diff options
Diffstat (limited to 'libavcodec/hevc_ps.c')
-rw-r--r-- | libavcodec/hevc_ps.c | 641 |
1 files changed, 507 insertions, 134 deletions
diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c index 2603e6d..1f18d03 100644 --- a/libavcodec/hevc_ps.c +++ b/libavcodec/hevc_ps.c @@ -6,26 +6,25 @@ * Copyright (C) 2012 - 2013 Gildas Cocherel * Copyright (C) 2013 Vittorio Giovara * - * This file is part of Libav. + * This file is part of FFmpeg. * - * Libav is free software; you can redistribute it and/or + * FFmpeg is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; either * version 2.1 of the License, or (at your option) any later version. * - * Libav is distributed in the hope that it will be useful, + * FFmpeg is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public - * License along with Libav; if not, write to the Free Software + * License along with FFmpeg; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ #include "libavutil/imgutils.h" - -#include "golomb_legacy.h" +#include "golomb.h" #include "hevc_data.h" #include "hevc_ps.h" @@ -89,6 +88,8 @@ static void remove_sps(HEVCParamSets *s, int id) for (i = 0; i < FF_ARRAY_ELEMS(s->pps_list); i++) if (s->pps_list[i] && ((HEVCPPS*)s->pps_list[i]->data)->sps_id == id) remove_pps(s, i); + + av_assert0(!(s->sps_list[id] && s->sps == (HEVCSPS*)s->sps_list[id]->data)); } av_buffer_unref(&s->sps_list[id]); } @@ -122,7 +123,8 @@ int ff_hevc_decode_short_term_rps(GetBitContext *gb, AVCodecContext *avctx, if (rps_predict) { const ShortTermRPS *rps_ridx; - int delta_rps, abs_delta_rps; + int delta_rps; + unsigned abs_delta_rps; uint8_t use_delta_flag = 0; uint8_t delta_rps_sign; @@ -141,6 +143,12 @@ int ff_hevc_decode_short_term_rps(GetBitContext *gb, AVCodecContext *avctx, delta_rps_sign = get_bits1(gb); abs_delta_rps = get_ue_golomb_long(gb) + 1; + if (abs_delta_rps < 1 || abs_delta_rps > 32768) { + av_log(avctx, AV_LOG_ERROR, + "Invalid value of abs_delta_rps: %d\n", + abs_delta_rps); + return AVERROR_INVALIDDATA; + } delta_rps = (1 - (delta_rps_sign << 1)) * abs_delta_rps; for (i = 0; i <= rps_ridx->num_delta_pocs; i++) { int used = rps->used[k] = get_bits1(gb); @@ -162,6 +170,12 @@ int ff_hevc_decode_short_term_rps(GetBitContext *gb, AVCodecContext *avctx, } } + if (k >= FF_ARRAY_ELEMS(rps->used)) { + av_log(avctx, AV_LOG_ERROR, + "Invalid num_delta_pocs: %d\n", k); + return AVERROR_INVALIDDATA; + } + rps->num_delta_pocs = k; rps->num_negative_pics = k0; // sort in increasing order (smallest first) @@ -211,6 +225,12 @@ int ff_hevc_decode_short_term_rps(GetBitContext *gb, AVCodecContext *avctx, prev = 0; for (i = 0; i < rps->num_negative_pics; i++) { delta_poc = get_ue_golomb_long(gb) + 1; + if (delta_poc < 1 || delta_poc > 32768) { + av_log(avctx, AV_LOG_ERROR, + "Invalid value of delta_poc: %d\n", + delta_poc); + return AVERROR_INVALIDDATA; + } prev -= delta_poc; rps->delta_poc[i] = prev; rps->used[i] = get_bits1(gb); @@ -218,6 +238,12 @@ int ff_hevc_decode_short_term_rps(GetBitContext *gb, AVCodecContext *avctx, prev = 0; for (i = 0; i < nb_positive_pics; i++) { delta_poc = get_ue_golomb_long(gb) + 1; + if (delta_poc < 1 || delta_poc > 32768) { + av_log(avctx, AV_LOG_ERROR, + "Invalid value of delta_poc: %d\n", + delta_poc); + return AVERROR_INVALIDDATA; + } prev += delta_poc; rps->delta_poc[rps->num_negative_pics + i] = prev; rps->used[rps->num_negative_pics + i] = get_bits1(gb); @@ -228,11 +254,14 @@ int ff_hevc_decode_short_term_rps(GetBitContext *gb, AVCodecContext *avctx, } -static void decode_profile_tier_level(GetBitContext *gb, AVCodecContext *avctx, +static int decode_profile_tier_level(GetBitContext *gb, AVCodecContext *avctx, PTLCommon *ptl) { int i; + if (get_bits_left(gb) < 2+1+5 + 32 + 4 + 16 + 16 + 12) + return -1; + ptl->profile_space = get_bits(gb, 2); ptl->tier_flag = get_bits1(gb); ptl->profile_idc = get_bits(gb, 5); @@ -242,6 +271,8 @@ static void decode_profile_tier_level(GetBitContext *gb, AVCodecContext *avctx, av_log(avctx, AV_LOG_DEBUG, "Main 10 profile bitstream\n"); else if (ptl->profile_idc == FF_PROFILE_HEVC_MAIN_STILL_PICTURE) av_log(avctx, AV_LOG_DEBUG, "Main Still Picture profile bitstream\n"); + else if (ptl->profile_idc == FF_PROFILE_HEVC_REXT) + av_log(avctx, AV_LOG_DEBUG, "Range Extension profile bitstream\n"); else av_log(avctx, AV_LOG_WARNING, "Unknown HEVC profile: %d\n", ptl->profile_idc); @@ -259,28 +290,48 @@ static void decode_profile_tier_level(GetBitContext *gb, AVCodecContext *avctx, skip_bits(gb, 16); // XXX_reserved_zero_44bits[0..15] skip_bits(gb, 16); // XXX_reserved_zero_44bits[16..31] skip_bits(gb, 12); // XXX_reserved_zero_44bits[32..43] + + return 0; } -static void parse_ptl(GetBitContext *gb, AVCodecContext *avctx, +static int parse_ptl(GetBitContext *gb, AVCodecContext *avctx, PTL *ptl, int max_num_sub_layers) { int i; - decode_profile_tier_level(gb, avctx, &ptl->general_ptl); + if (decode_profile_tier_level(gb, avctx, &ptl->general_ptl) < 0 || + get_bits_left(gb) < 8 + (8*2 * (max_num_sub_layers - 1 > 0))) { + av_log(avctx, AV_LOG_ERROR, "PTL information too short\n"); + return -1; + } + ptl->general_ptl.level_idc = get_bits(gb, 8); for (i = 0; i < max_num_sub_layers - 1; i++) { ptl->sub_layer_profile_present_flag[i] = get_bits1(gb); ptl->sub_layer_level_present_flag[i] = get_bits1(gb); } - if (max_num_sub_layers - 1 > 0) + + if (max_num_sub_layers - 1> 0) for (i = max_num_sub_layers - 1; i < 8; i++) skip_bits(gb, 2); // reserved_zero_2bits[i] for (i = 0; i < max_num_sub_layers - 1; i++) { - if (ptl->sub_layer_profile_present_flag[i]) - decode_profile_tier_level(gb, avctx, &ptl->sub_layer_ptl[i]); - if (ptl->sub_layer_level_present_flag[i]) - ptl->sub_layer_ptl[i].level_idc = get_bits(gb, 8); + if (ptl->sub_layer_profile_present_flag[i] && + decode_profile_tier_level(gb, avctx, &ptl->sub_layer_ptl[i]) < 0) { + av_log(avctx, AV_LOG_ERROR, + "PTL information for sublayer %i too short\n", i); + return -1; + } + if (ptl->sub_layer_level_present_flag[i]) { + if (get_bits_left(gb) < 8) { + av_log(avctx, AV_LOG_ERROR, + "Not enough data for sublayer %i level_idc\n", i); + return -1; + } else + ptl->sub_layer_ptl[i].level_idc = get_bits(gb, 8); + } } + + return 0; } static void decode_sublayer_hrd(GetBitContext *gb, unsigned int nb_cpb, @@ -300,7 +351,7 @@ static void decode_sublayer_hrd(GetBitContext *gb, unsigned int nb_cpb, } } -static void decode_hrd(GetBitContext *gb, int common_inf_present, +static int decode_hrd(GetBitContext *gb, int common_inf_present, int max_sublayers) { int nal_params_present = 0, vcl_params_present = 0; @@ -346,14 +397,20 @@ static void decode_hrd(GetBitContext *gb, int common_inf_present, else low_delay = get_bits1(gb); - if (!low_delay) + if (!low_delay) { nb_cpb = get_ue_golomb_long(gb) + 1; + if (nb_cpb < 1 || nb_cpb > 32) { + av_log(NULL, AV_LOG_ERROR, "nb_cpb %d invalid\n", nb_cpb); + return AVERROR_INVALIDDATA; + } + } if (nal_params_present) decode_sublayer_hrd(gb, nb_cpb, subpic_params_present); if (vcl_params_present) decode_sublayer_hrd(gb, nb_cpb, subpic_params_present); } + return 0; } int ff_hevc_decode_nal_vps(GetBitContext *gb, AVCodecContext *avctx, @@ -361,6 +418,7 @@ int ff_hevc_decode_nal_vps(GetBitContext *gb, AVCodecContext *avctx, { int i,j; int vps_id = 0; + ptrdiff_t nal_size; HEVCVPS *vps; AVBufferRef *vps_buf = av_buffer_allocz(sizeof(*vps)); @@ -370,6 +428,17 @@ int ff_hevc_decode_nal_vps(GetBitContext *gb, AVCodecContext *avctx, av_log(avctx, AV_LOG_DEBUG, "Decoding VPS\n"); + nal_size = gb->buffer_end - gb->buffer; + if (nal_size > sizeof(vps->data)) { + av_log(avctx, AV_LOG_WARNING, "Truncating likely oversized VPS " + "(%"PTRDIFF_SPECIFIER" > %"SIZE_SPECIFIER")\n", + nal_size, sizeof(vps->data)); + vps->data_size = sizeof(vps->data); + } else { + vps->data_size = nal_size; + } + memcpy(vps->data, gb->buffer, vps->data_size); + vps_id = get_bits(gb, 4); if (vps_id >= HEVC_MAX_VPS_COUNT) { av_log(avctx, AV_LOG_ERROR, "VPS id out of range: %d\n", vps_id); @@ -396,7 +465,8 @@ int ff_hevc_decode_nal_vps(GetBitContext *gb, AVCodecContext *avctx, goto err; } - parse_ptl(gb, avctx, &vps->ptl, vps->vps_max_sub_layers); + if (parse_ptl(gb, avctx, &vps->ptl, vps->vps_max_sub_layers) < 0) + goto err; vps->vps_sub_layer_ordering_info_present_flag = get_bits1(gb); @@ -406,7 +476,7 @@ int ff_hevc_decode_nal_vps(GetBitContext *gb, AVCodecContext *avctx, vps->vps_num_reorder_pics[i] = get_ue_golomb_long(gb); vps->vps_max_latency_increase[i] = get_ue_golomb_long(gb) - 1; - if (vps->vps_max_dec_pic_buffering[i] > HEVC_MAX_DPB_SIZE) { + if (vps->vps_max_dec_pic_buffering[i] > HEVC_MAX_DPB_SIZE || !vps->vps_max_dec_pic_buffering[i]) { av_log(avctx, AV_LOG_ERROR, "vps_max_dec_pic_buffering_minus1 out of range: %d\n", vps->vps_max_dec_pic_buffering[i] - 1); goto err; @@ -421,6 +491,12 @@ int ff_hevc_decode_nal_vps(GetBitContext *gb, AVCodecContext *avctx, vps->vps_max_layer_id = get_bits(gb, 6); vps->vps_num_layer_sets = get_ue_golomb_long(gb) + 1; + if (vps->vps_num_layer_sets < 1 || vps->vps_num_layer_sets > 1024 || + (vps->vps_num_layer_sets - 1LL) * (vps->vps_max_layer_id + 1LL) > get_bits_left(gb)) { + av_log(avctx, AV_LOG_ERROR, "too many layer_id_included_flags\n"); + goto err; + } + for (i = 1; i < vps->vps_num_layer_sets; i++) for (j = 0; j <= vps->vps_max_layer_id; j++) skip_bits(gb, 1); // layer_id_included_flag[i][j] @@ -433,6 +509,11 @@ int ff_hevc_decode_nal_vps(GetBitContext *gb, AVCodecContext *avctx, if (vps->vps_poc_proportional_to_timing_flag) vps->vps_num_ticks_poc_diff_one = get_ue_golomb_long(gb) + 1; vps->vps_num_hrd_parameters = get_ue_golomb_long(gb); + if (vps->vps_num_hrd_parameters > (unsigned)vps->vps_num_layer_sets) { + av_log(avctx, AV_LOG_ERROR, + "vps_num_hrd_parameters %d is invalid\n", vps->vps_num_hrd_parameters); + goto err; + } for (i = 0; i < vps->vps_num_hrd_parameters; i++) { int common_inf_present = 1; @@ -444,6 +525,13 @@ int ff_hevc_decode_nal_vps(GetBitContext *gb, AVCodecContext *avctx, } get_bits1(gb); /* vps_extension_flag */ + if (get_bits_left(gb) < 0) { + av_log(avctx, AV_LOG_ERROR, + "Overread VPS by %d bits\n", -get_bits_left(gb)); + if (ps->vps_list[vps_id]) + goto err; + } + if (ps->vps_list[vps_id] && !memcmp(ps->vps_list[vps_id]->data, vps_buf->data, vps_buf->size)) { av_buffer_unref(&vps_buf); @@ -462,8 +550,9 @@ err: static void decode_vui(GetBitContext *gb, AVCodecContext *avctx, int apply_defdispwin, HEVCSPS *sps) { - VUI *vui = &sps->vui; - int sar_present; + VUI backup_vui, *vui = &sps->vui; + GetBitContext backup; + int sar_present, alt = 0; av_log(avctx, AV_LOG_DEBUG, "Decoding VUI\n"); @@ -503,6 +592,19 @@ static void decode_vui(GetBitContext *gb, AVCodecContext *avctx, vui->transfer_characteristic = AVCOL_TRC_UNSPECIFIED; if (!av_color_space_name(vui->matrix_coeffs)) vui->matrix_coeffs = AVCOL_SPC_UNSPECIFIED; + if (vui->matrix_coeffs == AVCOL_SPC_RGB) { + switch (sps->pix_fmt) { + case AV_PIX_FMT_YUV444P: + sps->pix_fmt = AV_PIX_FMT_GBRP; + break; + case AV_PIX_FMT_YUV444P10: + sps->pix_fmt = AV_PIX_FMT_GBRP10; + break; + case AV_PIX_FMT_YUV444P12: + sps->pix_fmt = AV_PIX_FMT_GBRP12; + break; + } + } } } @@ -516,13 +618,22 @@ static void decode_vui(GetBitContext *gb, AVCodecContext *avctx, vui->field_seq_flag = get_bits1(gb); vui->frame_field_info_present_flag = get_bits1(gb); - vui->default_display_window_flag = get_bits1(gb); + // Backup context in case an alternate header is detected + memcpy(&backup, gb, sizeof(backup)); + memcpy(&backup_vui, vui, sizeof(backup_vui)); + if (get_bits_left(gb) >= 68 && show_bits_long(gb, 21) == 0x100000) { + vui->default_display_window_flag = 0; + av_log(avctx, AV_LOG_WARNING, "Invalid default display window\n"); + } else + vui->default_display_window_flag = get_bits1(gb); + if (vui->default_display_window_flag) { - //TODO: * 2 is only valid for 420 - vui->def_disp_win.left_offset = get_ue_golomb_long(gb) * 2; - vui->def_disp_win.right_offset = get_ue_golomb_long(gb) * 2; - vui->def_disp_win.top_offset = get_ue_golomb_long(gb) * 2; - vui->def_disp_win.bottom_offset = get_ue_golomb_long(gb) * 2; + int vert_mult = 1 + (sps->chroma_format_idc < 2); + int horiz_mult = 1 + (sps->chroma_format_idc < 3); + vui->def_disp_win.left_offset = get_ue_golomb_long(gb) * horiz_mult; + vui->def_disp_win.right_offset = get_ue_golomb_long(gb) * horiz_mult; + vui->def_disp_win.top_offset = get_ue_golomb_long(gb) * vert_mult; + vui->def_disp_win.bottom_offset = get_ue_golomb_long(gb) * vert_mult; if (apply_defdispwin && avctx->flags2 & AV_CODEC_FLAG2_IGNORE_CROP) { @@ -541,10 +652,26 @@ static void decode_vui(GetBitContext *gb, AVCodecContext *avctx, } } +timing_info: vui->vui_timing_info_present_flag = get_bits1(gb); + if (vui->vui_timing_info_present_flag) { + if( get_bits_left(gb) < 66 && !alt) { + // The alternate syntax seem to have timing info located + // at where def_disp_win is normally located + av_log(avctx, AV_LOG_WARNING, + "Strange VUI timing information, retrying...\n"); + memcpy(vui, &backup_vui, sizeof(backup_vui)); + memcpy(gb, &backup, sizeof(backup)); + alt = 1; + goto timing_info; + } vui->vui_num_units_in_tick = get_bits_long(gb, 32); vui->vui_time_scale = get_bits_long(gb, 32); + if (alt) { + av_log(avctx, AV_LOG_INFO, "Retry got %"PRIu32"/%"PRIu32" fps\n", + vui->vui_time_scale, vui->vui_num_units_in_tick); + } vui->vui_poc_proportional_to_timing_flag = get_bits1(gb); if (vui->vui_poc_proportional_to_timing_flag) vui->vui_num_ticks_poc_diff_one_minus1 = get_ue_golomb_long(gb); @@ -555,6 +682,15 @@ static void decode_vui(GetBitContext *gb, AVCodecContext *avctx, vui->bitstream_restriction_flag = get_bits1(gb); if (vui->bitstream_restriction_flag) { + if (get_bits_left(gb) < 8 && !alt) { + av_log(avctx, AV_LOG_WARNING, + "Strange VUI bitstream restriction information, retrying" + " from timing information...\n"); + memcpy(vui, &backup_vui, sizeof(backup_vui)); + memcpy(gb, &backup, sizeof(backup)); + alt = 1; + goto timing_info; + } vui->tiles_fixed_structure_flag = get_bits1(gb); vui->motion_vectors_over_pic_boundaries_flag = get_bits1(gb); vui->restricted_ref_pic_lists_flag = get_bits1(gb); @@ -564,6 +700,16 @@ static void decode_vui(GetBitContext *gb, AVCodecContext *avctx, vui->log2_max_mv_length_horizontal = get_ue_golomb_long(gb); vui->log2_max_mv_length_vertical = get_ue_golomb_long(gb); } + + if (get_bits_left(gb) < 1 && !alt) { + // XXX: Alternate syntax when sps_range_extension_flag != 0? + av_log(avctx, AV_LOG_WARNING, + "Overread in VUI, retrying from timing information...\n"); + memcpy(vui, &backup_vui, sizeof(backup_vui)); + memcpy(gb, &backup, sizeof(backup)); + alt = 1; + goto timing_info; + } } static void set_default_scaling_list_data(ScalingList *sl) @@ -589,24 +735,30 @@ static void set_default_scaling_list_data(ScalingList *sl) memcpy(sl->sl[2][4], default_scaling_list_inter, 64); memcpy(sl->sl[2][5], default_scaling_list_inter, 64); memcpy(sl->sl[3][0], default_scaling_list_intra, 64); - memcpy(sl->sl[3][1], default_scaling_list_inter, 64); + memcpy(sl->sl[3][1], default_scaling_list_intra, 64); + memcpy(sl->sl[3][2], default_scaling_list_intra, 64); + memcpy(sl->sl[3][3], default_scaling_list_inter, 64); + memcpy(sl->sl[3][4], default_scaling_list_inter, 64); + memcpy(sl->sl[3][5], default_scaling_list_inter, 64); } -static int scaling_list_data(GetBitContext *gb, AVCodecContext *avctx, ScalingList *sl) +static int scaling_list_data(GetBitContext *gb, AVCodecContext *avctx, ScalingList *sl, HEVCSPS *sps) { - uint8_t scaling_list_pred_mode_flag[4][6]; + uint8_t scaling_list_pred_mode_flag; int32_t scaling_list_dc_coef[2][6]; - int size_id, matrix_id, i, pos; + int size_id, matrix_id, pos; + int i; for (size_id = 0; size_id < 4; size_id++) - for (matrix_id = 0; matrix_id < (size_id == 3 ? 2 : 6); matrix_id++) { - scaling_list_pred_mode_flag[size_id][matrix_id] = get_bits1(gb); - if (!scaling_list_pred_mode_flag[size_id][matrix_id]) { + for (matrix_id = 0; matrix_id < 6; matrix_id += ((size_id == 3) ? 3 : 1)) { + scaling_list_pred_mode_flag = get_bits1(gb); + if (!scaling_list_pred_mode_flag) { unsigned int delta = get_ue_golomb_long(gb); /* Only need to handle non-zero delta. Zero means default, * which should already be in the arrays. */ if (delta) { // Copy from previous array. + delta *= (size_id == 3) ? 3 : 1; if (matrix_id < delta) { av_log(avctx, AV_LOG_ERROR, "Invalid delta in scaling list data: %d.\n", delta); @@ -639,31 +791,63 @@ static int scaling_list_data(GetBitContext *gb, AVCodecContext *avctx, ScalingLi ff_hevc_diag_scan8x8_x[i]; scaling_list_delta_coef = get_se_golomb(gb); - next_coef = (next_coef + scaling_list_delta_coef + 256) % 256; + next_coef = (next_coef + 256U + scaling_list_delta_coef) % 256; sl->sl[size_id][matrix_id][pos] = next_coef; } } } + if (sps->chroma_format_idc == 3) { + for (i = 0; i < 64; i++) { + sl->sl[3][1][i] = sl->sl[2][1][i]; + sl->sl[3][2][i] = sl->sl[2][2][i]; + sl->sl[3][4][i] = sl->sl[2][4][i]; + sl->sl[3][5][i] = sl->sl[2][5][i]; + } + sl->sl_dc[1][1] = sl->sl_dc[0][1]; + sl->sl_dc[1][2] = sl->sl_dc[0][2]; + sl->sl_dc[1][4] = sl->sl_dc[0][4]; + sl->sl_dc[1][5] = sl->sl_dc[0][5]; + } + + return 0; } static int map_pixel_format(AVCodecContext *avctx, HEVCSPS *sps) { const AVPixFmtDescriptor *desc; - if (sps->chroma_format_idc == 1) { - switch (sps->bit_depth) { - case 8: sps->pix_fmt = AV_PIX_FMT_YUV420P; break; - case 9: sps->pix_fmt = AV_PIX_FMT_YUV420P9; break; - case 10: sps->pix_fmt = AV_PIX_FMT_YUV420P10; break; - default: - avpriv_report_missing_feature(avctx, "Bit depth %d", - sps->bit_depth); - return AVERROR_PATCHWELCOME; - } - } else { - avpriv_report_missing_feature(avctx, "Non-4:2:0 support"); - return AVERROR_PATCHWELCOME; + switch (sps->bit_depth) { + case 8: + if (sps->chroma_format_idc == 0) sps->pix_fmt = AV_PIX_FMT_GRAY8; + if (sps->chroma_format_idc == 1) sps->pix_fmt = AV_PIX_FMT_YUV420P; + if (sps->chroma_format_idc == 2) sps->pix_fmt = AV_PIX_FMT_YUV422P; + if (sps->chroma_format_idc == 3) sps->pix_fmt = AV_PIX_FMT_YUV444P; + break; + case 9: + if (sps->chroma_format_idc == 0) sps->pix_fmt = AV_PIX_FMT_GRAY16; + if (sps->chroma_format_idc == 1) sps->pix_fmt = AV_PIX_FMT_YUV420P9; + if (sps->chroma_format_idc == 2) sps->pix_fmt = AV_PIX_FMT_YUV422P9; + if (sps->chroma_format_idc == 3) sps->pix_fmt = AV_PIX_FMT_YUV444P9; + break; + case 10: + if (sps->chroma_format_idc == 0) sps->pix_fmt = AV_PIX_FMT_GRAY10; + if (sps->chroma_format_idc == 1) sps->pix_fmt = AV_PIX_FMT_YUV420P10; + if (sps->chroma_format_idc == 2) sps->pix_fmt = AV_PIX_FMT_YUV422P10; + if (sps->chroma_format_idc == 3) sps->pix_fmt = AV_PIX_FMT_YUV444P10; + break; + case 12: + if (sps->chroma_format_idc == 0) sps->pix_fmt = AV_PIX_FMT_GRAY12; + if (sps->chroma_format_idc == 1) sps->pix_fmt = AV_PIX_FMT_YUV420P12; + if (sps->chroma_format_idc == 2) sps->pix_fmt = AV_PIX_FMT_YUV422P12; + if (sps->chroma_format_idc == 3) sps->pix_fmt = AV_PIX_FMT_YUV444P12; + break; + default: + av_log(avctx, AV_LOG_ERROR, + "The following bit-depths are currently specified: 8, 9, 10 and 12 bits, " + "chroma_format_idc is %d, depth is %d\n", + sps->chroma_format_idc, sps->bit_depth); + return AVERROR_INVALIDDATA; } desc = av_pix_fmt_desc_get(sps->pix_fmt); @@ -693,59 +877,58 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id, sps->vps_id = get_bits(gb, 4); if (sps->vps_id >= HEVC_MAX_VPS_COUNT) { av_log(avctx, AV_LOG_ERROR, "VPS id out of range: %d\n", sps->vps_id); - ret = AVERROR_INVALIDDATA; - goto err; + return AVERROR_INVALIDDATA; } if (vps_list && !vps_list[sps->vps_id]) { av_log(avctx, AV_LOG_ERROR, "VPS %d does not exist\n", sps->vps_id); - ret = AVERROR_INVALIDDATA; - goto err; + return AVERROR_INVALIDDATA; } sps->max_sub_layers = get_bits(gb, 3) + 1; if (sps->max_sub_layers > HEVC_MAX_SUB_LAYERS) { av_log(avctx, AV_LOG_ERROR, "sps_max_sub_layers out of range: %d\n", sps->max_sub_layers); - ret = AVERROR_INVALIDDATA; - goto err; + return AVERROR_INVALIDDATA; } - skip_bits1(gb); // temporal_id_nesting_flag + sps->temporal_id_nesting_flag = get_bits(gb, 1); - parse_ptl(gb, avctx, &sps->ptl, sps->max_sub_layers); + if ((ret = parse_ptl(gb, avctx, &sps->ptl, sps->max_sub_layers)) < 0) + return ret; *sps_id = get_ue_golomb_long(gb); if (*sps_id >= HEVC_MAX_SPS_COUNT) { av_log(avctx, AV_LOG_ERROR, "SPS id out of range: %d\n", *sps_id); - ret = AVERROR_INVALIDDATA; - goto err; + return AVERROR_INVALIDDATA; } sps->chroma_format_idc = get_ue_golomb_long(gb); - if (sps->chroma_format_idc != 1) { - avpriv_report_missing_feature(avctx, "chroma_format_idc %d", - sps->chroma_format_idc); - ret = AVERROR_PATCHWELCOME; - goto err; + if (sps->chroma_format_idc > 3U) { + av_log(avctx, AV_LOG_ERROR, "chroma_format_idc %d is invalid\n", sps->chroma_format_idc); + return AVERROR_INVALIDDATA; } if (sps->chroma_format_idc == 3) sps->separate_colour_plane_flag = get_bits1(gb); + if (sps->separate_colour_plane_flag) + sps->chroma_format_idc = 0; + sps->width = get_ue_golomb_long(gb); sps->height = get_ue_golomb_long(gb); if ((ret = av_image_check_size(sps->width, sps->height, 0, avctx)) < 0) - goto err; + return ret; if (get_bits1(gb)) { // pic_conformance_flag - //TODO: * 2 is only valid for 420 - sps->pic_conf_win.left_offset = get_ue_golomb_long(gb) * 2; - sps->pic_conf_win.right_offset = get_ue_golomb_long(gb) * 2; - sps->pic_conf_win.top_offset = get_ue_golomb_long(gb) * 2; - sps->pic_conf_win.bottom_offset = get_ue_golomb_long(gb) * 2; + int vert_mult = 1 + (sps->chroma_format_idc < 2); + int horiz_mult = 1 + (sps->chroma_format_idc < 3); + sps->pic_conf_win.left_offset = get_ue_golomb_long(gb) * horiz_mult; + sps->pic_conf_win.right_offset = get_ue_golomb_long(gb) * horiz_mult; + sps->pic_conf_win.top_offset = get_ue_golomb_long(gb) * vert_mult; + sps->pic_conf_win.bottom_offset = get_ue_golomb_long(gb) * vert_mult; if (avctx->flags2 & AV_CODEC_FLAG2_IGNORE_CROP) { av_log(avctx, AV_LOG_DEBUG, @@ -766,26 +949,24 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id, sps->bit_depth = get_ue_golomb_long(gb) + 8; bit_depth_chroma = get_ue_golomb_long(gb) + 8; - if (bit_depth_chroma != sps->bit_depth) { + if (sps->chroma_format_idc && bit_depth_chroma != sps->bit_depth) { av_log(avctx, AV_LOG_ERROR, "Luma bit depth (%d) is different from chroma bit depth (%d), " "this is unsupported.\n", sps->bit_depth, bit_depth_chroma); - ret = AVERROR_INVALIDDATA; - goto err; + return AVERROR_INVALIDDATA; } - + sps->bit_depth_chroma = bit_depth_chroma; ret = map_pixel_format(avctx, sps); if (ret < 0) - goto err; + return ret; sps->log2_max_poc_lsb = get_ue_golomb_long(gb) + 4; if (sps->log2_max_poc_lsb > 16) { av_log(avctx, AV_LOG_ERROR, "log2_max_pic_order_cnt_lsb_minus4 out range: %d\n", sps->log2_max_poc_lsb - 4); - ret = AVERROR_INVALIDDATA; - goto err; + return AVERROR_INVALIDDATA; } sublayer_ordering_info = get_bits1(gb); @@ -794,19 +975,17 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id, sps->temporal_layer[i].max_dec_pic_buffering = get_ue_golomb_long(gb) + 1; sps->temporal_layer[i].num_reorder_pics = get_ue_golomb_long(gb); sps->temporal_layer[i].max_latency_increase = get_ue_golomb_long(gb) - 1; - if (sps->temporal_layer[i].max_dec_pic_buffering > HEVC_MAX_DPB_SIZE) { + if (sps->temporal_layer[i].max_dec_pic_buffering > (unsigned)HEVC_MAX_DPB_SIZE) { av_log(avctx, AV_LOG_ERROR, "sps_max_dec_pic_buffering_minus1 out of range: %d\n", - sps->temporal_layer[i].max_dec_pic_buffering - 1); - ret = AVERROR_INVALIDDATA; - goto err; + sps->temporal_layer[i].max_dec_pic_buffering - 1U); + return AVERROR_INVALIDDATA; } if (sps->temporal_layer[i].num_reorder_pics > sps->temporal_layer[i].max_dec_pic_buffering - 1) { av_log(avctx, AV_LOG_WARNING, "sps_max_num_reorder_pics out of range: %d\n", sps->temporal_layer[i].num_reorder_pics); if (avctx->err_recognition & AV_EF_EXPLODE || sps->temporal_layer[i].num_reorder_pics > HEVC_MAX_DPB_SIZE - 1) { - ret = AVERROR_INVALIDDATA; - goto err; + return AVERROR_INVALIDDATA; } sps->temporal_layer[i].max_dec_pic_buffering = sps->temporal_layer[i].num_reorder_pics + 1; } @@ -827,11 +1006,26 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id, sps->log2_max_trafo_size = log2_diff_max_min_transform_block_size + sps->log2_min_tb_size; - if (sps->log2_min_tb_size >= sps->log2_min_cb_size) { + if (sps->log2_min_cb_size < 3 || sps->log2_min_cb_size > 30) { + av_log(avctx, AV_LOG_ERROR, "Invalid value %d for log2_min_cb_size", sps->log2_min_cb_size); + return AVERROR_INVALIDDATA; + } + + if (sps->log2_diff_max_min_coding_block_size > 30) { + av_log(avctx, AV_LOG_ERROR, "Invalid value %d for log2_diff_max_min_coding_block_size", sps->log2_diff_max_min_coding_block_size); + return AVERROR_INVALIDDATA; + } + + if (sps->log2_min_tb_size >= sps->log2_min_cb_size || sps->log2_min_tb_size < 2) { av_log(avctx, AV_LOG_ERROR, "Invalid value for log2_min_tb_size"); - ret = AVERROR_INVALIDDATA; - goto err; + return AVERROR_INVALIDDATA; } + + if (log2_diff_max_min_transform_block_size < 0 || log2_diff_max_min_transform_block_size > 30) { + av_log(avctx, AV_LOG_ERROR, "Invalid value %d for log2_diff_max_min_transform_block_size", log2_diff_max_min_transform_block_size); + return AVERROR_INVALIDDATA; + } + sps->max_transform_hierarchy_depth_inter = get_ue_golomb_long(gb); sps->max_transform_hierarchy_depth_intra = get_ue_golomb_long(gb); @@ -840,9 +1034,9 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id, set_default_scaling_list_data(&sps->scaling_list); if (get_bits1(gb)) { - ret = scaling_list_data(gb, avctx, &sps->scaling_list); + ret = scaling_list_data(gb, avctx, &sps->scaling_list, sps); if (ret < 0) - goto err; + return ret; } } @@ -856,12 +1050,11 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id, sps->pcm.log2_min_pcm_cb_size = get_ue_golomb_long(gb) + 3; sps->pcm.log2_max_pcm_cb_size = sps->pcm.log2_min_pcm_cb_size + get_ue_golomb_long(gb); - if (sps->pcm.bit_depth > sps->bit_depth) { + if (FFMAX(sps->pcm.bit_depth, sps->pcm.bit_depth_chroma) > sps->bit_depth) { av_log(avctx, AV_LOG_ERROR, - "PCM bit depth (%d) is greater than normal bit depth (%d)\n", - sps->pcm.bit_depth, sps->bit_depth); - ret = AVERROR_INVALIDDATA; - goto err; + "PCM bit depth (%d, %d) is greater than normal bit depth (%d)\n", + sps->pcm.bit_depth, sps->pcm.bit_depth_chroma, sps->bit_depth); + return AVERROR_INVALIDDATA; } sps->pcm.loop_filter_disable_flag = get_bits1(gb); @@ -871,13 +1064,12 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id, if (sps->nb_st_rps > HEVC_MAX_SHORT_TERM_REF_PIC_SETS) { av_log(avctx, AV_LOG_ERROR, "Too many short term RPS: %d.\n", sps->nb_st_rps); - ret = AVERROR_INVALIDDATA; - goto err; + return AVERROR_INVALIDDATA; } for (i = 0; i < sps->nb_st_rps; i++) { if ((ret = ff_hevc_decode_short_term_rps(gb, avctx, &sps->st_rps[i], sps, 0)) < 0) - goto err; + return ret; } sps->long_term_ref_pics_present_flag = get_bits1(gb); @@ -886,8 +1078,7 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id, if (sps->num_long_term_ref_pics_sps > HEVC_MAX_LONG_TERM_REF_PICS) { av_log(avctx, AV_LOG_ERROR, "Too many long term ref pics: %d.\n", sps->num_long_term_ref_pics_sps); - ret = AVERROR_INVALIDDATA; - goto err; + return AVERROR_INVALIDDATA; } for (i = 0; i < sps->num_long_term_ref_pics_sps; i++) { sps->lt_ref_pic_poc_lsb_sps[i] = get_bits(gb, sps->log2_max_poc_lsb); @@ -901,8 +1092,42 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id, vui_present = get_bits1(gb); if (vui_present) decode_vui(gb, avctx, apply_defdispwin, sps); - skip_bits1(gb); // sps_extension_flag + if (get_bits1(gb)) { // sps_extension_flag + int sps_extension_flag[1]; + for (i = 0; i < 1; i++) + sps_extension_flag[i] = get_bits1(gb); + skip_bits(gb, 7); //sps_extension_7bits = get_bits(gb, 7); + if (sps_extension_flag[0]) { + int extended_precision_processing_flag; + int high_precision_offsets_enabled_flag; + int cabac_bypass_alignment_enabled_flag; + + sps->transform_skip_rotation_enabled_flag = get_bits1(gb); + sps->transform_skip_context_enabled_flag = get_bits1(gb); + sps->implicit_rdpcm_enabled_flag = get_bits1(gb); + + sps->explicit_rdpcm_enabled_flag = get_bits1(gb); + + extended_precision_processing_flag = get_bits1(gb); + if (extended_precision_processing_flag) + av_log(avctx, AV_LOG_WARNING, + "extended_precision_processing_flag not yet implemented\n"); + + sps->intra_smoothing_disabled_flag = get_bits1(gb); + high_precision_offsets_enabled_flag = get_bits1(gb); + if (high_precision_offsets_enabled_flag) + av_log(avctx, AV_LOG_WARNING, + "high_precision_offsets_enabled_flag not yet implemented\n"); + + sps->persistent_rice_adaptation_enabled_flag = get_bits1(gb); + + cabac_bypass_alignment_enabled_flag = get_bits1(gb); + if (cabac_bypass_alignment_enabled_flag) + av_log(avctx, AV_LOG_WARNING, + "cabac_bypass_alignment_enabled_flag not yet implemented\n"); + } + } if (apply_defdispwin) { sps->output_window.left_offset += sps->vui.def_disp_win.left_offset; sps->output_window.right_offset += sps->vui.def_disp_win.right_offset; @@ -918,12 +1143,12 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id, av_log(avctx, AV_LOG_WARNING, "Invalid cropping offsets: %u/%u/%u/%u\n", ow->left_offset, ow->right_offset, ow->top_offset, ow->bottom_offset); if (avctx->err_recognition & AV_EF_EXPLODE) { - ret = AVERROR_INVALIDDATA; - goto err; + return AVERROR_INVALIDDATA; } av_log(avctx, AV_LOG_WARNING, "Displaying the whole video surface.\n"); memset(ow, 0, sizeof(*ow)); + memset(&sps->pic_conf_win, 0, sizeof(sps->pic_conf_win)); } // Inferred parameters @@ -931,6 +1156,19 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id, sps->log2_diff_max_min_coding_block_size; sps->log2_min_pu_size = sps->log2_min_cb_size - 1; + if (sps->log2_ctb_size > HEVC_MAX_LOG2_CTB_SIZE) { + av_log(avctx, AV_LOG_ERROR, "CTB size out of range: 2^%d\n", sps->log2_ctb_size); + return AVERROR_INVALIDDATA; + } + if (sps->log2_ctb_size < 4) { + av_log(avctx, + AV_LOG_ERROR, + "log2_ctb_size %d differs from the bounds of any known profile\n", + sps->log2_ctb_size); + avpriv_request_sample(avctx, "log2_ctb_size %d", sps->log2_ctb_size); + return AVERROR_INVALIDDATA; + } + sps->ctb_width = (sps->width + (1 << sps->log2_ctb_size) - 1) >> sps->log2_ctb_size; sps->ctb_height = (sps->height + (1 << sps->log2_ctb_size) - 1) >> sps->log2_ctb_size; sps->ctb_size = sps->ctb_width * sps->ctb_height; @@ -941,40 +1179,40 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id, sps->min_tb_height = sps->height >> sps->log2_min_tb_size; sps->min_pu_width = sps->width >> sps->log2_min_pu_size; sps->min_pu_height = sps->height >> sps->log2_min_pu_size; + sps->tb_mask = (1 << (sps->log2_ctb_size - sps->log2_min_tb_size)) - 1; sps->qp_bd_offset = 6 * (sps->bit_depth - 8); - if (sps->width & ((1 << sps->log2_min_cb_size) - 1) || - sps->height & ((1 << sps->log2_min_cb_size) - 1)) { + if (av_mod_uintp2(sps->width, sps->log2_min_cb_size) || + av_mod_uintp2(sps->height, sps->log2_min_cb_size)) { av_log(avctx, AV_LOG_ERROR, "Invalid coded frame dimensions.\n"); - goto err; + return AVERROR_INVALIDDATA; } - if (sps->log2_ctb_size > HEVC_MAX_LOG2_CTB_SIZE) { - av_log(avctx, AV_LOG_ERROR, "CTB size out of range: 2^%d\n", sps->log2_ctb_size); - goto err; - } if (sps->max_transform_hierarchy_depth_inter > sps->log2_ctb_size - sps->log2_min_tb_size) { av_log(avctx, AV_LOG_ERROR, "max_transform_hierarchy_depth_inter out of range: %d\n", sps->max_transform_hierarchy_depth_inter); - goto err; + return AVERROR_INVALIDDATA; } if (sps->max_transform_hierarchy_depth_intra > sps->log2_ctb_size - sps->log2_min_tb_size) { av_log(avctx, AV_LOG_ERROR, "max_transform_hierarchy_depth_intra out of range: %d\n", sps->max_transform_hierarchy_depth_intra); - goto err; + return AVERROR_INVALIDDATA; } if (sps->log2_max_trafo_size > FFMIN(sps->log2_ctb_size, 5)) { av_log(avctx, AV_LOG_ERROR, "max transform block size out of range: %d\n", sps->log2_max_trafo_size); - goto err; + return AVERROR_INVALIDDATA; } - return 0; + if (get_bits_left(gb) < 0) { + av_log(avctx, AV_LOG_ERROR, + "Overread SPS by %d bits\n", -get_bits_left(gb)); + return AVERROR_INVALIDDATA; + } -err: - return ret < 0 ? ret : AVERROR_INVALIDDATA; + return 0; } int ff_hevc_decode_nal_sps(GetBitContext *gb, AVCodecContext *avctx, @@ -984,6 +1222,7 @@ int ff_hevc_decode_nal_sps(GetBitContext *gb, AVCodecContext *avctx, AVBufferRef *sps_buf = av_buffer_allocz(sizeof(*sps)); unsigned int sps_id; int ret; + ptrdiff_t nal_size; if (!sps_buf) return AVERROR(ENOMEM); @@ -991,6 +1230,17 @@ int ff_hevc_decode_nal_sps(GetBitContext *gb, AVCodecContext *avctx, av_log(avctx, AV_LOG_DEBUG, "Decoding SPS\n"); + nal_size = gb->buffer_end - gb->buffer; + if (nal_size > sizeof(sps->data)) { + av_log(avctx, AV_LOG_WARNING, "Truncating likely oversized SPS " + "(%"PTRDIFF_SPECIFIER" > %"SIZE_SPECIFIER")\n", + nal_size, sizeof(sps->data)); + sps->data_size = sizeof(sps->data); + } else { + sps->data_size = nal_size; + } + memcpy(sps->data, gb->buffer, sps->data_size); + ret = ff_hevc_parse_sps(sps, gb, &sps_id, apply_defdispwin, ps->vps_list, avctx); @@ -1036,16 +1286,57 @@ static void hevc_pps_free(void *opaque, uint8_t *data) av_freep(&pps->ctb_addr_ts_to_rs); av_freep(&pps->tile_pos_rs); av_freep(&pps->tile_id); - av_freep(&pps->min_tb_addr_zs); + av_freep(&pps->min_tb_addr_zs_tab); av_freep(&pps); } +static int pps_range_extensions(GetBitContext *gb, AVCodecContext *avctx, + HEVCPPS *pps, HEVCSPS *sps) { + int i; + + if (pps->transform_skip_enabled_flag) { + pps->log2_max_transform_skip_block_size = get_ue_golomb_long(gb) + 2; + } + pps->cross_component_prediction_enabled_flag = get_bits1(gb); + pps->chroma_qp_offset_list_enabled_flag = get_bits1(gb); + if (pps->chroma_qp_offset_list_enabled_flag) { + pps->diff_cu_chroma_qp_offset_depth = get_ue_golomb_long(gb); + pps->chroma_qp_offset_list_len_minus1 = get_ue_golomb_long(gb); + if (pps->chroma_qp_offset_list_len_minus1 > 5) { + av_log(avctx, AV_LOG_ERROR, + "chroma_qp_offset_list_len_minus1 shall be in the range [0, 5].\n"); + return AVERROR_INVALIDDATA; + } + for (i = 0; i <= pps->chroma_qp_offset_list_len_minus1; i++) { + pps->cb_qp_offset_list[i] = get_se_golomb_long(gb); + if (pps->cb_qp_offset_list[i]) { + av_log(avctx, AV_LOG_WARNING, + "cb_qp_offset_list not tested yet.\n"); + } + pps->cr_qp_offset_list[i] = get_se_golomb_long(gb); + if (pps->cr_qp_offset_list[i]) { + av_log(avctx, AV_LOG_WARNING, + "cb_qp_offset_list not tested yet.\n"); + } + } + } + pps->log2_sao_offset_scale_luma = get_ue_golomb_long(gb); + pps->log2_sao_offset_scale_chroma = get_ue_golomb_long(gb); + + if ( pps->log2_sao_offset_scale_luma > FFMAX(sps->bit_depth - 10, 0) + || pps->log2_sao_offset_scale_chroma > FFMAX(sps->bit_depth_chroma - 10, 0) + ) + return AVERROR_INVALIDDATA; + + return(0); +} + static inline int setup_pps(AVCodecContext *avctx, GetBitContext *gb, HEVCPPS *pps, HEVCSPS *sps) { int log2_diff; - int pic_area_in_ctbs, pic_area_in_min_tbs; + int pic_area_in_ctbs; int i, j, x, y, ctb_addr_rs, tile_id; // Inferred parameters @@ -1092,14 +1383,13 @@ static inline int setup_pps(AVCodecContext *avctx, GetBitContext *gb, * 6.5 */ pic_area_in_ctbs = sps->ctb_width * sps->ctb_height; - pic_area_in_min_tbs = sps->min_tb_width * sps->min_tb_height; pps->ctb_addr_rs_to_ts = av_malloc_array(pic_area_in_ctbs, sizeof(*pps->ctb_addr_rs_to_ts)); pps->ctb_addr_ts_to_rs = av_malloc_array(pic_area_in_ctbs, sizeof(*pps->ctb_addr_ts_to_rs)); pps->tile_id = av_malloc_array(pic_area_in_ctbs, sizeof(*pps->tile_id)); - pps->min_tb_addr_zs = av_malloc_array(pic_area_in_min_tbs, sizeof(*pps->min_tb_addr_zs)); + pps->min_tb_addr_zs_tab = av_malloc_array((sps->tb_mask+2) * (sps->tb_mask+2), sizeof(*pps->min_tb_addr_zs_tab)); if (!pps->ctb_addr_rs_to_ts || !pps->ctb_addr_ts_to_rs || - !pps->tile_id || !pps->min_tb_addr_zs) { + !pps->tile_id || !pps->min_tb_addr_zs_tab) { return AVERROR(ENOMEM); } @@ -1152,8 +1442,13 @@ static inline int setup_pps(AVCodecContext *avctx, GetBitContext *gb, pps->row_bd[j] * sps->ctb_width + pps->col_bd[i]; log2_diff = sps->log2_ctb_size - sps->log2_min_tb_size; - for (y = 0; y < sps->min_tb_height; y++) { - for (x = 0; x < sps->min_tb_width; x++) { + pps->min_tb_addr_zs = &pps->min_tb_addr_zs_tab[1*(sps->tb_mask+2)+1]; + for (y = 0; y < sps->tb_mask+2; y++) { + pps->min_tb_addr_zs_tab[y*(sps->tb_mask+2)] = -1; + pps->min_tb_addr_zs_tab[y] = -1; + } + for (y = 0; y < sps->tb_mask+1; y++) { + for (x = 0; x < sps->tb_mask+1; x++) { int tb_x = x >> log2_diff; int tb_y = y >> log2_diff; int rs = sps->ctb_width * tb_y + tb_x; @@ -1162,7 +1457,7 @@ static inline int setup_pps(AVCodecContext *avctx, GetBitContext *gb, int m = 1 << i; val += (m & x ? m * m : 0) + (m & y ? 2 * m * m : 0); } - pps->min_tb_addr_zs[y * sps->min_tb_width + x] = val; + pps->min_tb_addr_zs[y * (sps->tb_mask+2) + x] = val; } } @@ -1175,6 +1470,8 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb, AVCodecContext *avctx, HEVCSPS *sps = NULL; int i, ret = 0; unsigned int pps_id = 0; + ptrdiff_t nal_size; + unsigned log2_parallel_merge_level_minus2; AVBufferRef *pps_buf; HEVCPPS *pps = av_mallocz(sizeof(*pps)); @@ -1191,6 +1488,17 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb, AVCodecContext *avctx, av_log(avctx, AV_LOG_DEBUG, "Decoding PPS\n"); + nal_size = gb->buffer_end - gb->buffer; + if (nal_size > sizeof(pps->data)) { + av_log(avctx, AV_LOG_WARNING, "Truncating likely oversized PPS " + "(%"PTRDIFF_SPECIFIER" > %"SIZE_SPECIFIER")\n", + nal_size, sizeof(pps->data)); + pps->data_size = sizeof(pps->data); + } else { + pps->data_size = nal_size; + } + memcpy(pps->data, gb->buffer, pps->data_size); + // Default values pps->loop_filter_across_tiles_enabled_flag = 1; pps->num_tile_columns = 1; @@ -1199,6 +1507,7 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb, AVCodecContext *avctx, pps->disable_dbf = 0; pps->beta_offset = 0; pps->tc_offset = 0; + pps->log2_max_transform_skip_block_size = 2; // Coded parameters pps_id = get_ue_golomb_long(gb); @@ -1241,6 +1550,14 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb, AVCodecContext *avctx, if (pps->cu_qp_delta_enabled_flag) pps->diff_cu_qp_delta_depth = get_ue_golomb_long(gb); + if (pps->diff_cu_qp_delta_depth < 0 || + pps->diff_cu_qp_delta_depth > sps->log2_diff_max_min_coding_block_size) { + av_log(avctx, AV_LOG_ERROR, "diff_cu_qp_delta_depth %d is invalid\n", + pps->diff_cu_qp_delta_depth); + ret = AVERROR_INVALIDDATA; + goto err; + } + pps->cb_qp_offset = get_se_golomb(gb); if (pps->cb_qp_offset < -12 || pps->cb_qp_offset > 12) { av_log(avctx, AV_LOG_ERROR, "pps_cb_qp_offset out of range: %d\n", @@ -1267,14 +1584,14 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb, AVCodecContext *avctx, if (pps->tiles_enabled_flag) { pps->num_tile_columns = get_ue_golomb_long(gb) + 1; pps->num_tile_rows = get_ue_golomb_long(gb) + 1; - if (pps->num_tile_columns == 0 || + if (pps->num_tile_columns <= 0 || pps->num_tile_columns >= sps->width) { av_log(avctx, AV_LOG_ERROR, "num_tile_columns_minus1 out of range: %d\n", pps->num_tile_columns - 1); ret = AVERROR_INVALIDDATA; goto err; } - if (pps->num_tile_rows == 0 || + if (pps->num_tile_rows <= 0 || pps->num_tile_rows >= sps->height) { av_log(avctx, AV_LOG_ERROR, "num_tile_rows_minus1 out of range: %d\n", pps->num_tile_rows - 1); @@ -1325,46 +1642,63 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb, AVCodecContext *avctx, pps->deblocking_filter_override_enabled_flag = get_bits1(gb); pps->disable_dbf = get_bits1(gb); if (!pps->disable_dbf) { - pps->beta_offset = get_se_golomb(gb) * 2; - pps->tc_offset = get_se_golomb(gb) * 2; - if (pps->beta_offset/2 < -6 || pps->beta_offset/2 > 6) { + int beta_offset_div2 = get_se_golomb(gb); + int tc_offset_div2 = get_se_golomb(gb) ; + if (beta_offset_div2 < -6 || beta_offset_div2 > 6) { av_log(avctx, AV_LOG_ERROR, "pps_beta_offset_div2 out of range: %d\n", - pps->beta_offset/2); + beta_offset_div2); ret = AVERROR_INVALIDDATA; goto err; } - if (pps->tc_offset/2 < -6 || pps->tc_offset/2 > 6) { + if (tc_offset_div2 < -6 || tc_offset_div2 > 6) { av_log(avctx, AV_LOG_ERROR, "pps_tc_offset_div2 out of range: %d\n", - pps->tc_offset/2); + tc_offset_div2); ret = AVERROR_INVALIDDATA; goto err; } + pps->beta_offset = 2 * beta_offset_div2; + pps->tc_offset = 2 * tc_offset_div2; } } pps->scaling_list_data_present_flag = get_bits1(gb); if (pps->scaling_list_data_present_flag) { set_default_scaling_list_data(&pps->scaling_list); - ret = scaling_list_data(gb, avctx, &pps->scaling_list); + ret = scaling_list_data(gb, avctx, &pps->scaling_list, sps); if (ret < 0) goto err; } pps->lists_modification_present_flag = get_bits1(gb); - pps->log2_parallel_merge_level = get_ue_golomb_long(gb) + 2; - if (pps->log2_parallel_merge_level > sps->log2_ctb_size) { + log2_parallel_merge_level_minus2 = get_ue_golomb_long(gb); + if (log2_parallel_merge_level_minus2 > sps->log2_ctb_size) { av_log(avctx, AV_LOG_ERROR, "log2_parallel_merge_level_minus2 out of range: %d\n", - pps->log2_parallel_merge_level - 2); + log2_parallel_merge_level_minus2); ret = AVERROR_INVALIDDATA; goto err; } + pps->log2_parallel_merge_level = log2_parallel_merge_level_minus2 + 2; pps->slice_header_extension_present_flag = get_bits1(gb); - skip_bits1(gb); // pps_extension_flag + + if (get_bits1(gb)) { // pps_extension_present_flag + int pps_range_extensions_flag = get_bits1(gb); + /* int pps_extension_7bits = */ get_bits(gb, 7); + if (sps->ptl.general_ptl.profile_idc == FF_PROFILE_HEVC_REXT && pps_range_extensions_flag) { + if ((ret = pps_range_extensions(gb, avctx, pps, sps)) < 0) + goto err; + } + } ret = setup_pps(avctx, gb, pps, sps); if (ret < 0) goto err; + if (get_bits_left(gb) < 0) { + av_log(avctx, AV_LOG_ERROR, + "Overread PPS by %d bits\n", -get_bits_left(gb)); + goto err; + } + remove_pps(ps, pps_id); ps->pps_list[pps_id] = pps_buf; @@ -1374,3 +1708,42 @@ err: av_buffer_unref(&pps_buf); return ret; } + +void ff_hevc_ps_uninit(HEVCParamSets *ps) +{ + int i; + + for (i = 0; i < FF_ARRAY_ELEMS(ps->vps_list); i++) + av_buffer_unref(&ps->vps_list[i]); + for (i = 0; i < FF_ARRAY_ELEMS(ps->sps_list); i++) + av_buffer_unref(&ps->sps_list[i]); + for (i = 0; i < FF_ARRAY_ELEMS(ps->pps_list); i++) + av_buffer_unref(&ps->pps_list[i]); + + ps->sps = NULL; + ps->pps = NULL; + ps->vps = NULL; +} + +int ff_hevc_compute_poc(const HEVCSPS *sps, int pocTid0, int poc_lsb, int nal_unit_type) +{ + int max_poc_lsb = 1 << sps->log2_max_poc_lsb; + int prev_poc_lsb = pocTid0 % max_poc_lsb; + int prev_poc_msb = pocTid0 - prev_poc_lsb; + int poc_msb; + + if (poc_lsb < prev_poc_lsb && prev_poc_lsb - poc_lsb >= max_poc_lsb / 2) + poc_msb = prev_poc_msb + max_poc_lsb; + else if (poc_lsb > prev_poc_lsb && poc_lsb - prev_poc_lsb > max_poc_lsb / 2) + poc_msb = prev_poc_msb - max_poc_lsb; + else + poc_msb = prev_poc_msb; + + // For BLA picture types, POCmsb is set to 0. + if (nal_unit_type == HEVC_NAL_BLA_W_LP || + nal_unit_type == HEVC_NAL_BLA_W_RADL || + nal_unit_type == HEVC_NAL_BLA_N_LP) + poc_msb = 0; + + return poc_msb + poc_lsb; +} |