From a5faeca88fdaaf82a151e21ad69b5250374833e4 Mon Sep 17 00:00:00 2001 From: James Almer Date: Thu, 21 May 2026 00:00:00 +0000 Subject: [PATCH] avcodec/cbs_h266_syntax_template: Fix pps_exp_slice_height_in_ctus_minus1 range Found-by: Claude (Anthropic). Human-verified and reported by Omkhar Arasaratnam . Signed-off-by: Michael Niedermayer (cherry-picked from commit bf608f16fd6772b1977a2637e8ab49644f6b5eb5) --- libavcodec/cbs_h266_syntax_template.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c index 979d2051d6..4ae636e176 100644 --- a/libavcodec/cbs_h266_syntax_template.c +++ b/libavcodec/cbs_h266_syntax_template.c @@ -2022,7 +2022,7 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw, for (j = 0; j < current->pps_num_exp_slices_in_tile[i]; j++) { ues(pps_exp_slice_height_in_ctus_minus1[i][j], 0, - remaining_height_in_ctbs_y - 1, 2, + remaining_height_in_ctbs_y - (current->pps_num_exp_slices_in_tile[i] - j), 2, i, j); slice_height_in_ctus = current->