Commit cc7f5bcfad for ffmpeg

commit cc7f5bcfad93281baa6e445c39785b15967be749
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Oct 6 06:52:48 2026 +0200

    avformat/dvdvideodec: Check the menu audio stream count

    The title path rejects more than 8 audio streams, the menu path did not.

    Fixes: out of array read
    Fixes: q4AeKlitZZgH
    Fixes: AISLE-2026-0111-00216
    Out of array read Replicated through UnModified FFmpeg with ASAN
    Found-by: Joshua Rogers <joshua.rogers@aisle.com>

diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c
index 544206c67b..cf4c7962df 100644
--- a/libavformat/dvdvideodec.c
+++ b/libavformat/dvdvideodec.c
@@ -252,6 +252,13 @@ static int dvdvideo_ifo_open(AVFormatContext *s)
             return AVERROR_EXTERNAL;
         }

+        if ((!c->opt_menu_vts && c->vmg_ifo->vmgi_mat->nr_of_vmgm_audio_streams > 8) ||
+            ( c->opt_menu_vts && c->vts_ifo->vtsi_mat->nr_of_vtsm_audio_streams > 8)) {
+            av_log(s, AV_LOG_ERROR, "Menu has invalid headers (too many audio streams)\n");
+
+            return AVERROR_INVALIDDATA;
+        }
+
         return 0;
     }