Commit 0260f625ba for ffmpeg

commit 0260f625ba51ba9f02b189da757862fd96fb1da0
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Fri Oct 2 17:53:26 2026 +0200

    avformat/mov: make room in tts_data by the index entry count in mov_read_trun()

    Move the same range as for index_entries, tts_count is set to
    nb_index_entries right after.

    Fixes: out of array access
    Fixes: crash.mp4 / make-crash.py
    Fixes: srZp1wXh4CXQ
    Found-by: OpenAI Security Research
    Replicated through UnModified FFmpeg

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 71c4e38c88..e3e0100e11 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -6380,7 +6380,7 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom)
                 (sti->nb_index_entries - index_entry_pos));
         memmove(sc->tts_data + index_entry_pos + entries,
                 sc->tts_data + index_entry_pos,
-                sizeof(*sc->tts_data) * (sc->tts_count - index_entry_pos));
+                sizeof(*sc->tts_data) * (sti->nb_index_entries - index_entry_pos));
         if (index_entry_pos < sc->current_sample) {
             sc->current_sample += entries;
         }