Commit d8013c0617 for ffmpeg

commit d8013c061725631261d7326c07d2af3a67fa4bc1
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Thu Oct 29 00:00:11 2026 +0100

    avcodec/bsf/dts2pts: reject packets with more than two H.264 pictures

    Fixes: iYUViL6T5SOa
    Fixes: AISLE-2026-0150-00073
    Fixes: Timeout
    Timeout Replicated through UnModified FFmpeg with /usr/bin/time

    Found-by: Joshua Rogers <joshua.rogers@aisle.com>

diff --git a/libavcodec/bsf/dts2pts.c b/libavcodec/bsf/dts2pts.c
index 03e7c39983..6d86a2cf5d 100644
--- a/libavcodec/bsf/dts2pts.c
+++ b/libavcodec/bsf/dts2pts.c
@@ -264,7 +264,7 @@ static int h264_filter(AVBSFContext *ctx)
     AVPacket *in;
     int output_picture_number = INT_MIN;
     int field_poc[2];
-    int queued = 0, ret;
+    int queued = 0, nb_pictures = 0, ret;

     ret = ff_bsf_get_packet(ctx, &in);
     if (ret < 0)
@@ -340,6 +340,11 @@ static int h264_filter(AVBSFContext *ctx)
             }

             if (output_picture_number != h264->last_poc) {
+                if (++nb_pictures > 2) {
+                    av_log(ctx, AV_LOG_ERROR, "More than two pictures in a packet\n");
+                    ret = AVERROR_INVALIDDATA;
+                    goto fail;
+                }
                 if (h264->last_poc != INT_MIN) {
                     int64_t diff = FFABS(h264->last_poc - (int64_t)output_picture_number);