Commit 9bd5ce2dcd for ffmpeg

commit 9bd5ce2dcd7554829e7f93786324e4b763a32e8f
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Wed Oct 7 00:04:51 2026 +0200

    avformat/rtpdec_h261: Keep a single byte fragment with EBIT as end byte

    When a one byte payload completed the pending end byte and also had
    EBIT set, the merged byte was written as complete and then taken again
    from buf[-1] as the new pending end byte, adding a byte to the frame.
    Keep the merged byte pending with its 8 - EBIT valid bits instead.

    Wrong output Replicated through UnModified FFmpeg
    Found during triage of the security report TNp7g6QtpR0J

diff --git a/libavformat/rtpdec_h261.c b/libavformat/rtpdec_h261.c
index 1fb71f2b10..2fa5653167 100644
--- a/libavformat/rtpdec_h261.c
+++ b/libavformat/rtpdec_h261.c
@@ -112,10 +112,16 @@ static int h261_handle_packet(AVFormatContext *ctx, PayloadContext *rtp_h261_ctx
     if (rtp_h261_ctx->endbyte_bits || sbit) {
         if (rtp_h261_ctx->endbyte_bits == sbit) {
             rtp_h261_ctx->endbyte     |= buf[0] & (0xff >> sbit);
-            rtp_h261_ctx->endbyte_bits = 0;
             buf++;
             len--;
-            avio_w8(rtp_h261_ctx->buf, rtp_h261_ctx->endbyte);
+            if (!len && ebit) {
+                rtp_h261_ctx->endbyte     &= 0xff << ebit;
+                rtp_h261_ctx->endbyte_bits = 8 - ebit;
+                ebit = 0;
+            } else {
+                rtp_h261_ctx->endbyte_bits = 0;
+                avio_w8(rtp_h261_ctx->buf, rtp_h261_ctx->endbyte);
+            }
         } else {
             /* ebit/sbit values inconsistent, assuming packet loss */
             GetBitContext gb;