From: Attila Nagy <attilanagy@google.com>
Date: Fri, 14 Oct 2011 06:19:03 +0000 (+0300)
Subject: Fix: vp8cx_pack_tokens_into_partitions_armv5 crash
X-Git-Tag: v1.0.0~122^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a5cd42feb9d5944cbc4043aca2829ef78e270431;p=libvpx

Fix: vp8cx_pack_tokens_into_partitions_armv5 crash

It was crashing when number of partitions was bigger than the number
of MB rows (ex. 128x96 with 8 partitions).
Start point was not checked against mb_rows, plus extra
"empty" partitions were not written out.

Change-Id: I9c2f013b9ec022354b658fab4ef799ff8b1de93d
---

diff --git a/vp8/encoder/arm/armv5te/vp8_packtokens_partitions_armv5.asm b/vp8/encoder/arm/armv5te/vp8_packtokens_partitions_armv5.asm
index c00375e88..c061b2fab 100644
--- a/vp8/encoder/arm/armv5te/vp8_packtokens_partitions_armv5.asm
+++ b/vp8/encoder/arm/armv5te/vp8_packtokens_partitions_armv5.asm
@@ -65,7 +65,7 @@
 numparts_loop
     ldr     r10, [sp, #40]              ; ptr
     ldr     r5,  [sp, #36]              ; move mb_rows to the counting section
-    sub     r5, r5, r11                 ; move start point with each partition
+    subs    r5, r5, r11                 ; move start point with each partition
                                         ; mb_rows starts at i
     str     r5,  [sp, #12]
 
@@ -80,6 +80,8 @@ numparts_loop
     str     r2,  [r0, #vp8_writer_pos]
     str     r10, [r0, #vp8_writer_buffer]
 
+    ble     end_partition               ; if (mb_rows <= 0) end partition
+
 mb_row_loop
 
     ldr     r1, [r7, #tokenlist_start]
@@ -344,6 +346,7 @@ check_p_lt_stop
     str     r6, [sp, #12]
     bgt     mb_row_loop
 
+end_partition
     mov     r12, #32
 
 stop_encode_loop