Commit 06291d49f4 for ffmpeg

commit 06291d49f4b6a5b20de82acb368390ed0faf7ad9
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Wed Oct 7 02:43:31 2026 +0200

    avformat/rtpenc_vc2hq: Reject transform parameters that run past the picture

    Not a security issue.

    Fixes: GOnB0bwaMBbJ
    Byte after the picture sent Replicated through UnModified FFmpeg
    Found during triage of the security report nd3rLqSpKgo5

diff --git a/libavformat/rtpenc_vc2hq.c b/libavformat/rtpenc_vc2hq.c
index 66984e6e97..f7689f7d8f 100644
--- a/libavformat/rtpenc_vc2hq.c
+++ b/libavformat/rtpenc_vc2hq.c
@@ -88,6 +88,8 @@ static int send_picture(AVFormatContext *ctx, const uint8_t *buf, int size, int
     }

     frag_len = (get_bits_count(&gc) + 7) / 8; /* length of transform parameters */
+    if (get_bits_left(&gc) < 0)
+        return AVERROR_INVALIDDATA;

     AV_WB32(&info_hdr[ 0], pic_nr);
     AV_WB16(&info_hdr[ 4], prefix_bytes);