Commit 546d1a737c for ffmpeg

commit 546d1a737c4b89aab7b09e5faaad450343142015
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Wed Oct 7 00:04:32 2026 +0200

    avformat/rmenc: Do not write a byte past odd sized AC-3 packets

    Not a security issue.

    Wrong packet framing Replicated through UnModified FFmpeg
    Found-by: zhang xingxing <2388969553@qq.com>
    Found-by: Joshua Rogers <joshua.rogers@aisle.com>
    Suggested-by: zhang xingxing <2388969553@qq.com>

diff --git a/libavformat/rmenc.c b/libavformat/rmenc.c
index faa6cb9bdc..bc54231379 100644
--- a/libavformat/rmenc.c
+++ b/libavformat/rmenc.c
@@ -374,10 +374,12 @@ static int rm_write_audio(AVFormatContext *s, const uint8_t *buf, int size, int

     if (stream->par->codec_id == AV_CODEC_ID_AC3) {
         /* for AC-3, the words seem to be reversed */
-        for (i = 0; i < size; i += 2) {
+        for (i = 0; i + 1 < size; i += 2) {
             avio_w8(pb, buf[i + 1]);
             avio_w8(pb, buf[i]);
         }
+        if (i < size)
+            avio_w8(pb, buf[i]);
     } else {
         avio_write(pb, buf, size);
     }