avcodec/mjpegdec: reject a SOF without a preceding SOI when a hwaccel is used

Fixes: KICdwlv5dwyY
Fixes: AISLE-2026-0150-00792
Fixes: use after free
Use after free Replicated through Modified FFmpeg with ASAN

Found-by: Joshua Rogers (AISLE)

The report suggested clearing raw_image_buffer per packet and rejecting a
SOF that is not preceded by a SOI.

libavcodec/mjpegdec.c

@@ -824,6 +824,10 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
 
     if (s->avctx->hwaccel) {
         const FFHWAccel *hwaccel = ffhwaccel(s->avctx->hwaccel);
+        if (!s->raw_image_buffer) {
+            av_log(s->avctx, AV_LOG_ERROR, "SOF without SOI\n");
+            return AVERROR_INVALIDDATA;
+        }
 
         /* A previous frame may have been aborted before its end_frame call,
          * leaving the private data behind. */
@@ -2435,6 +2439,8 @@ int ff_mjpeg_decode_frame_from_buf(AVCodecContext *avctx, AVFrame *frame,
     s->total_ls_decoded_height = 0;
 
     s->buf_size = buf_size;
+    s->raw_image_buffer      = NULL;
+    s->raw_image_buffer_size = 0;
 
     av_exif_free(&s->exif_metadata);
     av_freep(&s->stereo3d);