Commit 6364d8606c for ffmpeg

commit 6364d8606ca6f04291f9a5cfcd98d60f624e359e
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Fri Oct 23 17:39:52 2026 +0200

    avcodec/ffv1enc: reject 32bit float Golomb-Rice slices above 2^18 pixels

    The escape code of a Golomb-Rice residual is 12 + bits long and
    put_bits() writes at most 31 bits, so bits must stay below 20. The RCT
    planes of remapped 32bit floats need log2 of the summed remap counts of
    two planes, which a slice of at most 1<<18 pixels keeps within 19 bits.
    The default slice size of 360x288 is within that, larger slices requested
    with -slices were written with escape codes longer than put_bits()
    supports. The assertion on k follows the same limit.

diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c
index 1d18f10f05..869834c2e8 100644
--- a/libavcodec/ffv1enc.c
+++ b/libavcodec/ffv1enc.c
@@ -250,7 +250,7 @@ static inline void put_vlc_symbol(PutBitContext *pb, VlcState *const state,
         i += i;
     }

-    av_assert2(k <= 16);
+    av_assert2(k <= 19);

     code = v ^ ((2 * state->drift + state->count) >> 31);

@@ -1053,6 +1053,18 @@ static av_cold int encode_init_internal(AVCodecContext *avctx)
         if ((ret = ff_ffv1_encode_determine_slices(avctx)) < 0)
             return ret;

+        /* The Golomb-Rice escape code is 12 + bits long and put_bits()
+         * writes at most 31 bits, so bits must stay below 20. The RCT
+         * planes of remapped 32bit floats need log2 of the summed remap
+         * counts of two planes, which a slice of at most 1<<18 pixels
+         * keeps within 19 bits. */
+        if (s->ac == AC_GOLOMB_RICE && s->bits_per_raw_sample == 32 &&
+            ((avctx->width  + s->num_h_slices - 1) / s->num_h_slices) *
+            (int64_t)((avctx->height + s->num_v_slices - 1) / s->num_v_slices) > 1 << 18) {
+            av_log(avctx, AV_LOG_ERROR, "Slices larger than 262144 pixels are not supported with 32bit floats and the Golomb-Rice coder\n");
+            return AVERROR(EINVAL);
+        }
+
         if ((ret = ff_ffv1_write_extradata(avctx)) < 0)
             return ret;
     }