media: vicodec: Handle the case that the reference buffer is NULL

In the stateless decoder the reference buffer is null if the
frame is an I-frame (flagged with FWHT_FL_I_FRAME).
Make sure not to dereference it in that case.

Signed-off-by: Dafna Hirschfeld <dafna3@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

diff --git a/drivers/media/platform/vicodec/codec-fwht.c b/drivers/media/platform/vicodec/codec-fwht.c
index 5d3e844d2802586bbcafa65f927ff993eae5c8c8..31faf319e50872cf495a080efedd0d43d7a66110 100644 (file)
--- a/drivers/media/platform/vicodec/codec-fwht.c
+++ b/drivers/media/platform/vicodec/codec-fwht.c
@@ -841,6 +841,7 @@ static bool decode_plane(struct fwht_cframe *cf, const __be16 **rlco,
        s16 copy[8 * 8];
        u16 stat;
        unsigned int i, j;
+       bool is_intra = !ref;
 
        width = round_up(width, 8);
        height = round_up(height, 8);
@@ -872,7 +873,7 @@ static bool decode_plane(struct fwht_cframe *cf, const __be16 **rlco,
 
                        if (copies) {
                                memcpy(cf->de_fwht, copy, sizeof(copy));
-                               if (stat & PFRAME_BIT)
+                               if ((stat & PFRAME_BIT) && !is_intra)
                                        add_deltas(cf->de_fwht, refp,
                                                   ref_stride, ref_step);
                                fill_decoder_block(dstp, cf->de_fwht,
@@ -884,18 +885,18 @@ static bool decode_plane(struct fwht_cframe *cf, const __be16 **rlco,
                        stat = derlc(rlco, cf->coeffs, end_of_rlco_buf);
                        if (stat & OVERFLOW_BIT)
                                return false;
-                       if (stat & PFRAME_BIT)
+                       if ((stat & PFRAME_BIT) && !is_intra)
                                dequantize_inter(cf->coeffs);
                        else
                                dequantize_intra(cf->coeffs);
 
                        ifwht(cf->coeffs, cf->de_fwht,
-                             (stat & PFRAME_BIT) ? 0 : 1);
+                             ((stat & PFRAME_BIT) && !is_intra) ? 0 : 1);
 
                        copies = (stat & DUPS_MASK) >> 1;
                        if (copies)
                                memcpy(copy, cf->de_fwht, sizeof(copy));
-                       if (stat & PFRAME_BIT)
+                       if ((stat & PFRAME_BIT) && !is_intra)
                                add_deltas(cf->de_fwht, refp,
                                           ref_stride, ref_step);
                        fill_decoder_block(dstp, cf->de_fwht, dst_stride,

diff --git a/drivers/media/platform/vicodec/codec-v4l2-fwht.c b/drivers/media/platform/vicodec/codec-v4l2-fwht.c
index 372ed95e1a1f51a64a5c8d22d43248ec822126d9..01e7f09efc4e2ebc4d16dadf74c7c6170ef4824c 100644 (file)
--- a/drivers/media/platform/vicodec/codec-v4l2-fwht.c
+++ b/drivers/media/platform/vicodec/codec-v4l2-fwht.c
@@ -99,6 +99,17 @@ static int prepare_raw_frame(struct fwht_raw_frame *rf,
        rf->alpha = NULL;
        rf->components_num = info->components_num;
 
+       /*
+        * The buffer is NULL if it is the reference
+        * frame of an I-frame in the stateless decoder
+        */
+       if (!buf) {
+               rf->luma = NULL;
+               rf->cb = NULL;
+               rf->cr = NULL;
+               rf->alpha = NULL;
+               return 0;
+       }
        switch (info->id) {
        case V4L2_PIX_FMT_GREY:
                rf->cb = NULL;