Commit b8f74a99fb for ffmpeg

commit b8f74a99fbea9edceda911f90be3b6f330c34173
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 10 06:38:14 2026 +0200

    avcodec/cbs_h266: allocate the VPS profile_tier_level array on demand

    Allocate the array for the number of PTLs the VPS signals, like the
    extension data. This shrinks H266RawVPS to 41 KB.

    Out of memory Replicated through API

    Found during triage/review of OSS-Fuzz issue 529105369

    Fixes: out of memory
    Fixes: b0PmzXuS2hhp/vps10k.bin / gen_vps.py
    Fixes: b0PmzXuS2hhp

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavcodec/cbs_h266.c b/libavcodec/cbs_h266.c
index 8c92b4f557..f0782c814b 100644
--- a/libavcodec/cbs_h266.c
+++ b/libavcodec/cbs_h266.c
@@ -143,7 +143,7 @@ static int FUNC_H266(name) args
                                         AV_INPUT_BUFFER_PADDING_SIZE); \
         if (!name ## _ref) \
             return AVERROR(ENOMEM); \
-        name = name ## _ref->data; \
+        name = (void *)name ## _ref->data; \
     } while (0)

 #define FUNC(name) FUNC_H266(name)
@@ -760,7 +760,17 @@ static void cbs_h266_free_sei(AVRefStructOpaque unused, void *content)
 static CodedBitstreamUnitTypeDescriptor cbs_h266_unit_types[] = {
     CBS_UNIT_TYPE_INTERNAL_REF(VVC_DCI_NUT, H266RawDCI, extension_data.data),
     CBS_UNIT_TYPE_INTERNAL_REF(VVC_OPI_NUT, H266RawOPI, extension_data.data),
-    CBS_UNIT_TYPE_INTERNAL_REF(VVC_VPS_NUT, H266RawVPS, extension_data.data),
+    {
+        .nb_unit_types     = 1,
+        .unit_type.list[0] = VVC_VPS_NUT,
+        .content_type      = CBS_CONTENT_TYPE_INTERNAL_REFS,
+        .content_size      = sizeof(H266RawVPS),
+        .type.ref          = {
+            .nb_offsets = 2,
+            .offsets    = { offsetof(H266RawVPS, vps_profile_tier_level),
+                            offsetof(H266RawVPS, extension_data.data) }
+        },
+    },
     {
         .nb_unit_types     = 1,
         .unit_type.list[0] = VVC_SPS_NUT,
diff --git a/libavcodec/cbs_h266.h b/libavcodec/cbs_h266.h
index d315f6b64a..8f7ce5f5b6 100644
--- a/libavcodec/cbs_h266.h
+++ b/libavcodec/cbs_h266.h
@@ -280,7 +280,8 @@ typedef struct H266RawVPS {
     uint8_t  vps_num_ptls_minus1;
     uint8_t  vps_pt_present_flag[VVC_MAX_PTLS];
     uint8_t  vps_ptl_max_tid[VVC_MAX_PTLS];
-    H266RawProfileTierLevel vps_profile_tier_level[VVC_MAX_PTLS];
+    H266RawProfileTierLevel *vps_profile_tier_level;
+    AVBufferRef             *vps_profile_tier_level_ref;
     uint8_t  vps_ols_ptl_idx[VVC_MAX_TOTAL_NUM_OLSS];

     uint16_t vps_num_dpb_params_minus1;
diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c
index 9e0776defe..f15d70cb8d 100644
--- a/libavcodec/cbs_h266_syntax_template.c
+++ b/libavcodec/cbs_h266_syntax_template.c
@@ -930,6 +930,9 @@ static int FUNC(vps) (CodedBitstreamContext *ctx, RWContext *rw,
             return AVERROR_INVALIDDATA;
     }

+    allocate(current->vps_profile_tier_level,
+             (current->vps_num_ptls_minus1 + 1) *
+             sizeof(*current->vps_profile_tier_level));
     for (i = 0; i <= current->vps_num_ptls_minus1; i++) {
         CHECK(FUNC(profile_tier_level) (ctx, rw,
                                         current->vps_profile_tier_level + i,