Commit 452820cba6 for ffmpeg

commit 452820cba64711b4a4bc9a4a67645bd1aa188309
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Mon Sep 21 00:25:31 2026 +0200

    avcodec/opus/dec: do not offset the missing second CELT plane for mono output

    Fixes: undefined pointer arithmetic
    Fixes: applying non-zero offset 3840 to null pointer
    Fixes: ezT5LyXXGPHO
    Found during triage/review of the security report q8954W25MJoa
    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavcodec/opus/dec.c b/libavcodec/opus/dec.c
index 1617890fd5..712a0351b6 100644
--- a/libavcodec/opus/dec.c
+++ b/libavcodec/opus/dec.c
@@ -342,10 +342,10 @@ static int opus_decode_frame(OpusStreamContext *s, const uint8_t *data, int size

         if (s->packet.mode == OPUS_MODE_HYBRID) {
             int celt_delay = s->packet.frame_duration - celt_output_samples;
-            void *delaybuf[2] = { s->celt_output[0] + celt_output_samples,
-                                  s->celt_output[1] + celt_output_samples };
+            void *delaybuf[2];

             for (i = 0; i < s->output_channels; i++) {
+                delaybuf[i] = s->celt_output[i] + celt_output_samples;
                 s->fdsp->vector_fmac_scalar(out_tmp[i],
                                             s->celt_output[i], 1.0,
                                             celt_output_samples);