[FFmpeg-cvslog] avcodec/cbs_av1: fix array size for ar_coeffs_cb_plus_128 and ar_coeffs_cr_plus_128

[James Almer]

ffmpeg | branch: release/4.2 | James Almer <jamrial at gmail.com> | Wed Dec 11 18:54:38 2019 -0300| [d3fef1a3bd9fc9e408a4b5b366a19249aea0c3f2] | committer: James Almer

avcodec/cbs_av1: fix array size for ar_coeffs_cb_plus_128 and ar_coeffs_cr_plus_128

Taking into account the code

fb(2, ar_coeff_lag);
num_pos_luma = 2 * current->ar_coeff_lag * (current->ar_coeff_lag + 1);
if (current->num_y_points)
    num_pos_chroma = num_pos_luma + 1;
else
    num_pos_chroma = num_pos_luma;

Max value for ar_coeff_lag is 3 (two bits), for num_pos_luma 24, and for
num_pos_chroma 25.

Both ar_coeffs_cb_plus_128 and ar_coeffs_cr_plus_128 may have up to
num_pos_chroma values.

Reviewed-by: Ronald S. Bultje <rsbultje at gmail.com>
Signed-off-by: James Almer <jamrial at gmail.com>
(cherry picked from commit a23dd33606d5a711fd632383d81a1d6c60082e0f)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d3fef1a3bd9fc9e408a4b5b366a19249aea0c3f2
---

 libavcodec/cbs_av1.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/cbs_av1.h b/libavcodec/cbs_av1.h
index 675ed28f60..dee06010db 100644
--- a/libavcodec/cbs_av1.h
+++ b/libavcodec/cbs_av1.h
@@ -268,8 +268,8 @@ typedef struct AV1RawFrameHeader {
     uint8_t  grain_scaling_minus_8;
     uint8_t  ar_coeff_lag;
     uint8_t  ar_coeffs_y_plus_128[24];
-    uint8_t  ar_coeffs_cb_plus_128[24];
-    uint8_t  ar_coeffs_cr_plus_128[24];
+    uint8_t  ar_coeffs_cb_plus_128[25];
+    uint8_t  ar_coeffs_cr_plus_128[25];
     uint8_t  ar_coeff_shift_minus_6;
     uint8_t  grain_scale_shift;
     uint8_t  cb_mult;