Commit a88221d8df for ffmpeg

commit a88221d8df6585d5364bea674ece688ac7477d03
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sun Oct 25 05:47:50 2026 +0100

    avcodec/cbs_lcevc: append with position -1 in ff_cbs_lcevc_add_process_block()

    ff_cbs_lcevc_list_add() resolves a position of -1 to the end of the
    list, but the block was then set up at blocks[-1].

    Fixes: Am7oZsN0qfFR/testcase/cbs_lcevc_append.c
    Fixes: Am7oZsN0qfFR
    Fixes: out of array write
    Out of array write Replicated through API with ASAN

    Found during the review of PR 25408.

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavcodec/cbs_lcevc.c b/libavcodec/cbs_lcevc.c
index 0beae6f6f1..05cc63431a 100644
--- a/libavcodec/cbs_lcevc.c
+++ b/libavcodec/cbs_lcevc.c
@@ -628,6 +628,9 @@ int ff_cbs_lcevc_add_process_block(CodedBitstreamContext *ctx,
     if (err < 0)
         return err;

+    if (position == -1)
+        position = list->nb_blocks;
+
     // Add a new block to the message list.
     err = ff_cbs_lcevc_list_add(list, position);
     if (err < 0)