Commit 1ab25e6897 for ffmpeg

commit 1ab25e6897991423698a23078574d91378f11e28
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Oct 13 07:00:12 2026 +0200

    avcodec/cbs_apv: reject ITU-T T.35 metadata shorter than its country code

    Fixes: F9Vetk0Ebf1N

    Found during triage of the security report 00smV7L5DOfY

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavcodec/cbs_apv_syntax_template.c b/libavcodec/cbs_apv_syntax_template.c
index 3cdb320ca4..bcc72a015d 100644
--- a/libavcodec/cbs_apv_syntax_template.c
+++ b/libavcodec/cbs_apv_syntax_template.c
@@ -353,6 +353,9 @@ static int FUNC(metadata_itu_t_t35)(CodedBitstreamContext *ctx,

     ub(8, itu_t_t35_country_code);

+    if (payload_size < 1 + (current->itu_t_t35_country_code == 0xff))
+        return AVERROR_INVALIDDATA;
+
     if (current->itu_t_t35_country_code == 0xff) {
         ub(8, itu_t_t35_country_code_extension);
         --read_size;