Commit 38eda0354c for ffmpeg

commit 38eda0354c3a38beec6365734c9995b681255c36
Author: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
Date:   Sun Nov 8 16:46:04 2026 +0100

    avcodec/vmdvideo: reject method 2 frames shorter than the frame area

    A method 2 frame with too little data was returned with the part of the
    frame past the end of the data left as it was in the reused frame
    buffer, exposing previously decoded pictures.

    Fixes: information disclosure
    Fixes: 4q1titS5dliF
    Information disclosure Replicated through UnModified FFmpeg

    Found-by: Ratnaker Gautam

diff --git a/libavcodec/vmdvideo.c b/libavcodec/vmdvideo.c
index b168a931ce..022e60a692 100644
--- a/libavcodec/vmdvideo.c
+++ b/libavcodec/vmdvideo.c
@@ -325,7 +325,9 @@ static int vmd_decode(VmdVideoContext *s, AVFrame *frame)

     case 2:
         for (i = 0; i < frame_height; i++) {
-            bytestream2_get_buffer(&gb, dp, frame_width);
+            if (bytestream2_get_bytes_left(&gb) < frame_width)
+                return AVERROR_INVALIDDATA;
+            bytestream2_get_bufferu(&gb, dp, frame_width);
             dp += frame->linesize[0];
         }
         break;