Commit 4b5c351f9a for ffmpeg

commit 4b5c351f9a6906b17fef9d4f7034ee931944a8dc
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sun Oct 11 07:37:41 2026 +0200

    ffplay: round the chapter length without overflowing

    A chapter length near INT64_MAX overflowed the rounding, the hour count
    was also truncated to int.

    Fixes: signed integer overflow
    Fixes: 7JHyBJsQ7bNE
    Regression since: 80a55704b7
    Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24589
    Signed integer overflow Replicated through UnModified FFmpeg with UBSAN

diff --git a/fftools/ffplay.c b/fftools/ffplay.c
index bd64794b65..0d6a2ab2b4 100644
--- a/fftools/ffplay.c
+++ b/fftools/ffplay.c
@@ -1374,10 +1374,10 @@ static void chapter_list_script(VideoState *is, AVBPrint *script)
         av_bprintf(script, CHAPTER_LIST_EVENT "Hint,{\\an5\\pos(%d,%d)}i\n", l.detail_x, y + l.line / 2);
         if (row->length < 0)
             continue;
-        seconds = (row->length + AV_TIME_BASE / 2) / AV_TIME_BASE;
+        seconds = av_rescale_rnd(row->length, 1, AV_TIME_BASE, AV_ROUND_NEAR_INF);
         av_bprintf(script, CHAPTER_LIST_EVENT "%s,{\\an6\\pos(%d,%d)}", style, l.length_x, y + l.line / 2);
         if (seconds >= 3600)
-            av_bprintf(script, "%d:%02d:%02d\n", (int)(seconds / 3600), (int)(seconds / 60 % 60), (int)(seconds % 60));
+            av_bprintf(script, "%"PRId64":%02d:%02d\n", seconds / 3600, (int)(seconds / 60 % 60), (int)(seconds % 60));
         else
             av_bprintf(script, "%d:%02d\n", (int)(seconds / 60), (int)(seconds % 60));
     }