Commit 894876ae57 for ffmpeg

commit 894876ae57960d0881a6d971bb673f6f57829111
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Fri Oct 16 23:19:10 2026 +0200

    avcodec/vulkan_decode: limit the slice data of a frame to 2 GiB

    Not replicated.

    Fixes: Jdy0O5Qn34O8
    Fixes: AISLE-2026-0150-00708

    Found-by: Joshua Rogers (AISLE)

    The report suggested bounding the size and rounding it in 64 bits.

diff --git a/libavcodec/vulkan_decode.c b/libavcodec/vulkan_decode.c
index 55c34d92f9..3c78c22c95 100644
--- a/libavcodec/vulkan_decode.c
+++ b/libavcodec/vulkan_decode.c
@@ -250,9 +250,11 @@ int ff_vk_decode_add_slice(AVCodecContext *avctx, FFVulkanDecodePicture *vp,
     uint32_t *slice_off;
     FFVkBuffer *vkbuf;

-    size_t new_size = vp->slices_size + startcode_len + size +
-                      ctx->caps.minBitstreamBufferSizeAlignment;
+    uint64_t new_size = vp->slices_size + startcode_len + size +
+                        ctx->caps.minBitstreamBufferSizeAlignment;
     new_size = FFALIGN(new_size, ctx->caps.minBitstreamBufferSizeAlignment);
+    if (new_size > INT32_MAX)
+        return AVERROR(ENOSYS);

     if (offsets) {
         slice_off = av_fast_realloc(dec->slice_off, &dec->slice_off_max,
@@ -275,7 +277,7 @@ int ff_vk_decode_add_slice(AVCodecContext *avctx, FFVulkanDecodePicture *vp,

         /* Align buffer to nearest power of two. Makes fragmentation management
          * easier, and gives us ample headroom. */
-        buf_size = 2 << av_log2(buf_size);
+        buf_size = 2ULL << av_log2(buf_size);

         /* When the frames context uses DRM modifier tiling,
          * hwctx->create_pnext contains VkImageDrmFormatModifierListCreateInfoEXT,