Commit 4ca04ef9a7 for ffmpeg

commit 4ca04ef9a73ec778acdc633576c93a01bfcfa813
Author: zhang xingxing <2388969553@qq.com>
Date:   Fri Nov 6 02:00:36 2026 +0100

    avformat/imf_cpl: reject an EntryPoint beyond the IntrinsicDuration

    SMPTE ST 2067-3 requires SourceDuration to be between 0 and
    IntrinsicDuration - EntryPoint.

    Fixes: signed integer overflow
    Fixes: SQJJJ0fTnvsv
    Fixes: swarm-Unsigned-underflow-in-fill_base_resource-EntryPoint-handling-c8cd96

    Found-by: zhang xingxing <2388969553@qq.com>

    Signed integer overflow Replicated through UnModified FFmpeg with UBSAN

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavformat/imf_cpl.c b/libavformat/imf_cpl.c
index dba502007c..0edfcbec03 100644
--- a/libavformat/imf_cpl.c
+++ b/libavformat/imf_cpl.c
@@ -351,6 +351,10 @@ static int fill_base_resource(void *log_ctx, xmlNodePtr resource_elem,
         av_log(log_ctx, AV_LOG_ERROR, "Invalid IntrinsicDuration element found in a Resource\n");
         return ret;
     }
+    if (resource->entry_point > resource->duration) {
+        av_log(log_ctx, AV_LOG_ERROR, "EntryPoint is beyond the IntrinsicDuration of a Resource\n");
+        return AVERROR_INVALIDDATA;
+    }
     resource->duration -= resource->entry_point;

     /* read SourceDuration */