Commit 507e9ad286 for ffmpeg

commit 507e9ad2862619b66046ed7381296d4e5d3c8188
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Fri Oct 2 03:02:43 2026 +0200

    avcodec/vvc/dec: require all slices of a frame to use the same PH and PPS

    The testcases reproduce since b0c77e5a12.

    Fixes: out of array read
    Fixes: fAak9zecyttL/testcase/poc.vvc
    Fixes: fAak9zecyttL/testcase/poc-entry-points.vvc
    Fixes: fAak9zecyttL
    Found-by: mzfr <security@mzfr.me>

diff --git a/libavcodec/vvc/dec.c b/libavcodec/vvc/dec.c
index 8ed9e1e4b8..f69fa99c6d 100644
--- a/libavcodec/vvc/dec.c
+++ b/libavcodec/vvc/dec.c
@@ -965,6 +965,15 @@ static int decode_slice(VVCContext *s, VVCFrameContext *fc, AVBufferRef *buf_ref
         ret = frame_setup(fc, s);
         if (ret < 0)
             return ret;
+    } else {
+        const H266RawSlice *first = fc->slices[0]->ref;
+        const H266RawSlice *slice = sc->ref;
+
+        if (slice->ph != first->ph || slice->pps != first->pps) {
+            av_log(fc->log_ctx, AV_LOG_ERROR,
+                   "Slice does not use the PH and PPS of the first slice.\n");
+            return AVERROR_INVALIDDATA;
+        }
     }

     ret = slice_start(sc, s, fc, unit, is_first_slice);