Commit d75429af4c for ffmpeg

commit d75429af4c008cabb4644e9ece34bfff1cd607df
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 10 07:15:39 2026 +0200

    avformat/asfdec_o: truncate a media object whose payload data ends at EOF

    Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind

    Found during triage/review of OSS-Fuzz issues 472415045 and 490256472

    Fixes: use of uninitialized memory
    Fixes: h3BedIQL9KeL

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavformat/asfdec_o.c b/libavformat/asfdec_o.c
index 420324114f..cb721993b2 100644
--- a/libavformat/asfdec_o.c
+++ b/libavformat/asfdec_o.c
@@ -1077,6 +1077,11 @@ static int asf_read_multiple_payload(AVFormatContext *s, AVPacket *pkt,
             ff_asfcrypt_dec(s->key, p, ret);
         avio_skip(pb, skip);
         asf_pkt->size_left -= pay_len;
+        if (ret < pay_len) {
+            av_shrink_packet(asf_pkt->avpkt, p - asf_pkt->avpkt->data + ret);
+            asf_pkt->data_size = asf_pkt->avpkt->size;
+            asf_pkt->size_left = 0;
+        }
         asf->nb_mult_left--;
     }

@@ -1128,6 +1133,11 @@ static int asf_read_single_payload(AVFormatContext *s, ASFPacket *asf_pkt)
         return ret;
     if (s->key && s->keylen == 20)
             ff_asfcrypt_dec(s->key, p, ret);
+    if (ret < size) {
+        av_shrink_packet(asf_pkt->avpkt, p - asf_pkt->avpkt->data + ret);
+        asf_pkt->data_size = asf_pkt->avpkt->size;
+        asf_pkt->size_left = 0;
+    }
     if (asf->packet_size_internal)
         avio_skip(pb, asf->packet_size - asf->packet_size_internal);
     avio_skip(pb, asf->pad_len); // skip padding