Commit a82e676a82 for ffmpeg

commit a82e676a82f014cf52bad2b9ac4f1d3ef7f0b3ea
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 10 07:16:08 2026 +0200

    avcodec/vvc/ps: do not truncate the virtual boundary position limit to 16 bits

    Fixes: negative-size-param
    Fixes: left shift of negative value
    Fixes: 0IMcpiRlVAb5
    Fixes: ANT-2026-QY2HYS5A
    Fixes: poc.mkv
    Found-by: Claude and Ada Logics

    Negative size memcpy Replicated through UnModified FFmpeg with ASAN and UBSAN

diff --git a/libavcodec/vvc/ps.c b/libavcodec/vvc/ps.c
index 48468f5019..84adaf191d 100644
--- a/libavcodec/vvc/ps.c
+++ b/libavcodec/vvc/ps.c
@@ -927,7 +927,7 @@ static int ph_max_num_subblock_merge_cand(const H266RawSPS *sps, const H266RawPi
     return sps->sps_sbtmvp_enabled_flag && ph->ph_temporal_mvp_enabled_flag;
 }

-static int ph_vb_pos(uint16_t *vbs, uint8_t *num_vbs, const uint16_t *pos_minus_1, const uint8_t num_pos, uint16_t max, const int ctb_size_y)
+static int ph_vb_pos(uint16_t *vbs, uint8_t *num_vbs, const uint16_t *pos_minus_1, const uint8_t num_pos, int max, const int ctb_size_y)
 {
     max = FF_CEIL_RSHIFT(max, 3) - 2;
     for (int i = 0; i < num_pos; i++) {