Commit 50865f20b1 for ffmpeg

commit 50865f20b1f474e6b11735c88f668751bc9aa528
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Nov 3 04:31:08 2026 +0100

    avcodec/vmnc: restore the screen under the cursor only after it was painted

    Fixes: use of uninitialized memory
    Fixes: t1Iyw4k7bw8h
    Fixes: AISLE-2026-0150-00465
    Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind

    Found-by: Joshua Rogers (AISLE)

diff --git a/libavcodec/vmnc.c b/libavcodec/vmnc.c
index 162e8ee9bb..b3946f96b1 100644
--- a/libavcodec/vmnc.c
+++ b/libavcodec/vmnc.c
@@ -71,6 +71,7 @@ typedef struct VmncContext {
     int cur_hx, cur_hy;
     uint8_t *curbits, *curmask;
     uint8_t *screendta;
+    int cursor_painted;
 } VmncContext;

 /* read pixel value from stream */
@@ -345,7 +346,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *rframe,
     c->pic->pict_type = AV_PICTURE_TYPE_P;

     // restore screen after cursor
-    if (c->screendta) {
+    if (c->cursor_painted) {
         int i;
         w = c->cur_w;
         if (c->width < c->cur_x + w)
@@ -371,6 +372,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *rframe,
                 outptr += c->pic->linesize[0];
             }
         }
+        c->cursor_painted = 0;
     }

     while (chunks--) {
@@ -513,6 +515,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *rframe,
             }
             outptr = c->pic->data[0];
             put_cursor(outptr, c->pic->linesize[0], c, c->cur_x, c->cur_y);
+            c->cursor_painted = 1;
         }
     }
     *got_frame = 1;