From f6d70de099236a3f203c18ee82332f7c3165ee66 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 10 Oct 2026 07:23:56 +0200
Subject: [PATCH] avcodec/huffyuvdec: budget 33 bits per sample when choosing
 the unchecked 16 bit loop

Fixes: heap-buffer-overflow (read)
Fixes: BIqbuSbTJqAH
Fixes: ANT-2026-V2EPGE9M
Fixes: poc.avi
Found-by: Claude and Ada Logics

Out of array read Replicated through UnModified FFmpeg with ASAN
---
 libavcodec/huffyuvdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/huffyuvdec.c b/libavcodec/huffyuvdec.c
index 78bd3d99b3..ff982deeab 100644
--- a/libavcodec/huffyuvdec.c
+++ b/libavcodec/huffyuvdec.c
@@ -760,7 +760,7 @@ static void decode_plane_bitstream(HYuvDecContext *s, int width, int plane)
             s->temp16[0][width - 1] = 0;
         CLOSE_READER(re, &s->gb);
     } else {
-        if (count >= (get_bits_left(&s->gb)) / (32 * 2)) {
+        if (count >= (get_bits_left(&s->gb)) / (33 * 2)) {
             for (i = 0; i < count && get_bits_left(&s->gb) > 0; i++) {
                 READ_2PIX_PLANE16(s->temp16[0][2 * i], s->temp16[0][2 * i + 1], plane);
             }