Commit 82b7a19f4a for ffmpeg

commit 82b7a19f4a18425dd17df4156062f8103da624f9
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sun Oct 11 07:15:19 2026 +0200

    avcodec/hevc: keep the active VPS when a layer SPS is cleared

    set_sps(s, l, NULL) drops the SPS of a non-base layer whose VPS does not
    match the active one. It also dropped the active VPS of the base layer,
    the next base layer frame then dereferenced the NULL VPS in
    ff_hevc_is_alpha_video().

    Fixes: NULL pointer dereference
    Fixes: 4WKa0bETBVfE
    Regression since: c7f0753a6b
    Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24895
    NULL pointer dereference Replicated through UnModified FFmpeg with ASAN

diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c
index a36ea57bc2..4f40862c29 100644
--- a/libavcodec/hevc/hevcdec.c
+++ b/libavcodec/hevc/hevcdec.c
@@ -764,7 +764,6 @@ static int set_sps(HEVCContext *s, HEVCLayerContext *l, const HEVCSPS *sps)

     pic_arrays_free(l);
     av_refstruct_unref(&l->sps);
-    av_refstruct_unref(&s->vps);

     if (!sps)
         return 0;
@@ -773,6 +772,8 @@ static int set_sps(HEVCContext *s, HEVCLayerContext *l, const HEVCSPS *sps)
     if (ret < 0)
         goto fail;

+    av_refstruct_unref(&s->vps);
+
     ff_hevc_pred_init(&s->hpc,     sps->bit_depth);
     ff_hevc_dsp_init (&s->hevcdsp, sps->bit_depth);
     ff_videodsp_init (&s->vdsp,    sps->bit_depth);