Commit 863ca906a1 for ffmpeg

commit 863ca906a164eb63cb397c19e043e59dbdaf5823
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Mon Oct 12 02:06:36 2026 +0200

    avcodec/ratecontrol: check the picture number in ff_get_2pass_fcode()

    Fixes: out of array read
    Fixes: H7ATVBRB6ALZ
    Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24758
    Out of array read Replicated through UnModified FFmpeg with ASAN

diff --git a/libavcodec/mpegvideo_enc.c b/libavcodec/mpegvideo_enc.c
index 08d7aa59b7..9f5ec9f650 100644
--- a/libavcodec/mpegvideo_enc.c
+++ b/libavcodec/mpegvideo_enc.c
@@ -3710,7 +3710,9 @@ static int encode_picture(MPVMainEncContext *const m, const AVPacket *pkt)
         ret = estimate_qp(m, 1);
         if (ret < 0)
             return ret;
-        ff_get_2pass_fcode(m);
+        ret = ff_get_2pass_fcode(m);
+        if (ret < 0)
+            return ret;
     } else if (!(s->c.avctx->flags & AV_CODEC_FLAG_QSCALE)) {
         if (s->c.pict_type == AV_PICTURE_TYPE_B)
             s->lambda = m->last_lambda_for[s->c.pict_type];
diff --git a/libavcodec/ratecontrol.c b/libavcodec/ratecontrol.c
index 397a235821..130f09b9b7 100644
--- a/libavcodec/ratecontrol.c
+++ b/libavcodec/ratecontrol.c
@@ -900,14 +900,21 @@ static void adaptive_quantization(RateControlContext *const rcc,
     }
 }

-void ff_get_2pass_fcode(MPVMainEncContext *const m)
+int ff_get_2pass_fcode(MPVMainEncContext *const m)
 {
     MPVEncContext *const s = &m->s;
     const RateControlContext *rcc = &m->rc_context;
-    const RateControlEntry   *rce = &rcc->entry[s->picture_number];
+    const RateControlEntry   *rce;
+
+    if (s->picture_number >= rcc->num_entries) {
+        av_log(s->c.avctx, AV_LOG_ERROR, "Input is longer than 2-pass log file\n");
+        return AVERROR(EINVAL);
+    }
+    rce = &rcc->entry[s->picture_number];

     s->f_code = rce->f_code;
     s->b_code = rce->b_code;
+    return 0;
 }

 // FIXME rd or at least approx for dquant
diff --git a/libavcodec/ratecontrol.h b/libavcodec/ratecontrol.h
index 3bcfa5658a..f4f8af5bf5 100644
--- a/libavcodec/ratecontrol.h
+++ b/libavcodec/ratecontrol.h
@@ -100,7 +100,7 @@ int ff_rate_control_init(MPVMainEncContext *m);
 float ff_rate_estimate_qscale(MPVMainEncContext *m, int dry_run);
 void ff_write_pass1_stats(MPVMainEncContext *m);
 int ff_vbv_update(MPVMainEncContext *m, int frame_size);
-void ff_get_2pass_fcode(MPVMainEncContext *m);
+int ff_get_2pass_fcode(MPVMainEncContext *m);
 void ff_rate_control_uninit(RateControlContext *rcc);

 #endif /* AVCODEC_RATECONTROL_H */