From b3a15b4ee1f38245fb46cd84a384b1f0576a88cc Mon Sep 17 00:00:00 2001 From: James Almer Date: Thu, 21 May 2026 00:00:00 +0000 Subject: [PATCH] avcodec/cbs_h266_syntax_template: Fix pps_exp_slice_height_in_ctus_minus1 range Found-by: Claude (Anthropic). Human-verified and reported by Omkhar Arasaratnam . Signed-off-by: Michael Niedermayer (cherry picked from commit bf608f16fd6772b1977a2637e8ab49644f6b5eb5) Signed-off-by: Michael Niedermayer --- libavcodec/cbs_h266_syntax_template.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c index f48dfd1024..214629d423 100644 --- a/libavcodec/cbs_h266_syntax_template.c +++ b/libavcodec/cbs_h266_syntax_template.c @@ -2022,7 +2022,7 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw, for (j = 0; j < current->pps_num_exp_slices_in_tile[i]; j++) { ues(pps_exp_slice_height_in_ctus_minus1[i][j], 0, - remaining_height_in_ctbs_y - 1, 2, + remaining_height_in_ctbs_y - (current->pps_num_exp_slices_in_tile[i] - j), 2, i, j); slice_height_in_ctus = current->