if needed
+        // default settings for frame pictures, relevant Motion Vectors will be reset if needed
         packedLumaMvs[0] = packedLumaMvs[2] = packedLumaMvs[4] = packedLumaMvs[6] = (int16_t)mv[CodechalDecodeRstFirstForwHorz];
         packedLumaMvs[1] = packedLumaMvs[3] = packedLumaMvs[5] = packedLumaMvs[7] = (int16_t)mv[CodechalDecodeRstFirstForwVert];
 
@@ -2918,9 +2918,6 @@ MOS_STATUS CodechalDecodeVc1::AllocateResources()
         m_vc1RefList,
         CODECHAL_NUM_UNCOMPRESSED_SURFACE_VC1));
 
-    m_vldSliceRecord =
-        (PCODECHAL_VC1_VLD_SLICE_RECORD)MOS_AllocAndZeroMemory(m_picHeightInMb * sizeof(CODECHAL_VC1_VLD_SLICE_RECORD));
-
     // Second level batch buffer for IT mode
     if (m_mode == CODECHAL_DECODE_MODE_VC1IT)
     {
@@ -3041,6 +3038,7 @@ CodechalDecodeVc1::~CodechalDecodeVc1()
     CodecHalFreeDataList(m_vc1RefList, CODECHAL_NUM_UNCOMPRESSED_SURFACE_VC1);
 
     MOS_FreeMemory(m_vldSliceRecord);
+    m_vldSliceRecord = nullptr;
 
     Mhw_FreeBb(m_osInterface, &m_itObjectBatchBuffer, nullptr);
 
@@ -3122,6 +3120,28 @@ MOS_STATUS CodechalDecodeVc1::SetFrameStates()
     if (CodecHalIsDecodeModeVLD(m_mode))
     {
         CODECHAL_DECODE_CHK_NULL_RETURN(m_vc1SliceParams);
+        uint32_t numSliceRecord  = 0;
+        bool     invalidSliceNum = false;
+
+        numSliceRecord = m_numMacroblocks;
+        if (m_numSlices > m_numMacroblocks)
+        {
+            numSliceRecord  = m_numSlices;
+            invalidSliceNum = true;
+        }
+
+        if (numSliceRecord > m_numVldSliceRecord || m_vldSliceRecord == nullptr)
+        {
+            MOS_SafeFreeMemory(m_vldSliceRecord);
+            m_vldSliceRecord =
+                (PCODECHAL_VC1_VLD_SLICE_RECORD)MOS_AllocAndZeroMemory(numSliceRecord * sizeof(CODECHAL_VC1_VLD_SLICE_RECORD));
+            CODECHAL_DECODE_CHK_NULL_RETURN(m_vldSliceRecord);
+            m_numVldSliceRecord = numSliceRecord;
+        }
+        else
+        {
+            MOS_ZeroMemory(m_vldSliceRecord, m_numVldSliceRecord * sizeof(CODECHAL_VC1_VLD_SLICE_RECORD));
+        }
     }
     else if (CodecHalIsDecodeModeIT(m_mode))
     {

diff --git a/media_driver/agnostic/common/codec/hal/codechal_decode_vc1.h b/media_driver/agnostic/common/codec/hal/codechal_decode_vc1.h
@@ -743,6 +743,7 @@ class CodechalDecodeVc1 : public CodechalDecode
     MOS_RESOURCE                   m_resBsdMpcRowStoreScratchBuffer;                     //!< Handle of BSD/MPC Row Store Scratch data surface
     MOS_RESOURCE                   m_resVc1BsdMvData[CODECHAL_DECODE_VC1_DMV_MAX];       //!< Handle of VC1 BSD MV Data
     PCODECHAL_VC1_VLD_SLICE_RECORD m_vldSliceRecord = nullptr;                           //!< [VLD mode] Slice record
+    uint32_t                       m_numVldSliceRecord = 0;
     PCODEC_REF_LIST                m_vc1RefList[CODECHAL_NUM_UNCOMPRESSED_SURFACE_VC1];  //!< VC1 Reference List
     MOS_RESOURCE                   m_resSyncObject;                                      //!< Handle of Sync Object
     MOS_RESOURCE                   m_resPrivateBistreamBuffer;                           //!< Handle of Private Bistream Buffer
@@ -901,19 +902,19 @@ class CodechalDecodeVc1 : public CodechalDecode
     void PackMotionVectorsChroma4MvP(uint16_t intraFlags, int16_t *lmv, int16_t *cmv);
 
     //!
-    //! \brief    Find Median for 3 MVs
+    //! \brief    Find Median for 3 Motion Vectors
     //! \param    [in] mv#
     //!           Motion Vectors
     //! \return   int16_t
-    //!           return median for 3 MVs
+    //!           return median for 3 Motion Vectors
     //!
     int16_t PackMotionVectorsMedian3(int16_t mv1, int16_t mv2, int16_t mv3);
     //!
-    //! \brief    Find Median for 4 MVs
+    //! \brief    Find Median for 4 Motion Vectors
     //! \param    [in] mv#
     //!           Motion Vectors
     //! \return   int16_t
-    //!           return median for 4 MVs
+    //!           return median for 4 Motion Vectors
     //!
     int16_t PackMotionVectorsMedian4(int16_t mv1, int16_t mv2, int16_t mv3, int16_t mv4);