Commit 6280907da4 for ffmpeg

commit 6280907da48c4dd78f95ef5c713a29c7702153a3
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sun Oct 18 05:37:11 2026 +0200

    avcodec/cbs_vp9: check superframe frame sizes without overflowing size_t

    Fixes: j1Bk4Efn73Vz
    Fixes: AISLE-2026-0150-00765
    Fixes: out of array read
    Out of array read Replicated through UnModified FFmpeg with ASAN

    Found-by: Joshua Rogers (AISLE)

    The report suggested ordered subtraction checks.

diff --git a/libavcodec/cbs_vp9.c b/libavcodec/cbs_vp9.c
index 37015f5c77..ffa7d3cc9b 100644
--- a/libavcodec/cbs_vp9.c
+++ b/libavcodec/cbs_vp9.c
@@ -397,7 +397,7 @@ static int cbs_vp9_split_fragment(CodedBitstreamContext *ctx,

         pos = 0;
         for (i = 0; i <= sfi.frames_in_superframe_minus_1; i++) {
-            if (pos + sfi.frame_sizes[i] + index_size > frag->data_size) {
+            if (sfi.frame_sizes[i] > frag->data_size - index_size - pos) {
                 av_log(ctx->log_ctx, AV_LOG_ERROR, "Frame %d too large "
                        "in superframe: %"PRIu32" bytes.\n",
                        i, sfi.frame_sizes[i]);