From dec6dacbc93cc6fedc6cb37d0402ef708dd47aa0 Mon Sep 17 00:00:00 2001 From: jeffqjiangNew <142832361+jeffqjiangNew@users.noreply.github.com> Date: Wed, 22 Jan 2025 12:47:01 -0500 Subject: [PATCH] * rocDecode/HEVC: Added short term RPS parsing error handling. (#495) --- src/parser/hevc_parser.cpp | 13 ++++++++++--- src/parser/hevc_parser.h | 3 ++- src/parser/roc_video_parser.h | 2 +- 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/src/parser/hevc_parser.cpp b/src/parser/hevc_parser.cpp index 58d3c589f0..4e137930e2 100644 --- a/src/parser/hevc_parser.cpp +++ b/src/parser/hevc_parser.cpp @@ -962,7 +962,7 @@ void HevcVideoParser::ParseScalingList(HevcScalingListData * sl_ptr, uint8_t *na } } -void HevcVideoParser::ParseShortTermRefPicSet(HevcShortTermRps *rps, uint32_t st_rps_idx, uint32_t number_short_term_ref_pic_sets, HevcShortTermRps rps_ref[], uint8_t *nalu, size_t /*size*/, size_t& offset) { +ParserResult HevcVideoParser::ParseShortTermRefPicSet(HevcSeqParamSet *sps_ptr, HevcShortTermRps *rps, uint32_t st_rps_idx, uint32_t number_short_term_ref_pic_sets, HevcShortTermRps rps_ref[], uint8_t *nalu, size_t /*size*/, size_t& offset) { int i, j; memset(rps, 0, sizeof(HevcShortTermRps)); @@ -1040,6 +1040,7 @@ void HevcVideoParser::ParseShortTermRefPicSet(HevcShortTermRps *rps, uint32_t st rps->num_negative_pics = Parser::ExpGolomb::ReadUe(nalu, offset); rps->num_positive_pics = Parser::ExpGolomb::ReadUe(nalu, offset); rps->num_of_delta_pocs = rps->num_negative_pics + rps->num_positive_pics; + CHECK_ALLOWED_RANGE(rps->num_of_delta_pocs, 0, sps_ptr->sps_max_dec_pic_buffering_minus1[sps_ptr->sps_max_sub_layers_minus1]); for (i = 0; i < rps->num_negative_pics; i++) { rps->delta_poc_s0_minus1[i] = Parser::ExpGolomb::ReadUe(nalu, offset); @@ -1061,6 +1062,7 @@ void HevcVideoParser::ParseShortTermRefPicSet(HevcShortTermRps *rps, uint32_t st rps->used_by_curr_pic_s1[i] = Parser::GetBit(nalu, offset); } } + return PARSER_OK; } void HevcVideoParser::ParsePredWeightTable(HevcSliceSegHeader *slice_header_ptr, int chroma_array_type, uint8_t *stream_ptr, size_t &offset) { @@ -1357,7 +1359,9 @@ void HevcVideoParser::ParseSps(uint8_t *nalu, size_t size) { sps_ptr->num_short_term_ref_pic_sets = Parser::ExpGolomb::ReadUe(nalu, offset); for (int i=0; inum_short_term_ref_pic_sets; i++) { //short_term_ref_pic_set( i ) - ParseShortTermRefPicSet(&sps_ptr->st_rps[i], i, sps_ptr->num_short_term_ref_pic_sets, sps_ptr->st_rps, nalu, size, offset); + if (ParseShortTermRefPicSet(sps_ptr, &sps_ptr->st_rps[i], i, sps_ptr->num_short_term_ref_pic_sets, sps_ptr->st_rps, nalu, size, offset) != PARSER_OK) { + return; + } } sps_ptr->long_term_ref_pics_present_flag = Parser::GetBit(nalu, offset); if (sps_ptr->long_term_ref_pics_present_flag) { @@ -1532,6 +1536,7 @@ ParserResult HevcVideoParser::ParseSliceHeader(uint8_t *nalu, size_t size, HevcS sps_ptr = &sps_list_[m_active_sps_id_]; new_seq_activated_ = true; // Note: clear this flag after the actions are taken. } + sps_ptr = &sps_list_[m_active_sps_id_]; if (sps_ptr->is_received == 0) { ERR("Empty SPS is referred."); @@ -1604,7 +1609,9 @@ ParserResult HevcVideoParser::ParseSliceHeader(uint8_t *nalu, size_t size, HevcS p_slice_header->short_term_ref_pic_set_sps_flag = Parser::GetBit(nalu, offset); int32_t pos = offset; if (!p_slice_header->short_term_ref_pic_set_sps_flag) { - ParseShortTermRefPicSet(&p_slice_header->st_rps, sps_ptr->num_short_term_ref_pic_sets, sps_ptr->num_short_term_ref_pic_sets, sps_ptr->st_rps, nalu, size, offset); + if ( ParseShortTermRefPicSet(sps_ptr, &p_slice_header->st_rps, sps_ptr->num_short_term_ref_pic_sets, sps_ptr->num_short_term_ref_pic_sets, sps_ptr->st_rps, nalu, size, offset) != PARSER_OK) { + return PARSER_WRONG_STATE; + } } else { if (sps_ptr->num_short_term_ref_pic_sets > 1) { int num_bits = 0; diff --git a/src/parser/hevc_parser.h b/src/parser/hevc_parser.h index 054a9fbbe3..678965a365 100644 --- a/src/parser/hevc_parser.h +++ b/src/parser/hevc_parser.h @@ -241,6 +241,7 @@ protected: void ParseVui(HevcVuiParameters *vui, uint32_t max_num_sub_layers_minus1, uint8_t *data, size_t size, size_t &offset); /*! \brief Function to parse Short Term Reference Picture Set + * \param [in] sps_ptr The pointer to the associated SPS * \param [out] rps A pointer of HevcShortTermRps for the output from the parsed stream * \param [in] st_rps_idx specifies the index in the RPS buffer * \param [in] num_short_term_ref_pic_sets Specifies the count of Short Term RPS in uint32_t @@ -250,7 +251,7 @@ protected: * \param [in] offset Reference to the offset in the input buffer * \return No return value */ - void ParseShortTermRefPicSet(HevcShortTermRps *rps, uint32_t st_rps_idx, uint32_t num_short_term_ref_pic_sets, HevcShortTermRps rps_ref[], uint8_t *data, size_t size, size_t &offset); + ParserResult ParseShortTermRefPicSet(HevcSeqParamSet *sps_ptr, HevcShortTermRps *rps, uint32_t st_rps_idx, uint32_t num_short_term_ref_pic_sets, HevcShortTermRps rps_ref[], uint8_t *data, size_t size, size_t &offset); /*! \brief Function to parse weighted prediction table * \param [in/out] Slice_header_ptr Pointer to the slice segment header diff --git a/src/parser/roc_video_parser.h b/src/parser/roc_video_parser.h index 295b5b7471..acbef543b1 100644 --- a/src/parser/roc_video_parser.h +++ b/src/parser/roc_video_parser.h @@ -82,7 +82,7 @@ typedef struct { #define CHECK_ALLOWED_RANGE(val, min, max) { \ if (val < min || val > max) { \ - ERR ("value not in range: " + TOSTR(val) + "allowed: " + TOSTR(min) + " " + TOSTR(max));\ + ERR ("value not in range: " + TOSTR(val) + " allowed (min,max): " + TOSTR(min) + " " + TOSTR(max));\ return PARSER_OUT_OF_RANGE; \ } \ }