Commit 21ae927dc6 for ffmpeg

commit 21ae927dc6fd9b7cf8be3b54d620c1f707c83095
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Mon Oct 19 22:08:13 2026 +0200

    avcodec/rw2dec: release a hwaccel picture left over by a failed frame

    A failing hwaccel call returned with the picture still allocated and the
    next frame failed the assertion in ff_hwaccel_frame_priv_alloc(). Release
    the picture before allocating the next one, as proresdec does.

    Not replicated, no hwaccel exists for rw2 yet.

    Fixes: 233BfozgW6QZ

    Found during triage/review of the security report AISLE-2026-R0043

diff --git a/libavcodec/rw2dec.c b/libavcodec/rw2dec.c
index 86dc6d95de..529daa1339 100644
--- a/libavcodec/rw2dec.c
+++ b/libavcodec/rw2dec.c
@@ -519,6 +519,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,

     s->frame = frame;

+    av_refstruct_unref(&s->hwaccel_picture_private);
     ret = ff_hwaccel_frame_priv_alloc(avctx, &s->hwaccel_picture_private);
     if (ret < 0)
         return ret;