Commit f6d70de099 for ffmpeg

commit f6d70de099236a3f203c18ee82332f7c3165ee66
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 10 07:23:56 2026 +0200

    avcodec/huffyuvdec: budget 33 bits per sample when choosing the unchecked 16 bit loop

    Fixes: heap-buffer-overflow (read)
    Fixes: BIqbuSbTJqAH
    Fixes: ANT-2026-V2EPGE9M
    Fixes: poc.avi
    Found-by: Claude and Ada Logics

    Out of array read Replicated through UnModified FFmpeg with ASAN

diff --git a/libavcodec/huffyuvdec.c b/libavcodec/huffyuvdec.c
index 78bd3d99b3..ff982deeab 100644
--- a/libavcodec/huffyuvdec.c
+++ b/libavcodec/huffyuvdec.c
@@ -760,7 +760,7 @@ static void decode_plane_bitstream(HYuvDecContext *s, int width, int plane)
             s->temp16[0][width - 1] = 0;
         CLOSE_READER(re, &s->gb);
     } else {
-        if (count >= (get_bits_left(&s->gb)) / (32 * 2)) {
+        if (count >= (get_bits_left(&s->gb)) / (33 * 2)) {
             for (i = 0; i < count && get_bits_left(&s->gb) > 0; i++) {
                 READ_2PIX_PLANE16(s->temp16[0][2 * i], s->temp16[0][2 * i + 1], plane);
             }