Commit eac2bedcf6 for ffmpeg

commit eac2bedcf6245552b39eed32b334851bc6a1b8fa
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 17 03:22:33 2026 +0200

    avcodec/decode: allow a hwaccel free_frame_priv callback without a hw_frames_ctx

    Found during triage/review of the security report AISLE-2026-R0043

diff --git a/libavcodec/decode.c b/libavcodec/decode.c
index e4922cefcd..d0e20c3637 100644
--- a/libavcodec/decode.c
+++ b/libavcodec/decode.c
@@ -2371,14 +2371,13 @@ int ff_hwaccel_frame_priv_alloc(AVCodecContext *avctx, void **hwaccel_picture_pr
     av_assert0(!*hwaccel_picture_private);

     if (hwaccel->free_frame_priv) {
-        AVHWFramesContext *frames_ctx;
+        AVHWDeviceContext *device_ctx = NULL;

-        if (!avctx->hw_frames_ctx)
-            return AVERROR(EINVAL);
+        if (avctx->hw_frames_ctx)
+            device_ctx = ((AVHWFramesContext *)avctx->hw_frames_ctx->data)->device_ctx;

-        frames_ctx = (AVHWFramesContext *) avctx->hw_frames_ctx->data;
         *hwaccel_picture_private = av_refstruct_alloc_ext(hwaccel->frame_priv_data_size, 0,
-                                                          frames_ctx->device_ctx,
+                                                          device_ctx,
                                                           hwaccel->free_frame_priv);
     } else {
         *hwaccel_picture_private = av_refstruct_allocz(hwaccel->frame_priv_data_size);
diff --git a/libavcodec/hwaccel_internal.h b/libavcodec/hwaccel_internal.h
index 7224406815..ac860f8ab0 100644
--- a/libavcodec/hwaccel_internal.h
+++ b/libavcodec/hwaccel_internal.h
@@ -154,7 +154,8 @@ typedef struct FFHWAccel {
     /**
      * Callback to free the hwaccel-specific frame data.
      *
-     * @param hwctx a pointer to an AVHWDeviceContext.
+     * @param hwctx a pointer to an AVHWDeviceContext, NULL when the decoder
+     *              has no hw_frames_ctx.
      * @param data the per-frame hardware accelerator private data to be freed.
      */
     void (*free_frame_priv)(AVRefStructOpaque hwctx, void *data);