From 4f72addce10b8dc2b08b7ebfdcc261a543a768fe Mon Sep 17 00:00:00 2001 From: Gil Portnoy Date: Wed, 11 Mar 2026 04:00:15 +0100 Subject: [PATCH] avcodec/cbs_h266_syntax_template: Fix rows vs columns Fixes: out of array access Fixes: vvc_poc_cbs_divergence_max.h266 Signed-off-by: Michael Niedermayer (cherry picked from commit 51606de0e92867b62abef42509de38181aa25b3e) Signed-off-by: Michael Niedermayer --- libavcodec/cbs_h266_syntax_template.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c index 0ff7459f5c..f2003d8bac 100644 --- a/libavcodec/cbs_h266_syntax_template.c +++ b/libavcodec/cbs_h266_syntax_template.c @@ -3506,7 +3506,7 @@ static int FUNC(slice_header) (CodedBitstreamContext *ctx, RWContext *rw, tile_idx <= current->sh_slice_address + current->sh_num_tiles_in_slice_minus1; tile_idx++) { - tile_y = tile_idx / pps->num_tile_rows; + tile_y = tile_idx / pps->num_tile_columns; height = pps->row_height_val[tile_y]; current->num_entry_points += (entropy_sync ? height : 1); }