From b6d0c41a5930d104d179e36f889d4cdaf1d66997 Mon Sep 17 00:00:00 2001
From: jeffqjiangNew <142832361+jeffqjiangNew@users.noreply.github.com>
Date: Fri, 17 Nov 2023 12:57:19 -0500
Subject: [PATCH] * rocDecode/HEVC: Fixed the segmentation fault at the end of
 decode session on stream chimei_demo_1080p_h265_60fps.mp4 or similar streams.
 (#72)

Root cause: num_entry_point_offsets in the slice header of frame #2164 is 674, exceeding the entry_point_offset_minus1[440] array size. Parser writes beyond the array boundary, corrupting memory. Frame #2164 is not in conformance of the HEVC spec.

We need to put the constraint from the spec on the num_entry_point_offsets parsed from the stream. Also need to change the array size to the max possible for 8K.
---
 src/parser/hevc_parser.cpp | 14 ++++++++++++++
 src/parser/hevc_parser.h   |  5 +++--
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/src/parser/hevc_parser.cpp b/src/parser/hevc_parser.cpp
index ad45fad074..0951f4ca0c 100644
--- a/src/parser/hevc_parser.cpp
+++ b/src/parser/hevc_parser.cpp
@@ -1796,7 +1796,21 @@ bool HEVCVideoParser::ParseSliceHeader(uint8_t *nalu, size_t size) {
     }
 
     if (pps_ptr->tiles_enabled_flag || pps_ptr->entropy_coding_sync_enabled_flag) {
+        int max_num_entry_point_offsets;  // 7.4.7.1
+        if (!pps_ptr->tiles_enabled_flag && pps_ptr->entropy_coding_sync_enabled_flag) {
+            max_num_entry_point_offsets = pic_height_in_ctbs_y_ - 1;
+        }
+        else if (pps_ptr->tiles_enabled_flag && !pps_ptr->entropy_coding_sync_enabled_flag) {
+            max_num_entry_point_offsets = (pps_ptr->num_tile_columns_minus1 + 1) * (pps_ptr->num_tile_rows_minus1 + 1) - 1;
+        }
+        else {
+            max_num_entry_point_offsets = (pps_ptr->num_tile_columns_minus1 + 1) * pic_height_in_ctbs_y_ - 1;
+        }
         m_sh_->num_entry_point_offsets = Parser::ExpGolomb::ReadUe(nalu, offset);
+        if (m_sh_->num_entry_point_offsets > max_num_entry_point_offsets) {
+            m_sh_->num_entry_point_offsets = max_num_entry_point_offsets;
+        }
+
         if (m_sh_->num_entry_point_offsets) {
             m_sh_->offset_len_minus1 = Parser::ExpGolomb::ReadUe(nalu, offset);
             for (int i = 0; i < m_sh_->num_entry_point_offsets; i++) {
diff --git a/src/parser/hevc_parser.h b/src/parser/hevc_parser.h
index dbea04c7d7..1d8ae227d9 100644
--- a/src/parser/hevc_parser.h
+++ b/src/parser/hevc_parser.h
@@ -44,6 +44,8 @@ extern int scaling_list_default_3[1][2][64];
 #define SEI_BUF_SIZE  1024
 #define HVC_MAX_DPB_FRAMES 16  // (A-2)
 #define HEVC_MAX_NUM_REF_PICS 16
+// 7.4.7.1. (num_tile_columns_minus1 + 1) * PicHeightInCtbsY − 1. Max tile columns = 20 (A.4.2). Pic height in 16x16 CTB of 8K = 270.
+#define MAX_ENTRY_POINT_OFFSETS 20 * 270
 
 class HEVCVideoParser : public RocVideoParser {
 
@@ -595,8 +597,7 @@ protected:
         bool slice_loop_filter_across_slices_enabled_flag;   //u(1)
         uint32_t num_entry_point_offsets;                    //ue(v)
         uint32_t offset_len_minus1;                          //ue(v)
-        //num_entry_point_offsets max is 440
-        uint32_t entry_point_offset_minus1[440];             //u(v)
+        uint32_t entry_point_offset_minus1[MAX_ENTRY_POINT_OFFSETS]; //u(v)
         uint32_t slice_segment_header_extension_length;      //ue(v)
         //slice_segment_header_extension_length max is 256
         uint8_t slice_segment_header_extension_data_byte[256];    //u(8)