hwcontext_vulkan: fix compilation with older header versions

Fixes a heap-buffer-overflow in `decode_frame` where `header_len` read
from the bitstream was not validated against the remaining bytes in the
input buffer (`gb`). This allowed `gb_hdr` to be initialized with a size
exceeding the actual packet data, leading to an out-of-bounds read.

The fix adds a check to ensure `bytestream2_get_bytes_left(&gb)` is
greater than or equal to `header_len - 2` before initializing `gb_hdr`.

Fixes: https://issues.oss-fuzz.com/issues/439711053

libavcodec/neon/mpegvideo.c

@@ -41,6 +41,8 @@ static void inline ff_dct_unquantize_h263_neon(int qscale, int qadd, int nCoeffs
     int16x8_t q14s16, q15s16, qzs16;
     uint16x8_t q1u16, q9u16;
 
+    qzs16 = vdupq_n_s16(0);
+
     q15s16 = vdupq_n_s16(qscale << 1);
     q14s16 = vdupq_n_s16(qadd);
     q13s16 = vnegq_s16(q14s16);

libavcodec/prores_raw.c

@@ -360,7 +360,7 @@ static int decode_frame(AVCodecContext *avctx,
         return AVERROR_INVALIDDATA;
 
     int header_len = bytestream2_get_be16(&gb);
-    if (header_len < 62)
+    if (header_len < 62 || bytestream2_get_bytes_left(&gb) < header_len - 2)
         return AVERROR_INVALIDDATA;
 
     GetByteContext gb_hdr;

libavutil/hwcontext_vulkan.c

@@ -2569,7 +2569,7 @@ static int switch_layout_host(AVHWFramesContext *hwfc, FFVkExecPool *ectx,
     VkResult ret;
     VulkanDevicePriv *p = hwfc->device_ctx->hwctx;
     FFVulkanFunctions *vk = &p->vkctx.vkfn;
-    VkHostImageLayoutTransitionInfo layout_change[AV_NUM_DATA_POINTERS];
+    VkHostImageLayoutTransitionInfoEXT layout_change[AV_NUM_DATA_POINTERS];
     int nb_images = ff_vk_count_images(frame);
 
     VkImageLayout new_layout;
@@ -2585,7 +2585,7 @@ static int switch_layout_host(AVHWFramesContext *hwfc, FFVkExecPool *ectx,
         return AVERROR(ENOTSUP);
 
     for (i = 0; i < nb_images; i++) {
-        layout_change[i] = (VkHostImageLayoutTransitionInfo) {
+        layout_change[i] = (VkHostImageLayoutTransitionInfoEXT) {
             .sType = VK_STRUCTURE_TYPE_HOST_IMAGE_LAYOUT_TRANSITION_INFO,
             .image = frame->img[i],
             .oldLayout = frame->layout[i],

tests/checkasm/mpegvideo_unquantize.c

@@ -215,11 +215,11 @@ void checkasm_check_mpegvideo_unquantize(void)
     int q_scale_type = rnd() & 1;
 
     ff_mpv_unquantize_init(&unquant_dsp_ctx, 1 /* bitexact */, q_scale_type);
-    declare_func(void, MPVContext *s, int16_t *block, int n, int qscale);
+    declare_func(void, const MPVContext *s, int16_t *block, int n, int qscale);
 
     for (size_t i = 0; i < FF_ARRAY_ELEMS(tests); ++i) {
-        void (*func)(MPVContext *s, int16_t *block, int n, int qscale) =
-            *(void (**)(MPVContext *, int16_t *, int, int))((char*)&unquant_dsp_ctx + tests[i].offset);
+        void (*func)(const MPVContext *s, int16_t *block, int n, int qscale) =
+            *(void (**)(const MPVContext *, int16_t *, int, int))((char*)&unquant_dsp_ctx + tests[i].offset);
         if (check_func(func, "%s", tests[i].name)) {
             MPVContext new, ref;
             DECLARE_ALIGNED(16, int16_t, block_new)[64];