Commit d522eb22c2 for ffmpeg

commit d522eb22c275f0564a2ea48c44b19460ed1c5f3e
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 3 23:21:30 2026 +0200

    avformat/iamf_parse: free the context when reading the descriptors fails

    Fixes: heap-use-after-free
    Fixes: GXcHU0CpqXBk
    Fixes: ANT-2026-5PRHEUWY
    Found-by: Anthropic agents; validated and reported by Ada Logics.
    Suggested-by: James Almer <jamrial@gmail.com>

diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index 5338004d99..94540ab8bd 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -1268,8 +1268,8 @@ int ff_iamf_parse_obu_header(const uint8_t *buf, int buf_size,
     return size;
 }

-int ff_iamfdec_read_descriptors(IAMFContext *c, AVIOContext *pb,
-                                int max_size, void *log_ctx)
+static int read_descriptors(IAMFContext *c, AVIOContext *pb,
+                            int max_size, void *log_ctx)
 {
     uint8_t header[MAX_IAMF_OBU_HEADER_SIZE + AV_INPUT_BUFFER_PADDING_SIZE];
     int ret;
@@ -1329,3 +1329,13 @@ int ff_iamfdec_read_descriptors(IAMFContext *c, AVIOContext *pb,

     return 0;
 }
+
+int ff_iamfdec_read_descriptors(IAMFContext *c, AVIOContext *pb,
+                                int max_size, void *log_ctx)
+{
+    int ret = read_descriptors(c, pb, max_size, log_ctx);
+
+    if (ret < 0)
+        ff_iamf_uninit_context(c);
+    return ret;
+}