Skip to content

media/hevc_d: Do not reject slice header with bad ref_idx entries - #7620

Merged
pelwell merged 1 commit into
raspberrypi:rpi-6.18.yfrom
jc-kynesim:dev/6.18.y/fix_bad_idx_1
Sep 15, 2026
Merged

pelwell merged 1 commit into
raspberrypi:rpi-6.18.yfrom
jc-kynesim:dev/6.18.y/fix_bad_idx_1

Conversation

@jc-kynesim

Copy link
Copy Markdown
Contributor

The previous patch to hevc_d checked that the entries in ref_idx were legal and rejected the slice header if not. Unfortunately gstreamer marks missing frames in this manner and expects decode to continue. Stop rejecting the header and produce a sanitized copy of ref_idx_lX that we use for the decode.

Tested with a hacked ffmpeg that corrupted the ref_idx_lX entries on a regular basis.

The previous patch to hevc_d checked that the entries in ref_idx
were legal and rejected the slice header if not. Unfortunately
gstreamer marks missing frames in this manner and expects decode
to continue. Stop rejecting the header and produce a sanitized
copy of ref_idx_lX that we use for the decode.

Signed-off-by: John Cox <jc@kynesim.co.uk>

@6by9 6by9 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@popcornmix I'm not expecting you to be too fussed over this one as it is covering invalid streams (references to invalid reference frames), but you might want to review or test it.

@popcornmix

Copy link
Copy Markdown
Collaborator

I do have this in my home kodi build, and I've not seen any issue.

@pelwell

pelwell commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

Good enough for me.

@pelwell
pelwell merged commit 4bb2406 into raspberrypi:rpi-6.18.y Sep 15, 2026
12 checks passed
popcornmix added a commit to raspberrypi/firmware that referenced this pull request Sep 15, 2026
kernel: drm/mipi-dbi: display a cropped region of an oversized framebuffer
See: raspberrypi/linux#7589

kernel: media: i2c: imx296: Add strobe outputs, controlled by module parameters
See: raspberrypi/linux#7606

kernel: Correctly unbind CFE
See: raspberrypi/linux#7624

kernel: media/hevc_d: Do not reject slice header with bad ref_idx entries
See: raspberrypi/linux#7620
popcornmix added a commit to raspberrypi/rpi-firmware that referenced this pull request Sep 15, 2026
kernel: drm/mipi-dbi: display a cropped region of an oversized framebuffer
See: raspberrypi/linux#7589

kernel: media: i2c: imx296: Add strobe outputs, controlled by module parameters
See: raspberrypi/linux#7606

kernel: Correctly unbind CFE
See: raspberrypi/linux#7624

kernel: media/hevc_d: Do not reject slice header with bad ref_idx entries
See: raspberrypi/linux#7620
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants