Commit cc62602d89 for ffmpeg

commit cc62602d8939ec8327e62384d5ab3530a80db5e6
Author: Kacper Michajłow <kasper93@gmail.com>
Date:   Wed Nov 4 19:54:18 2026 +0100

    avcodec/vp3: report progress in coding order for flipped images

    render_slice() and await_reference_row() count rows in coding order for
    both image orientations, but vp3_draw_horiz_band() reported height - y
    for old Theora bitstreams with a flipped image. The progress was highest
    after the first slice and never reached INT_MAX, so with frame threading
    the next frame read reference rows before they were decoded or waited
    for them forever.

    Fixes: Timeout
    Fixes: clusterfuzz-testcase-minimized-fuzzer_loadfile_mkv-5633304502796288
    Found-by: https://github.com/google/oss-fuzz/tree/master/projects/mpv
    Signed-off-by: Kacper Michajłow <kasper93@gmail.com>

diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
index 9b6b9901d8..0bf14d155e 100644
--- a/libavcodec/vp3.c
+++ b/libavcodec/vp3.c
@@ -1896,14 +1896,11 @@ static void vp3_draw_horiz_band(Vp3DecodeContext *s, int y)
     int offset[AV_NUM_DATA_POINTERS];

     if (HAVE_THREADS && s->avctx->active_thread_type & FF_THREAD_FRAME) {
-        int y_flipped = s->flipped_image ? s->height - y : y;
-
         /* At the end of the frame, report INT_MAX instead of the height of
          * the frame. This makes the other threads' ff_thread_await_progress()
          * calls cheaper, because they don't have to clip their values. */
         ff_progress_frame_report(&s->current_frame,
-                                 y_flipped == s->height ? INT_MAX
-                                                        : y_flipped - 1);
+                                 y == s->height ? INT_MAX : y - 1);
     }

     if (!s->avctx->draw_horiz_band)