From 4faaf2e9b896fa9d97285a1ddcaa77c4a5107e63 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 12 Oct 2026 02:07:46 +0200
Subject: [PATCH] avcodec/ratecontrol: check the fcode and bcode of the 2-pass
 log

Fixes: out of array access
Fixes: DY618nKRv9YY
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24758
Out of array access Replicated through UnModified FFmpeg with ASAN
---
 libavcodec/ratecontrol.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libavcodec/ratecontrol.c b/libavcodec/ratecontrol.c
index 130f09b9b7..98e05601da 100644
--- a/libavcodec/ratecontrol.c
+++ b/libavcodec/ratecontrol.c
@@ -635,6 +635,11 @@ av_cold int ff_rate_control_init(MPVMainEncContext *const m)
                        rce->pict_type, i);
                 return -1;
             }
+            if ((unsigned)rce->f_code > MAX_FCODE || (unsigned)rce->b_code > MAX_FCODE) {
+                av_log(avctx, AV_LOG_ERROR, "invalid fcode %d / bcode %d at line %d\n",
+                       rce->f_code, rce->b_code, i);
+                return -1;
+            }
 
             p = next;
         }