Commit 4968cc472b for ffmpeg

commit 4968cc472b724e52fc9fd405877f367b42db92cf
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 10 07:19:58 2026 +0200

    avcodec/mjpegdec: set the AVID frame height and cropping before flipping

    Fixes: heap-buffer-overflow (read)
    Fixes: NzELYSvufGfQ
    Fixes: ANT-2026-324B3XNF
    Fixes: ant-324b3xnf-avrn-64x32-flipped.avi
    Found-by: Claude and Ada Logics

    Out of array read Replicated through UnModified FFmpeg with ASAN

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 8002ca191a..df46b2b8dc 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -2797,6 +2797,14 @@ the_end:
             }
         }
     }
+    if (avctx->codec_id != AV_CODEC_ID_SMVJPEG &&
+        (avctx->codec_tag == MKTAG('A', 'V', 'R', 'n') ||
+         avctx->codec_tag == MKTAG('A', 'V', 'D', 'J')) &&
+        avctx->coded_height > s->orig_height) {
+        frame->height   = AV_CEIL_RSHIFT(avctx->coded_height, avctx->lowres);
+        frame->crop_top = frame->height - avctx->height;
+    }
+
     if (s->flipped && !s->rgb && !s->bayer) {
         ret = av_pix_fmt_get_chroma_sub_sample(avctx->pix_fmt, &hshift, &vshift);
         if (ret)
@@ -2921,14 +2929,6 @@ the_end:
             av_log(avctx, AV_LOG_WARNING, "couldn't attach EXIF metadata\n");
     }

-    if (avctx->codec_id != AV_CODEC_ID_SMVJPEG &&
-        (avctx->codec_tag == MKTAG('A', 'V', 'R', 'n') ||
-         avctx->codec_tag == MKTAG('A', 'V', 'D', 'J')) &&
-        avctx->coded_height > s->orig_height) {
-        frame->height   = AV_CEIL_RSHIFT(avctx->coded_height, avctx->lowres);
-        frame->crop_top = frame->height - avctx->height;
-    }
-
 the_end_no_picture:
     av_log(avctx, AV_LOG_DEBUG, "decode frame unused %td bytes\n",
            buf_end - buf_ptr);