Commit bbf6a552eb for ffmpeg

commit bbf6a552eb58e91bacd70d0b5f3d0fbdbf82f017
Author: zhang xingxing <2388969553@qq.com>
Date:   Fri Nov 6 02:04:07 2026 +0100

    avformat/bink: reject frames too small for the audio size field

    Fixes: integer underflow
    Fixes: x58AlI4Komta
    Fixes: swarm-Underflow-in-remain_packet_size-check-in-Bink-read_packet-391e16

    Found-by: zhang xingxing <2388969553@qq.com>

    Unsigned underflow Replicated through UnModified FFmpeg with ffprobe

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavformat/bink.c b/libavformat/bink.c
index 18eaeba738..6becc59031 100644
--- a/libavformat/bink.c
+++ b/libavformat/bink.c
@@ -263,7 +263,7 @@ static int read_packet(AVFormatContext *s, AVPacket *pkt)

     while (bink->current_track < bink->num_audio_tracks) {
         uint32_t audio_size = avio_rl32(pb);
-        if (audio_size > bink->remain_packet_size - 4) {
+        if (audio_size + 4LL > bink->remain_packet_size) {
             av_log(s, AV_LOG_ERROR,
                    "frame %"PRId64": audio size in header (%"PRIu32") > size of packet left (%"PRIu32")\n",
                    bink->video_pts, audio_size, bink->remain_packet_size);