Commit 30455d58d2 for ffmpeg

commit 30455d58d268e2dfb02274ac6b2b9ee05880b7d9
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Mon Oct 12 02:04:57 2026 +0200

    avcodec/aac: do not keep the frame pointer after decoding

    Fixes: use after free
    Fixes: MbYbttK2ue35
    Regression since: eee5fa0808
    Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24678
    Use after free Replicated through UnModified FFmpeg with ASAN

diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c
index 66ab648016..700f16c56a 100644
--- a/libavcodec/aac/aacdec.c
+++ b/libavcodec/aac/aacdec.c
@@ -2612,6 +2612,7 @@ static int aac_decode_frame(AVCodecContext *avctx, AVFrame *frame,
     default:
         err = aac_decode_frame_int(avctx, frame, got_frame_ptr, &gb, avpkt);
     }
+    ac->frame = NULL;
     if (err < 0)
         return err;

diff --git a/libavcodec/aac/aacdec_latm.h b/libavcodec/aac/aacdec_latm.h
index 398d40741b..d9e836e949 100644
--- a/libavcodec/aac/aacdec_latm.h
+++ b/libavcodec/aac/aacdec_latm.h
@@ -308,6 +308,7 @@ static int latm_decode_frame(AVCodecContext *avctx, AVFrame *out,
     default:
         err = aac_decode_frame_int(avctx, out, got_frame_ptr, &gb, avpkt);
     }
+    latmctx->aac_ctx.frame = NULL;
     if (err < 0)
         return err;