Commit 4a942afe81 for ffmpeg

commit 4a942afe819201c8ba9157983e0c8cb04b9cd44a
Author: Marvin Scholz <epirat07@gmail.com>
Date:   Thu Oct 29 23:40:45 2026 +0000

    avutil/encryption_info: set size fields only after allocation checks

    In av_encryption_init_info_alloc(), the size variables were assigned
    to the struct before checking whether the corresponding allocations
    succeeded. In case of info->key_ids, if alloc failed, it would still
    write num_key_ids into the struct before doing the call check and
    call av_encryption_init_info_free, which due to the non-zero
    num_key_ids would try to iterate over key_ids, dereferencing a NULL
    pointer.

    To fix that, assign the size and count fields only after verifying
    that the allocations succeeded, so the struct remains consistent even
    for the error cleanup path.

    Signed-off-by: Marvin Scholz <epirat07@gmail.com>

diff --git a/libavutil/encryption_info.c b/libavutil/encryption_info.c
index 9643840157..0b8843b3db 100644
--- a/libavutil/encryption_info.c
+++ b/libavutil/encryption_info.c
@@ -190,12 +190,8 @@ AVEncryptionInitInfo *av_encryption_init_info_alloc(
         return NULL;

     info->system_id = av_mallocz(system_id_size);
-    info->system_id_size = system_id_size;
     info->key_ids = key_id_size ? av_calloc(num_key_ids, sizeof(*info->key_ids)) : NULL;
-    info->num_key_ids = num_key_ids;
-    info->key_id_size = key_id_size;
     info->data = av_mallocz(data_size);
-    info->data_size = data_size;

     // Allow pointers to be NULL if the size is 0.
     if ((!info->system_id && system_id_size) || (!info->data && data_size) ||
@@ -204,6 +200,11 @@ AVEncryptionInitInfo *av_encryption_init_info_alloc(
         return NULL;
     }

+    info->system_id_size = system_id_size;
+    info->num_key_ids = num_key_ids;
+    info->key_id_size = key_id_size;
+    info->data_size = data_size;
+
     if (key_id_size) {
         for (i = 0; i < num_key_ids; i++) {
             info->key_ids[i] = av_mallocz(key_id_size);