Commit ef7534ee38 for ffmpeg

commit ef7534ee38cd792d093ba2ab126a5f4954b46358
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Fri Oct 16 23:19:10 2026 +0200

    avcodec/vulkan_hevc: reject tile counts the Vulkan PPS cannot hold

    Fixes: sG5Hl4tXqkD5
    Fixes: out of array write
    Out of array write Replicated through UnModified FFmpeg with UBSAN

    Found during triage/review of the security report AISLE-2026-R0043

diff --git a/libavcodec/vulkan_hevc.c b/libavcodec/vulkan_hevc.c
index 6c0cd56363..c8badf692f 100644
--- a/libavcodec/vulkan_hevc.c
+++ b/libavcodec/vulkan_hevc.c
@@ -450,11 +450,15 @@ static void set_sps(const HEVCSPS *sps, int sps_idx,
     };
 }

-static void set_pps(const HEVCPPS *pps, const HEVCSPS *sps,
-                    StdVideoH265ScalingLists *vkpps_scaling,
-                    StdVideoH265PictureParameterSet *vkpps,
-                    StdVideoH265PredictorPaletteEntries *pal)
+static int set_pps(const HEVCPPS *pps, const HEVCSPS *sps,
+                   StdVideoH265ScalingLists *vkpps_scaling,
+                   StdVideoH265PictureParameterSet *vkpps,
+                   StdVideoH265PredictorPaletteEntries *pal)
 {
+    if (pps->num_tile_columns > FF_ARRAY_ELEMS(vkpps->column_width_minus1) + 1 ||
+        pps->num_tile_rows    > FF_ARRAY_ELEMS(vkpps->row_height_minus1) + 1)
+        return AVERROR(ENOSYS);
+
     copy_scaling_list(&pps->scaling_list, vkpps_scaling);

     *vkpps = (StdVideoH265PictureParameterSet) {
@@ -536,6 +540,8 @@ static void set_pps(const HEVCPPS *pps, const HEVCSPS *sps,
         vkpps->cb_qp_offset_list[i] = pps->cb_qp_offset_list[i];
         vkpps->cr_qp_offset_list[i] = pps->cr_qp_offset_list[i];
     }
+
+    return 0;
 }

 static void set_vps(const HEVCVPS *vps,
@@ -680,8 +686,10 @@ static int vk_hevc_create_params(AVCodecContext *avctx, VkVideoSessionParameters
             const HEVCPPS *pps_l = h->ps.pps_list[i];
             const HEVCSPS *sps_l = h->ps.sps_list[pps_l->sps_id];
             int idx = h265_params_info.stdPPSCount++;
-            set_pps(pps_l, sps_l, &hdr->hpps[idx].scaling,
-                    &hdr->pps[idx], &hdr->hpps[idx].pal);
+            err = set_pps(pps_l, sps_l, &hdr->hpps[idx].scaling,
+                          &hdr->pps[idx], &hdr->hpps[idx].pal);
+            if (err < 0)
+                return err;
         }
     }

@@ -887,7 +895,9 @@ static int vk_hevc_end_frame(AVCodecContext *avctx)
             return err;
         hdr = dec->hevc_headers;

-        set_pps(pps, sps, &hdr->hpps[0].scaling, &hdr->pps[0], &hdr->hpps[0].pal);
+        err = set_pps(pps, sps, &hdr->hpps[0].scaling, &hdr->pps[0], &hdr->hpps[0].pal);
+        if (err < 0)
+            return err;
         set_sps(sps, pps->sps_id, &hdr->hsps[0].scaling, &hdr->hsps[0].vui_header,
                 &hdr->hsps[0].vui, &hdr->sps[0], hdr->hsps[0].nal_hdr,
                 hdr->hsps[0].vcl_hdr, &hdr->hsps[0].ptl, &hdr->hsps[0].dpbm,