Commit 8732d7585c for ffmpeg

commit 8732d7585cd8ab9d1dd9baeb4db5e93466c0efa7
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 24 06:08:55 2026 +0200

    avcodec/vvc/refs: reject slices with more active reference indices than list entries

    H.266 8.3.2 requires num_ref_entries to be at least NumRefIdxActive.

    Fixes: UfO9ZQ9qW76g/testcase/gdr_rpl2.bit
    Fixes: UfO9ZQ9qW76g
    Fixes: AISLE-2026-0150-00775
    Fixes: division by zero
    Division by zero Replicated through UnModified FFmpeg with UBSAN

    Found-by: Joshua Rogers (AISLE)

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavcodec/vvc/refs.c b/libavcodec/vvc/refs.c
index a5a2d28c93..e0eab0cefa 100644
--- a/libavcodec/vvc/refs.c
+++ b/libavcodec/vvc/refs.c
@@ -597,6 +597,8 @@ int ff_vvc_slice_rpl(VVCContext *s, VVCFrameContext *fc, SliceContext *sc)
                 return ret;
             }
         }
+        if (rsh->num_ref_idx_active[lx] > rpl->nb_refs)
+            return AVERROR_INVALIDDATA;
         if (ph->r->ph_temporal_mvp_enabled_flag &&
             (!rsh->sh_collocated_from_l0_flag) == lx &&
             rsh->sh_collocated_ref_idx < rpl->nb_refs) {