IN gsth265parser.c ,  gst_h265_parse_pps(), 

Line 1868/1869
pps->num_tile_columns_minus1 can be 19,

then go into Line 1874, num_col = 20,

in while loop for (i = 0; i < num_col; i++)
i can be 19,

pps->column_width_minus1[i] will overflow

in header file, its size is 19, column_width_minus1[19];


same issue with pps->num_tile_rows_minus1;