avcodec/cbs_h265: bound the number of decoding units by the picture size and the slice segment limit

Fixes: out of array write
Fixes: feHKdS1bdTcu
Found-by: Zheng Yu @ Depthfirst

libavcodec/cbs_h265_syntax_template.c

@@ -1986,8 +1986,14 @@ SEI_FUNC(sei_pic_timing, (CodedBitstreamContext *ctx, RWContext *rw,
 
         if (hrd->sub_pic_hrd_params_present_flag &&
             hrd->sub_pic_cpb_params_in_pic_timing_sei_flag) {
-            // Each decoding unit must contain at least one slice segment.
-            ue(num_decoding_units_minus1, 0, HEVC_MAX_SLICE_SEGMENTS);
+            unsigned int pic_width_in_ctbs_y, pic_height_in_ctbs_y;
+            cbs_h265_pic_size_in_ctbs(sps, &pic_width_in_ctbs_y, &pic_height_in_ctbs_y);
+            // D.3.3 bounds this by PicSizeInCtbsY - 1. A decoding unit holds at
+            // least one VCL NAL unit (3.47) and no level allows a picture more
+            // than HEVC_MAX_SLICE_SEGMENTS slice segments (A.4.2), which is also
+            // the size of the arrays indexed by it.
+            ue(num_decoding_units_minus1, 0,
+               FFMIN(pic_width_in_ctbs_y * pic_height_in_ctbs_y, HEVC_MAX_SLICE_SEGMENTS) - 1);
             flag(du_common_cpb_removal_delay_flag);
 
             length = hrd->du_cpb_removal_delay_increment_length_minus1 + 1;