Commit 1f7228e4fc for ffmpeg

commit 1f7228e4fcc492301fc7629603e50447d57a3dd1
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Fri Oct 2 02:11:30 2026 +0200

    avcodec/dvbsubdec: check the pixel buffer constraint without int overflow

    Fixes: signed integer overflow: 1073790975 * 2 cannot be represented in type 'int'
    Fixes: PKTwNdHfFZne/testcase/poc.dvbsub
    Fixes: PKTwNdHfFZne
    Fixes: OOM
    Found-by: mzfr <security@mzfr.me>
    Suggested-by: mzfr

diff --git a/libavcodec/dvbsubdec.c b/libavcodec/dvbsubdec.c
index db8a9d1eb1..7608a44423 100644
--- a/libavcodec/dvbsubdec.c
+++ b/libavcodec/dvbsubdec.c
@@ -1189,7 +1189,7 @@ static int dvbsub_parse_region_segment(AVCodecContext *avctx,
     buf += 2;

     ret = av_image_check_size2(region->width, region->height, avctx->max_pixels, AV_PIX_FMT_PAL8, 0, avctx);
-    if (ret >= 0 && region->width * region->height * 2 > 320 * 1024 * 8) {
+    if (ret >= 0 && region->width * region->height > 320 * 1024 * 8 / 2) {
         ret = AVERROR_INVALIDDATA;
         av_log(avctx, AV_LOG_ERROR, "Pixel buffer memory constraint violated\n");
     }