Commit 2bcaf650e9 for ffmpeg

commit 2bcaf650e988014809a8025c53f85986988db73f
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Fri Nov 6 01:58:10 2026 +0100

    avformat/dashdec: limit the number of segments of a SegmentTimeline

    Fixes: Timeout
    Fixes: JyLanfEvTbhF
    Fixes: swarm-Unbounded-timeline-repeat-causes-CPU-DoS-699421

    Found-by: zhang xingxing <2388969553@qq.com>

    Timeout Replicated through UnModified FFmpeg (ffprobe) with a timeout

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index 00f91fc205..43cbfa18ab 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -34,6 +34,7 @@
 #include "url.h"

 #define INITIAL_BUFFER_SIZE 32768
+#define MAX_TIMELINE_SEGMENTS (1 << 24)

 struct fragment {
     int64_t url_offset;
@@ -1125,6 +1126,16 @@ static int parse_manifest_representation(AVFormatContext *s, const char *url,
         goto free;
     }

+    int64_t nb_timeline_segments = 0;
+    for (int i = 0; i < rep->n_timelines; i++) {
+        nb_timeline_segments += av_clip64(rep->timelines[i]->repeat, 0, INT_MAX) + 1;
+        if (nb_timeline_segments > MAX_TIMELINE_SEGMENTS) {
+            av_log(s, AV_LOG_ERROR, "Too many segments in SegmentTimeline\n");
+            ret = AVERROR_INVALIDDATA;
+            goto free;
+        }
+    }
+
     if (rep->fragment_duration > 0 && !rep->fragment_timescale)
         rep->fragment_timescale = 1;
     rep->bandwidth = rep_bandwidth_val ? atoi(rep_bandwidth_val) : 0;