Commit 26b4c37526 for ffmpeg

commit 26b4c37526fe0ecf1095b45daac08050f25f7659
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Nov 3 01:22:43 2026 +0100

    avcodec/motionpixels: check init_get_bits8() for failure

    Fixes: RW8zVRAMA9UY
    Fixes: AISLE-2026-0150-00225
    Fixes: null pointer dereference
    Null pointer dereference Replicated through API with ASAN (one 2^28 byte
    packet sent to the motionpixels decoder; the MVI demuxer limits packets
    to 2^24 bytes)

    Found-by: Joshua Rogers (AISLE)

diff --git a/libavcodec/motionpixels.c b/libavcodec/motionpixels.c
index e5c3daece6..04a3528ca0 100644
--- a/libavcodec/motionpixels.c
+++ b/libavcodec/motionpixels.c
@@ -299,7 +299,8 @@ static int mp_decode_frame(AVCodecContext *avctx, AVFrame *rframe,
                        buf_size / 4);
     if (buf_size & 3)
         memcpy(mp->bswapbuf + (buf_size & ~3), buf + (buf_size & ~3), buf_size & 3);
-    init_get_bits(&gb, mp->bswapbuf, buf_size * 8);
+    if ((ret = init_get_bits8(&gb, mp->bswapbuf, buf_size)) < 0)
+        return ret;

     memset(mp->changes_map, 0, avctx->width * avctx->height);
     for (i = !(avctx->extradata[1] & 2); i < 2; ++i) {