Commit afdc555aac for ffmpeg

commit afdc555aace698b88c86d3f33a7773a6c8ba2897
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Nov 3 04:46:20 2026 +0100

    avcodec/vc1dec: free the slice buffer when init_get_bits8() fails

    Fixes: Ju3bQZ3z2paC
    Fixes: AISLE-2026-0150-00166
    Fixes: memory leak
    Memory leak Replicated through UnModified FFmpeg with ASAN (AVI with one
    268435475 byte WVC1 packet holding a single slice start code)

    Found-by: Joshua Rogers (AISLE)

diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c
index 94bccbfa50..a4d465dd0b 100644
--- a/libavcodec/vc1dec.c
+++ b/libavcodec/vc1dec.c
@@ -856,8 +856,10 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame *pict,
                     buf_size3 = v->vc1dsp.vc1_unescape_buffer(start + 4, size,
                                                               slices[n_slices].buf);
                     ret = init_get_bits8(&slices[n_slices].gb, slices[n_slices].buf, buf_size3);
-                    if (ret < 0)
+                    if (ret < 0) {
+                        av_freep(&slices[n_slices].buf);
                         goto err;
+                    }
                     slices[n_slices].mby_start = avctx->coded_height + 31 >> 5;
                     slices[n_slices].rawbuf = start;
                     slices[n_slices].raw_size = size + 4;
@@ -889,8 +891,10 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame *pict,
                     buf_size3 = v->vc1dsp.vc1_unescape_buffer(start + 4, size,
                                                               slices[n_slices].buf);
                     ret = init_get_bits8(&slices[n_slices].gb, slices[n_slices].buf, buf_size3);
-                    if (ret < 0)
+                    if (ret < 0) {
+                        av_freep(&slices[n_slices].buf);
                         goto err;
+                    }
                     slices[n_slices].mby_start = get_bits(&slices[n_slices].gb, 9);
                     slices[n_slices].rawbuf = start;
                     slices[n_slices].raw_size = size + 4;
@@ -924,8 +928,10 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame *pict,
                 }
                 buf_size3 = v->vc1dsp.vc1_unescape_buffer(divider + 4, buf + buf_size - divider - 4, slices[n_slices].buf);
                 ret = init_get_bits8(&slices[n_slices].gb, slices[n_slices].buf, buf_size3);
-                if (ret < 0)
+                if (ret < 0) {
+                    av_freep(&slices[n_slices].buf);
                     goto err;
+                }
                 slices[n_slices].mby_start = s->mb_height + 1 >> 1;
                 slices[n_slices].rawbuf = divider;
                 slices[n_slices].raw_size = buf + buf_size - divider;