Commit 5ed22b254c for ffmpeg

commit 5ed22b254c266873602e5e7773741ba576b0c29a
Author: Ayoub Nabil Boubagrat <237098474+ayoubnabil@users.noreply.github.com>
Date:   Wed Sep 9 21:50:00 2026 +0200

    avcodec/tdsc: clear newly allocated reference frames

    A TDSF packet can allocate a reference frame without covering it with any
    tiles. The decoder then copies the whole uninitialized reference frame to
    the output frame.

    Clear new reference frames before decoding the tiles.

    Fixes: read of uninitialized memory
    Fixes: BhqRF844Pmu5
    Found-by: Ayoub Nabil Boubagrat <237098474+ayoubnabil@users.noreply.github.com>

    Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind
    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavcodec/tdsc.c b/libavcodec/tdsc.c
index 976b67b8f9..9f66ba9e18 100644
--- a/libavcodec/tdsc.c
+++ b/libavcodec/tdsc.c
@@ -34,6 +34,7 @@
  */

 #include <stdint.h>
+#include <string.h>
 #include <zlib.h>

 #include "libavutil/attributes_internal.h"
@@ -498,6 +499,8 @@ static int tdsc_parse_tdsf(AVCodecContext *avctx, int number_tiles)
         ret = av_frame_get_buffer(ctx->refframe, 0);
         if (ret < 0)
             return ret;
+        memset(ctx->refframe->data[0], 0,
+               (size_t)ctx->refframe->linesize[0] * ctx->refframe->height);
     }

     /* Decode all tiles in a frame */