Commit 3df42b4cae for ffmpeg

commit 3df42b4cae0f15bb695761316dc70049fbbaec02
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 10 04:58:54 2026 +0200

    avformat/sbgdec: reject tone-sets with more than 16 channels

    Out of memory Replicated through API

    Fixes: out of memory
    Fixes: 474457174/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6678348798689280
    Fixes: CjKWQoTOOUJW

    Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavformat/sbgdec.c b/libavformat/sbgdec.c
index 71cbad2dae..0792520723 100644
--- a/libavformat/sbgdec.c
+++ b/libavformat/sbgdec.c
@@ -37,6 +37,7 @@
 #define SBG_SCALE (1 << 16)
 #define DAY (24 * 60 * 60)
 #define DAY_TS ((int64_t)DAY * AV_TIME_BASE)
+#define SBG_MAX_CHANNELS 16

 struct sbg_demuxer {
     AVClass *class;
@@ -756,6 +757,11 @@ static int parse_synth_def(struct sbg_parser *p,
     lex_space(p);
     if (synth == p->scs.nb_synth)
         return AVERROR_INVALIDDATA;
+    if (p->scs.nb_synth - synth > SBG_MAX_CHANNELS) {
+        snprintf(p->err_msg, sizeof(p->err_msg),
+                 "too many channels in tone-set");
+        return AVERROR_INVALIDDATA;
+    }
     if (!lex_line_end(p))
         return AVERROR_INVALIDDATA;
     def->type        = 'S';