decoder: Fixes for Klocwork reported critical issues

This patch fixes multiple issues reported by Klockwork
static analysis tool. No functionality change introduced
with these fixes.

Signed-off-by: Gaviraju D B <x1046101@ti.com>
Signed-off-by: Megharaj A G <megharaj@ti.com>
Signed-off-by: Amit Makani <amit.makani@ti.com>
Signed-off-by: Amai Prashanth Kumar <prashanth.amai@ti.com>
Signed-off-by: Sunita Nadampalli <sunitan@ti.com>

diff --git a/driver/common/ra.c b/driver/common/ra.c
index 10af8d9cb76fcf79a9edce5a1ed740e3529859e2..40eb73650fe8748e35ea9b8200b9a1a357226b3c 100644 (file)
--- a/driver/common/ra.c
+++ b/driver/common/ra.c
@@ -257,10 +257,12 @@ static void ra_free_list_remove(struct arena *arena_arg,
        if (bt_arg->nxt_free)
                bt_arg->nxt_free->prv_free = bt_arg->prv_free;
 
-       if (!bt_arg->prv_free && index < FREE_TABLE_LIMIT)
+       if (!bt_arg->prv_free && index < FREE_TABLE_LIMIT) {
                arena_arg->head_free[index] = bt_arg->nxt_free;
-       else
+       }
+       else if (bt_arg->prv_free) {
                bt_arg->prv_free->nxt_free = bt_arg->nxt_free;
+       }
 }
 
 /*

diff --git a/driver/common/talmmu_api.c b/driver/common/talmmu_api.c
index cd925f9aba7a6c65445cb54093c2aefad48a7cea..22aaab03d792c2a6d01bb3e06da1d8d3eef4384a 100644 (file)
--- a/driver/common/talmmu_api.c
+++ b/driver/common/talmmu_api.c
@@ -355,7 +355,7 @@ int32 talmmu_devmem_ctx_create(void *devmem_tmplt_hndl,
        struct talmmu_devmem_ctx *dm_ctx;
        struct talmmu_devmem_heap *dm_heap;
        int32 i;
-       uint32 res;
+       uint32 res = IMG_SUCCESS;
 
        if (!devmem_tmplt_hndl)
                return IMG_ERROR_INVALID_PARAMETERS;

diff --git a/driver/decoder/bspp.c b/driver/decoder/bspp.c
index 7935c80e46e321cd6f757c3ba579ee151f6a92f9..5184928ac96104a13b8d94a070089cc04147a383 100644 (file)
--- a/driver/decoder/bspp.c
+++ b/driver/decoder/bspp.c
@@ -1456,13 +1456,15 @@ static int32 bspp_jump_to_next_view(struct bspp_grp_bstr_ctx *grp_btsr_ctx,
        struct bspp_bitstream_buffer *cur_buf;
        int32 result;
        uint32 i;
-       uint8 vidx = grp_btsr_ctx->current_view_idx;
+       uint8 vidx;
 
        if (!grp_btsr_ctx || !parse_state || !preparsed_data) {
                result = IMG_ERROR_INVALID_PARAMETERS;
                goto error;
        }
 
+       vidx = grp_btsr_ctx->current_view_idx;
+
        if (vidx >= VDEC_H264_MVC_MAX_VIEWS) {
                result = IMG_ERROR_NOT_SUPPORTED;
                goto error;
@@ -1698,7 +1700,7 @@ int32 bspp_stream_preparse_buffers(void *str_context_handle,
 
        /*
         * A picture currently being parsed is already decoded (may happen
-        * after dwr in low latnecy mode) and its recources were freed. Skip
+        * after dwr in low latency mode) and its recourses were freed. Skip
         * the rest of the picture.
         */
        if (pict_ctx->sequ_hdr_info &&
@@ -1776,6 +1778,12 @@ int32 bspp_stream_preparse_buffers(void *str_context_handle,
                struct bspp_bitstream_buffer *cur_buf =
                        lst_first(&str_ctx->grp_bstr_ctx.in_flight_bufs);
 
+               if(!cur_buf) {
+                       OSA_PR_ERR("%s: cur_buf pointer is NULL\n", __func__);
+                       result = IMG_ERROR_INVALID_PARAMETERS;
+                       goto error;
+               }
+
                if (str_ctx->swsr_ctx.sr_config.delim_type ==
                    SWSR_DELIM_SIZE && cur_buf->bstr_element_type ==
                    VDEC_BSTRELEMENT_CODEC_CONFIG &&

diff --git a/driver/decoder/core.c b/driver/decoder/core.c
index bc1fe350676eecefbd0d1eeb53f34d7692adfe40..4b95291a7e3bce835843968e78b9742018810c5c 100644 (file)
--- a/driver/decoder/core.c
+++ b/driver/decoder/core.c
@@ -16,6 +16,7 @@
  */
 
 #include "osal/inc/osa_mem.h"
+#include "osal/inc/osa_err.h"
 
 #include "core.h"
 #include "decoder.h"
@@ -931,6 +932,12 @@ core_free_picture_resource(struct core_stream_context *core_strctx,
 {
        int32 result = IMG_SUCCESS;
 
+       /* Check input arguments */
+       if((!core_strctx) || (!pict_resint)) {
+               VDEC_ASSERT(0);
+               return -OSA_EINVAL;
+       }
+
        result = core_free_common_picture_resource(core_strctx, pict_resint);
 
        VDEC_ASSERT(core_strctx->std_spec_ops);
@@ -3473,8 +3480,8 @@ static int32 core_hevc_bufs_get_size(struct core_stream_context *core_strctx,
        const uint32 max_tile_height_in_mbs =
                        seqhdr_info->max_frame_size.height / mb_size;
 
-       uint8 level_maj = seqhdr_info->codec_level / 30;
-       uint8 level_min = (seqhdr_info->codec_level % 30) / 3;
+       int8 level_maj = seqhdr_info->codec_level / 30;
+       int8 level_min = (seqhdr_info->codec_level % 30) / 3;
 
        /*
         * If we are somehow able to deliver more information here (CTU size,
@@ -3514,8 +3521,18 @@ static int32 core_hevc_bufs_get_size(struct core_stream_context *core_strctx,
                level_min = 2;
        }
 
-       max_slice_segments = max_slice_segments_list[level_maj - 1][level_min];
-       max_tile_cols = max_tile_cols_list[level_maj - 1][level_min];
+       if((level_maj > 0) && (level_maj <= HEVC_LEVEL_MAJOR_NUM) &&
+                       (level_min >= 0) && (level_min < HEVC_LEVEL_MINOR_NUM))
+       {
+               max_slice_segments = max_slice_segments_list[level_maj - 1][level_min];
+               max_tile_cols = max_tile_cols_list[level_maj - 1][level_min];
+       }
+       else
+       {
+               OSA_PR_ERR("%s: Invalid parameters \n", __func__);
+               return IMG_ERROR_INVALID_PARAMETERS;
+       }
+
        raw_byte_per_mb = total_sample_per_mb[pix_info->chroma_fmt_idc] *
                        VDEC_ALIGN_SIZE(bit_depth, 8, uint32, int32) / 8;
 

diff --git a/driver/decoder/decoder.c b/driver/decoder/decoder.c
index 7a66b3cf44a477179e3f3ecd7147c8366ae24db3..10ecc18da0de748299ebed07961fe8b7d4cfe7c2 100644 (file)
--- a/driver/decoder/decoder.c
+++ b/driver/decoder/decoder.c
@@ -16,6 +16,7 @@
  */
 
 #include "osal/inc/osa_mem.h"
+#include "osal/inc/osa_err.h"
 
 #include "decoder.h"
 #include "dec_resources.h"
@@ -547,8 +548,11 @@ int32 decoder_deinitialise(void *dec_ctx)
                struct dec_core_ctx *dec_core_ctx_local =
                                        dec_context->dec_core_ctx;
 
-               if (!dec_core_ctx_local)
+               if (!dec_core_ctx_local) {
                        OSA_PR_WARN("%s %d NULL Decoder context passed", __func__, __LINE__);
+                       VDEC_ASSERT(0);
+                       return -OSA_EFAULT;
+               }
 
                /* Stream list should be empty. */
                if (!lst_empty(&dec_context->str_list))
@@ -869,6 +873,11 @@ int32 decoder_stream_destroy(void *dec_str_context, uint8 abort)
 
                        res_handle_local = &dec_str_ctx_local->resources;
 
+                       if(!dec_core_ctx_local) {
+                               VDEC_ASSERT(0);
+                               return -OSA_EINVAL;
+                       }
+
                        ret =
                        hwctrl_removefrom_piclist(dec_core_ctx_local->hw_ctx,
                                                  dec_str_unit_local->dec_pict);
@@ -1048,15 +1057,15 @@ decoder_stream_decode_resource_create(struct dec_str_ctx *dec_str_context)
        int32 ret;
        uint32 mem_heap_id;
        enum sys_emem_attrib mem_attribs;
-       const struct vdecdd_dd_devconfig *dev_cfg;
 
        uint8 fw_ctx_buf = osa_false;
        uint8 h264_sgmbuf = osa_false;
 
-       VDEC_ASSERT(dec_str_context);
-       VDEC_ASSERT(dec_str_context && dec_str_context->decctx);
-       dev_cfg = dec_str_context->decctx->dev_cfg;
-       VDEC_ASSERT(dev_cfg);
+       /* Validate input arguments */
+       if((!dec_str_context) || (!dec_str_context->decctx) || (!dec_str_context->decctx->dev_cfg)) {
+               VDEC_ASSERT(0);
+               return -OSA_EINVAL;
+       }
 
        mem_heap_id = dec_str_context->decctx->internal_heap_id;
        mem_attribs = (enum sys_emem_attrib)(SYS_MEMATTRIB_UNCACHED | SYS_MEMATTRIB_WRITECOMBINE);
@@ -1378,6 +1387,11 @@ struct dec_decoded_pict *decoder_get_next_decpict_contiguous(struct dec_decoded_
        if (decoded_pict) {
                if (decoded_pict != dq_last(str_decoded_pict_list)) {
                        next_dec_pict = dq_next(decoded_pict);
+                       if(!next_dec_pict) {
+                               VDEC_ASSERT(0);
+                               return NULL;
+                       }
+
 
                        if (next_dec_pict->pict) {
                                /*
@@ -1472,8 +1486,11 @@ static int32 decoder_picture_display(struct dec_str_ctx *dec_str_ctx,
        if (ret == IMG_SUCCESS) {
                struct vdecdd_ddbuf_mapinfo *pict_buf;
 
-               VDEC_ASSERT(picture);
-               VDEC_ASSERT(picture && picture->dec_pict_info);
+               /* validate pointers */
+               if((!picture) || (!picture->dec_pict_info)) {
+                       VDEC_ASSERT(0);
+                       return -OSA_EIO;
+               }
 
                pict_buf = picture->disp_pict_buf.pict_buf;
                VDEC_ASSERT(pict_buf);
@@ -1643,13 +1660,19 @@ static int32 decoder_picture_release(struct dec_str_ctx *dec_str_ctx,
        struct vdecdd_picture *picture;
        int32 ret;
 
-       VDEC_ASSERT(dec_str_ctx);
+       /* validate input arguments */
+       if(!dec_str_ctx) {
+               VDEC_ASSERT(0);
+               return -OSA_EINVAL;
+       }
 
        ret = idgen_gethandle(dec_str_ctx->pict_idgen, pict_id,
                              (void **)&picture);
        if (ret == IMG_SUCCESS) {
-               VDEC_ASSERT(picture);
-               VDEC_ASSERT(picture && picture->dec_pict_info);
+               if((!picture) || (!picture->dec_pict_info)) {
+                       VDEC_ASSERT(0);
+                       return -OSA_EINVAL;
+               }
 
                /* Set decode order id */
                picture->dec_pict_info->decode_id = pict_id;
@@ -2056,6 +2079,12 @@ int32 decoder_stream_flush(void *dec_str_ctx_arg, uint8 discard_refs)
                while (!dq_empty(&dec_str_ctx->str_decd_pict_list)) {
                        struct dec_decoded_pict *non_decoded_pict =
                                dq_first(&dec_str_ctx->str_decd_pict_list);
+
+                       if(!non_decoded_pict) {
+                               VDEC_ASSERT(0);
+                               return -OSA_EINVAL;
+                       }
+
                        OSA_PR_INFO("[USERSID=0x%08X] Decoded picture list contains item ID:0x%08x when DPB is empty",
                                dec_str_ctx->config.user_str_id,
                                non_decoded_pict->transaction_id);
@@ -2142,6 +2171,10 @@ int32 decoder_get_load(void *dec_str_ctx_arg, uint32 *avail_slots)
        }
 
        dec_core_ctx_local = decoder_str_ctx_to_core_ctx(dec_str_ctx);
+       if(!dec_core_ctx_local)  {
+               VDEC_ASSERT(0);
+               return -OSA_EIO;
+       }
 
        if (dec_core_ctx_local->busy)
                *avail_slots = 0;
@@ -2158,12 +2191,10 @@ static int32 decoder_check_ref_errors(struct dec_str_ctx *dec_str_ctx,
        struct dec_decoded_pict *ref_pict;
        uint32 i;
 
-       VDEC_ASSERT(dec_str_ctx);
-       VDEC_ASSERT(buf_ctrl);
-       VDEC_ASSERT(picture);
        if (!dec_str_ctx || !buf_ctrl || !picture) {
                OSA_PR_ERR("[USERSID=0x%08X] Invalid parameters for checking reference lists.",
                       dec_str_ctx->config.user_str_id);
+               VDEC_ASSERT(0);
                return IMG_ERROR_INVALID_PARAMETERS;
        }
 
@@ -2242,15 +2273,19 @@ decoder_picture_decode(struct dec_str_ctx *dec_str_ctx,
        int32 ret = IMG_SUCCESS;
        struct decoder_regsoffsets regs_offsets;
 
-       VDEC_ASSERT(dec_str_ctx);
-       VDEC_ASSERT(str_unit);
-       VDEC_ASSERT(str_unit && str_unit->pict_hdr_info);
-       VDEC_ASSERT(dec_pict_ptr);
+       /* Validate input arguments */
+       if((!dec_str_ctx) || (!str_unit) || (!str_unit->pict_hdr_info) || (!dec_pict_ptr)) {
+               VDEC_ASSERT(0);
+               return -OSA_EIO;
+       }
 
        picture = (struct vdecdd_picture *)str_unit->dd_pict_data;
        dec_core_ctx = decoder_str_ctx_to_core_ctx(dec_str_ctx);
-       VDEC_ASSERT(picture);
-       VDEC_ASSERT(dec_core_ctx);
+
+       if((!picture) || (!dec_core_ctx)) {
+               VDEC_ASSERT(0);
+               return IMG_ERROR_INVALID_PARAMETERS;
+       }
 
        /* Ensure this is a new picture */
        VDEC_ASSERT(!dec_str_ctx->cur_pict);
@@ -2485,8 +2520,10 @@ decoder_stream_reference_resource_create(struct dec_str_ctx *dec_str_ctx)
        uint32 mem_heap_id;
        enum sys_emem_attrib mem_attribs;
 
-       VDEC_ASSERT(dec_str_ctx);
-       VDEC_ASSERT(dec_str_ctx && dec_str_ctx->decctx);
+       if((!dec_str_ctx) || (!dec_str_ctx->decctx)) {
+               VDEC_ASSERT(0);
+               return -OSA_EINVAL;
+       }
 
        mem_heap_id = dec_str_ctx->decctx->internal_heap_id;
        mem_attribs = (enum sys_emem_attrib)(SYS_MEMATTRIB_UNCACHED | SYS_MEMATTRIB_WRITECOMBINE);
@@ -2571,9 +2608,12 @@ static int32 decoder_picture_finalize(struct dec_str_ctx *dec_str_ctx,
        }
 
        dec_core_ctx = decoder_str_ctx_to_core_ctx(dec_str_ctx);
-       VDEC_ASSERT(dec_core_ctx);
 
-       VDEC_ASSERT(dec_core_ctx->busy);
+       if((!dec_core_ctx) || (!dec_core_ctx->busy)) {
+               VDEC_ASSERT(0);
+               return -OSA_EINVAL;
+       }
+
        dec_core_ctx->busy = osa_false;
 
        /* Picture data are now complete, nullify pointer */
@@ -2595,11 +2635,10 @@ static int32 decoder_submit_fragment(struct dec_str_ctx *dec_str_context,
        struct dec_pict_fragment *pict_fragment;
        int32 ret = IMG_SUCCESS;
 
-       VDEC_ASSERT(dec_str_context);
-
-       if (!dec_str_context->cur_pict) {
+       if ((!dec_str_context) ||(!dec_str_context->cur_pict)) {
                OSA_PR_ERR("[USERSID=0x%08X] Unable to get the current picture from Decoder context",
                       dec_str_context->config.user_str_id);
+               VDEC_ASSERT(0);
                return IMG_ERROR_GENERIC_FAILURE;
        }
 
@@ -4288,13 +4327,30 @@ int32 decoder_service_firmware_response(void *dec_str_ctx_arg, uint32 *msg,
        enum vdecdd_str_unit_type str_unit_type;
        struct vdecdd_picture *picture;
        struct decoder_pict_fragment *pict_fragment;
+       struct dec_str_ctx *dec_strctx;
+       struct dec_core_ctx *dec_core_ctx;
 
-       struct dec_str_ctx *dec_strctx =
-                       decoder_stream_get_context(dec_str_ctx_arg);
+       /* validate input arguments */
+       if((!dec_str_ctx_arg) || (!msg)) {
+               VDEC_ASSERT(0);
+               return IMG_ERROR_INVALID_PARAMETERS;
+       }
 
-       struct dec_core_ctx *dec_core_ctx =
-                       decoder_str_ctx_to_core_ctx(dec_strctx);
-       VDEC_ASSERT(dec_core_ctx);
+       dec_strctx = decoder_stream_get_context(dec_str_ctx_arg);
+
+       if(!dec_strctx) {
+               OSA_PR_ERR("%s: dec_strctx is NULL\n", __func__);
+               VDEC_ASSERT(0);
+               return IMG_ERROR_INVALID_PARAMETERS;
+       }
+
+       dec_core_ctx = decoder_str_ctx_to_core_ctx(dec_strctx);
+
+       if(!dec_core_ctx) {
+               OSA_PR_ERR("%s: dec_core_ctx is NULL\n", __func__);
+               VDEC_ASSERT(0);
+               return IMG_ERROR_INVALID_PARAMETERS;
+       }
 
        OSA_PR_DEBUG("%s : process firmware response\n",__func__);
        ret = hwctrl_process_msg(dec_core_ctx->hw_ctx, msg_flags, msg,
@@ -4320,6 +4376,11 @@ int32 decoder_service_firmware_response(void *dec_str_ctx_arg, uint32 *msg,
         */
        VDEC_ASSERT(dec_core_ctx->dec_ctx);
        dec_str_ctx = lst_first(&dec_core_ctx->dec_ctx->str_list);
+       if(!dec_str_ctx) {
+               VDEC_ASSERT(0);
+               return -OSA_EINVAL;
+       }
+
        while (dec_str_ctx) {
                if (dec_str_ctx == dec_pict->dec_str_ctx)
                        break;

diff --git a/driver/decoder/hevc_secure_parser.c b/driver/decoder/hevc_secure_parser.c
index 5abf0d4381a41c2ba0e6ec479202526214813326..ef87accc284315022762eb56b0a5d929f1b1550b 100644 (file)
--- a/driver/decoder/hevc_secure_parser.c
+++ b/driver/decoder/hevc_secure_parser.c
@@ -1511,7 +1511,7 @@ bspp_hevc_parsepps(void *sr_ctx, void *str_res, struct bspp_hevc_pps *pps)
                 * pps_multilayer_extension_flag (1)
                 * pps_extension_6bits (6)
                 */
-               if (pps->pps_range_extensions_flag) {
+               if (pps->pps_range_extensions_flag && sps) {
                        parse_err |=
                        bspp_hevc_parsepps_range_extensions(sr_ctx,
                                                            &pps->range_exts,
@@ -1521,7 +1521,7 @@ bspp_hevc_parsepps(void *sr_ctx, void *str_res, struct bspp_hevc_pps *pps)
        }
 
        /* calculate derived elements */
-       if (pps->tiles_enabled_flag)
+       if (pps->tiles_enabled_flag && sps)
                bspp_hevc_dotilecalculations(sps, pps);
 
        return parse_err;

diff --git a/driver/decoder/hw_control.c b/driver/decoder/hw_control.c
index e6d1dc8999fd421e2da47ce1dc8183409911613a..58c3c98a8b753a8bb02e4b47da1505a519b86ca5 100644 (file)
--- a/driver/decoder/hw_control.c
+++ b/driver/decoder/hw_control.c
@@ -905,14 +905,18 @@ int32 hwctrl_process_msg(void *hndl_hwctx, uint32 msg_flags, uint32 *msg,
                       struct dec_decpict **decpict)
 {
        int32 result;
-       struct hwctrl_ctx *hwctx = (struct hwctrl_ctx *)hndl_hwctx;
+       struct hwctrl_ctx *hwctx;
        enum vxd_msg_attr msg_attr = VXD_MSG_ATTR_NONE;
        struct dec_decpict *pdecpict = NULL;
        uint32 val_first = 0;
        uint32 val_sec = 0;
 
-       if (!hwctx || !msg || !decpict)
+       if (!hndl_hwctx || !msg || !decpict) {
+               VDEC_ASSERT(0);
                return IMG_ERROR_INVALID_PARAMETERS;
+       }
+
+       hwctx = (struct hwctrl_ctx *)hndl_hwctx;
 
        *decpict = NULL;
 
@@ -921,12 +925,18 @@ int32 hwctrl_process_msg(void *hndl_hwctx, uint32 msg_flags, uint32 *msg,
                                    &hwctx->pend_pict_list, msg_flags,
                                    &msg_attr, &pdecpict);
 
+       /* validate pointers before using them */
+       if((!pdecpict) || (!pdecpict->first_fld_fwmsg) || (!pdecpict->second_fld_fwmsg)) {
+               VDEC_ASSERT(0);
+               return -OSA_EIO;
+       }
+
        val_first = pdecpict->first_fld_fwmsg->pict_attrs.pict_attrs.deverror;
        val_sec = pdecpict->second_fld_fwmsg->pict_attrs.pict_attrs.deverror;
        if (pdecpict) {
                if ((pdecpict->first_fld_fwmsg && val_first) ||
                    (pdecpict->second_fld_fwmsg && val_sec))
-                       OSA_PR_ERR("device signalled critical error!!!\n");
+                       OSA_PR_ERR("device signaled critical error!!!\n");
 
                if (msg_attr == VXD_MSG_ATTR_DECODED) {
                        pdecpict->state = DECODER_PICTURE_STATE_DECODED;

diff --git a/driver/decoder/pixel_api.c b/driver/decoder/pixel_api.c
index 1843e96c8f9d89ab41e8904d52334394b1f7d666..cfca031f21e2913cacdfcd4277c5d810c2c34991 100644 (file)
--- a/driver/decoder/pixel_api.c
+++ b/driver/decoder/pixel_api.c
@@ -17,6 +17,7 @@
 
 #include "osal/inc/osa_mem.h"
 #include "osal/inc/osa_define.h"
+#include "osal/inc/osa_err.h"
 #include "img_errors.h"
 #include "img_pixfmts.h"
 #include "pixel_api.h"
@@ -878,6 +879,11 @@ int32 pixel_get_fmt_desc(enum img_pixfmt pix_fmt,
        } else {
                struct pixel_info *info =
                        pixel_get_bufinfo_from_pixfmt(pix_fmt);
+               if(!info) {
+                       VDEC_ASSERT(0);
+                       return -OSA_EINVAL;
+               }
+
                pixel_yuv_get_descriptor_int(info, pix_desc);
        }
 

diff --git a/driver/decoder/swsr.c b/driver/decoder/swsr.c
index bfe8e78e4371b54d94b23736e438cec0d82bb29e..c5ffcd25aad43a4122b4bf27a0a8be1c9a746944 100644 (file)
--- a/driver/decoder/swsr.c
+++ b/driver/decoder/swsr.c
@@ -16,7 +16,9 @@
  */
 
 #include "osal/inc/osa_define.h"
+#include "osal/inc/osa_err.h"
 #include "swsr.h"
+#include "vdec_defs.h"
 
 #define NBIT_8BYTE_MASK(n)    (((uint64)1 << (n)) - 1)
 
@@ -718,17 +720,19 @@ uint32 swsr_read_onebit(void *ctx_hndl)
        uint32 bitread;
 
        /* Validate input arguments. */
-       if (!ctx) {
-               OSA_PR_ERR("Invalid arguments to function: %s\n", __func__);
-               return IMG_ERROR_INVALID_PARAMETERS;
+       if(!ctx_hndl) {
+               VDEC_ASSERT(0);
+               return OSA_EIO;
        }
 
+       ctx = (struct swsr_context *)ctx_hndl;
+
        if (!ctx->initialised) {
                OSA_PR_ERR("SWSR not yet initialised: %s\n", __func__);
                return IMG_ERROR_NOT_INITIALISED;
        }
 
-       /* Optimise with inline code (specific version of call below). */
+       /* Optimize with inline code (specific version of call below). */
        bitread = swsr_read_bits(ctx, 1);
 
        return bitread;
@@ -736,10 +740,18 @@ uint32 swsr_read_onebit(void *ctx_hndl)
 
 uint32 swsr_read_bits(void *ctx_hndl, uint32 no_bits)
 {
-       struct swsr_context *ctx = (struct swsr_context *)ctx_hndl;
+       struct swsr_context *ctx;
 
        /* Validate input arguments. */
-       if (!ctx || !ctx->initialised) {
+       if(!ctx_hndl) {
+               VDEC_ASSERT(0);
+               return OSA_EIO;
+       }
+
+       ctx = (struct swsr_context *)ctx_hndl;
+
+       /* Validate input arguments. */
+       if (!ctx->initialised) {
                OSA_PR_ERR("%s: Invalid SWSR context\n", __func__);
                ctx->exception = SWSR_EXCEPT_INVALID_CONTEXT;
                ctx->exception_handler_fxn(ctx->exception, ctx->pexception_param);
@@ -760,11 +772,19 @@ uint32 swsr_read_bits(void *ctx_hndl, uint32 no_bits)
 
 int32 swsr_read_signedbits(void *ctx_hndl, uint32 no_bits)
 {
-       struct swsr_context *ctx = (struct swsr_context *)ctx_hndl;
+       struct swsr_context *ctx;
        int32 outbits = 0;
 
        /* Validate input arguments. */
-       if (!ctx || !ctx->initialised) {
+       if(!ctx_hndl) {
+               VDEC_ASSERT(0);
+               return -OSA_EIO;
+       }
+
+       ctx = (struct swsr_context *)ctx_hndl;
+
+       /* Check if the context has been initialized. */
+       if (!ctx->initialised) {
                OSA_PR_ERR("%s: Invalid SWSR context\n", __func__);
                ctx->exception = SWSR_EXCEPT_INVALID_CONTEXT;
                ctx->exception_handler_fxn(ctx->exception, ctx->pexception_param);
@@ -786,10 +806,18 @@ int32 swsr_read_signedbits(void *ctx_hndl, uint32 no_bits)
 
 uint32 swsr_peekbits(void *ctx_hndl, uint32 no_bits)
 {
-       struct swsr_context *ctx = (struct swsr_context *)ctx_hndl;
+       struct swsr_context *ctx;
+
+       /* validate input parameters */
+       if(!ctx_hndl) {
+               VDEC_ASSERT(0);
+               return OSA_EIO;
+       }
+
+       ctx = (struct swsr_context *)ctx_hndl;
 
        /* Validate input arguments. */
-       if (!ctx || !ctx->initialised) {
+       if (!ctx->initialised) {
                OSA_PR_ERR("%s: Invalid SWSR context\n", __func__);
                ctx->exception = SWSR_EXCEPT_INVALID_CONTEXT;
                ctx->exception_handler_fxn(ctx->exception, ctx->pexception_param);
@@ -1425,7 +1453,10 @@ int32 swsr_initialise(swsr_except_handler_fxn exception_handler_fxn,
 
        /* Allocate and initialise shift-register context */
        ctx = osa_zalloc(sizeof(*ctx), OSA_GFP_KERNEL);
-       SWSR_ASSERT(ctx);
+       if(!ctx) {
+               VDEC_ASSERT(0);
+               return -OSA_EINVAL;
+       }
 
        /* Setup shift-register context */
        ctx->exception_handler_fxn = exception_handler_fxn;

diff --git a/driver/decoder/vdecdd_utils_buf.c b/driver/decoder/vdecdd_utils_buf.c
index a2070127008a235cda357537516f7d6e2408c08e..a428f21c008d552497a27e89bdf3a4c2dc77a481 100644 (file)
--- a/driver/decoder/vdecdd_utils_buf.c
+++ b/driver/decoder/vdecdd_utils_buf.c
@@ -153,7 +153,7 @@ int32 vdecddutils_ref_pic_hevc_get_maxnum(const struct vdec_comsequ_hdrinfo *com
        uint32 pic_size_in_samples_Y = comseq_hdrinfo->frame_size.height *
                                        comseq_hdrinfo->frame_size.width;
 
-       uint8 level_maj, level_min;
+       int8 level_maj, level_min;
        uint32 max_luma_ps;
 
        /* some error resilience */
@@ -169,8 +169,15 @@ int32 vdecddutils_ref_pic_hevc_get_maxnum(const struct vdec_comsequ_hdrinfo *com
 
        level_maj = comseq_hdrinfo->codec_level / 30;
        level_min = (comseq_hdrinfo->codec_level % 30) / 3;
-       VDEC_ASSERT(level_maj > 0);
-       max_luma_ps = max_luma_ps_list[level_maj - 1][level_min];
+
+       if((level_maj > 0) && (level_maj <= HEVC_LEVEL_MAJOR_NUM) &&
+                       (level_min >= 0) && (level_min < HEVC_LEVEL_MINOR_NUM)) {
+               max_luma_ps = max_luma_ps_list[level_maj - 1][level_min];
+       }
+       else {
+               OSA_PR_ERR("%s: Invalid parameters \n", __func__);
+               return IMG_ERROR_INVALID_PARAMETERS;
+       }
 
        if (max_luma_ps == 0) {
                OSA_PR_ERR("Wrong HEVC level value: %u.%u (general_level_idc: %u)",
@@ -599,7 +606,7 @@ vdecddutils_get_render_info(const struct vdec_str_configdata *str_cfg_data,
        struct img_pixfmt_desc  pixfmt;
        struct vdec_pict_size   coded_pict_size;
        uint8   single_stride = osa_false;
-       uint32  vert_sample[IMG_MAX_NUM_PLANES];
+       uint32  vert_sample[IMG_MAX_NUM_PLANES] = {0};
        uint32  total_vert_samples;
        uint32  largest_stride;
        uint32  result;

diff --git a/driver/decoder/vxd_core.c b/driver/decoder/vxd_core.c
index 30f158d1f8ddcac84f94973789cc2f028c1fe208..b959f94b24be87fb7a36015f9fb166a5cc8de299 100644 (file)
--- a/driver/decoder/vxd_core.c
+++ b/driver/decoder/vxd_core.c
@@ -1233,11 +1233,11 @@ void vxd_deinit(struct vxd_dev *vxd)
        osa_cancel_delayed_work_sync(vxd->dwork);
        vxd_make_hw_off_locked(vxd, osa_false);
 
-       /* Deallocate rendec buffer */
-       img_mem_free(vxd_drv.mem_ctx, vxd->rendec_buf_id);
-
        /* Destroy memory management context */
        if (vxd_drv.mem_ctx) {
+               /* Deallocate rendec buffer */
+               img_mem_free(vxd_drv.mem_ctx, vxd->rendec_buf_id);
+
                img_mem_destroy_ctx(vxd_drv.mem_ctx);
                vxd_drv.mem_ctx = NULL;
        }
@@ -1443,7 +1443,7 @@ int32 vxd_send_msg(struct vxd_dec_ctx *ctx, struct vxd_fw_msg *msg)
                goto out_unlock;
        }
 
-       item = osa_malloc(sizeof(*item) + msg->payload_size, OSA_GFP_KERNEL);
+       item = (struct vxd_item *)osa_malloc(sizeof(*item) + msg->payload_size, OSA_GFP_KERNEL);
        if (!item) {
                ret = -OSA_ENOMEM;
                goto out_unlock;

diff --git a/osal/src/tirtos/osa_time.c b/osal/src/tirtos/osa_time.c
index 87025510a872a072bd77e85292b890ff735df7d0..d81a5c56bfba54fe56480c315cb6bb2b2068f0af 100644 (file)
--- a/osal/src/tirtos/osa_time.c
+++ b/osal/src/tirtos/osa_time.c
@@ -91,11 +91,9 @@ void osa_getnstimeofday(struct osa_timespec *ts_args)
 void osa_timespec_sub(struct osa_timespec *end_time, struct osa_timespec *start_time, struct osa_timespec *dif_time)
 {
 
-       if(end_time->ts >= start_time->ts)
-       {
+       if(end_time->ts >= start_time->ts) {
                dif_time->ts = end_time->ts - start_time->ts;
-       }else
-       {
+       }else {
                dif_time->ts = end_time->ts + (0xFFFFFFFFFFFFFFFFU - start_time->ts);
        }
 }

diff --git a/osal/src/tirtos/osa_workqueue.c b/osal/src/tirtos/osa_workqueue.c
index a8936d977c2228a14003aef845add2c11c939162..f319b1a07a6caf430ea25d20701134cbb3daa5f2 100644 (file)
--- a/osal/src/tirtos/osa_workqueue.c
+++ b/osal/src/tirtos/osa_workqueue.c
@@ -171,13 +171,12 @@ int32 osa_cancel_delayed_work_sync(void *dwork)
                osa_utils_quereset(work->queue_handle);
                work->work_complete = TRUE;
                osa_utils_queput(work->queue_handle, work, (uint32)osa_semaphore_wait_forever);
-               SemaphoreP_pend(work->workq_sem_handle, SemaphoreP_WAIT_FOREVER);
-       }
 
-       timerStatus = TimerP_delete(work->timer_handle);
-       if(timerStatus != TimerP_OK)
-       {
-               OSA_PR_ERR("%s : Timer delete error \n", __func__);
+               timerStatus = TimerP_delete(work->timer_handle);
+               if(timerStatus != TimerP_OK)
+               {
+                       OSA_PR_ERR("%s : Timer delete error \n", __func__);
+               }
        }
 
        return 0;

diff --git a/timmlib/decoder/mm_dec_create.c b/timmlib/decoder/mm_dec_create.c
index 3b209a034f06dc06e5efe8c8da08cd5852746471..a40e1b69e38119196980fe26dbf47ebb0144b27b 100644 (file)
--- a/timmlib/decoder/mm_dec_create.c
+++ b/timmlib/decoder/mm_dec_create.c
@@ -43,8 +43,10 @@ static int32 vxd_dec_s_fmt(struct mm_vxd_dec_fmt *pix_mp, uint32 chId)
 
        q_data = get_q_data(ctx, pix_mp->fmt->type);
 
-       if (!q_data)
+       if (!q_data) {
+               VDEC_ASSERT(0);
                return -OSA_EINVAL;
+       }
 
        /*
         * saving the orignal dimensions to pass to gstreamer (to remove the green
@@ -180,8 +182,8 @@ static int32 vxd_dec_s_fmt(struct mm_vxd_dec_fmt *pix_mp, uint32 chId)
 
 int32_t MM_DEC_BufPrepare(struct mm_buffer *buffer, uint32_t chId)
 {
-       struct vxd_dec_ctx *ctx = g_MM_DEC_Inst.ch_obj[chId].mm_ctx;
-       mm_vxd_buff *mm_buf = g_MM_DEC_Inst.ch_obj[chId].mm_buf;
+       struct vxd_dec_ctx *ctx = NULL;
+       mm_vxd_buff *mm_buf = NULL;
        struct vxd_dec_q_data *q_data;
        int32 plane, num_planes, ret = 0;
        struct vxd_buffer *buf;
@@ -197,6 +199,9 @@ int32_t MM_DEC_BufPrepare(struct mm_buffer *buffer, uint32_t chId)
                return -OSA_EFAULT;
        }
 
+       ctx = g_MM_DEC_Inst.ch_obj[chId].mm_ctx;
+       mm_buf = g_MM_DEC_Inst.ch_obj[chId].mm_buf;
+
        if (buffer->chId != chId)
        {
                buffer->chId = chId;
@@ -206,7 +211,7 @@ int32_t MM_DEC_BufPrepare(struct mm_buffer *buffer, uint32_t chId)
        vxd_buf = vxd_get_buf(buffer, chId);
        if (vxd_buf != NULL)
        {
-               //OSA_PR_ERR("%s:This buffer is already mapped\n",__func__);
+               OSA_PR_ERR("%s:This buffer is already mapped\n",__func__);
                return 0;
        }
 
@@ -623,11 +628,11 @@ exit:
 
 int32_t MM_DEC_Destroy(uint32_t chId)
 {
-       struct vxd_dec_ctx *ctx = g_MM_DEC_Inst.ch_obj[chId].mm_ctx;
-       mm_vxd_buff *mm_buf = g_MM_DEC_Inst.ch_obj[chId].mm_buf;
-       struct vxd_dev *vxd = ctx->dev;
-       struct bspp_ddbuf_array_info *fw_sequ = ctx->fw_sequ;
-       struct bspp_ddbuf_array_info *fw_pps = ctx->fw_pps;
+       struct vxd_dec_ctx *ctx;
+       mm_vxd_buff *mm_buf;
+       struct vxd_dev *vxd;
+       struct bspp_ddbuf_array_info *fw_sequ;
+       struct bspp_ddbuf_array_info *fw_pps;
        int32 i, ret = 0;
        struct vxd_dec_q_data *s_q_data;
 
@@ -637,6 +642,12 @@ int32_t MM_DEC_Destroy(uint32_t chId)
                return -OSA_EFAULT;
        }
 
+       ctx = g_MM_DEC_Inst.ch_obj[chId].mm_ctx;
+       mm_buf = g_MM_DEC_Inst.ch_obj[chId].mm_buf;
+       vxd = ctx->dev;
+       fw_sequ = ctx->fw_sequ;
+       fw_pps = ctx->fw_pps;
+
        s_q_data = &ctx->q_data[Q_DATA_SRC];
 
        if (ctx->stream_created) {
@@ -706,7 +717,7 @@ void vxd_dec_return_all_buffers(struct vxd_dec_ctx *ctx)
 int32_t MM_DEC_StartStreaming(uint32_t chId, mm_buffertype type)
 {
        int32 ret = 0;
-       struct vxd_dec_ctx *ctx = g_MM_DEC_Inst.ch_obj[chId].mm_ctx;
+       struct vxd_dec_ctx *ctx;
 
        if (chId >= MAX_NUM_CHANNELS)
        {
@@ -714,6 +725,8 @@ int32_t MM_DEC_StartStreaming(uint32_t chId, mm_buffertype type)
                return -OSA_EFAULT;
        }
 
+       ctx = g_MM_DEC_Inst.ch_obj[chId].mm_ctx;
+
        if (MM_TYPE_IS_OUTPUT(type))
                ctx->dst_streaming = osa_true;
        else
@@ -737,7 +750,7 @@ int32_t MM_DEC_StartStreaming(uint32_t chId, mm_buffertype type)
 
 int32_t MM_DEC_StopStreaming(uint32_t chId, mm_buffertype type)
 {
-       struct vxd_dec_ctx *ctx = g_MM_DEC_Inst.ch_obj[chId].mm_ctx;
+       struct vxd_dec_ctx *ctx;
 
        struct clist_head *list;
        struct clist_head *temp;
@@ -749,6 +762,8 @@ int32_t MM_DEC_StopStreaming(uint32_t chId, mm_buffertype type)
                return -OSA_EFAULT;
        }
 
+       ctx = g_MM_DEC_Inst.ch_obj[chId].mm_ctx;
+
        if (ctx->num_decoding) {
                OSA_PR_INFO("buffers are still being decoded, so waiting for complete!\n");
                ctx->stop_initiated = osa_true;

diff --git a/timmlib/decoder/mm_dec_process.c b/timmlib/decoder/mm_dec_process.c
index 465cc8dfda2d56cc07fd2cf67e2c9f7e116f1882..d1044e0e9f13f011db8fcabe261119c541d704dd 100644 (file)
--- a/timmlib/decoder/mm_dec_process.c
+++ b/timmlib/decoder/mm_dec_process.c
@@ -30,8 +30,8 @@
 int32_t MM_DEC_Process(struct mm_buffer *in_buf,
                struct mm_buffer *out_buf, uint32_t chId)
 {
-       struct vxd_dec_ctx *ctx = g_MM_DEC_Inst.ch_obj[chId].mm_ctx;
-       struct vxd_dev *vxd_dev = ctx->dev;
+       struct vxd_dec_ctx *ctx = NULL;
+       struct vxd_dev *vxd_dev = NULL;
        struct vxd_buffer *src_vxdb;
        struct vxd_buffer *dst_vxdb;
        struct bspp_bitstr_seg *item = NULL, *next = NULL;
@@ -47,6 +47,9 @@ int32_t MM_DEC_Process(struct mm_buffer *in_buf,
                return -OSA_EFAULT;
        }
 
+       ctx = g_MM_DEC_Inst.ch_obj[chId].mm_ctx;
+       vxd_dev = ctx->dev;
+
        if (in_buf->chId != chId)
        {
                in_buf->chId = chId;
@@ -208,7 +211,7 @@ int32_t MM_DEC_RegisterCb(
                void (*mm_ret_resource)(struct mm_buffer *buf, mm_process_cb cb_type),
                uint32_t chId)
 {
-       struct vxd_dec_ctx *ctx = g_MM_DEC_Inst.ch_obj[chId].mm_ctx;
+       struct vxd_dec_ctx *ctx = NULL;
 
        if (chId >= MAX_NUM_CHANNELS)
        {
@@ -216,6 +219,8 @@ int32_t MM_DEC_RegisterCb(
                return -OSA_EFAULT;
        }
 
+       ctx = g_MM_DEC_Inst.ch_obj[chId].mm_ctx;
+
        if(mm_ret_resource == NULL)
                return -1;