From a876bc9c17e4d50e8cb9033c78300944adb6231a Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Tue, 27 Oct 2020 18:25:06 -0300
Subject: [PATCH] avcodec/cbs_av1: add a range check to tg_end

Section 6.10.1 of the AV1 spec states:

It is a requirement of bitstream conformance that the value of tg_start is
equal to the value of TileNum at the point that tile_group_obu is invoked.
It is a requirement of bitstream conformance that the value of tg_end is
greater than or equal to tg_start.

Signed-off-by: James Almer <jamrial@gmail.com>
---
 libavcodec/cbs_av1.c                 | 1 +
 libavcodec/cbs_av1.h                 | 1 +
 libavcodec/cbs_av1_syntax_template.c | 8 ++++++--
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/libavcodec/cbs_av1.c b/libavcodec/cbs_av1.c
index 8aa7b09fa7..9badfe31e4 100644
--- a/libavcodec/cbs_av1.c
+++ b/libavcodec/cbs_av1.c
@@ -1205,6 +1205,7 @@ static void cbs_av1_flush(CodedBitstreamContext *ctx)
     memset(priv->ref, 0, sizeof(priv->ref));
     priv->operating_point_idc = 0;
     priv->seen_frame_header = 0;
+    priv->tile_num = 0;
 }
 
 static void cbs_av1_close(CodedBitstreamContext *ctx)
diff --git a/libavcodec/cbs_av1.h b/libavcodec/cbs_av1.h
index a2d78e736f..386774750a 100644
--- a/libavcodec/cbs_av1.h
+++ b/libavcodec/cbs_av1.h
@@ -446,6 +446,7 @@ typedef struct CodedBitstreamAV1Context {
     int all_lossless;
     int tile_cols;
     int tile_rows;
+    int tile_num;
 
     AV1ReferenceFrameState ref[AV1_NUM_REF_FRAMES];
 } CodedBitstreamAV1Context;
diff --git a/libavcodec/cbs_av1_syntax_template.c b/libavcodec/cbs_av1_syntax_template.c
index 884dbec760..bef53e145b 100644
--- a/libavcodec/cbs_av1_syntax_template.c
+++ b/libavcodec/cbs_av1_syntax_template.c
@@ -1725,6 +1725,8 @@ static int FUNC(frame_header_obu)(CodedBitstreamContext *ctx, RWContext *rw,
 
         CHECK(FUNC(uncompressed_header)(ctx, rw, current));
 
+        priv->tile_num = 0;
+
         if (current->show_existing_frame) {
             priv->seen_frame_header = 0;
         } else {
@@ -1790,10 +1792,12 @@ static int FUNC(tile_group_obu)(CodedBitstreamContext *ctx, RWContext *rw,
     } else {
         tile_bits = cbs_av1_tile_log2(1, priv->tile_cols) +
                     cbs_av1_tile_log2(1, priv->tile_rows);
-        fb(tile_bits, tg_start);
-        fb(tile_bits, tg_end);
+        fc(tile_bits, tg_start, priv->tile_num, num_tiles - 1);
+        fc(tile_bits, tg_end, current->tg_start, num_tiles - 1);
     }
 
+    priv->tile_num = current->tg_end + 1;
+
     CHECK(FUNC(byte_alignment)(ctx, rw));
 
     // Reset header for next frame.