Out-of-Bounds Array Read in ctrl_get_tile_data

BUG=aomedia:503197473

Change-Id: I795f3def8e47643c6bd0f63f477cbc844e4c86c8

av1/av1_dx_iface.c

diff --git a/av1/av1_dx_iface.c b/av1/av1_dx_iface.c
index 50baa48..cd41f8c 100644
--- a/av1/av1_dx_iface.c
+++ b/av1/av1_dx_iface.c
@@ -1326,6 +1326,11 @@
       FrameWorkerData *const frame_worker_data =
           (FrameWorkerData *)worker->data1;
       const AV1Decoder *pbi = frame_worker_data->pbi;
+      if (pbi->dec_tile_row < 0 || pbi->dec_tile_row >= MAX_TILE_ROWS ||
+          pbi->dec_tile_col < 0 || pbi->dec_tile_col >= MAX_TILE_COLS) {
+        return AOM_CODEC_ERROR;
+      }
+
       tile_data->coded_tile_data_size =
           pbi->tile_buffers[pbi->dec_tile_row][pbi->dec_tile_col].size;
       tile_data->coded_tile_data =