From 2c515eea07df719379e7f73deeeb7ccb8768433f Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 10 Oct 2026 07:25:28 +0200
Subject: [PATCH] avcodec/cbs_sei: clear the message slot handed out by
 ff_cbs_sei_list_add()

Fixes: heap-use-after-free
Fixes: YtyT0QH1InrQ
Fixes: ANT-2026-13DK7NZD
Fixes: poc.264
Found-by: Claude and Ada Logics

Use after free Replicated through UnModified FFmpeg with ASAN
---
 libavcodec/cbs_sei.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/libavcodec/cbs_sei.c b/libavcodec/cbs_sei.c
index f354a10029..4f04b9ff83 100644
--- a/libavcodec/cbs_sei.c
+++ b/libavcodec/cbs_sei.c
@@ -279,11 +279,8 @@ int ff_cbs_sei_list_add(SEIRawMessageList *list)
 
         list->messages = ptr;
         list->nb_messages_allocated = new_count;
-
-        // Zero the newly-added entries.
-        memset(list->messages + old_count, 0,
-               (new_count - old_count) * sizeof(*list->messages));
     }
+    memset(&list->messages[list->nb_messages], 0, sizeof(*list->messages));
     ++list->nb_messages;
     return 0;
 }