fixed #2350

src/filters/reframe_nalu.c

@@ -239,6 +239,8 @@ typedef struct
 	u32 clli_crc, mdcv_crc;
 
 	u32 nb_dv_rpu, nb_dv_el;
+
+	u32 valid_ps_flags;
 } GF_NALUDmxCtx;
 
 static void naludmx_enqueue_or_dispatch(GF_NALUDmxCtx *ctx, GF_FilterPacket *n_pck, Bool flush_ref);
@@ -995,11 +997,15 @@ GF_Err naludmx_set_hevc_oinf(GF_NALUDmxCtx *ctx, u8 *max_temporal_id)
 	for (i = 0; i < vps->max_layers; i++) {
 		LHEVC_DependentLayer *dep;
 		u32 j, k;
+		if (i==MAX_LHVC_LAYERS) break;
+
 		GF_SAFEALLOC(dep, LHEVC_DependentLayer);
 		if (!dep) return GF_OUT_OF_MEM;
 
 		dep->dependent_layerID = vps->layer_id_in_nuh[i];
 		for (j = 0; j < vps->max_layers; j++) {
+			if (j==MAX_LHVC_LAYERS) break;
+
 			if (vps->direct_dependency_flag[dep->dependent_layerID][j]) {
 				dep->dependent_on_layerID[dep->num_layers_dependent_on] = j;
 				dep->num_layers_dependent_on ++;
@@ -2055,9 +2061,11 @@ static void naludmx_queue_param_set(GF_NALUDmxCtx *ctx, char *data, u32 size, u3
 		case GF_HEVC_NALU_SEQ_PARAM:
 			list = ctx->sps;
 			flush_au = GF_TRUE;
+			ctx->valid_ps_flags |= 1;
 			break;
 		case GF_HEVC_NALU_PIC_PARAM:
 			list = ctx->pps;
+			ctx->valid_ps_flags |= 1<<1;
 			break;
 		default:
 			assert(0);
@@ -2073,9 +2081,11 @@ static void naludmx_queue_param_set(GF_NALUDmxCtx *ctx, char *data, u32 size, u3
 		case GF_VVC_NALU_SEQ_PARAM:
 			list = ctx->sps;
 			flush_au = GF_TRUE;
+			ctx->valid_ps_flags |= 1;
 			break;
 		case GF_VVC_NALU_PIC_PARAM:
 			list = ctx->pps;
+			ctx->valid_ps_flags |= 1<<1;
 			break;
 		case GF_VVC_NALU_DEC_PARAM:
 			if (!ctx->vvc_dci) ctx->vvc_dci = gf_list_new();
@@ -2096,11 +2106,13 @@ static void naludmx_queue_param_set(GF_NALUDmxCtx *ctx, char *data, u32 size, u3
 	} else {
 		switch (ps_type) {
 		case GF_AVC_NALU_SEQ_PARAM:
+			ctx->valid_ps_flags |= 1;
 			flush_au = GF_TRUE;
 		case GF_AVC_NALU_SVC_SUBSEQ_PARAM:
 			list = ctx->sps;
 			break;
 		case GF_AVC_NALU_PIC_PARAM:
+			ctx->valid_ps_flags |= 1<<1;
 			list = ctx->pps;
 			alt_list = ctx->pps_svc;
 			break;
@@ -3059,6 +3071,15 @@ GF_Err naludmx_process(GF_Filter *filter)
 			}
 			if (ctx->opid)
 				gf_filter_pid_set_eos(ctx->opid);
+
+			if ((ctx->valid_ps_flags & 0x03) != 0x03) {
+				ctx->nb_nalus = 0;
+				return GF_NON_COMPLIANT_BITSTREAM;
+			}
+			if (ctx->nb_nalus && !(ctx->nb_i|ctx->nb_p|ctx->nb_b|ctx->nb_idr|ctx->nb_si|ctx->nb_sp|ctx->nb_cra)) {
+				ctx->nb_nalus = 0;
+				return GF_NON_COMPLIANT_BITSTREAM;
+			}
 			return GF_EOS;
 		}
 		return GF_OK;

src/media_tools/av_parsers.c

@@ -5395,6 +5395,8 @@ static s32 gf_avc_read_sps_bs_internal(GF_BitStream *bs, AVCState *avc, u32 subs
 			return sps_id;
 		}
 	}
+	if (gf_bs_is_overflow(bs))
+		return -1;
 	return sps_id;
 }
 
@@ -5512,6 +5514,8 @@ static s32 gf_avc_read_pps_bs_internal(GF_BitStream *bs, AVCState *avc, u32 nal_
 	gf_bs_read_int_log(bs, 1, "constrained_intra_pred");
 	pps->redundant_pic_cnt_present = gf_bs_read_int_log(bs, 1, "redundant_pic_cnt_present");
 
+	if (gf_bs_is_overflow(bs))
+		return -1;
 	return pps_id;
 }
 
@@ -7996,7 +8000,8 @@ static s32 gf_hevc_read_vps_bs_internal(GF_BitStream *bs, HEVCState *hevc, Bool
 	vps->base_layer_available_flag = gf_bs_read_int_log(bs, 1, "base_layer_available_flag");
 	vps->max_layers = 1 + gf_bs_read_int_log(bs, 6, "max_layers_minus1");
 	if (vps->max_layers > MAX_LHVC_LAYERS) {
-		GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[HEVC] sorry, %d layers in VPS but only %d supported\n", vps->max_layers, MAX_LHVC_LAYERS));
+		GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[HEVC] %d layers in VPS but only %d supported in GPAC\n", vps->max_layers, MAX_LHVC_LAYERS));
+		vps->max_layers = MAX_LHVC_LAYERS;
 		return -1;
 	}
 	vps->max_sub_layers = gf_bs_read_int_log(bs, 3, "max_sub_layers_minus1") + 1;
@@ -8258,7 +8263,12 @@ static s32 gf_hevc_read_sps_bs_internal(GF_BitStream *bs, HEVCState *hevc, u8 la
 				return -1;
 			}
 		} else {
-			sps->rep_format_idx = vps->rep_format_idx[layer_id];
+			if (layer_id<MAX_LHVC_LAYERS) {
+				u32 idx = vps->layer_id_in_vps[layer_id];
+				if (idx>15)
+					return -1;
+				sps->rep_format_idx = vps->rep_format_idx[idx];
+			}
 		}
 		sps->width = vps->rep_formats[sps->rep_format_idx].pic_width_luma_samples;
 		sps->height = vps->rep_formats[sps->rep_format_idx].pic_height_luma_samples;
@@ -8471,7 +8481,8 @@ static s32 gf_hevc_read_sps_bs_internal(GF_BitStream *bs, HEVCState *hevc, u8 la
 #endif
 
 	}
-
+	if (gf_bs_is_overflow(bs))
+		return -1;
 	return sps_id;
 }
 
@@ -8605,6 +8616,9 @@ static s32 gf_hevc_read_pps_bs_internal(GF_BitStream *bs, HEVCState *hevc)
 #endif
 
 	}
+
+	if (gf_bs_is_overflow(bs))
+		return -1;
 	return pps_id;
 }
 
@@ -10311,8 +10325,9 @@ static s32 gf_vvc_read_vps_bs_internal(GF_BitStream *bs, VVCState *vvc, Bool sto
 		vps->state = 1;
 	}
 	vps->max_layers = 1 + gf_bs_read_int_log(bs, 6, "max_layers");
-	if (vps->max_layers > MAX_LHVC_LAYERS) {
-		GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[VVC] sorry, %d layers in VPS but only %d supported\n", vps->max_layers, MAX_LHVC_LAYERS));
+	if (vps->max_layers > VVC_MAX_LAYERS) {
+		GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[VVC] %d layers in VPS but only %d supported in GPAC\n", vps->max_layers, VVC_MAX_LAYERS));
+		vps->max_layers = VVC_MAX_LAYERS;
 		return -1;
 	}
 	vps->max_sub_layers = gf_bs_read_int_log(bs, 3, "max_sub_layers_minus1") + 1;
@@ -10377,6 +10392,10 @@ static s32 gf_vvc_read_vps_bs_internal(GF_BitStream *bs, VVCState *vvc, Bool sto
 	}
 
 	//TODO, parse multilayer stuff
+
+
+	if (gf_bs_is_overflow(bs))
+		return -1;
 	return vps_id;
 }
 
@@ -10881,6 +10900,9 @@ static s32 gf_vvc_read_sps_bs_internal(GF_BitStream *bs, VVCState *vvc, u8 layer
 		//WE DON'T PARSE vui_payload_bit_equal_to_one because we dont parse the rest (sps extensions)
 		//if needed, see rewrite_vui code
 	}
+
+	if (gf_bs_is_overflow(bs))
+		return -1;
 	return sps_id;
 }
 
@@ -11174,6 +11196,9 @@ static s32 gf_vvc_read_pps_bs_internal(GF_BitStream *bs, VVCState *vvc)
 		//while ( more_rbsp_data()) bit(1);
 	}
 	//rbsp_trailing_bits()
+
+	if (gf_bs_is_overflow(bs))
+		return -1;
 	return pps_id;
 }