Commit 1fd404c6ba for ffmpeg

commit 1fd404c6ba57d469341857345a6f15ff97c615c2
Author: Lynne <dev@lynne.ee>
Date:   Sat Nov 7 16:47:43 2026 +0800

    vulkan: keep the plain bitstream reader within its buffer

    The reader without shared memory refills straight from its buffer, with
    no regard for the end. Corrupt data, or a decoder that has lost track of
    the bitstream, makes it read on past the end into memory that may not be
    mapped: an APV stream which threw off the decoder made an RX 6900 XT
    fault and lose the device.

    Read words past the end of the buffer from the end instead, as the
    shared memory reader does with its lines. Reads now stay within 8 bytes
    of the end, which valid streams already reach. This costs up to 2% in
    APV decoding, and nothing measurable in FFV1's Golomb mode.

diff --git a/libavcodec/vulkan/common.glsl b/libavcodec/vulkan/common.glsl
index 27a38531a9..27fd0b0ff2 100644
--- a/libavcodec/vulkan/common.glsl
+++ b/libavcodec/vulkan/common.glsl
@@ -254,9 +254,12 @@ struct GetBitContext {
 };

 #ifndef GET_BITS_SMEM
+/* Words past the end of the buffer are read from its end instead, so corrupt
+ * data cannot run the reader off into unmapped memory. */
 #define LOAD64()                                       \
     {                                                  \
-        u8vec4buf ptr = u8vec4buf(gb.buf);             \
+        uint64_t addr = min(gb.buf, gb.buf_end);       \
+        u8vec4buf ptr = u8vec4buf(addr);               \
         uint32_t rf1 = pack32((ptr[0].v).wzyx);        \
         uint32_t rf2 = pack32((ptr[1].v).wzyx);        \
         gb.buf += 8;                                   \
@@ -266,7 +269,7 @@ struct GetBitContext {

 #define RELOAD32()                                                \
     {                                                             \
-        u8vec4buf ptr = u8vec4buf(gb.buf);                        \
+        u8vec4buf ptr = u8vec4buf(min(gb.buf, gb.buf_end));       \
         uint32_t rf = pack32((ptr[0].v).wzyx);                    \
         gb.buf += 4;                                              \
         gb.bits = uint64_t(rf) << (32 - gb.bits_valid) | gb.bits; \