Commit 4ec127c826 for ffmpeg

commit 4ec127c82678b06658e963291f272881dc878735
Author: Ruk Doe <info@doany.io>
Date:   Sat Oct 10 15:50:24 2026 +0900

    avcodec/libaribcaption: free only the added rects on ass errors

    The ass error path freed sub->rects[0] .. [region_count - 1], but
    ff_ass_add_rect() grows the array one rect at a time and counts the
    rects it added in sub->num_rects, including one whose dialog string
    failed to allocate. Entries past num_rects are not initialized, so an
    allocation failure part way through read them, or past the array.

    Free up to sub->num_rects instead.

    Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01DdDiDRusmi6eD7qSrKBjHb
    Reported-by: Forgejo_Fairy
    Reference: #24992
    Found-by: Joshua Rogers <joshua.rogers@aisle.com>

diff --git a/libavcodec/libaribcaption.c b/libavcodec/libaribcaption.c
index eeda071367..3e22aa5e0a 100644
--- a/libavcodec/libaribcaption.c
+++ b/libavcodec/libaribcaption.c
@@ -793,7 +793,7 @@ static int aribcaption_trans_ass_subtitle(ARIBCaptionContext *ctx)

 fail:
     if (sub->rects) {
-        for (int i = 0; i < ctx->caption.region_count; i++) {
+        for (int i = 0; i < sub->num_rects; i++) {
             if (sub->rects[i]) {
                 av_freep(&sub->rects[i]->ass);
                 av_freep(&sub->rects[i]);