Commit 1436f56075 for ffmpeg

commit 1436f560753a15757d59f3b425a3ab1a1bb0ed6b
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 10 07:22:41 2026 +0200

    avcodec/aacsbr: turn SBR off when the USAC SBR data cannot be parsed

    Fixes: heap-buffer-overflow (write)
    Fixes: GITTfi6VsK4u
    Fixes: ANT-2026-5KX1BXM6
    Fixes: poc.flv
    Found-by: Claude and Ada Logics

    Out of array write Replicated through UnModified FFmpeg with ASAN

diff --git a/libavcodec/aacsbr_template.c b/libavcodec/aacsbr_template.c
index cc22b64416..f398d79a61 100644
--- a/libavcodec/aacsbr_template.c
+++ b/libavcodec/aacsbr_template.c
@@ -1210,12 +1210,11 @@ int ff_aac_sbr_config_usac(AACDecContext *ac, ChannelElement *che,
     return 0;
 }

-int ff_aac_sbr_decode_usac_data(AACDecContext *ac, ChannelElement *che,
-                                AACUsacElemConfig *ue, GetBitContext *gb,
-                                int sbr_ch, int indep_flag)
+static int read_usac_sbr_data(AACDecContext *ac, SpectralBandReplication *sbr,
+                              AACUsacElemConfig *ue, GetBitContext *gb,
+                              int sbr_ch, int indep_flag)
 {
     int ret;
-    SpectralBandReplication *sbr = get_sbr(che);
     int info_present = 1;
     int header_present = 1;

@@ -1356,6 +1355,19 @@ int ff_aac_sbr_decode_usac_data(AACDecContext *ac, ChannelElement *che,

     return 0;
 }
+
+int ff_aac_sbr_decode_usac_data(AACDecContext *ac, ChannelElement *che,
+                                AACUsacElemConfig *ue, GetBitContext *gb,
+                                int sbr_ch, int indep_flag)
+{
+    SpectralBandReplication *sbr = get_sbr(che);
+    int ret = read_usac_sbr_data(ac, sbr, ue, gb, sbr_ch, indep_flag);
+
+    if (ret < 0)
+        sbr_turnoff(sbr);
+
+    return ret;
+}
 #endif

 /**