Commit 12e5d4ec98 for ffmpeg

commit 12e5d4ec98b7add7bcac9d8131d9a6dfb2549966
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 10 07:09:02 2026 +0200

    avcodec/lcldec: check the packet size before reading the ZLIB multithread header

    Fixes: heap-buffer-overflow (read)
    Fixes: G8jPOZLbzYtj
    Fixes: ANT-2026-22YEN9NA
    Fixes: lcl-zlib-mt-shortlace.mkv
    Found-by: Claude and Ada Logics

    Out of array read Replicated through UnModified FFmpeg with ASAN

diff --git a/libavcodec/lcldec.c b/libavcodec/lcldec.c
index ad40c58546..f6c8bc7051 100644
--- a/libavcodec/lcldec.c
+++ b/libavcodec/lcldec.c
@@ -283,6 +283,10 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
                 break;
             }
         } else if (c->flags & FLAG_MULTITHREAD) {
+            if (len < 8) {
+                av_log(avctx, AV_LOG_ERROR, "len %d is too small\n", len);
+                return AVERROR_INVALIDDATA;
+            }
             mthread_inlen = AV_RL32(buf);
             mthread_inlen = FFMIN(mthread_inlen, len - 8);
             mthread_outlen = AV_RL32(buf + 4);