Commit ea9dc61dc2 for ffmpeg

commit ea9dc61dc2780e3bacf3e90782cc55969437852b
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Mon Oct 26 15:57:23 2026 +0100

    avcodec/vvc/ps: widen the per slice CTU offset and count to 32 bits

    A picture can hold up to 627264 CTUs (25332x25332 with 32x32 CTUs) and
    level 6.3 allows 78336 CTUs at that CTU size, but slice_start_offset and
    num_ctus_in_slice were 16 bit. A rectangular slice with more than 65535
    CTUs, or starting after the 65535th CTU, was mapped to the wrong CTUs
    and the picture was rejected because its CTUs were not all covered
    exactly once.

    Rejected pictures Replicated through UnModified FFmpeg with ASAN
    Fixes: 4BDaLEwFScvp

    This allows reading outside the array but not outside allocated space

    Found-by: app.depthfirst.com

diff --git a/libavcodec/vvc/ps.h b/libavcodec/vvc/ps.h
index 90bd4c0e9e..add8e22367 100644
--- a/libavcodec/vvc/ps.h
+++ b/libavcodec/vvc/ps.h
@@ -99,8 +99,8 @@ typedef struct VVCPPS {
     uint16_t width;
     uint16_t height;

-    uint16_t slice_start_offset[VVC_MAX_SLICES];
-    uint16_t num_ctus_in_slice [VVC_MAX_SLICES];
+    uint32_t slice_start_offset[VVC_MAX_SLICES];
+    uint32_t num_ctus_in_slice [VVC_MAX_SLICES];

     uint16_t min_cb_width;
     uint16_t min_cb_height;