Commit message: None
CVE: CVE-2016-3881
CWE: CWE-119
Vulnerability description: The decoder_peek_si_internal function in vp9/vp9_dx_iface.c in libvpx in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allows remote attackers to cause a denial of service (buffer over-read, and device hang or reboot) via a crafted media file, aka internal bug 30013856.

Project: Android

static INLINE void check_resync(vpx_codec_alg_priv_t *const ctx,
 const VP9Decoder *const pbi) {
 if (ctx->need_resync == 1 && pbi->need_resync == 0 &&
 (pbi->common.intra_only || pbi->common.frame_type == KEY_FRAME))
    ctx->need_resync = 0;
}

Project: Android

static vpx_codec_err_t ctrl_copy_reference(vpx_codec_alg_priv_t *ctx,
                                           va_list args) {
 vpx_ref_frame_t *data = va_arg(args, vpx_ref_frame_t *);

 if (ctx->frame_parallel_decode) {
    set_error_detail(ctx, "Not supported in frame parallel decode");
 return VPX_CODEC_INCAPABLE;
 }

 if (data) {
 vpx_ref_frame_t *frame = (vpx_ref_frame_t *) data;
    YV12_BUFFER_CONFIG sd;
 VPxWorker *const worker = ctx->frame_workers;
 FrameWorkerData *const frame_worker_data = (FrameWorkerData *)worker->data1;
    image2yuvconfig(&frame->img, &sd);
 return vp9_copy_reference_dec(frame_worker_data->pbi,
 (VP9_REFFRAME)frame->frame_type, &sd);
 } else {
 return VPX_CODEC_INVALID_PARAM;
 }
}

Project: Android

static vpx_codec_err_t ctrl_get_frame_corrupted(vpx_codec_alg_priv_t *ctx,
                                                va_list args) {
 int *corrupted = va_arg(args, int *);

 if (corrupted) {
 if (ctx->frame_workers) {
 VPxWorker *const worker = ctx->frame_workers;
 FrameWorkerData *const frame_worker_data =
 (FrameWorkerData *)worker->data1;
 RefCntBuffer *const frame_bufs =
          frame_worker_data->pbi->common.buffer_pool->frame_bufs;
 if (frame_worker_data->pbi->common.frame_to_show == NULL)
 return VPX_CODEC_ERROR;
 if (ctx->last_show_frame >= 0)
 *corrupted = frame_bufs[ctx->last_show_frame].buf.corrupted;
 return VPX_CODEC_OK;
 } else {
 return VPX_CODEC_ERROR;
 }
 }

 return VPX_CODEC_INVALID_PARAM;
}

Project: Android

static vpx_codec_err_t ctrl_get_frame_size(vpx_codec_alg_priv_t *ctx,
                                           va_list args) {
 int *const frame_size = va_arg(args, int *);

 if (ctx->frame_parallel_decode) {
    set_error_detail(ctx, "Not supported in frame parallel decode");
 return VPX_CODEC_INCAPABLE;
 }

 if (frame_size) {
 if (ctx->frame_workers) {
 VPxWorker *const worker = ctx->frame_workers;
 FrameWorkerData *const frame_worker_data =
 (FrameWorkerData *)worker->data1;
 const VP9_COMMON *const cm = &frame_worker_data->pbi->common;
      frame_size[0] = cm->width;
      frame_size[1] = cm->height;
 return VPX_CODEC_OK;
 } else {
 return VPX_CODEC_ERROR;
 }
 }

 return VPX_CODEC_INVALID_PARAM;
}

Project: Android

static vpx_codec_err_t ctrl_get_last_ref_updates(vpx_codec_alg_priv_t *ctx,
                                                 va_list args) {
 int *const update_info = va_arg(args, int *);

 if (ctx->frame_parallel_decode) {
    set_error_detail(ctx, "Not supported in frame parallel decode");
 return VPX_CODEC_INCAPABLE;
 }

 if (update_info) {
 if (ctx->frame_workers) {
 VPxWorker *const worker = ctx->frame_workers;
 FrameWorkerData *const frame_worker_data =
 (FrameWorkerData *)worker->data1;
 *update_info = frame_worker_data->pbi->refresh_frame_flags;
 return VPX_CODEC_OK;
 } else {
 return VPX_CODEC_ERROR;
 }
 }

 return VPX_CODEC_INVALID_PARAM;
}

Project: Android

static vpx_codec_err_t ctrl_get_reference(vpx_codec_alg_priv_t *ctx,
                                          va_list args) {
 vp9_ref_frame_t *data = va_arg(args, vp9_ref_frame_t *);

 if (ctx->frame_parallel_decode) {
    set_error_detail(ctx, "Not supported in frame parallel decode");
 return VPX_CODEC_INCAPABLE;
 }

 if (data) {
    YV12_BUFFER_CONFIG* fb;
 VPxWorker *const worker = ctx->frame_workers;
 FrameWorkerData *const frame_worker_data = (FrameWorkerData *)worker->data1;
    fb = get_ref_frame(&frame_worker_data->pbi->common, data->idx);
 if (fb == NULL) return VPX_CODEC_ERROR;
    yuvconfig2image(&data->img, fb, NULL);
 return VPX_CODEC_OK;
 } else {
 return VPX_CODEC_INVALID_PARAM;
 }
}

Project: Android

static vpx_codec_err_t ctrl_get_render_size(vpx_codec_alg_priv_t *ctx,
                                            va_list args) {
 int *const render_size = va_arg(args, int *);

 if (ctx->frame_parallel_decode) {
    set_error_detail(ctx, "Not supported in frame parallel decode");
 return VPX_CODEC_INCAPABLE;
 }

 if (render_size) {
 if (ctx->frame_workers) {
 VPxWorker *const worker = ctx->frame_workers;
 FrameWorkerData *const frame_worker_data =
 (FrameWorkerData *)worker->data1;
 const VP9_COMMON *const cm = &frame_worker_data->pbi->common;
      render_size[0] = cm->render_width;
      render_size[1] = cm->render_height;
 return VPX_CODEC_OK;
 } else {
 return VPX_CODEC_ERROR;
 }
 }

 return VPX_CODEC_INVALID_PARAM;
}

Project: Android

static vpx_codec_err_t ctrl_set_byte_alignment(vpx_codec_alg_priv_t *ctx,
                                               va_list args) {
 const int legacy_byte_alignment = 0;
 const int min_byte_alignment = 32;
 const int max_byte_alignment = 1024;
 const int byte_alignment = va_arg(args, int);

 if (byte_alignment != legacy_byte_alignment &&
 (byte_alignment < min_byte_alignment ||
       byte_alignment > max_byte_alignment ||
 (byte_alignment & (byte_alignment - 1)) != 0))
 return VPX_CODEC_INVALID_PARAM;

  ctx->byte_alignment = byte_alignment;
 if (ctx->frame_workers) {
 VPxWorker *const worker = ctx->frame_workers;
 FrameWorkerData *const frame_worker_data =
 (FrameWorkerData *)worker->data1;
    frame_worker_data->pbi->common.byte_alignment = byte_alignment;
 }
 return VPX_CODEC_OK;
}

Project: Android

static vpx_codec_err_t ctrl_set_dbg_options(vpx_codec_alg_priv_t *ctx,
                                            va_list args) {
 (void)ctx;
 (void)args;
 return VPX_CODEC_INCAPABLE;
}

Project: Android

static vpx_codec_err_t ctrl_set_decryptor(vpx_codec_alg_priv_t *ctx,
                                          va_list args) {
  vpx_decrypt_init *init = va_arg(args, vpx_decrypt_init *);
  ctx->decrypt_cb = init ? init->decrypt_cb : NULL;
  ctx->decrypt_state = init ? init->decrypt_state : NULL;
 return VPX_CODEC_OK;
}

Project: Android

static vpx_codec_err_t ctrl_set_invert_tile_order(vpx_codec_alg_priv_t *ctx,
                                                  va_list args) {
  ctx->invert_tile_order = va_arg(args, int);
 return VPX_CODEC_OK;
}

Project: Android

static vpx_codec_err_t ctrl_set_postproc(vpx_codec_alg_priv_t *ctx,
                                         va_list args) {
#if CONFIG_VP9_POSTPROC
 vp8_postproc_cfg_t *data = va_arg(args, vp8_postproc_cfg_t *);

 if (data) {
    ctx->postproc_cfg_set = 1;
    ctx->postproc_cfg = *((vp8_postproc_cfg_t *)data);
 return VPX_CODEC_OK;
 } else {
 return VPX_CODEC_INVALID_PARAM;
 }
#else
 (void)ctx;
 (void)args;
 return VPX_CODEC_INCAPABLE;
#endif
}

Project: Android

static vpx_codec_err_t ctrl_set_reference(vpx_codec_alg_priv_t *ctx,
                                          va_list args) {
 vpx_ref_frame_t *const data = va_arg(args, vpx_ref_frame_t *);

 if (ctx->frame_parallel_decode) {
    set_error_detail(ctx, "Not supported in frame parallel decode");
 return VPX_CODEC_INCAPABLE;
 }

 if (data) {
 vpx_ref_frame_t *const frame = (vpx_ref_frame_t *)data;
    YV12_BUFFER_CONFIG sd;
 VPxWorker *const worker = ctx->frame_workers;
 FrameWorkerData *const frame_worker_data = (FrameWorkerData *)worker->data1;
    image2yuvconfig(&frame->img, &sd);
 return vp9_set_reference_dec(&frame_worker_data->pbi->common,
 (VP9_REFFRAME)frame->frame_type, &sd);
 } else {
 return VPX_CODEC_INVALID_PARAM;
 }
}

Project: Android

static vpx_codec_err_t ctrl_set_skip_loop_filter(vpx_codec_alg_priv_t *ctx,
                                                 va_list args) {
  ctx->skip_loop_filter = va_arg(args, int);

 if (ctx->frame_workers) {
 VPxWorker *const worker = ctx->frame_workers;
 FrameWorkerData *const frame_worker_data = (FrameWorkerData *)worker->data1;
    frame_worker_data->pbi->common.skip_loop_filter = ctx->skip_loop_filter;
 }

 return VPX_CODEC_OK;
}

Project: Android

static vpx_codec_err_t decode_one(vpx_codec_alg_priv_t *ctx,
 const uint8_t **data, unsigned int data_sz,
 void *user_priv, int64_t deadline) {
 const VPxWorkerInterface *const winterface = vpx_get_worker_interface();
 (void)deadline;

 if (!ctx->si.h) {
 int is_intra_only = 0;
 const vpx_codec_err_t res =
        decoder_peek_si_internal(*data, data_sz, &ctx->si, &is_intra_only,
                                 ctx->decrypt_cb, ctx->decrypt_state);
 if (res != VPX_CODEC_OK)
 return res;

 if (!ctx->si.is_kf && !is_intra_only)
 return VPX_CODEC_ERROR;
 }

 if (!ctx->frame_parallel_decode) {
 VPxWorker *const worker = ctx->frame_workers;
 FrameWorkerData *const frame_worker_data = (FrameWorkerData *)worker->data1;
    frame_worker_data->data = *data;
    frame_worker_data->data_size = data_sz;
    frame_worker_data->user_priv = user_priv;
    frame_worker_data->received_frame = 1;

    frame_worker_data->pbi->decrypt_cb = ctx->decrypt_cb;
    frame_worker_data->pbi->decrypt_state = ctx->decrypt_state;

    worker->had_error = 0;
    winterface->execute(worker);

 *data = frame_worker_data->data_end;

 if (worker->had_error)
 return update_error_state(ctx, &frame_worker_data->pbi->common.error);

    check_resync(ctx, frame_worker_data->pbi);
 } else {
 VPxWorker *const worker = &ctx->frame_workers[ctx->next_submit_worker_id];
 FrameWorkerData *const frame_worker_data = (FrameWorkerData *)worker->data1;
 if (ctx->next_submit_worker_id != ctx->last_submit_worker_id)
      vp9_frameworker_copy_context(
 &ctx->frame_workers[ctx->next_submit_worker_id],
 &ctx->frame_workers[ctx->last_submit_worker_id]);

    frame_worker_data->pbi->ready_for_new_data = 0;
 if (frame_worker_data->scratch_buffer_size < data_sz) {
      frame_worker_data->scratch_buffer =
 (uint8_t *)vpx_realloc(frame_worker_data->scratch_buffer, data_sz);
 if (frame_worker_data->scratch_buffer == NULL) {
        set_error_detail(ctx, "Failed to reallocate scratch buffer");
 return VPX_CODEC_MEM_ERROR;
 }
      frame_worker_data->scratch_buffer_size = data_sz;
 }
    frame_worker_data->data_size = data_sz;
    memcpy(frame_worker_data->scratch_buffer, *data, data_sz);

    frame_worker_data->frame_decoded = 0;
    frame_worker_data->frame_context_ready = 0;
    frame_worker_data->received_frame = 1;
    frame_worker_data->data = frame_worker_data->scratch_buffer;
    frame_worker_data->user_priv = user_priv;

 if (ctx->next_submit_worker_id != ctx->last_submit_worker_id)
      ctx->last_submit_worker_id =
 (ctx->last_submit_worker_id + 1) % ctx->num_frame_workers;

    ctx->next_submit_worker_id =
 (ctx->next_submit_worker_id + 1) % ctx->num_frame_workers;
 --ctx->available_threads;
    worker->had_error = 0;
    winterface->launch(worker);
 }

 return VPX_CODEC_OK;
}

Project: Android

static vpx_codec_err_t decoder_decode(vpx_codec_alg_priv_t *ctx,
 const uint8_t *data, unsigned int data_sz,
 void *user_priv, long deadline) {
 const uint8_t *data_start = data;
 const uint8_t * const data_end = data + data_sz;
 vpx_codec_err_t res;
 uint32_t frame_sizes[8];
 int frame_count;

 if (data == NULL && data_sz == 0) {
    ctx->flushed = 1;
 return VPX_CODEC_OK;
 }

  ctx->flushed = 0;

 if (ctx->frame_workers == NULL) {
 const vpx_codec_err_t res = init_decoder(ctx);
 if (res != VPX_CODEC_OK)
 return res;
 }

  res = vp9_parse_superframe_index(data, data_sz, frame_sizes, &frame_count,
                                   ctx->decrypt_cb, ctx->decrypt_state);
 if (res != VPX_CODEC_OK)
 return res;

 if (ctx->frame_parallel_decode) {
 if (frame_count > 0) {
 int i;

 for (i = 0; i < frame_count; ++i) {
 const uint8_t *data_start_copy = data_start;
 const uint32_t frame_size = frame_sizes[i];
 if (data_start < data
 || frame_size > (uint32_t) (data_end - data_start)) {
          set_error_detail(ctx, "Invalid frame size in index");
 return VPX_CODEC_CORRUPT_FRAME;
 }

 if (ctx->available_threads == 0) {
 if (ctx->num_cache_frames < FRAME_CACHE_SIZE) {
            wait_worker_and_cache_frame(ctx);
 } else {
            set_error_detail(ctx, "Frame output cache is full.");
 return VPX_CODEC_ERROR;
 }
 }

        res = decode_one(ctx, &data_start_copy, frame_size, user_priv,
                         deadline);
 if (res != VPX_CODEC_OK)
 return res;
        data_start += frame_size;
 }
 } else {
 if (ctx->available_threads == 0) {
 if (ctx->num_cache_frames < FRAME_CACHE_SIZE) {
          wait_worker_and_cache_frame(ctx);
 } else {
          set_error_detail(ctx, "Frame output cache is full.");
 return VPX_CODEC_ERROR;
 }
 }

      res = decode_one(ctx, &data, data_sz, user_priv, deadline);
 if (res != VPX_CODEC_OK)
 return res;
 }
 } else {
 if (frame_count > 0) {
 int i;

 for (i = 0; i < frame_count; ++i) {
 const uint8_t *data_start_copy = data_start;
 const uint32_t frame_size = frame_sizes[i];
 vpx_codec_err_t res;
 if (data_start < data
 || frame_size > (uint32_t) (data_end - data_start)) {
          set_error_detail(ctx, "Invalid frame size in index");
 return VPX_CODEC_CORRUPT_FRAME;
 }

        res = decode_one(ctx, &data_start_copy, frame_size, user_priv,
                         deadline);
 if (res != VPX_CODEC_OK)
 return res;

        data_start += frame_size;
 }
 } else {
 while (data_start < data_end) {
 const uint32_t frame_size = (uint32_t) (data_end - data_start);
 const vpx_codec_err_t res = decode_one(ctx, &data_start, frame_size,
                                               user_priv, deadline);
 if (res != VPX_CODEC_OK)
 return res;

 while (data_start < data_end) {
 const uint8_t marker = read_marker(ctx->decrypt_cb,
                                             ctx->decrypt_state, data_start);
 if (marker)
 break;
 ++data_start;
 }
 }
 }
 }

 return res;
}

Project: Android

static vpx_image_t *decoder_get_frame(vpx_codec_alg_priv_t *ctx,
 vpx_codec_iter_t *iter) {
 vpx_image_t *img = NULL;

 if (ctx->frame_parallel_decode && ctx->available_threads > 0 &&
 !ctx->flushed) {
 return NULL;
 }

 if (ctx->num_cache_frames > 0) {
    release_last_output_frame(ctx);
    ctx->last_show_frame  = ctx->frame_cache[ctx->frame_cache_read].fb_idx;
 if (ctx->need_resync)
 return NULL;
    img = &ctx->frame_cache[ctx->frame_cache_read].img;
    ctx->frame_cache_read = (ctx->frame_cache_read + 1) % FRAME_CACHE_SIZE;
 --ctx->num_cache_frames;
 return img;
 }

 if (*iter == NULL && ctx->frame_workers != NULL) {
 do {
      YV12_BUFFER_CONFIG sd;
 vp9_ppflags_t flags = {0, 0, 0};
 const VPxWorkerInterface *const winterface = vpx_get_worker_interface();
 VPxWorker *const worker =
 &ctx->frame_workers[ctx->next_output_worker_id];
 FrameWorkerData *const frame_worker_data =
 (FrameWorkerData *)worker->data1;
      ctx->next_output_worker_id =
 (ctx->next_output_worker_id + 1) % ctx->num_frame_workers;
 if (ctx->base.init_flags & VPX_CODEC_USE_POSTPROC)
        set_ppflags(ctx, &flags);
 if (winterface->sync(worker)) {
 if (frame_worker_data->received_frame == 1) {
 ++ctx->available_threads;
          frame_worker_data->received_frame = 0;
          check_resync(ctx, frame_worker_data->pbi);
 }
 if (vp9_get_raw_frame(frame_worker_data->pbi, &sd, &flags) == 0) {
          VP9_COMMON *const cm = &frame_worker_data->pbi->common;
 RefCntBuffer *const frame_bufs = cm->buffer_pool->frame_bufs;
          release_last_output_frame(ctx);
          ctx->last_show_frame = frame_worker_data->pbi->common.new_fb_idx;
 if (ctx->need_resync)
 return NULL;
          yuvconfig2image(&ctx->img, &sd, frame_worker_data->user_priv);
          ctx->img.fb_priv = frame_bufs[cm->new_fb_idx].raw_frame_buffer.priv;
          img = &ctx->img;
 return img;
 }
 } else {
        frame_worker_data->received_frame = 0;
 ++ctx->available_threads;
        ctx->need_resync = 1;
 if (ctx->flushed != 1)
 return NULL;
 }
 } while (ctx->next_output_worker_id != ctx->next_submit_worker_id);
 }
 return NULL;
}

Project: Android

static vpx_codec_err_t decoder_get_si(vpx_codec_alg_priv_t *ctx,
 vpx_codec_stream_info_t *si) {
 const size_t sz = (si->sz >= sizeof(vp9_stream_info_t))
 ? sizeof(vp9_stream_info_t)
 : sizeof(vpx_codec_stream_info_t);
  memcpy(si, &ctx->si, sz);
  si->sz = (unsigned int)sz;

 return VPX_CODEC_OK;
}

Project: Android

static vpx_codec_err_t decoder_init(vpx_codec_ctx_t *ctx,
 vpx_codec_priv_enc_mr_cfg_t *data) {
 (void)data;

 if (!ctx->priv) {
 vpx_codec_alg_priv_t *const priv =
 (vpx_codec_alg_priv_t *)vpx_calloc(1, sizeof(*priv));
 if (priv == NULL)
 return VPX_CODEC_MEM_ERROR;

    ctx->priv = (vpx_codec_priv_t *)priv;
    ctx->priv->init_flags = ctx->init_flags;
    priv->si.sz = sizeof(priv->si);
    priv->flushed = 0;
    priv->frame_parallel_decode =
 (ctx->config.dec && (ctx->config.dec->threads > 1) &&
 (ctx->init_flags & VPX_CODEC_USE_FRAME_THREADING)) ? 1 : 0;
 if (ctx->config.dec) {
      priv->cfg = *ctx->config.dec;
      ctx->config.dec = &priv->cfg;
 }
 }

 return VPX_CODEC_OK;
}

Project: Android

static vpx_codec_err_t decoder_peek_si(const uint8_t *data,
 unsigned int data_sz,
 vpx_codec_stream_info_t *si) {
 return decoder_peek_si_internal(data, data_sz, si, NULL, NULL, NULL);
}

Project: Android

static vpx_codec_err_t decoder_set_fb_fn(
 vpx_codec_alg_priv_t *ctx,
 vpx_get_frame_buffer_cb_fn_t cb_get,
 vpx_release_frame_buffer_cb_fn_t cb_release, void *cb_priv) {
 if (cb_get == NULL || cb_release == NULL) {
 return VPX_CODEC_INVALID_PARAM;
 } else if (ctx->frame_workers == NULL) {
    ctx->get_ext_fb_cb = cb_get;
    ctx->release_ext_fb_cb = cb_release;
    ctx->ext_priv = cb_priv;
 return VPX_CODEC_OK;
 }

 return VPX_CODEC_ERROR;
}

Project: Android

static void init_buffer_callbacks(vpx_codec_alg_priv_t *ctx) {
 int i;

 for (i = 0; i < ctx->num_frame_workers; ++i) {
 VPxWorker *const worker = &ctx->frame_workers[i];
 FrameWorkerData *const frame_worker_data = (FrameWorkerData *)worker->data1;
    VP9_COMMON *const cm = &frame_worker_data->pbi->common;
 BufferPool *const pool = cm->buffer_pool;

    cm->new_fb_idx = INVALID_IDX;
    cm->byte_alignment = ctx->byte_alignment;
    cm->skip_loop_filter = ctx->skip_loop_filter;

 if (ctx->get_ext_fb_cb != NULL && ctx->release_ext_fb_cb != NULL) {
      pool->get_fb_cb = ctx->get_ext_fb_cb;
      pool->release_fb_cb = ctx->release_ext_fb_cb;
      pool->cb_priv = ctx->ext_priv;
 } else {
      pool->get_fb_cb = vp9_get_frame_buffer;
      pool->release_fb_cb = vp9_release_frame_buffer;

 if (vp9_alloc_internal_frame_buffers(&pool->int_frame_buffers))
        vpx_internal_error(&cm->error, VPX_CODEC_MEM_ERROR,
 "Failed to initialize internal frame buffers");

      pool->cb_priv = &pool->int_frame_buffers;
 }
 }
}

Project: Android

static vpx_codec_err_t init_decoder(vpx_codec_alg_priv_t *ctx) {
 int i;
 const VPxWorkerInterface *const winterface = vpx_get_worker_interface();

  ctx->last_show_frame = -1;
  ctx->next_submit_worker_id = 0;
  ctx->last_submit_worker_id = 0;
  ctx->next_output_worker_id = 0;
  ctx->frame_cache_read = 0;
  ctx->frame_cache_write = 0;
  ctx->num_cache_frames = 0;
  ctx->need_resync = 1;
  ctx->num_frame_workers =
 (ctx->frame_parallel_decode == 1) ? ctx->cfg.threads: 1;
 if (ctx->num_frame_workers > MAX_DECODE_THREADS)
    ctx->num_frame_workers = MAX_DECODE_THREADS;
  ctx->available_threads = ctx->num_frame_workers;
  ctx->flushed = 0;

  ctx->buffer_pool = (BufferPool *)vpx_calloc(1, sizeof(BufferPool));
 if (ctx->buffer_pool == NULL)
 return VPX_CODEC_MEM_ERROR;

#if CONFIG_MULTITHREAD
 if (pthread_mutex_init(&ctx->buffer_pool->pool_mutex, NULL)) {
      set_error_detail(ctx, "Failed to allocate buffer pool mutex");
 return VPX_CODEC_MEM_ERROR;
 }
#endif

  ctx->frame_workers = (VPxWorker *)
      vpx_malloc(ctx->num_frame_workers * sizeof(*ctx->frame_workers));
 if (ctx->frame_workers == NULL) {
    set_error_detail(ctx, "Failed to allocate frame_workers");
 return VPX_CODEC_MEM_ERROR;
 }

 for (i = 0; i < ctx->num_frame_workers; ++i) {
 VPxWorker *const worker = &ctx->frame_workers[i];
 FrameWorkerData *frame_worker_data = NULL;
    winterface->init(worker);
    worker->data1 = vpx_memalign(32, sizeof(FrameWorkerData));
 if (worker->data1 == NULL) {
      set_error_detail(ctx, "Failed to allocate frame_worker_data");
 return VPX_CODEC_MEM_ERROR;
 }
    frame_worker_data = (FrameWorkerData *)worker->data1;
    frame_worker_data->pbi = vp9_decoder_create(ctx->buffer_pool);
 if (frame_worker_data->pbi == NULL) {
      set_error_detail(ctx, "Failed to allocate frame_worker_data");
 return VPX_CODEC_MEM_ERROR;
 }
    frame_worker_data->pbi->frame_worker_owner = worker;
    frame_worker_data->worker_id = i;
    frame_worker_data->scratch_buffer = NULL;
    frame_worker_data->scratch_buffer_size = 0;
    frame_worker_data->frame_context_ready = 0;
    frame_worker_data->received_frame = 0;
#if CONFIG_MULTITHREAD
 if (pthread_mutex_init(&frame_worker_data->stats_mutex, NULL)) {
      set_error_detail(ctx, "Failed to allocate frame_worker_data mutex");
 return VPX_CODEC_MEM_ERROR;
 }

 if (pthread_cond_init(&frame_worker_data->stats_cond, NULL)) {
      set_error_detail(ctx, "Failed to allocate frame_worker_data cond");
 return VPX_CODEC_MEM_ERROR;
 }
#endif
    frame_worker_data->pbi->max_threads =
 (ctx->frame_parallel_decode == 0) ? ctx->cfg.threads : 0;

    frame_worker_data->pbi->inv_tile_order = ctx->invert_tile_order;
    frame_worker_data->pbi->frame_parallel_decode = ctx->frame_parallel_decode;
    frame_worker_data->pbi->common.frame_parallel_decode =
        ctx->frame_parallel_decode;
    worker->hook = (VPxWorkerHook)frame_worker_hook;
 if (!winterface->reset(worker)) {
      set_error_detail(ctx, "Frame Worker thread creation failed");
 return VPX_CODEC_MEM_ERROR;
 }
 }

 if (!ctx->postproc_cfg_set &&
 (ctx->base.init_flags & VPX_CODEC_USE_POSTPROC))
    set_default_ppflags(&ctx->postproc_cfg);

  init_buffer_callbacks(ctx);

 return VPX_CODEC_OK;
}

Project: Android

static int parse_bitdepth_colorspace_sampling(
    BITSTREAM_PROFILE profile, struct vpx_read_bit_buffer *rb) {
 vpx_color_space_t color_space;
 if (profile >= PROFILE_2)
    rb->bit_offset += 1; // Bit-depth 10 or 12.
  color_space = (vpx_color_space_t)vpx_rb_read_literal(rb, 3);
 if (color_space != VPX_CS_SRGB) {
    rb->bit_offset += 1; // [16,235] (including xvycc) vs [0,255] range.
 if (profile == PROFILE_1 || profile == PROFILE_3) {
      rb->bit_offset += 2; // subsampling x/y.
      rb->bit_offset += 1; // unused.
 }
 } else {
 if (profile == PROFILE_1 || profile == PROFILE_3) {
      rb->bit_offset += 1; // unused
 } else {
 return 0;
 }
 }
 return 1;
}

Project: Android

static void release_last_output_frame(vpx_codec_alg_priv_t *ctx) {
 RefCntBuffer *const frame_bufs = ctx->buffer_pool->frame_bufs;
 if (ctx->frame_parallel_decode && ctx->last_show_frame >= 0) {
 BufferPool *const pool = ctx->buffer_pool;
    lock_buffer_pool(pool);
    decrease_ref_count(ctx->last_show_frame, frame_bufs, pool);
    unlock_buffer_pool(pool);
 }
}

Project: Android

static void set_default_ppflags(vp8_postproc_cfg_t *cfg) {
  cfg->post_proc_flag = VP8_DEBLOCK | VP8_DEMACROBLOCK;
  cfg->deblocking_level = 4;
  cfg->noise_level = 0;
}

Project: Android

static void set_error_detail(vpx_codec_alg_priv_t *ctx,
 const char *const error) {
  ctx->base.err_detail = error;
}

Project: Android

static void set_ppflags(const vpx_codec_alg_priv_t *ctx,
 vp9_ppflags_t *flags) {
  flags->post_proc_flag =
      ctx->postproc_cfg.post_proc_flag;

  flags->deblocking_level = ctx->postproc_cfg.deblocking_level;
  flags->noise_level = ctx->postproc_cfg.noise_level;
}

Project: Android

static vpx_codec_err_t update_error_state(vpx_codec_alg_priv_t *ctx,
 const struct vpx_internal_error_info *error) {
 if (error->error_code)
    set_error_detail(ctx, error->has_detail ? error->detail : NULL);

 return error->error_code;
}

Project: Android

static void wait_worker_and_cache_frame(vpx_codec_alg_priv_t *ctx) {
  YV12_BUFFER_CONFIG sd;
 vp9_ppflags_t flags = {0, 0, 0};
 const VPxWorkerInterface *const winterface = vpx_get_worker_interface();
 VPxWorker *const worker = &ctx->frame_workers[ctx->next_output_worker_id];
 FrameWorkerData *const frame_worker_data = (FrameWorkerData *)worker->data1;
  ctx->next_output_worker_id =
 (ctx->next_output_worker_id + 1) % ctx->num_frame_workers;
  winterface->sync(worker);
  frame_worker_data->received_frame = 0;
 ++ctx->available_threads;

  check_resync(ctx, frame_worker_data->pbi);

 if (vp9_get_raw_frame(frame_worker_data->pbi, &sd, &flags) == 0) {
    VP9_COMMON *const cm = &frame_worker_data->pbi->common;
 RefCntBuffer *const frame_bufs = cm->buffer_pool->frame_bufs;
    ctx->frame_cache[ctx->frame_cache_write].fb_idx = cm->new_fb_idx;
    yuvconfig2image(&ctx->frame_cache[ctx->frame_cache_write].img, &sd,
                    frame_worker_data->user_priv);
    ctx->frame_cache[ctx->frame_cache_write].img.fb_priv =
        frame_bufs[cm->new_fb_idx].raw_frame_buffer.priv;
    ctx->frame_cache_write =
 (ctx->frame_cache_write + 1) % FRAME_CACHE_SIZE;
 ++ctx->num_cache_frames;
 }
}