Commit a88838af48 for ffmpeg

commit a88838af482100fa22dd22c94be592c35642de46
Author: Altaf Khan <ak9179916910@gmail.com>
Date:   Tue Oct 27 17:54:18 2026 +0530

    avcodec/cbs: check slice and OBU data sizes without overflowing size_t

    The checks that compare a data size with the space left in the write
    buffer multiply the size by 8 first.  That multiplication is done in
    size_t, so with a 32 bit size_t a data size of 2^29 - 1 bytes or more
    wraps and the check can pass for data that does not fit; the slice data
    is then copied past the end of the write buffer, which
    cbs_write_unit_data() caps at INT_MAX / 8 bytes.

    cbs_mpeg2 is reachable: the demuxer passes an oversized slice unit
    straight through to the metadata bitstream filter.  On a 32 bit build a
    512 MiB slice makes the check compare 16 against a non-zero
    put_bits_left() and the memcpy() runs off the 1 MiB buffer.  cbs_h2645
    and cbs_av1 cannot be reached today because h2645_parse and
    cbs_av1_split_fragment() reject units larger than INT_MAX / 8, but
    their checks are wrong in the same way and should not rely on that.

    Compare the byte count against put_bits_left() / 8 instead, as was
    already done for cbs_jpeg and cbs_vp9.  The slice writers keep the byte
    reserved for the rbsp_stop_one_bit by comparing data_size + 1; the two
    forms are equivalent for every non-wrapping size.

    Signed-off-by: Altaf Khan <ak9179916910@gmail.com>

diff --git a/libavcodec/cbs_av1.c b/libavcodec/cbs_av1.c
index 4bacebf086..e4b275199b 100644
--- a/libavcodec/cbs_av1.c
+++ b/libavcodec/cbs_av1.c
@@ -1199,7 +1199,7 @@ static int cbs_av1_write_obu(CodedBitstreamContext *ctx,
     flush_put_bits(pbc);
     av_assert0(data_pos <= start_pos);

-    if (8 * obu->obu_size > put_bits_left(pbc)) {
+    if (obu->obu_size > put_bits_left(pbc) / 8) {
         av_refstruct_unref(&priv->sequence_header_ref);
         av_buffer_unref(&priv->frame_header_ref);
         *priv = av1ctx;
diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c
index 61b70f4118..9329554cab 100644
--- a/libavcodec/cbs_h2645.c
+++ b/libavcodec/cbs_h2645.c
@@ -272,7 +272,7 @@ int ff_cbs_h2645_write_slice_data(CodedBitstreamContext *ctx,
     av_assert0(data_bit_start >= 0 &&
                data_size > data_bit_start / 8);

-    if (data_size * 8 + 8 > put_bits_left(pbc))
+    if (data_size + 1 > put_bits_left(pbc) / 8)
         return AVERROR(ENOSPC);

     if (!rest)
diff --git a/libavcodec/cbs_mpeg2.c b/libavcodec/cbs_mpeg2.c
index 87401d1543..57c2205393 100644
--- a/libavcodec/cbs_mpeg2.c
+++ b/libavcodec/cbs_mpeg2.c
@@ -319,7 +319,7 @@ static int cbs_mpeg2_write_slice(CodedBitstreamContext *ctx,
         av_assert0(slice->data_bit_start >= 0 &&
                    slice->data_size > slice->data_bit_start / 8);

-        if (slice->data_size * 8 + 8 > put_bits_left(pbc))
+        if (slice->data_size + 1 > put_bits_left(pbc) / 8)
             return AVERROR(ENOSPC);

         // First copy the remaining bits of the first byte