Commit 67f9665f8e for ffmpeg

commit 67f9665f8e6f775d4fdcf2c5f33f95e8d937d78f
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 10 07:15:27 2026 +0200

    avcodec/cbs_h266: reject SPS virtual boundaries when the resolution may change

    Fixes: negative-size-param
    Fixes: left shift of negative value
    Fixes: 0IMcpiRlVAb5
    Fixes: ANT-2026-QY2HYS5A
    Fixes: poc.mkv
    Found-by: Claude and Ada Logics

    Negative size memcpy Replicated through UnModified FFmpeg with ASAN and UBSAN

diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c
index ba64139a97..99c35873a8 100644
--- a/libavcodec/cbs_h266_syntax_template.c
+++ b/libavcodec/cbs_h266_syntax_template.c
@@ -1587,7 +1587,7 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw,

     flag(sps_virtual_boundaries_enabled_flag);
     if (current->sps_virtual_boundaries_enabled_flag) {
-        flag(sps_virtual_boundaries_present_flag);
+        u(1, sps_virtual_boundaries_present_flag, 0, !current->sps_res_change_in_clvs_allowed_flag);
         if (current->sps_virtual_boundaries_present_flag) {
             ue(sps_num_ver_virtual_boundaries,
                0, current->sps_pic_width_max_in_luma_samples <= 8 ? 0 : VVC_MAX_VBS);