Commit 5c2df9ffdf for ffmpeg

commit 5c2df9ffdf117ee75c0339ea57c50e945ffd2477
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Fri Oct 16 23:19:10 2026 +0200

    avcodec/vaapi_hevc: reject tile counts the VAAPI picture parameters cannot hold

    Fixes: 6ZyaPaO9BN6r
    Fixes: AISLE-2026-0150-00198
    Fixes: out of array write
    Out of array write Replicated through UnModified FFmpeg with ASAN and UBSAN
    using a stub VAAPI driver

    Found-by: Joshua Rogers (AISLE)

    The report suggested rejecting tile counts beyond the array sizes.

diff --git a/libavcodec/vaapi_hevc.c b/libavcodec/vaapi_hevc.c
index 4a0202570b..c2870d09da 100644
--- a/libavcodec/vaapi_hevc.c
+++ b/libavcodec/vaapi_hevc.c
@@ -214,13 +214,18 @@ static int vaapi_hevc_start_frame(AVCodecContext          *avctx,
     fill_vaapi_reference_frames(h, l, pic_param);

     if (pps->tiles_enabled_flag) {
+        if (pps->num_tile_columns > FF_ARRAY_ELEMS(pic_param->column_width_minus1) + 1 ||
+            pps->num_tile_rows    > FF_ARRAY_ELEMS(pic_param->row_height_minus1) + 1) {
+            av_log(avctx, AV_LOG_ERROR, "Too many tiles\n");
+            return AVERROR(ENOSYS);
+        }
         pic_param->num_tile_columns_minus1 = pps->num_tile_columns - 1;
         pic_param->num_tile_rows_minus1    = pps->num_tile_rows - 1;

-        for (i = 0; i < pps->num_tile_columns; i++)
+        for (i = 0; i < FFMIN(pps->num_tile_columns, FF_ARRAY_ELEMS(pic_param->column_width_minus1)); i++)
             pic_param->column_width_minus1[i] = pps->column_width[i] - 1;

-        for (i = 0; i < pps->num_tile_rows; i++)
+        for (i = 0; i < FFMIN(pps->num_tile_rows, FF_ARRAY_ELEMS(pic_param->row_height_minus1)); i++)
             pic_param->row_height_minus1[i] = pps->row_height[i] - 1;
     }