Commit 1983a36669 for ffmpeg

commit 1983a36669b6541087633d65b9d09fc8dff98604
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Mon Oct 19 22:08:13 2026 +0200

    avcodec/apv_decode: release a hwaccel picture left over by a failed frame

    A failing hwaccel call returned with the picture still allocated and the
    next frame failed the assertion in ff_hwaccel_frame_priv_alloc(); closing
    the decoder leaked it. Release the picture before allocating the next one
    and on close, as proresdec does.

    Fixes: 233BfozgW6QZ
    Fixes: assertion failure
    Assertion failure Replicated through Modified FFmpeg with a failure injected
    into the Vulkan hwaccel, with -threads 1

    Found during triage/review of the security report AISLE-2026-R0043

diff --git a/libavcodec/apv_decode.c b/libavcodec/apv_decode.c
index a5167cc4e7..19c24d293f 100644
--- a/libavcodec/apv_decode.c
+++ b/libavcodec/apv_decode.c
@@ -177,6 +177,7 @@ static av_cold int apv_decode_close(AVCodecContext *avctx)
 {
     APVDecodeContext *apv = avctx->priv_data;

+    av_refstruct_unref(&apv->hwaccel_picture_private);
     ff_cbs_fragment_free(&apv->au);
     ff_cbs_close(&apv->cbc);

@@ -382,6 +383,7 @@ static int apv_decode(AVCodecContext *avctx, AVFrame *output,

     apv_derive_tile_info(tile_info, &input->frame_header);

+    av_refstruct_unref(&apv->hwaccel_picture_private);
     err = ff_hwaccel_frame_priv_alloc(avctx, &apv->hwaccel_picture_private);
     if (err < 0)
         return err;