Commit 3af39075bd for ffmpeg

commit 3af39075bd10c549c8beba74eeab77273d4c6e34
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Fri Oct 16 23:19:10 2026 +0200

    avcodec/vdpau_hevc: reject tile counts the VDPAU picture info cannot hold

    Fixes: 71WWW3jyHksv
    Fixes: AISLE-2026-0150-00422
    Fixes: out of array write
    Out of array write Replicated through UnModified FFmpeg with ASAN and UBSAN
    using a stub VDPAU driver

    Found-by: Joshua Rogers (AISLE)

    The report suggested rejecting tile counts beyond the array sizes.

diff --git a/libavcodec/vdpau_hevc.c b/libavcodec/vdpau_hevc.c
index 1a8429475e..4fa06edd63 100644
--- a/libavcodec/vdpau_hevc.c
+++ b/libavcodec/vdpau_hevc.c
@@ -150,6 +150,11 @@ static int vdpau_hevc_start_frame(AVCodecContext *avctx,
     info->tiles_enabled_flag = pps->tiles_enabled_flag;
     info->entropy_coding_sync_enabled_flag = pps->entropy_coding_sync_enabled_flag;
     if (info->tiles_enabled_flag) {
+        if (pps->num_tile_columns > FF_ARRAY_ELEMS(info->column_width_minus1) ||
+            pps->num_tile_rows    > FF_ARRAY_ELEMS(info->row_height_minus1)) {
+            av_log(avctx, AV_LOG_ERROR, "Too many tiles\n");
+            return AVERROR(ENOSYS);
+        }
         /* Only valid if tiles_enabled_flag is set. Ignored otherwise. */
         info->num_tile_columns_minus1 = pps->num_tile_columns - 1;
         /* Only valid if tiles_enabled_flag is set. Ignored otherwise. */