Commit 0bfa350291 for ffmpeg

commit 0bfa350291b2118f6d590263dc1ee9cea766c0f1
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Nov 3 04:46:19 2026 +0100

    avcodec/cfhd: allocate the inverse transform scratch buffer zeroed

    Fixes: 1ivYPVLs04AI
    Fixes: AISLE-2026-0150-00896
    Fixes: use of uninitialized memory
    Use of uninitialized memory Replicated through UnModified FFmpeg with MSAN
    (CFHD AVI sample with the ImageHeight tag raised from 720 to 1080)

    Found-by: Joshua Rogers (AISLE)

diff --git a/libavcodec/cfhd.c b/libavcodec/cfhd.c
index 28ec749cba..e4f54ba196 100644
--- a/libavcodec/cfhd.c
+++ b/libavcodec/cfhd.c
@@ -289,13 +289,13 @@ static int alloc_buffers(AVCodecContext *avctx)
             s->plane[i].idwt_buf =
                 av_calloc(s->plane[i].idwt_size, sizeof(*s->plane[i].idwt_buf));
             s->plane[i].idwt_tmp =
-                av_malloc_array(s->plane[i].idwt_size, sizeof(*s->plane[i].idwt_tmp));
+                av_calloc(s->plane[i].idwt_size, sizeof(*s->plane[i].idwt_tmp));
         } else {
             s->plane[i].idwt_size = FFALIGN(height, 8) * stride * 2;
             s->plane[i].idwt_buf =
                 av_calloc(s->plane[i].idwt_size, sizeof(*s->plane[i].idwt_buf));
             s->plane[i].idwt_tmp =
-                av_malloc_array(s->plane[i].idwt_size, sizeof(*s->plane[i].idwt_tmp));
+                av_calloc(s->plane[i].idwt_size, sizeof(*s->plane[i].idwt_tmp));
         }

         if (!s->plane[i].idwt_buf || !s->plane[i].idwt_tmp)