Commit 3f322521c0 for ffmpeg

commit 3f322521c0b8a722f09e3ed5682e408b3c5fd6e2
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Mon Oct 12 02:10:17 2026 +0200

    avformat/hls: saturate the timestamps of ID3 timestamped streams

    Fixes: signed integer overflow
    Fixes: CniIhjP8pfgr
    Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24873
    Signed integer overflow Replicated through UnModified FFmpeg with UBSAN

diff --git a/libavformat/hls.c b/libavformat/hls.c
index 766f9a6274..0bff339850 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -2827,12 +2827,12 @@ static int recheck_discard_flags(AVFormatContext *s, int first)
 static void fill_timing_for_id3_timestamped_stream(struct playlist *pls)
 {
     if (pls->id3_offset >= 0) {
-        pls->pkt->dts = pls->id3_mpegts_timestamp +
-                                 av_rescale_q(pls->id3_offset,
-                                              pls->ctx->streams[pls->pkt->stream_index]->time_base,
-                                              MPEG_TIME_BASE_Q);
+        pls->pkt->dts = av_sat_add64(pls->id3_mpegts_timestamp,
+                                     av_rescale_q(pls->id3_offset,
+                                                  pls->ctx->streams[pls->pkt->stream_index]->time_base,
+                                                  MPEG_TIME_BASE_Q));
         if (pls->pkt->duration)
-            pls->id3_offset += pls->pkt->duration;
+            pls->id3_offset = av_sat_add64(pls->id3_offset, pls->pkt->duration);
         else
             pls->id3_offset = -1;
     } else {