From a95f4607841574fe7eb511ebf8be4d4c3d946c78 Mon Sep 17 00:00:00 2001
From: Yu Kang Ku <yu.kang.ku@intel.com>
Date: Wed, 11 Mar 2020 22:09:13 -0700
Subject: [PATCH] [VP] Fix memory corruption

When KernelDll_BuildKernel_CmFc() calls cm_fc_combine_kernels()
(see [1]), one of the inputs is &dwEstimatedKernelSize.  It is a
uint32_t pointer but is typecasted to a size_t pointer.

On platforms where size_t is a 64-bit integer, subsequent write
operations using this size_t pointer results in 4 bytes of
memory corruption.

[1] https://github.com/intel/media-driver/blob/master/media_driver/agnostic/common/vp/kdll/hal_kerneldll.c#L5045

(cherry picked from commit 3783175d95a4d27cc3be6d69e144b5f7d521cbbf)
---
 .../agnostic/common/vp/kdll/hal_kerneldll.c        | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/media_driver/agnostic/common/vp/kdll/hal_kerneldll.c b/media_driver/agnostic/common/vp/kdll/hal_kerneldll.c
index 7532c736..bd530007 100644
--- a/media_driver/agnostic/common/vp/kdll/hal_kerneldll.c
+++ b/media_driver/agnostic/common/vp/kdll/hal_kerneldll.c
@@ -4915,7 +4915,7 @@ bool KernelDll_BuildKernel_CmFc(Kdll_State *pState, Kdll_SearchState *pSearchSta
     int32_t           iOffset;
     uint32_t          dwResolveOffset[DL_MAX_EXPORT_COUNT];
     uint32_t          dwTotalKernelCount;
-    uint32_t          dwEstimatedKernelSize;
+    size_t            stEstimatedKernelSize;
     int32_t           iKUID;
     bool              bResolveDone;
     int32_t           i;
@@ -4946,7 +4946,7 @@ bool KernelDll_BuildKernel_CmFc(Kdll_State *pState, Kdll_SearchState *pSearchSta
 
     MOS_ZeroMemory(Cm_Fc_kernels, sizeof(Cm_Fc_kernels));
     dwTotalKernelCount = 0;
-    dwEstimatedKernelSize = 0;
+    stEstimatedKernelSize = 0;
 
 #if EMUL || VPHAL_LIB || _DEBUG
     VPHAL_RENDER_NORMALMESSAGE("Component Kernels:");
@@ -4964,7 +4964,7 @@ bool KernelDll_BuildKernel_CmFc(Kdll_State *pState, Kdll_SearchState *pSearchSta
         // Append/Patch kernel from internal cache
         res = Kdll_AddKernelList(pKernelCache, pPatchCache, pSearchState, *pKernelID, pKernelPatch, pPatchData, &Cm_Fc_kernels[dwTotalKernelCount]);
 
-        dwEstimatedKernelSize += Cm_Fc_kernels[dwTotalKernelCount].binary_size;
+        stEstimatedKernelSize += Cm_Fc_kernels[dwTotalKernelCount].binary_size;
 
         if (*pKernelID == IDR_VP_EOT)
         {
@@ -5031,17 +5031,17 @@ bool KernelDll_BuildKernel_CmFc(Kdll_State *pState, Kdll_SearchState *pSearchSta
         } // for
     } while (!bResolveDone);
 
-    if (dwEstimatedKernelSize > DL_MAX_KERNEL_SIZE)
+    if (stEstimatedKernelSize > DL_MAX_KERNEL_SIZE)
     {
         res = false;
         VPHAL_RENDER_NORMALMESSAGE("Kernel size exceeded kdll limitatin.");
         goto finish;
     }
 
-    dwEstimatedKernelSize = DL_MAX_KERNEL_SIZE;
+    stEstimatedKernelSize = DL_MAX_KERNEL_SIZE;
 
     // Get combine kernel binary from CMFC lib
-    if (CM_FC_OK != cm_fc_combine_kernels(dwTotalKernelCount, Cm_Fc_kernels, (char *)pSearchState->Kernel, (size_t *)&dwEstimatedKernelSize, nullptr))
+    if (CM_FC_OK != cm_fc_combine_kernels(dwTotalKernelCount, Cm_Fc_kernels, (char *)pSearchState->Kernel, &stEstimatedKernelSize, nullptr))
     {
         res = false;
         VPHAL_RENDER_NORMALMESSAGE("cm_fc_combine_kernels() function call failed.");
@@ -5049,7 +5049,7 @@ bool KernelDll_BuildKernel_CmFc(Kdll_State *pState, Kdll_SearchState *pSearchSta
     }
 
     // Get combine kernel binary size from CMFC lib
-    pSearchState->KernelSize = dwEstimatedKernelSize;
+    pSearchState->KernelSize = (int) stEstimatedKernelSize;
 
     res = true;
 
-- 
2.26.2