AI/rocm-systems
2
0
Garpu 0
Kode Masalah Tarik Permintaan Actions Packages Projects Rilis Wiki Kegiatan

* rocDecode/HEVC: Fixed the segmentation fault at the end of decode session on stream chimei_demo_1080p_h265_60fps.mp4 or similar streams. (#72)

Telusuri Sumber 
Root cause: num_entry_point_offsets in the slice header of frame #2164 is 674, exceeding the entry_point_offset_minus1[440] array size. Parser writes beyond the array boundary, corrupting memory. Frame #2164 is not in conformance of the HEVC spec.

We need to put the constraint from the spec on the num_entry_point_offsets parsed from the stream. Also need to change the array size to the max possible for 8K.
This commit is contained in:
jeffqjiangNew
2023-11-17 12:57:19 -05:00
committed by GitHub
orang tua 071b37b3bd
melakukan b6d0c41a59
2 mengubah file dengan 17 tambahan dan 2 penghapusan
Download Patch File Download Diff File Expand all files Collapse all files
src/parser/hevc_parser.cpp
+14
Melihat File
@@ -1796,7 +1796,21 @@ bool HEVCVideoParser::ParseSliceHeader(uint8_t *nalu, size_t size) {
}
if (pps_ptr->tiles_enabled_flag || pps_ptr->entropy_coding_sync_enabled_flag) {
int max_num_entry_point_offsets; // 7.4.7.1
if (!pps_ptr->tiles_enabled_flag && pps_ptr->entropy_coding_sync_enabled_flag) {
max_num_entry_point_offsets = pic_height_in_ctbs_y_ - 1;
}
else if (pps_ptr->tiles_enabled_flag && !pps_ptr->entropy_coding_sync_enabled_flag) {
max_num_entry_point_offsets = (pps_ptr->num_tile_columns_minus1 + 1) * (pps_ptr->num_tile_rows_minus1 + 1) - 1;
}
else {
max_num_entry_point_offsets = (pps_ptr->num_tile_columns_minus1 + 1) * pic_height_in_ctbs_y_ - 1;
}
m_sh_->num_entry_point_offsets = Parser::ExpGolomb::ReadUe(nalu, offset);
if (m_sh_->num_entry_point_offsets > max_num_entry_point_offsets) {
m_sh_->num_entry_point_offsets = max_num_entry_point_offsets;
}
if (m_sh_->num_entry_point_offsets) {
m_sh_->offset_len_minus1 = Parser::ExpGolomb::ReadUe(nalu, offset);
for (int i = 0; i < m_sh_->num_entry_point_offsets; i++) {
src/parser/hevc_parser.h
+3 -2
Melihat File
@@ -44,6 +44,8 @@ extern int scaling_list_default_3[1][2][64];
#define SEI_BUF_SIZE 1024
#define HVC_MAX_DPB_FRAMES 16 // (A-2)
#define HEVC_MAX_NUM_REF_PICS 16
// 7.4.7.1. (num_tile_columns_minus1 + 1) * PicHeightInCtbsY − 1. Max tile columns = 20 (A.4.2). Pic height in 16x16 CTB of 8K = 270.
#define MAX_ENTRY_POINT_OFFSETS 20 * 270
class HEVCVideoParser : public RocVideoParser {
@@ -595,8 +597,7 @@ protected:
bool slice_loop_filter_across_slices_enabled_flag; //u(1)
uint32_t num_entry_point_offsets; //ue(v)
uint32_t offset_len_minus1; //ue(v)
//num_entry_point_offsets max is 440
uint32_t entry_point_offset_minus1[440]; //u(v)
uint32_t entry_point_offset_minus1[MAX_ENTRY_POINT_OFFSETS]; //u(v)
uint32_t slice_segment_header_extension_length; //ue(v)
//slice_segment_header_extension_length max is 256
uint8_t slice_segment_header_extension_data_byte[256]; //u(8)