Commit 7145d13201 for ffmpeg

commit 7145d13201c9f9c5253f40295714faa4f4ada1a0
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Sep 29 01:57:32 2026 +0200

    avcodec/cook: reject js_subband_start beyond subbands

    Fixes: information leak of heap pointers and decoder state into the output
    Fixes: qhg9vxxyEOy1
    Found-by: Yuyao Jiang
    Replicated through Modified FFmpeg

diff --git a/libavcodec/cook.c b/libavcodec/cook.c
index 5ed3d2596b..71c2409ad3 100644
--- a/libavcodec/cook.c
+++ b/libavcodec/cook.c
@@ -1218,6 +1218,13 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)
             return AVERROR_PATCHWELCOME;
         }

+        if (q->subpacket[s].joint_stereo &&
+            q->subpacket[s].js_subband_start > q->subpacket[s].subbands) {
+            av_log(avctx, AV_LOG_ERROR, "js_subband_start %d > subbands %d\n",
+                   q->subpacket[s].js_subband_start, q->subpacket[s].subbands);
+            return AVERROR_INVALIDDATA;
+        }
+
         if ((q->subpacket[s].js_vlc_bits > 6) ||
             (q->subpacket[s].js_vlc_bits < 2 * q->subpacket[s].joint_stereo)) {
             av_log(avctx, AV_LOG_ERROR, "js_vlc_bits = %d, only >= %d and <= 6 allowed!\n",