From b6305a787330af716377f89d1a09afad38c3f05f Mon Sep 17 00:00:00 2001 From: Andreas Rheinhardt Date: Sun, 16 Jul 2023 16:01:58 +0200 Subject: [PATCH] avcodec/evc_ps: Fix size of tile_(row|column) arrays Prevents out-of-bound writes when parsing tile row heights. Fixes Coverity issue #1538300. Reviewed-by: James Almer Signed-off-by: Andreas Rheinhardt --- libavcodec/evc_ps.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/evc_ps.h b/libavcodec/evc_ps.h index 0bbec1f138..336953b176 100644 --- a/libavcodec/evc_ps.h +++ b/libavcodec/evc_ps.h @@ -192,8 +192,8 @@ typedef struct EVCParserPPS { uint32_t num_tile_columns_minus1; // ue(v) uint32_t num_tile_rows_minus1; // ue(v) uint8_t uniform_tile_spacing_flag; // u(1) - uint32_t tile_column_width_minus1[EVC_MAX_TILE_ROWS]; // ue(v) - uint32_t tile_row_height_minus1[EVC_MAX_TILE_COLUMNS]; // ue(v) + uint32_t tile_column_width_minus1[EVC_MAX_TILE_COLUMNS]; // ue(v) + uint32_t tile_row_height_minus1[EVC_MAX_TILE_ROWS]; // ue(v) uint8_t loop_filter_across_tiles_enabled_flag; // u(1) uint32_t tile_offset_len_minus1; // ue(v) uint8_t tile_id_len_minus1; // ue(v)