Commit bcce323201 for ffmpeg

commit bcce3232016695f5e482867519c45727a0a2a2c9
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sun Oct 18 05:35:34 2026 +0200

    avcodec/vp9: reset the CBS fragment on every error after reading the packet

    Fixes: bmXNoLIHNO2l
    Fixes: AISLE-2026-0150-00467
    Fixes: memleak
    Memleak Replicated through UnModified FFmpeg with ASAN

    Regression since: c0bf1382a757a4dd45b0c5f8ab70578e7126beca

    Found-by: Joshua Rogers (AISLE)

    The report suggested routing these returns through the fail label.

diff --git a/libavcodec/vp9.c b/libavcodec/vp9.c
index c20b1002c1..dfd5da08ed 100644
--- a/libavcodec/vp9.c
+++ b/libavcodec/vp9.c
@@ -1702,13 +1702,13 @@ static int vp9_decode_frame(AVCodecContext *avctx, AVFrame *frame,
         const FFHWAccel *hwaccel = ffhwaccel(avctx->hwaccel);
         ret = hwaccel->start_frame(avctx, pkt->buf, pkt->data, pkt->size);
         if (ret < 0)
-            return ret;
+            goto fail;
         ret = hwaccel->decode_slice(avctx, pkt->data, pkt->size);
         if (ret < 0)
-            return ret;
+            goto fail;
         ret = hwaccel->end_frame(avctx);
         if (ret < 0)
-            return ret;
+            goto fail;

         for (i = 0; i < 8; i++) {
             vp9_frame_replace(&s->s.ref_frames[i],
@@ -1736,7 +1736,7 @@ static int vp9_decode_frame(AVCodecContext *avctx, AVFrame *frame,
     if ((ret = update_block_buffers(avctx)) < 0) {
         av_log(avctx, AV_LOG_ERROR,
                "Failed to allocate block buffers\n");
-        return ret;
+        goto fail;
     }
     if (s->s.h.refreshctx && s->s.h.parallelmode) {
         int j, k, l, m;
@@ -1794,13 +1794,17 @@ static int vp9_decode_frame(AVCodecContext *avctx, AVFrame *frame,
                         data += 4;
                         size -= 4;
                     }
-                    if (tile_size > size)
-                        return AVERROR_INVALIDDATA;
+                    if (tile_size > size) {
+                        ret = AVERROR_INVALIDDATA;
+                        goto fail;
+                    }
                     ret = ff_vpx_init_range_decoder(&s->td[tile_col].c_b[tile_row], data, tile_size);
                     if (ret < 0)
-                        return ret;
-                    if (vpx_rac_get_prob_branchy(&s->td[tile_col].c_b[tile_row], 128)) // marker bit
-                        return AVERROR_INVALIDDATA;
+                        goto fail;
+                    if (vpx_rac_get_prob_branchy(&s->td[tile_col].c_b[tile_row], 128)) { // marker bit
+                        ret = AVERROR_INVALIDDATA;
+                        goto fail;
+                    }
                     data += tile_size;
                     size -= tile_size;
                 }