Commit 463cff5b96 for ffmpeg

commit 463cff5b9641d6a2df6595fa59234b2aa74d8463
Author: Rainbaby <r@bgr.jp>
Date:   Fri Aug 28 16:18:07 2026 +0900

    avcodec/cavsdec: parse slice_vertical_position_extension

    slice_vertical_position is the low byte of the start code and stops at
    0xAF, so a tall picture carries the high bits of MbRow in a 3 bit
    extension (table 25, clause 7.2.4). No level of annex B reaches that
    height, so this is completeness rather than a decode fix.

    Signed-off-by: Rainbaby <r@bgr.jp>

diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c
index 67002049f0..f53576d787 100644
--- a/libavcodec/cavsdec.c
+++ b/libavcodec/cavsdec.c
@@ -944,12 +944,18 @@ static int decode_mb_b(AVSContext *h, enum cavs_mb mb_type)

 static inline int decode_slice_header(AVSContext *h, GetBitContext *gb)
 {
-    if (h->stc >= h->mb_height) {
-        av_log(h->avctx, AV_LOG_ERROR, "stc 0x%02x is too large\n", h->stc);
+    int mby = h->stc;
+
+    /* over 2800 lines MbRow carries high bits here (clause 7.2.4) */
+    if (h->height > 2800)
+        mby += get_bits(gb, 3) << 7; //slice_vertical_position_extension
+
+    if (mby >= h->mb_height) {
+        av_log(h->avctx, AV_LOG_ERROR, "MbRow %d is too large\n", mby);
         return AVERROR_INVALIDDATA;
     }

-    h->mby   = h->stc;
+    h->mby   = mby;
     h->mbidx = h->mby * h->mb_width;

     /* mark top macroblocks as unavailable */