Commit 20b8812f5c for ffmpeg

commit 20b8812f5cd9a2fb7a8c6468a53fa2b174c17542
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 10 07:13:43 2026 +0200

    avcodec/cbs_h266: reject an empty SPS conformance window

    Fixes: heap-buffer-overflow (read)
    Fixes: q0RFgfMenefI
    Fixes: ANT-2026-HRT03RV0
    Fixes: vvc-subpic-tiles.mkv
    Found-by: Claude and Ada Logics

    Out of array read Replicated through UnModified FFmpeg with ASAN

diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c
index e11799c2e5..ba64139a97 100644
--- a/libavcodec/cbs_h266_syntax_template.c
+++ b/libavcodec/cbs_h266_syntax_template.c
@@ -1116,12 +1116,12 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw,

     flag(sps_conformance_window_flag);
     if (current->sps_conformance_window_flag) {
-        uint16_t width = current->sps_pic_width_max_in_luma_samples / sub_width_c;
-        uint16_t height = current->sps_pic_height_max_in_luma_samples / sub_height_c;
-        ue(sps_conf_win_left_offset, 0, width);
-        ue(sps_conf_win_right_offset, 0, width - current->sps_conf_win_left_offset);
-        ue(sps_conf_win_top_offset, 0, height);
-        ue(sps_conf_win_bottom_offset, 0, height - current->sps_conf_win_top_offset);
+        uint16_t max_offsets_x = (current->sps_pic_width_max_in_luma_samples - 1) / sub_width_c;
+        uint16_t max_offsets_y = (current->sps_pic_height_max_in_luma_samples - 1) / sub_height_c;
+        ue(sps_conf_win_left_offset, 0, max_offsets_x);
+        ue(sps_conf_win_right_offset, 0, max_offsets_x - current->sps_conf_win_left_offset);
+        ue(sps_conf_win_top_offset, 0, max_offsets_y);
+        ue(sps_conf_win_bottom_offset, 0, max_offsets_y - current->sps_conf_win_top_offset);
     } else {
         infer(sps_conf_win_left_offset, 0);
         infer(sps_conf_win_right_offset, 0);