Commit 60b286521b for ffmpeg

commit 60b286521b46caa09792af04c6a4e3437aac8293
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Thu Oct 29 13:39:18 2026 +0100

    avcodec/decode: check the enhanced LCEVC picture size against max_pixels

    Fixes: W5cs7fsOfb24/testcase/lcevc_16000x16000.h264 / gen.py
    Fixes: W5cs7fsOfb24
    Fixes: AISLE-2026-0150-00838
    Fixes: max_pixels bypass
    max_pixels bypass Replicated through UnModified FFmpeg

    Found-by: Joshua Rogers (AISLE)

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavcodec/decode.c b/libavcodec/decode.c
index 92dbdc4998..c9ec6a49e2 100644
--- a/libavcodec/decode.c
+++ b/libavcodec/decode.c
@@ -1627,11 +1627,21 @@ static int lcevc_parse_frame(AVCodecContext *avctx, DecodeContext *dc, AVFrame *
     ret = ff_lcevc_parse_frame(dc->lcevc.ctx, frame, &dc->lcevc.format,
                                &dc->lcevc.base_format,
                                &dc->lcevc.width, &dc->lcevc.height);
+    int enhance = !ret && dc->lcevc.width && dc->lcevc.height &&
+                  frame->format == dc->lcevc.base_format;
+    if (enhance) {
+        ret = av_image_check_size2(FFMAX(frame->width,  dc->lcevc.width),
+                                   FFMAX(frame->height, dc->lcevc.height),
+                                   avctx->max_pixels, AV_PIX_FMT_NONE, 0, avctx);
+        if (ret < 0) {
+            dc->lcevc.width = dc->lcevc.height = 0;
+            enhance = 0;
+        }
+    }
     if (ret < 0 && (avctx->err_recognition & AV_EF_EXPLODE))
         return ret;

-    if (ret < 0 || !dc->lcevc.width || !dc->lcevc.height ||
-        frame->format != dc->lcevc.base_format) {
+    if (!enhance) {
         dc->lcevc.frame = 0;
         return 0;
     }