Commit 4b924c367f for ffmpeg

commit 4b924c367f77d91dfa6e2cdf0d8496ea2c28cfae
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Oct 6 06:49:45 2026 +0200

    avcodec/dvbsubenc: Reserve 4 bytes of line overhead in dvb_encode_rle8()

    Since 74f470c05c a line ends with two 0x00 bytes before the 0xf0, so the
    worst case line needs 4 bytes besides the pixel codes, not 3.

    Fixes: out of array write
    Fixes: RzTpnrDqkaCQ
    Out of array write Replicated through API with ASAN
    Regression since: 74f470c05c
    Found during triage of the security report IRdTPagGrTLk

diff --git a/libavcodec/dvbsubenc.c b/libavcodec/dvbsubenc.c
index c9ff94c2c0..b6e31ab933 100644
--- a/libavcodec/dvbsubenc.c
+++ b/libavcodec/dvbsubenc.c
@@ -221,8 +221,8 @@ static int dvb_encode_rle8(uint8_t **pq, int buf_size,
     q = *pq;

     for (y = 0; y < h; y++) {
-        // Worst case line is 12 bits per value, + 3 bytes overhead
-        if (buf_size * 8 < w * 12 + 24)
+        // Worst case line is 12 bits per value, + 4 bytes overhead
+        if (buf_size * 8 < w * 12 + 32)
             return AVERROR_BUFFER_TOO_SMALL;
         line_begin = q;
         *q++ = 0x12;