Commit 14f4e547d6 for ffmpeg

commit 14f4e547d6664610f4eb3f7fb5f1cb03a4d9b57c
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Mon Oct 19 02:16:05 2026 +0200

    avformat/rtpenc_jpeg: Check that the JPEG payload header fits in the packet

    Fixes: heap-buffer-overflow
    Fixes: negative-size-param
    Fixes: infinite loop
    Fixes: hnrHe6JoiDya

    Out of array write, negative-size memcpy and endless loop Replicated through UnModified FFmpeg with ASAN

    Found during triage of the security report TwYfznAFyatl (#22717), the
    JPEG case is mentioned in the discussion of the issue

diff --git a/libavformat/rtpenc_jpeg.c b/libavformat/rtpenc_jpeg.c
index ddbce261d4..ffffb7cd15 100644
--- a/libavformat/rtpenc_jpeg.c
+++ b/libavformat/rtpenc_jpeg.c
@@ -208,6 +208,12 @@ void ff_rtp_send_jpeg(AVFormatContext *s1, const uint8_t *buf, int size)
         if (off == 0 && nb_qtables)
             hdr_size += 4 + 64 * nb_qtables;

+        if (hdr_size >= s->max_payload_size) {
+            av_log(s1, AV_LOG_ERROR, "RTP max payload size %d too small for the %d byte JPEG header\n",
+                   s->max_payload_size, hdr_size);
+            return;
+        }
+
         /* payload max in one packet */
         len = FFMIN(size, s->max_payload_size - hdr_size);