id	summary	reporter	owner	description	type	status	priority	milestone	component	version	resolution	keywords	cc
1060	Segmentation fault when decoding streams with multiple picture parameter sets	peterderivaz	ksuehring	"If a stream uses a PPS that is not the most recent, then we can get a segmentation fault in the reference decoder.

This applies to both the version tagged 10.0, and the current development branch (as of 2 April 2013).

{{{
Program received signal SIGSEGV, Segmentation fault.
__memcpy_ssse3_back () at ../sysdeps/x86_64/multiarch/memcpy-ssse3-back.S:1524
	in ../sysdeps/x86_64/multiarch/memcpy-ssse3-back.S
#1  0x0000000000430135 in TDecSbac::xCopyContextsFrom (this=0xa776c8, pSrc=0xa17e48) at /apollo/pfcd/work/hevc/HM-10.0dev/build/linux/lib/TLibDecoder/../../../../source/Lib/TLibDecoder/TDecSbac.cpp:1532
}}}

The reason appears to be that the size of the context memory is set in TDecTop::xDecodePPS via line 604 of TDecTop.cpp to be
{{{
Int NumCtx = pps->getEntropyCodingSyncEnabledFlag()?2:1;
}}}

This code is activated when a PPS is decoded.  The problem occurs if we have a PPS with EntropyCodingSyncEnabledFlag==1, followed by another with EntropyCodingSyncEnabledFlag==0, followed by a CVS that uses the first PPS.

This ends up trying to use m_cSliceDecoder.CTXMem[1] which is now pointing to deallocated memory.

Note that the specification includes the constraint
{{{
It is a requirement of bitstream conformance that the value of entropy_coding_sync_enabled_flag shall be the same for all PPSs that are activated within a CVS.
}}}
However, this does not appear to prohibit this case as only a single PPS is activated within the CVS.

Perhaps a workaround would be to always set NumCtx equal to 2?"	defect	closed	minor	HM-10.1	HM	HM-10.0	fixed		fbossen ksuehring davidf jct-vc@…