Commit 548cf658c0 for ffmpeg

commit 548cf658c019ee34123280a8b19f7dc30c86d6e8
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 10 04:58:54 2026 +0200

    avcodec/eatgq: reject packets too small for the frame before allocating it

    Timeout Replicated through API

    Fixes: Timeout
    Fixes: 557846267/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGQ_fuzzer-6100142894415872
    Fixes: a3IxtdH9wk9F

    Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavcodec/eatgq.c b/libavcodec/eatgq.c
index 8d6ef122ce..e50f6056d9 100644
--- a/libavcodec/eatgq.c
+++ b/libavcodec/eatgq.c
@@ -272,12 +272,17 @@ static int tgq_decode_frame(AVCodecContext *avctx, AVFrame *frame,
     tgq_calculate_qtable(s, bytestream2_get_byteu(&gbyte));
     bytestream2_skipu(&gbyte, 3);

+    int mb_width  = FFALIGN(avctx->width,  16) >> 4;
+    int mb_height = FFALIGN(avctx->height, 16) >> 4;
+    if (bytestream2_get_bytes_left(&gbyte) < mb_width * mb_height)
+        return AVERROR_INVALIDDATA;
+
     if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
         return ret;

     frame->flags |= AV_FRAME_FLAG_KEY;
-    for (y = 0; y < FFALIGN(avctx->height, 16) >> 4; y++)
-        for (x = 0; x < FFALIGN(avctx->width, 16) >> 4; x++)
+    for (y = 0; y < mb_height; y++)
+        for (x = 0; x < mb_width; x++)
             if (tgq_decode_mb(s, &gbyte, frame, y, x) < 0)
                 return AVERROR_INVALIDDATA;