Commit 1eaaa6c60c for ffmpeg

commit 1eaaa6c60c4dc3366e876dad7fa6a4b38c6ff62e
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sun Oct 11 07:31:13 2026 +0200

    avcodec/tdsc: reject unknown cursor formats before replacing the cursor sprite

    The sprite buffer was reallocated and the new geometry stored before the
    format was checked, the uninitialized sprite was then painted onto every
    following frame.

    Fixes: use of uninitialized memory
    Fixes: JJihVQxE36RL
    Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24682
    Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind

diff --git a/libavcodec/tdsc.c b/libavcodec/tdsc.c
index f31655ce3d..976b67b8f9 100644
--- a/libavcodec/tdsc.c
+++ b/libavcodec/tdsc.c
@@ -209,6 +209,11 @@ static int tdsc_load_cursor(AVCodecContext *avctx)

     cursor_fmt = bytestream2_get_le32(&ctx->gbc);

+    if (cursor_fmt != CUR_FMT_MONO && cursor_fmt != CUR_FMT_BGRA &&
+        cursor_fmt != CUR_FMT_RGBA) {
+        avpriv_request_sample(avctx, "Cursor format %08x", cursor_fmt);
+        return AVERROR_PATCHWELCOME;
+    }
     if (w < 1 || w > 256 || h < 1 || h > 256) {
         av_log(avctx, AV_LOG_ERROR, "Invalid cursor dimensions %dx%d.\n", w, h);
         return AVERROR_INVALIDDATA;
@@ -305,9 +310,6 @@ static int tdsc_load_cursor(AVCodecContext *avctx)
             }
         }
         break;
-    default:
-        avpriv_request_sample(avctx, "Cursor format %08x", cursor_fmt);
-        return AVERROR_PATCHWELCOME;
     }

     return 0;