Commit 10a1b53b69 for ffmpeg

commit 10a1b53b690549c93d7f69938e0be4bc9afaf835
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Wed Oct 7 00:04:31 2026 +0200

    avutil/des: Do not advance a NULL source pointer

    av_des_crypt() and av_des_mac() accept a NULL src, but the loop still
    added 8 to it for every block, which is undefined behavior.

    Pointer arithmetic on NULL Replicated through UnModified FFmpeg with UBSAN
    Found during triage of the security report f3cEzuDEDwTL

diff --git a/libavutil/des.c b/libavutil/des.c
index e0e9a86660..26e219b6c6 100644
--- a/libavutil/des.c
+++ b/libavutil/des.c
@@ -295,7 +295,11 @@ static void av_des_crypt_mac(AVDES *d, uint8_t *dst, const uint8_t *src,
     uint64_t iv_val = iv ? AV_RB64(iv) : 0;
     while (count-- > 0) {
         uint64_t dst_val;
-        uint64_t src_val = src ? AV_RB64(src) : 0;
+        uint64_t src_val = 0;
+        if (src) {
+            src_val = AV_RB64(src);
+            src += 8;
+        }
         if (decrypt) {
             uint64_t tmp = src_val;
             if (d->triple_des) {
@@ -313,7 +317,6 @@ static void av_des_crypt_mac(AVDES *d, uint8_t *dst, const uint8_t *src,
             iv_val = iv ? dst_val : 0;
         }
         AV_WB64(dst, dst_val);
-        src += 8;
         if (!mac)
             dst += 8;
     }