From a8151d78fc946c142d63682055adad9534083ac6 Mon Sep 17 00:00:00 2001
From: "duhui.lee" <duhui.lee@lge.com>
Date: Tue, 14 Jan 2014 23:21:25 +0900
Subject: [PATCH] h265parser: Fix segfault when parsing VPS

https://bugzilla.gnome.org/show_bug.cgi?id=722081
---
 gst-libs/gst/codecparsers/gsth265parser.c | 12 ++++++------
 gst-libs/gst/codecparsers/gsth265parser.h | 13 +++++++------
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/gst-libs/gst/codecparsers/gsth265parser.c b/gst-libs/gst/codecparsers/gsth265parser.c
index 7a89353d68..94fed0ec3e 100644
--- a/gst-libs/gst/codecparsers/gsth265parser.c
+++ b/gst-libs/gst/codecparsers/gsth265parser.c
@@ -1714,12 +1714,12 @@ gst_h265_parse_vps (GstH265NalUnit * nalu, GstH265VPS * vps)
         G_MAXUINT32 - 1);
   }
   /* setting default values if vps->sub_layer_ordering_info_present_flag is zero */
-  if (!vps->sub_layer_ordering_info_present_flag) {
+  if (!vps->sub_layer_ordering_info_present_flag && vps->max_sub_layers_minus1) {
     for (i = 0; i <= (vps->max_sub_layers_minus1 - 1); i++) {
       vps->max_dec_pic_buffering_minus1[i] =
           vps->max_dec_pic_buffering_minus1[vps->max_sub_layers_minus1];
-      vps->max_dec_pic_buffering_minus1[i] =
-          vps->max_dec_pic_buffering_minus1[vps->max_sub_layers_minus1];
+      vps->max_num_reorder_pics[i] =
+          vps->max_num_reorder_pics[vps->max_sub_layers_minus1];
       vps->max_latency_increase_plus1[i] =
           vps->max_latency_increase_plus1[vps->max_sub_layers_minus1];
     }
@@ -1881,12 +1881,12 @@ gst_h265_parse_sps (GstH265Parser * parser, GstH265NalUnit * nalu,
         G_MAXUINT32 - 1);
   }
   /* setting default values if sps->sub_layer_ordering_info_present_flag is zero */
-  if (!sps->sub_layer_ordering_info_present_flag) {
+  if (!sps->sub_layer_ordering_info_present_flag && sps->max_sub_layers_minus1) {
     for (i = 0; i <= (sps->max_sub_layers_minus1 - 1); i++) {
       sps->max_dec_pic_buffering_minus1[i] =
           sps->max_dec_pic_buffering_minus1[sps->max_sub_layers_minus1];
-      sps->max_dec_pic_buffering_minus1[i] =
-          sps->max_dec_pic_buffering_minus1[sps->max_sub_layers_minus1];
+      sps->max_num_reorder_pics[i] =
+          sps->max_num_reorder_pics[sps->max_sub_layers_minus1];
       sps->max_latency_increase_plus1[i] =
           sps->max_latency_increase_plus1[sps->max_sub_layers_minus1];
     }
diff --git a/gst-libs/gst/codecparsers/gsth265parser.h b/gst-libs/gst/codecparsers/gsth265parser.h
index 57cc00ce41..65ddec05a7 100644
--- a/gst-libs/gst/codecparsers/gsth265parser.h
+++ b/gst-libs/gst/codecparsers/gsth265parser.h
@@ -32,6 +32,7 @@
 
 G_BEGIN_DECLS
 
+#define GST_H265_MAX_SUB_LAYERS   8
 #define GST_H265_MAX_VPS_COUNT   16
 #define GST_H265_MAX_SPS_COUNT   16
 #define GST_H265_MAX_PPS_COUNT   64
@@ -463,9 +464,9 @@ struct _GstH265VPS {
   GstH265ProfileTierLevel profile_tier_level;
 
   guint8 sub_layer_ordering_info_present_flag;
-  guint8 max_dec_pic_buffering_minus1[7];
-  guint8 max_num_reorder_pics[7];
-  guint32 max_latency_increase_plus1[7];
+  guint8 max_dec_pic_buffering_minus1[GST_H265_MAX_SUB_LAYERS];
+  guint8 max_num_reorder_pics[GST_H265_MAX_SUB_LAYERS];
+  guint32 max_latency_increase_plus1[GST_H265_MAX_SUB_LAYERS];
 
   guint8 max_layer_id;
   guint16 num_layer_sets_minus1;
@@ -703,9 +704,9 @@ struct _GstH265SPS
   guint8 log2_max_pic_order_cnt_lsb_minus4;
 
   guint8 sub_layer_ordering_info_present_flag;
-  guint8 max_dec_pic_buffering_minus1[7];
-  guint8 max_num_reorder_pics[7];
-  guint8 max_latency_increase_plus1[7];
+  guint8 max_dec_pic_buffering_minus1[GST_H265_MAX_SUB_LAYERS];
+  guint8 max_num_reorder_pics[GST_H265_MAX_SUB_LAYERS];
+  guint8 max_latency_increase_plus1[GST_H265_MAX_SUB_LAYERS];
 
   guint8 log2_min_luma_coding_block_size_minus3;
   guint8 log2_diff_max_min_luma_coding_block_size;