Commit f58a677654 for ffmpeg

commit f58a6776546567367baf5223df9ffbfd289299f8
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 17 03:18:25 2026 +0200

    avcodec/mjpegdec: reject a SOF without a preceding SOI when a hwaccel is used

    Fixes: KICdwlv5dwyY
    Fixes: AISLE-2026-0150-00792
    Fixes: use after free
    Use after free Replicated through Modified FFmpeg with ASAN

    Found-by: Joshua Rogers (AISLE)

    The report suggested clearing raw_image_buffer per packet and rejecting a
    SOF that is not preceded by a SOI.

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 1f11b6fbb7..431ae239b5 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -824,6 +824,10 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)

     if (s->avctx->hwaccel) {
         const FFHWAccel *hwaccel = ffhwaccel(s->avctx->hwaccel);
+        if (!s->raw_image_buffer) {
+            av_log(s->avctx, AV_LOG_ERROR, "SOF without SOI\n");
+            return AVERROR_INVALIDDATA;
+        }

         /* A previous frame may have been aborted before its end_frame call,
          * leaving the private data behind. */
@@ -2435,6 +2439,8 @@ int ff_mjpeg_decode_frame_from_buf(AVCodecContext *avctx, AVFrame *frame,
     s->total_ls_decoded_height = 0;

     s->buf_size = buf_size;
+    s->raw_image_buffer      = NULL;
+    s->raw_image_buffer_size = 0;

     av_exif_free(&s->exif_metadata);
     av_freep(&s->stereo3d);