Opened 7 years ago

Closed 6 years ago

#1099 closed defect (duplicate)

Repeating the active SPS leaves a dangling pointer in previously decoded pictures

Reported by: jackh Owned by:
Priority: minor Milestone:
Component: HM Version: HM-10.0
Keywords: Cc: fbossen, ksuehring, davidf, jct-vc@…

Description

I have a stream which has an SPS_NUT NAL in the middle of a CVS which repeats the active SPS. I think this is legal by the spec; section 7.4.2.4.2 says:

Any SPS NAL unit containing the value of sps_seq_parameter_set_id for the active SPS RBSP for a CVS shall have the same content as that of the active SPS RBSP for the CVS, unless it follows the last access unit of the CVS and precedes the first VCL NAL unit and the first SEI NAL unit containing an active parameter sets SEI message (when present) of another CVS.

When the reference decoder is parsing this stream, it calls ParameterSetManagerDecoder::storePrefetchedSPS() (TDecSlice.cpp). This causes the previous copy of the SPS to be deleted and the newly allocated pointer to be stored. Any references held by stored slices to the previous pointer become dangling pointers, and can subsequently crash the reference picture set code. I would imagine that the same problem will be seen for PPSs and VPSs

I can see several possible solutions to this problem:

1) Just store the parameter set ID in the slice rather than a pointer, and look up the parameter set in the ParameterSetManager every time it's needed, so that the new pointer will be picked up. This might be a problem for PPSs, as they could legitimately have been replaced since the slice was decoded, so the slice might end up referring to the wrong PPS.

2) Check if the parameter sets are equal to each other before storing them. If so, don't change the existing pointer. This will have the same problem as above for PPSs, and incurs processing time for checking equality of all parameters (although this would enable the decoder to detect the non-conformant case when the active SPS or VPS is being replaced by a different SPS or VPS)

3) Use std::shared_ptr to refer to parameter sets. This way they will be deleted once no further references are held to them, and slices will always hold the parameter sets they originally referred to.

Attachments (2)

SVN_HEVCSoftware_trunk_replace_parameter_set.patch (1.0 KB) - added by jackh 7 years ago.
SVN_HEVCSoftware_trunk_ps_shared_ptr.patch (63.0 KB) - added by jackh 7 years ago.

Download all attachments as: .zip

Change History (7)

comment:1 Changed 7 years ago by DefaultCC Plugin

  • Cc fbossen ksuehring davidf jct-vc@… added

comment:2 Changed 7 years ago by jackh

Patch attached which addresses the SPS and VPS issue by not replacing the pointer if an SPS or VPS is encountered whose ID matches the active SPS or VPS. This patch doesn't check if the new SPS or VPS is the same as the old one, so it won't catch non-conformant streams that provide a different SPS or VPS with the same ID as the active one, but it does stop the reference decoder crashing on legitimate streams of this type. It also doesn't address the PPS issue.

comment:3 Changed 7 years ago by jackh

This is a much more extensive patch which fixes the problem properly using shared_ptrs. The previous patch had an issue in that it would block the changing of VPS/SPSs between CVSs, if the VPS/SPS being changed had the same number as the previous active VPS/SPS.

The new patch applies directly to the trunk, no need to apply the previous patch first.

comment:4 Changed 7 years ago by ksuehring

  • Milestone HM-10.1 deleted

comment:5 Changed 6 years ago by ksuehring

  • Resolution set to duplicate
  • Status changed from new to closed

Closed as duplicate of #1330.
A new report has been added with updated patches. Closing this as duplicate.

Note: See TracTickets for help on using tickets.

This list contains all users that will be notified about changes made to this ticket.

These roles will be notified: Reporter, Owner, Subscriber, Participant

  • David Flynn(Subscriber)
  • Frank Bossen(Subscriber)
  • Jack Haughton(Reporter, Participant)
  • jct-vc@…(Subscriber)
  • karl.sharman@…(Always)
  • Karsten Suehring(Subscriber, Participant, Always)