Commit 3d14f6f9e2 for ffmpeg

commit 3d14f6f9e252cda9ea7a5686576778d64882a2eb
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Oct 6 07:29:59 2026 +0200

    avformat/vvc: Check the number of sublayers

    Not a security issue, the accesses stay inside the PTL records and only
    their content is wrong.

    Fixes: IUOlTN86QoY1
    Fixes: AISLE-2026-0111-00046
    Array index out of bounds Replicated through API with UBSAN
    Found-by: Joshua Rogers <joshua.rogers@aisle.com>

diff --git a/libavformat/vvc.c b/libavformat/vvc.c
index cd5ed1b410..7c711cb783 100644
--- a/libavformat/vvc.c
+++ b/libavformat/vvc.c
@@ -245,6 +245,8 @@ static int vvcc_parse_vps(GetBitContext *gb,

     vps_max_layers_minus1 = get_bits(gb, 6);
     vps_max_sublayers_minus1 = get_bits(gb, 3);
+    if (vps_max_sublayers_minus1 >= VVC_MAX_SUBLAYERS)
+        return AVERROR_INVALIDDATA;

     /*
      * numTemporalLayers greater than 1 indicates that the stream to which this
@@ -310,9 +312,11 @@ static int vvcc_parse_vps(GetBitContext *gb,
         else
             vps_pt_present_flag[i] = 1;

-        if (!vps_default_ptl_dpb_hrd_max_tid_flag)
+        if (!vps_default_ptl_dpb_hrd_max_tid_flag) {
             vps_ptl_max_tid[i] = get_bits(gb, 3);
-        else
+            if (vps_ptl_max_tid[i] > vps_max_sublayers_minus1)
+                return AVERROR_INVALIDDATA;
+        } else
             vps_ptl_max_tid[i] = vps_max_sublayers_minus1;
     }

@@ -336,6 +340,8 @@ static int vvcc_parse_sps(GetBitContext *gb,

     skip_bits(gb, 8);  // sps_seq_parameter_set_id && sps_video_parameter_set_id
     sps_max_sublayers_minus1 = get_bits(gb, 3);
+    if (sps_max_sublayers_minus1 >= VVC_MAX_SUBLAYERS)
+        return AVERROR_INVALIDDATA;

     /*
      * numTemporalLayers greater than 1 indicates that the stream to which this