anv: Out of bounds read in anv_h265_decode_video()
commit 8d519eb5 ("anv: add initial video decode support for h265") has an out of bounds read in cum += pps->column_width_minus1[4 * i + 3] + 1;
for (unsigned i = 0; i < 5; i++) {
tile.ColumnPosition[i].CtbPos0i = cum;
if ((4 * i) == pps->num_tile_columns_minus1)
break;
cum += pps->column_width_minus1[4 * i] + 1;
tile.ColumnPosition[i].CtbPos1i = cum;
if ((4 * i + 1) == pps->num_tile_columns_minus1)
break;
cum += pps->column_width_minus1[4 * i + 1] + 1;
tile.ColumnPosition[i].CtbPos2i = cum;
if ((4 * i + 2) == pps->num_tile_columns_minus1)
break;
cum += pps->column_width_minus1[4 * i + 2] + 1;
tile.ColumnPosition[i].CtbPos3i = cum;
if ((4 * i + 3) == pps->num_tile_columns_minus1)
break;
cum += pps->column_width_minus1[4 * i + 3] + 1;
}
uint16_t column_width_minus1[STD_VIDEO_H265_CHROMA_QP_OFFSET_TILE_COLS_LIST_SIZE];
#define STD_VIDEO_H265_CHROMA_QP_OFFSET_TILE_COLS_LIST_SIZE 19