avcodec/cbs_av1: add a range check to tg_end

Section 6.10.1 of the AV1 spec states:

It is a requirement of bitstream conformance that the value of tg_start is
equal to the value of TileNum at the point that tile_group_obu is invoked.
It is a requirement of bitstream conformance that the value of tg_end is
greater than or equal to tg_start.

Signed-off-by: James Almer <jamrial@gmail.com>

libavcodec/cbs_av1.c

@@ -1205,6 +1205,7 @@ static void cbs_av1_flush(CodedBitstreamContext *ctx)
     memset(priv->ref, 0, sizeof(priv->ref));
     priv->operating_point_idc = 0;
     priv->seen_frame_header = 0;
+    priv->tile_num = 0;
 }
 
 static void cbs_av1_close(CodedBitstreamContext *ctx)

libavcodec/cbs_av1.h

@@ -446,6 +446,7 @@ typedef struct CodedBitstreamAV1Context {
     int all_lossless;
     int tile_cols;
     int tile_rows;
+    int tile_num;
 
     AV1ReferenceFrameState ref[AV1_NUM_REF_FRAMES];
 } CodedBitstreamAV1Context;

libavcodec/cbs_av1_syntax_template.c

@@ -1725,6 +1725,8 @@ static int FUNC(frame_header_obu)(CodedBitstreamContext *ctx, RWContext *rw,
 
         CHECK(FUNC(uncompressed_header)(ctx, rw, current));
 
+        priv->tile_num = 0;
+
         if (current->show_existing_frame) {
             priv->seen_frame_header = 0;
         } else {
@@ -1790,10 +1792,12 @@ static int FUNC(tile_group_obu)(CodedBitstreamContext *ctx, RWContext *rw,
     } else {
         tile_bits = cbs_av1_tile_log2(1, priv->tile_cols) +
                     cbs_av1_tile_log2(1, priv->tile_rows);
-        fb(tile_bits, tg_start);
-        fb(tile_bits, tg_end);
+        fc(tile_bits, tg_start, priv->tile_num, num_tiles - 1);
+        fc(tile_bits, tg_end, current->tg_start, num_tiles - 1);
     }
 
+    priv->tile_num = current->tg_end + 1;
+
     CHECK(FUNC(byte_alignment)(ctx, rw));
 
     // Reset header for next frame.