Commit d11fcddf17 for ffmpeg

commit d11fcddf175ae8e7d69fd3ef3504a104f6545087
Author: Rainbaby <r@bgr.jp>
Date:   Fri Aug 28 16:18:08 2026 +0900

    avcodec/cavsdec: reject the error returns of get_ue_golomb()

    get_ue_golomb() returns AVERROR_INVALIDDATA on thirteen or more leading
    zero bits. Two callers used the value unchecked: mb_type reached
    decode_mb_p() with a value no case of its switch covers, leaving
    ff_cavs_inter() and ff_cavs_filter() to index ff_cavs_partition_flags[]
    with it, and mb_skip_run was decremented from negative. decode_mb_b()
    already rejects the first, so do it the same way.

    Only the unsigned underlying type of enum cavs_mb hid the first under
    gcc and clang; that is a compiler's choice, not a guarantee.

    Signed-off-by: Rainbaby <r@bgr.jp>

diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c
index cd35491192..2e503a77aa 100644
--- a/libavcodec/cavsdec.c
+++ b/libavcodec/cavsdec.c
@@ -780,6 +780,11 @@ static int decode_mb_p(AVSContext *h, enum cavs_mb mb_type)
         ff_cavs_mv(h, MV_FWD_X1, MV_FWD_C2, MV_PRED_MEDIAN,   BLK_8X8, ref[1]);
         ff_cavs_mv(h, MV_FWD_X2, MV_FWD_X1, MV_PRED_MEDIAN,   BLK_8X8, ref[2]);
         ff_cavs_mv(h, MV_FWD_X3, MV_FWD_X0, MV_PRED_MEDIAN,   BLK_8X8, ref[3]);
+        break;
+    default:
+        av_log(h->avctx, AV_LOG_ERROR, "Invalid mb_type %d in P frame\n",
+               mb_type);
+        return AVERROR_INVALIDDATA;
     }
     ff_cavs_inter(h, mb_type);
     set_intra_mode_default(h);
@@ -1162,6 +1167,10 @@ static int decode_pic(AVSContext *h)
                     break;
                 }
                 skip_count = get_ue_golomb(&h->gb);
+                if (skip_count < 0) {
+                    ret = AVERROR_INVALIDDATA;
+                    break;
+                }
             }
             if (h->skip_mode_flag && skip_count--) {
                 ret = decode_mb_p(h, P_SKIP);
@@ -1199,6 +1208,10 @@ static int decode_pic(AVSContext *h)
                     break;
                 }
                 skip_count = get_ue_golomb(&h->gb);
+                if (skip_count < 0) {
+                    ret = AVERROR_INVALIDDATA;
+                    break;
+                }
             }
             if (h->skip_mode_flag && skip_count--) {
                 ret = decode_mb_b(h, B_SKIP);