Commit 39388bb647 for ffmpeg

commit 39388bb6477aff16d2208761ea76f66243084030
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Wed Nov 11 17:00:22 2026 +0100

    avcodec/cbs_av1: limit the number of OBUs of a fragment

    Every decomposed OBU gets an AV1RawOBU as content, whatever its size.
    A packet of 2 byte OBUs needed more than 1000 times its size in memory.

    Limit a fragment to 65536 OBUs, the limit av1_frame_merge uses for a
    temporal unit.

    Fixes: excessive memory allocation
    Fixes: RJDrEhcINcH8

    Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25569

    Excessive memory allocation Replicated through UnModified FFmpeg with time (maximum resident set size)

diff --git a/libavcodec/cbs_av1.c b/libavcodec/cbs_av1.c
index e4b275199b..71a55b658d 100644
--- a/libavcodec/cbs_av1.c
+++ b/libavcodec/cbs_av1.c
@@ -27,6 +27,8 @@
 #include "defs.h"
 #include "libavutil/refstruct.h"

+#define MAX_FRAGMENT_OBUS (1 << 16)
+

 #if CBS_READ
 static int cbs_av1_read_uvlc(CodedBitstreamContext *ctx, GetBitContext *gbc,
@@ -788,6 +790,12 @@ static int cbs_av1_split_fragment(CodedBitstreamContext *ctx,
             goto fail;
         }

+        if (frag->nb_units >= MAX_FRAGMENT_OBUS) {
+            av_log(ctx->log_ctx, AV_LOG_ERROR, "Too many OBUs in a fragment.\n");
+            err = AVERROR_INVALIDDATA;
+            goto fail;
+        }
+
         err = CBS_FUNC(append_unit_data)(frag, obu_header.obu_type,
                                       data, obu_length, frag->data_ref);
         if (err < 0)