From 6c114bd6fa9fe006bed7dcdb88de4790510080d4 Mon Sep 17 00:00:00 2001
From: Paul Adenot <padenot@mozilla.com>
Date: Sun, 12 Apr 2026 03:18:44 +0200
Subject: [PATCH] avcodec/vp9: Rollback dimensions when format is rejected

Fixes: BMO#2029296

Found-by: Mozilla Security Team, Paul Adenot for the write variant
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/vp9.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavcodec/vp9.c b/libavcodec/vp9.c
index 1ebf5ac18b..7957cbeab9 100644
--- a/libavcodec/vp9.c
+++ b/libavcodec/vp9.c
@@ -255,8 +255,10 @@ static int update_size(AVCodecContext *avctx, int w, int h)
         *fmtp = AV_PIX_FMT_NONE;
 
         ret = ff_get_format(avctx, pix_fmts);
-        if (ret < 0)
+        if (ret < 0) {
+            ff_set_dimensions(avctx, s->w, s->h);
             return ret;
+        }
 
         avctx->pix_fmt = ret;
         s->gf_fmt  = s->pix_fmt;