Commit 0c058a0855 for ffmpeg

commit 0c058a08554af2ae962497e7453c9595bc12f998
Author: Joshua Rogers <joshua.rogers@aisle.com>
Date:   Tue Oct 6 23:03:34 2026 +0200

    avformat/rtpenc_mpv: Do not read a picture header past the end of the packet

    A packet ending in a picture start code made the temporal reference and
    picture type be read from after the end of the packet.

    This is not a security issue, the bytes read are in the padding that
    muxer input is required to have, see ce1f4c78d1.

    Fixes: read into padding
    Fixes: FbXPpSfFS7Zp
    Fixes: AISLE-2026-0111-00268
    Read past the packet end Replicated through API with ASAN, using an unpadded packet
    Wrong picture header Replicated through UnModified FFmpeg with the sample of trac ticket 6345
    Found-by: Joshua Rogers <joshua.rogers@aisle.com>

diff --git a/libavformat/rtpenc_mpv.c b/libavformat/rtpenc_mpv.c
index c18c75082f..c371c41ce1 100644
--- a/libavformat/rtpenc_mpv.c
+++ b/libavformat/rtpenc_mpv.c
@@ -59,7 +59,7 @@ void ff_rtp_send_mpegvideo(AVFormatContext *s1, const uint8_t *buf1, int size)
                 r = avpriv_find_start_code(r1, end, &start_code);
                 if((start_code & 0xFFFFFF00) == 0x100) {
                     /* New start code found */
-                    if (start_code == 0x100) {
+                    if (start_code == 0x100 && end - r >= 2) {
                         frame_type = (r[1] & 0x38) >> 3;
                         temporal_reference = (int)r[0] << 2 | r[1] >> 6;
                     }