Commit ee30fb98c0 for ffmpeg

commit ee30fb98c0d4e97abbd5e371d2a3a926e92bec70
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Oct 6 06:18:55 2026 +0200

    avcodec/flicvideo: decrement pixel_countdown in the big endian FLI_BRUN byte swap

    Fixes: out of array write
    Fixes: bQcit4JdHaHN
    Found-by: Joey Tang <fishjojo1@gmail.com>
    Out of array write Replicated through Modified FFmpeg with ASAN
    Segmentation fault Replicated through UnModified FFmpeg (s390x) with qemu-s390x

diff --git a/libavcodec/flicvideo.c b/libavcodec/flicvideo.c
index f17e61a9f2..c678a4832f 100644
--- a/libavcodec/flicvideo.c
+++ b/libavcodec/flicvideo.c
@@ -883,6 +883,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                 while (pixel_countdown > 0) {
                     *((signed short*)(&pixels[pixel_ptr])) = AV_RL16(&buf[pixel_ptr]);
                     pixel_ptr += 2;
+                    pixel_countdown--;
                 }
 #endif
                 y_ptr += s->frame->linesize[0];