From 192118f17978b8ca11eadef2f7715395a2b1d413 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 30 Sep 2026 20:04:28 +0000
Subject: [PATCH] avcodec/vp56: Roll back dimensions when resizing fails

The VP5/VP6 headers install new dimensions before vp56_size_changed() allocates the arrays for them.  If resizing fails, leave the dimensions cleared so following frames cannot use the missing arrays, and preserve the allocation error for the caller.

Fixes: 24187

Assisted-by: Fairy
---
 libavcodec/vp56.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/libavcodec/vp56.c b/libavcodec/vp56.c
index 0d13d7a276..f740b53915 100644
--- a/libavcodec/vp56.c
+++ b/libavcodec/vp56.c
@@ -654,9 +654,11 @@ int ff_vp56_decode_frame(AVCodecContext *avctx, AVFrame *rframe,
     }
 
     if (res == VP56_SIZE_CHANGE) {
-        if (vp56_size_changed(s)) {
+        ret = vp56_size_changed(s);
+        if (ret < 0) {
             av_frame_unref(p);
-            return AVERROR_INVALIDDATA;
+            ff_set_dimensions(avctx, 0, 0);
+            return ret;
         }
     }