From 7c644989a5c27793331a14ee0f433ca177a0ffae Mon Sep 17 00:00:00 2001 From: James Almer Date: Sun, 30 Jun 2019 17:32:44 -0300 Subject: [PATCH] avcodec/hevc_ps: fix range of num_tile_{columns,rows}_minus1 From 7.4.3.3.1: num_tile_columns_minus1 shall be in the range of 0 to PicWidthInCtbsY - 1, inclusive. num_tile_rows_minus1 shall be in the range of 0 to PicHeightInCtbsY - 1, inclusive. Reviewed-by: Michael Niedermayer Signed-off-by: James Almer --- libavcodec/hevc_ps.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c index f6e80e1609..abf08b919b 100644 --- a/libavcodec/hevc_ps.c +++ b/libavcodec/hevc_ps.c @@ -1588,14 +1588,14 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb, AVCodecContext *avctx, int num_tile_rows_minus1 = get_ue_golomb(gb); if (num_tile_columns_minus1 < 0 || - num_tile_columns_minus1 >= sps->ctb_width - 1) { + num_tile_columns_minus1 >= sps->ctb_width) { av_log(avctx, AV_LOG_ERROR, "num_tile_columns_minus1 out of range: %d\n", num_tile_columns_minus1); ret = num_tile_columns_minus1 < 0 ? num_tile_columns_minus1 : AVERROR_INVALIDDATA; goto err; } if (num_tile_rows_minus1 < 0 || - num_tile_rows_minus1 >= sps->ctb_height - 1) { + num_tile_rows_minus1 >= sps->ctb_height) { av_log(avctx, AV_LOG_ERROR, "num_tile_rows_minus1 out of range: %d\n", num_tile_rows_minus1); ret = num_tile_rows_minus1 < 0 ? num_tile_rows_minus1 : AVERROR_INVALIDDATA;