From aa1bb2e94f1411cbf18b745a81f8d4973b08157d Mon Sep 17 00:00:00 2001
From: jeffqjiangNew <142832361+jeffqjiangNew@users.noreply.github.com>
Date: Wed, 5 Mar 2025 08:44:59 -0500
Subject: [PATCH] Error resilience: Added HEVC slice syntax error handle for
 some corrupted streams. (#525)

* * rocDecode/Error resilience: Added HEVC slice syntax error handle for some corrupted streams.
 - Detect out of range total reference numbers.

* * rocDecode/Error resilience: Added additional checks for HEVC reference parameters.

* * rocDecode/Error resilence: Corrected checked range.

[ROCm/rocdecode commit: 27adeb8c47f175655b1e98937fb1c7787107249f]
---
 projects/rocdecode/src/parser/hevc_parser.cpp | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/projects/rocdecode/src/parser/hevc_parser.cpp b/projects/rocdecode/src/parser/hevc_parser.cpp
index 9e5da5fed2..24e805eabd 100644
--- a/projects/rocdecode/src/parser/hevc_parser.cpp
+++ b/projects/rocdecode/src/parser/hevc_parser.cpp
@@ -1674,6 +1674,9 @@ ParserResult HevcVideoParser::ParseSliceHeader(uint8_t *nalu, size_t size, HevcS
                     }
                 }
             }
+            if (p_slice_header->slice_type != HEVC_SLICE_TYPE_I) {
+                CHECK_ALLOWED_RANGE(p_slice_header->st_rps.num_of_delta_pocs + p_slice_header->num_long_term_pics, 1, dpb_buffer_.dpb_size);
+            }
             if (sps_ptr->sps_temporal_mvp_enabled_flag) {
                 p_slice_header->slice_temporal_mvp_enabled_flag = Parser::GetBit(nalu, offset);
             }
@@ -1692,10 +1695,10 @@ ParserResult HevcVideoParser::ParseSliceHeader(uint8_t *nalu, size_t size, HevcS
             p_slice_header->num_ref_idx_active_override_flag = Parser::GetBit(nalu, offset);
             if (p_slice_header->num_ref_idx_active_override_flag) {
                 p_slice_header->num_ref_idx_l0_active_minus1 = Parser::ExpGolomb::ReadUe(nalu, offset);
-                CHECK_ALLOWED_MAX(p_slice_header->num_ref_idx_l0_active_minus1, 14);
+                CHECK_ALLOWED_MAX(p_slice_header->num_ref_idx_l0_active_minus1, std::min(14, static_cast<int>(dpb_buffer_.dpb_size - 1)));
                 if (p_slice_header->slice_type == HEVC_SLICE_TYPE_B) {
                     p_slice_header->num_ref_idx_l1_active_minus1 = Parser::ExpGolomb::ReadUe(nalu, offset);
-                    CHECK_ALLOWED_MAX(p_slice_header->num_ref_idx_l1_active_minus1, 14);
+                    CHECK_ALLOWED_MAX(p_slice_header->num_ref_idx_l1_active_minus1, std::min(14, static_cast<int>(dpb_buffer_.dpb_size - 1)));
                 }
             } else {
                 p_slice_header->num_ref_idx_l0_active_minus1 = pps_ptr->num_ref_idx_l0_default_active_minus1;
@@ -2083,7 +2086,7 @@ void HevcVideoParser::ConstructRefPicLists(HevcSliceInfo *p_slice_info) {
     uint32_t num_rps_curr_temp_list; // NumRpsCurrTempList0 or NumRpsCurrTempList1;
     int i, j;
     int rIdx;
-    uint32_t ref_pic_list_temp[HEVC_MAX_NUM_REF_PICS];  // RefPicListTemp0 or RefPicListTemp1
+    uint32_t ref_pic_list_temp[HEVC_MAX_NUM_REF_PICS] = {0};  // RefPicListTemp0 or RefPicListTemp1
 
     /// List 0
     rIdx = 0;