Commit 353cb778b1 for ffmpeg

commit 353cb778b1f13de93badde3f708531069858dcc3
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Thu Oct 8 02:13:57 2026 +0200

    avformat/rtpenc_h263_rfc2190: Limit the bit reader to the picture header

    Fixes: NULL pointer dereference
    Fixes: signed integer overflow
    Fixes: 2zAkARzDBRFd
    NULL pointer dereference Replicated through UnModified FFmpeg with ASAN,UBSAN
    Signed integer overflow Replicated through UnModified FFmpeg with UBSAN
    Found during triage of the security report nd3rLqSpKgo5

diff --git a/libavformat/rtpenc_h263_rfc2190.c b/libavformat/rtpenc_h263_rfc2190.c
index 3567202d8d..590cbc75b6 100644
--- a/libavformat/rtpenc_h263_rfc2190.c
+++ b/libavformat/rtpenc_h263_rfc2190.c
@@ -111,7 +111,7 @@ void ff_rtp_send_h263_rfc2190(AVFormatContext *s1, const uint8_t *buf, int size,

     s->timestamp = s->cur_timestamp;

-    init_get_bits(&gb, buf, size*8);
+    init_get_bits8(&gb, buf, FFMIN(size, 6));
     if (get_bits(&gb, 22) == 0x20) { /* Picture Start Code */
         info.tr  = get_bits(&gb, 8);
         skip_bits(&gb, 2); /* PTYPE start, H.261 disambiguation */