Commit 053660fdb0 for ffmpeg

commit 053660fdb0d2403b838690689c47ad7685c3b10b
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 24 06:08:53 2026 +0200

    avcodec/vvc/refs: check the rpl allocation size for overflow

    Fixes: sapW3mP74hBd/testcase/rpl_wrap.mp4
    Fixes: sapW3mP74hBd
    Fixes: AISLE-2026-0150-00723
    Fixes: out of array write
    Out of array write Replicated through UnModified FFmpeg with ASAN (i386 build)

    Found-by: Joshua Rogers (AISLE)

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavcodec/vvc/refs.c b/libavcodec/vvc/refs.c
index 4deb489b52..a5a2d28c93 100644
--- a/libavcodec/vvc/refs.c
+++ b/libavcodec/vvc/refs.c
@@ -145,7 +145,10 @@ static VVCFrame *alloc_frame(VVCContext *s, VVCFrameContext *fc)
         frame->sps = av_refstruct_ref_c(fc->ps.sps);
         frame->pps = av_refstruct_ref_c(fc->ps.pps);

-        frame->rpl = av_refstruct_allocz(s->current_frame.nb_units * sizeof(RefPicListTab));
+        size_t rpl_size;
+        if (av_size_mult(s->current_frame.nb_units, sizeof(RefPicListTab), &rpl_size) < 0)
+            goto fail;
+        frame->rpl = av_refstruct_allocz(rpl_size);
         if (!frame->rpl)
             goto fail;
         frame->nb_rpl_elems = s->current_frame.nb_units;